So, what’s the best path for HIPAA Compliance? It’s risk analysis.
The HIPAA Security Rule requires covered entities and business associates to ensure the confidentiality, integrity, and availability of all electronic protected health information (ePHI) that it creates, receives, maintains, or transmits.
Conducting a risk analysis—which is an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI held by an organization—is not only a Security Rule requirement, but is also fundamental to identifying and implementing safeguards that comply with and carry out the Security Rule standards and implementation specifications.
However, despite this long-standing HIPAA requirement, OCR investigations frequently find that organizations lack sufficient understanding of where all of the ePHI entrusted to their care is located.
Although the Security Rule does not require it, creating and maintaining an up-to-date, information technology (IT) asset inventory could be a useful tool in assisting in the development of a comprehensive, enterprise-wide risk analysis, to help organizations understand all of the places that ePHI may be stored within their environment, and improve their HIPAA Security Rule compliance.
How Can You Manage This at Your Organization?
You can try to manage this by yourself, but it would probably be more efficient and superior in implementation if you used an expert. A partner of EZClaim, Live Compliance, is one of those experts. They can help you easily manage, maintain, and assign your hardware and technical inventory to remote or in-office employees.
Do You Have Additional Questions?
If you have any questions about the best path for HIPPA compliance, contact Jim Johnson at Live Compliance (E-mail: firstname.lastname@example.org; Phone: (980) 999-1585).
For more on EZClaim’s products, either schedule a one-on-one consultation with their sales team, or download a FREE TRIAL to check it out the software yourself. For additional information right now, view their web site, send an e-mail to email@example.com, or contact the sales team at 877.650.0904.
[ Article contributed by Jim Johnson of Live Compliance ]
EZClaim is always looking for ways to help our medical billing clients improve. In an effort to further that mission, this month we are kicking off the first in a series called, “What’s Current in Coding.” In this series, we will highlight coding topics, events, webinars, and more, all with the aim of keeping you current in medical billing and coding.
This month our focus came from two articles on coding sourced from the AMBA Newsletter that we feel are hot topics of the industry: “Coding for Group Visits” and the “Telehealth Coding Guide.”
Below you will find full articles and source links.
ARTICLE 1: “Coding for Group Visits”
Many physicians are interested in providing group medical visits. Whether the drop-in group medical appointment (DIGMA), chronic care health clinic (CCHC) or other model is delivered, the coding and billing of these services raise questions about codes and payment policies.
While past instruction on coding for group visits often indicated that physicians should report code 99499 for unlisted evaluation and management services, using this code requires that documentation is sent with the claim to identify the service(s) provided and leaves valuing of the service in the hands of the payer.
No official payment or coding rules have been published by Medicare. However, the question of “the most appropriate CPT code to submit when billing for a documented face-to-face evaluation and management (E/M) service performed in the course of a shared medical appointment, the context of which is educational”, was sent to the Centers for Medicare and Medicaid Services (CMS) with a request for an official response. The request further clarified, “In other words, is Medicare payment for CPT code 99213, or other similar evaluation and management codes, dependent upon the service being provided in a private exam room or can these codes be billed if the identical service is provided in front of other patients in the course of a shared medical appointment?”
The response from CMS was, “…under existing CPT codes and Medicare rules, a physician could furnish a medically necessary face-to-face E/M visit (CPT code 99213 or similar code depending on level of complexity) to a patient that is observed by other patients. From a payment perspective, there is no prohibition on group members observing while a physician provides a service to another beneficiary.” The letter went on to state that any activities of the group (including group counseling activities) should not impact the level of code reported for the individual patient.
Some private payers have instructed physicians to bill an office visit (99201-99215) based on the entire group visit. For compliance purposes, we recommend that you ask for these instructions in writing and keep them on file as you would any other advice from a payer.
Where each individual patient is provided a medically necessary, one-on-one encounter, in addition to the time in the group discussions, there should be no problem in billing for the visit based solely on the documented services provided in a direct one-on-one encounter.
If your group visits include the services of nutritionists or a behavioral health specialist, contact payers to determine if that portion of the group visit can be directly billed by the non-physician provider. This typically would include codes for medical nutrition therapy (97804) or health and behavior intervention (96153).
Other codes that may be applicable are the codes for education and training for patient self-management involving a standardized curriculum (98961-98962). Neither these codes nor medical nutrition or behavioral health therapy are billed by physicians. Physicians must use evaluation and management codes to report these services.
Code 99078 describes physician educational services in a group. Again, it is necessary to contact the payer to verify that coverage of this service is a payable benefit.
As with many services, coding for group visits requires that billing and coding staff do preliminary work with payers to identify desired coding applications.
ARTICLE 2: “Telehealth Coding Guide”
There’s nothing more frustrating than rendering a service and not being paid. Nuanced coding rules are difficult to understand, and physicians aren’t taught this information in medical school.
