May 12, 2020 | Live Compliance
Ransomware Targeting Medical Billing Companies
As the number of healthcare providers taking advantage of Telehealth increases during this uncertain time, the number of ransomware attacks continues to increase as well.
Ransomware is a type of malicious software designed to block access to a computer system until a sum of money is paid. Microsoft says, “Multiple ransomware groups that have been accumulating access and maintaining persistence on target networks for several months activated dozens of ransomware deployments in the first two weeks of April 2020.”
The attacks are targeted towards aid organizations, medical billing companies, manufacturing, transport, government institutions, and educational software providers, however, Microsoft says that it doesn’t stop with critical service groups and suggests all networks are aware of these attacks and taking necessary steps to limit risk. NetWalker ransomware, for example, gained notoriety for targeting hospitals and healthcare providers with e-mails claiming to provide information about COVID-19.
Have you had an Accurate and Thorough Security Risk Assessment and/or penetration testing?
If you haven’t completed an accurate and thorough security risk assessment, you could also be penalized under ‘willful neglect’ (this category alone is $50,000 per violation!) in addition to the higher risk of ransomware attacks. What we do is keep this from ever being a worry for you! We perform your security risk assessment and manage all of your requirements, in a clean, organized cloud-based portal.
Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status.
It’s easy! Call us at (980) 999-1585, or email me, Jim Johnson at jim@LiveCompliance.com or visit
www.LiveCompliance.com
Live Compliance has partnered with EZClaim medical billing software to strengthen what they can provide for you. It provides all of your HIPAA Privacy, Security Requirements, and Measures. HIPAA compliance is a requirement for Covered Entities and Business Associates to safeguard personal, private, and protected health information—allowing organizations to relinquish the struggle of compliance requirements.
You can investigate the EZClaim medical billing software by either downloading a FREE DEMO or just contact our knowledgeable sales staff to answer any and all of your questions by phone at (877) 650-0904 or by e-mail at support@ezclaim.com.
[ Contributed by Jim Johnson of Live Compliance ]
Apr 13, 2020 | Live Compliance, Medical Billing Software Blog, Partner
Since CMS HHS just updated their Telehealth regulations to adjust to the COVID-19 environment—including having a remote workforce—we wanted to provide a clear update to independent physicians and billers to advise them of the fast-moving changes of many regulations, and what to expect in the near future.
It is important to note that CMS has recently announced that new and established patients have availability to Telehealth, and HHS OIG is providing flexibility for healthcare providers to reduce or waive cost-sharing for Telehealth visits paid by federal healthcare programs. CMS is also expanding Telehealth services to people with medicare.
As a result, please see the below video from CMS which highlights the Medicare Coverage and Payment of Virtual Services and Telehealth.
In addition, we’ve included a few key questions and answers below. If you have further questions about Telehealth and your compliance, contact Jim Johnson with Live Compliance at Jim@LiveCompliance.com or (980) 999-1585.
1. Who can provide Telehealth services?
-
- Physicians
- Nurse Practitioners
- Physician assistants
- Nurse-midwives
- Certified nurse anesthetists
- Clinical psychologists
- Registered dietitians
- Nutrition professionals
2. What services can a medicare beneficiary receive through Telehealth?
-
- Evaluation and management visits (common office visits)
- Mental health counseling
- Preventive health screenings
- More than 80 additional services
3. What are the types of virtual services?
-
- Medicare Telehealth visits
- Virtual check-ins
- E-visits
- Telephone services
Live Compliance is an EZclaim premier partner for HIPAA compliance and is integrated into EZclaim’s billing solution.
If you have any further questions about Telehealth regulations and your compliance, e-mail Jim Johnson at Live Compliance at Jim@LiveCompliance.com, or phone him at (980) 999-1585.
[ Contribution by Jim Johnson with the Live Compliance ]
Mar 10, 2020 | Live Compliance, Medical Billing Customer Service
Whether you are a person new to medical billing or someone who’s been in the business for years, launching a new medical billing practice can be hard. Understanding the market, connecting with new clients, and knowing how to master your processes are challenges that you often learn as you go. Despite these challenges, it is rewarding to be out on your own growing a new company. Before you jump, let us help you understand some essential keys that you can research upfront and prepare yourself to get one step closer to being successful.