Still, health care is a business. As business owners, physicians need to know how they’re paid, including what codes to use, what modifiers to append, and what details to document. Brushing up on common coding mistakes helps avoid costly recoupments and denials. We’ve asked several coding experts to provide their best advice on how physicians can maintain compliance and collect all of the revenue to which they’re entitled.
In part 1 of our two-part coding guide, we focused on coding for Telehealth and other forms of remote patient care — important codes for physician practices’ short-term survival as the U.S. continues to grapple with the COVID-19 pandemic.
In times of social distancing, telephone services have become a practical way to improve patient access and prevent the spread of COVID-19. Telephone services are ideal for straightforward problems (e.g., simple rash, asymptomatic cough, medication refills) that require a minimum of five minutes of medical discussion, says Toni Elhoms, CCS, CPC, chief executive officer of Alpha Coding Experts, LLC, in Orlando, Florida. Consider the following codes that Medicare accepts during the current public health emergency (PHE). Commercial payers may accept these codes, as well. Note that once the PHE has concluded, Medicare may only accept G2012 (virtual check-in) for telephone services.
Elhoms provides these tips to ensure compliance:
- Document verbal consent, including patient acknowledgment and acceptance of any copayments or coinsurance amounts due.
- Only count time spent on the phone engaging in medical discussion with the patient or caregiver. Do not report these codes for conversations lasting less than five minutes.
- Clearly document what was discussed, as well as the outcome of the conversation (e.g., medications prescribed, referrals to specialists, additional steps for the patient to take).
- Don’t report these codes when the telephone service ends with a decision to see the patient in 24 hours or the next available appointment.
- Don’t report these codes when the telephone service relates to a related E/M service performed within the previous seven days or within the postoperative period of a previously completed procedure.
- Only provide 99441-99443 and 98966-98968 for established patients. During the PHE, Medicare permits providers to bill G2012 for new and established patients.
‘The best way to operationalize these codes is to set up an edit in the practice management system that pends claims for a manual review to determine whether and which services are ultimately billable, Elhoms says.
In the last few months, providers have adopted Telehealth to improve patient access and generate revenue during COVID-19. Among the services physicians can render via Telehealth to patients with Medicare during the current PHE are Medicare annual wellness visits, new and established patient office visits, prolonged services, smoking, and tobacco cessation counseling, annual depression and alcohol screenings, advanced care planning, and more. Medicare covers more than 200 services via Telehealth, many of which were added for temporary coverage during the current PHE. Commercial payer coverage of these services may vary, and it’s best to check with individual payers, Elhoms says.
Elhoms provides these tips for billing Telehealth services:
- Pay attention to audio-only vs. audio-visual requirements. Medicare requires the use of audio-visual technology for certain Telehealth services and permits audio-only for others. Commercial payers also may have specific requirements. For example, physicians can render a Telehealth visit for advanced care planning using audio-only, but they must use audio-visual technology for a new patient telehealth office visit.
- Don’t render Medicare’s Initial Preventive Physical Exam via Telehealth. Medicare does not permit it.
- Document verbal consent for Telehealth, including patient acceptance of any copayments or coinsurance amounts due.
- Use place of service (POS) code 11 and modifier -95 when billing Medicare. Note that commercial payers may require a different POS code (e.g., POS 2 or POS “other”) and modifier.
- Document, document, document. Physicians need to prove they met all of the code requirements even when rendering the service via Telehealth, Elhoms says. “Don’t pull in a problem list if you didn’t treat or manage all of those problems,” she adds. “Physicians need to link the diagnosis with the assessment and treatment plan. That’s imperative.” One caveat is that during the current PHE, physicians can bill 99201-99215 rendered via Telehealth based on time or medical decision-making. “The total time in direct medical discussion with the patient is going to be critical,” Elhoms says.
“The best advice I can give anyone doing Telehealth right now is to watch the CMS [Centers for Medicare & Medicaid Services] and commercial payer websites pretty much on a daily basis,” says Rhonda Buckholtz, CPC, CPMA, owner of Coding and Reimbursement Experts in Pittsburgh, Pennsylvania. “The coding of services changes constantly, and practices really need to be careful.”
Online digital E/M services
Though online digital E/M services are relatively new, they also can help practices increase patient access during COVID-19. Here’s how it works: An established patient initiates a conversation through a HIPAA-compliant secure platform (e.g., electronic health record portals, secure email, secure texting). A physician or other qualified health care professional reviews the query, as well as any pertinent data and records. Then they develop a management plan and subsequently communicate that plan to the patient or their caregiver through online, telephone, email or other digitally supported communication.
Elhoms provides these tips to maintain compliance:
- Use these codes when physicians or other qualified health care professionals make a clinical decision that would otherwise occur during an office visit. Do not use them for scheduling appointments or nonevaluative communication of test results.
- Use these codes only for established patients.
- Do not use these codes for fewer than five minutes of E/M services.
- Document verbal consent, including patient acknowledgment and acceptance of any copayments or coinsurance amounts due.