1. ONE BILLING PLATFORM VERSUS MULTIPLE PLATFORMS: First and foremost you must make a conscious decision to either focus on being an expert on an individual medical billing platform, like EZClaim or tackling multiple platforms. There are pros and cons of both: being an expert can make you extremely efficient in your use of the software’s billing and, scheduling features, however, it can also limit your client base to only one set of software users. Whereas having a basic understanding of multiple platforms can allow you a larger base of medical offices while limiting your ability to truly understand how best to serve each individual client’s needs.
Pro tip: Start and master one trusted billing program, and grow your options as your billing business grows.
2. GET CLEAR ON THE CLEARINGHOUSE: A new billing company owner does not want to be held to just one clearinghouse as options are key here. Having the ability to work with any or many would be an essential piece to your billing services, however, you still want to know the best clearinghouses in the business. Understanding which clearinghouses provide the best products and services and being able to recommend those services to your client upfront will make your life easier and their business run smoother. For this very reason, EZClaim has built its software around partnerships and integrations with the best clearinghouses to make working with the one you need easy.
3. COMPLY OR DIE (HIPAA Compliance): The third key to any start-up is first understanding the importance of HIPAA Compliance. Medical billing firms literally can come crashing down with any missteps, mistakes, or misunderstandings of this essential piece of the puzzle. It goes without saying that if you are going to choose a billing software be sure that they have partnerships built around making sure you are protected. You are also responsible to make sure the data is protected so your customer and their patient’s data is safe.
HIPAA Hint: Check out Live Compliance for further details on the topic.
There are many options available out there for your new medical billing practice, and we recommend doing your research. Within that research, you will find that EZClaim ranks very high in performance and comes in at a great price.
To learn about EZClaim go to our about page, sign up for a demo, and/or download a trial for free today!
Mar 10, 2020 | Live Compliance, Partner
An independent physician gastroenterology practice in Utah had to report a breach related to a dispute with a Business Associate to the Office for Civil Rights Department of HHS.
After the investigation into the breach, it was determined that the practice of Steven A. Porter, MD “had failed to complete an accurate and thorough risk analysis, and failed to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level” and therefore, has agreed to pay a $100,000 fine.
In addition to the monetary penalty, the practice is required to implement a Corrective Action Plan (CAP). According to the investigation resolution agreement, the practice agreed to conduct a thorough Risk Analysis, the Practice must develop a complete inventory of all its categories of electronic equipment, data systems, and applications that contain or store ePHI, which will then be incorporated into its Risk Analysis and must complete a Risk Management plan. They must also revise and implement actionable policies and procedures, all of which should have been in place prior to the breach incident.
Have you ever read such headlines and doubted whether a small Billing Company or independent physician practice actually ever face penalties?
According to the Resolution Agreement, the practice must also completely reinvent its Business Associate process, and implement a strict protocol to ensure it’s Business Associates are HIPAA Compliant. In addition to ensuring their Business Associate relationships are accurate, the entire staff must undergo security and privacy training that stresses the use of Business Associate services and applications, disclosures to Business Associates that require a Business Associates agreement, or other reasonable assurances in place to ensure that the Business Associate will and can safeguard the PHI and/or the ePHI. This puts immense pressure on the Business Associates, such as Billing Companies, to ensure that they are HIPAA Compliant, but also independent physician practices to ensure their Business Associates, “down the chain” are also compliant. This is also known as gaining Satisfactory Assurance of vendor HIPAA compliance.
What can you do?
As we have stressed before, it is important for you to understand that every complaint or potential breach must be investigated by HHS/OCR. If you, a billing company, or another vendor, suspect a breach you must inform the covered entity (your client) and have a breach risk assessment completed to determine key factors and take action. Keep in mind, a business associate is a ‘person’ or ‘entity’. This means there is no Billing Company too small or too large to comply with the Federal HIPAA regulations. Again, if you haven’t completed an accurate and thorough security risk assessment prior to that, you could also be penalized under ‘willful neglect’. This category alone is $50,000 per violation!
What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud-based portal. Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status. It’s easy, call us at (980) 999-1585, email me jim@LiveCompliance.com or visit LiveCompliance.com
[ Contributed by Jim Johnson, President of Live Compliance ].
Jan 13, 2020 | Live Compliance, Partner, Support and Training
Lost laptop = $65,000 fine. Have you ever read such headlines and doubted whether a small billing company or independent physician practice would ever face such seemingly insurmountable penalties?
What happened? Most recently, an ambulance company out of Georgia paid $65,000 for a lost laptop that happened to be unencrypted. More often, small businesses and practices are taking work outside of the office, so this kind of violation is one that can occur to anyone.
The laptop contained 500 individual’s Protected Health Information. As a result of the investigation, the ambulance company will undergo a Technical Security Risk Assessment and is required to adopt a Corrective Action Plan. This is a great example of why it is important and mandatory to conduct a Technical and Objective Security Risk Assessment at least annually on all devices.
Following the investigation, it was uncovered that West Georgia Ambulance never provided a security awareness and training program for its employees! You and your workforce are your first line of defense. This reinforces the importance that both you, and your employees must understand what a breach is and the breach notification requirements! It was later revealed that West Georgia Ambulance failed to implement HIPAA Security Rule policies and procedures as well.
What can you do? As we have stressed before, it is important for you to understand that every complaint or potential breach must be investigated by HHS/OCR. If you, the Billing Company or independent physician practice, suspects a breach or complaint you must inform the covered entity (your client) and have a breach risk assessment completed to determine key factors and take action. Again, if you haven’t completed an accurate and thorough security risk assessment prior to that, you could also be penalized under ‘willful neglect’. This category alone is $50,000 per violation!
What we do is keep this from ever being a worry for you! In fact, we have a 100% audit pass rate since 2010! For example, Live Compliance has easy to understand HIPAA breach notification training. We perform your security risk assessment and manage all your requirements, including business associates, in a clean, organized cloud-based portal.
Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status.
It’s easy, call us at (980) 999-1585, email me or visit LiveCompliance.com
Keep in mind, a business associate is a ‘person’ or ‘entity’. This means there is no billing company too small or too large to comply with the Federal HIPAA regulations.
LEARN MORE
If you are enjoyed this article about the lost laptop as well as the informative content we’re providing and have a specific topic you would like to see covered, we would love to hear from you! Please feel free to send along your ideas via email to sales@ezclaim.com.
Dec 10, 2019 | AMBA National Conference, Live Compliance
Compliance Plan Breakout
AMBA 2019 National Conference Session Recap
Compliance Plan Breakout – Written by Stephanie Cremeans of EZClaim
Any provider that is treating Medicare or Medicaid patients is required to have a compliance plan for their practice. This is mandated under the Patient Protection and Affordable Care Act of 2010.
The Office of Inspector General (OIG) has established an outline of seven components to help the small or individual provider offices get started. They also understand that small practices don’t typically have extensive resources creating and establishing a plan, and encourage practices to start with one item, making the compliance plan a working document that is updated and added to as necessary. The seven components are as follows:
- Conduct internal monitoring and auditing
- Implement compliance and practice standards
- Designate a compliance officer or contact
- Conduct appropriate training and education
- Respond appropriately to detected offenses and develop corrective action
- Develop open lines of communication with employees
- Enforce disciplinary standards through well-publicized guidelines
Let’s dig in a bit to the first component, conducting internal monitoring and auditing. Starting with this step will help a practice lay the groundwork of its compliance plan and shed light on areas that need additional work. There is no set number of records that are required to be audited, rather a suggestion of 5 (or more) per provider annually for a small or solo practice. You can start your compliance plan by simply documenting that no less than 5 charts per provider will be audited annually. Keep track of the results and use them to start implementing other components. For instance, you have the audit results, but what is considered passing? What are you going to do if a provider isn’t compliant? Document the answers and you are building your plan. Did the audit show specific areas for improvement? Find applicable training or host training for those that need it, document it in your plan. Did you find overpayments? Document how these are to be handled, resolve them quickly, and put policies in place to prevent a bigger problem.
By taking steps to create a compliance plan and show a good-faith effort to improve on risk areas your practice will reap the benefits of clean claims with a reduction in denials, fewer billing errors, and the assurance that your records are ready for an audit. This will also reduce your risk exposure to fines.
For help getting started with that first audit, setting benchmarks and improvement plans or for education on problem areas contact RCM Insight. For additional assistance with building your HIPAA compliance plans contact Live Compliance.
If you are enjoying the informative content we’re providing and have a specific topic you would like to see covered, we would love to hear from you! Please feel free to send along your ideas via email to sales@ezclaim.com.