- Do not report these codes when the online digital E/M service ends with a decision to see the patient in 24 hours or the next available urgent visit appointment.
- Do not report these codes when the online digital E/M service relates to a related E/M service performed within the previous seven days or within the postoperative period of a previously completed procedure.
Promoting these services is often the biggest barrier, says Elhoms, who suggests putting up signs letting patients know they can access their provider electronically for non-urgent medical issues.
Remote patient monitoring
Remote patient monitoring (RPM) is a relatively easy way for physicians to keep tabs on patients without requiring them to come into the office. Medicare covers RPM for patients with one or more acute or chronic conditions, and commercial payer coverage may vary. During the PHE, physicians can initiate RPM on new and established patients. Normally, Medicare permits it only for established patients.
RPM consists of two forms: monitoring data through either a non-manual or manual data transfer, says Jim Collins, CPC, CCC, a consultant at CardiologyCoder.com, Inc. in Saratoga Springs, New York.
For example, physicians can remotely monitor a patient’s pulse oximetry, weight, blood pressure or respiratory flow rate using a device that transmits daily recordings or programmed alerts. Physicians can purchase them directly from manufacturers or patients can purchase the devices themselves. Collins says patients should look for Bluetooth-enabled devices or ones that include a built-in Global System for Mobile Communications (GSM) transmitter. The former requires an Internet connection, and the latter automatically transmits data to an internet cloud service through an encrypted bandwidth. Physicians can bill for the initial setup, cost of the device itself (when applicable), and data monitoring.
Another example is the self-measured blood pressure monitoring. When patients supply their own blood pressure device that a physician calibrates, physicians may be able to bill for patient education, device calibration, reviewing the data that the patient provides and communicating a treatment plan to the patient or caregiver.
“Monitoring physiologic data on a regular basis substantially reduces hospitalizations, trips to the emergency room and exacerbations of chronic conditions,” says Collins. “It can also be a huge chunk of revenue.”
Collins provides these tips for compliant RPM billing:
- Document patient consent. Patients must opt-in for these services.
- Document total time spent rendering these services to support time-based requirements.
- Know when these codes are appropriate. It’s unclear whether Medicare will pay physicians for monitoring physiologic data derived from internal devices (devices placed within the patient’s body) or data derived from wearable fitness devices.
- Only bill 99457 when the provider renders at least 20 minutes of live, interactive communication with the patient or caregiver. “It’s not going to be medically necessary to spend 20 minutes every month on every patient,” Collins says. “Patients could go for several months without physicians needing to do anything for them.”
“What’s Current in Coding?” is brought to you by EZClaim, a medical billing solution. To find out if it may work for you, either schedule a one-on-one consultation with their sales team, or download a FREE TRIAL to check it out the software yourself. For additional information right now, view their web site, send an e-mail to firstname.lastname@example.org, or contact the sales team at 877.650.0904.
Failing to implement HIPAA causes a large fine for a small town North Carolina health services provider. They were fined $25,000 for multiple, easily avoidable, HIPAA violations for “longstanding, systemic noncompliance” with the HIPAA Security Rule. [Note: The provider is a part of a health center which offers discounted medical services to the underserved population in rural NC, and the fines were reduced in consideration of this, but it still resulted in a significant monetary loss].
In 2011, Metropolitan Community Health Services (Metro), doing business as Agape Health Services, filed a breach report regarding “the impermissible disclosure of protected health information to an unknown email account.” The breach affected over 1,200 patients!
In addition to the large monetary penalty, the practice is required to develop and adopt a corrective action plan (which includes two years of thorough monitoring) after the Office for Civil Rights (OCR) discovered that Metro failed to conduct a thorough and comprehensive HIPAA Security Risk Assessment and Analysis. In addition, Metro did not implement a single HIPAA Security Rule Policy and Procedure for the health center. Possibly worst of all, Metro failed to provide workforce members with HIPAA Privacy and Security Awareness training until 2016!
Patients must trust who they share their personal, private, and protected health information with. A breach such as this, is obviously devastating for the patient, in addition to their doctor’s reputation. So, how can physicians ensure that they are meeting the HIPAA requirements and have proper safeguards in place to avoid this sort of breach?
First off, an accurate and thorough Security Risk Assessment and Analysis must be conducted to expose and target any potential administrative, physical, and technical vulnerabilities. Doing so highlights any major flaws in a practice’s administrative and technical safeguards, and accentuates the policies and procedures that the practice needs to implement.
In addition to that, the designated HIPAA Privacy and Security Officer must ensure that ALL employees complete HIPAA Workforce training. All employees of the practice, including the physicians, must take HIPAA training to ensure employees have a clear understanding of the HIPAA Privacy Rule and actionable policies and procedures.
So, remember, healthcare organizations and their vendors have a responsibility to be HIPAA compliant, and that starts by performing, updating, or reviewing an accurate and thorough Security Risk Assessment covering your technical, administrative, and physical safeguards. This will help uncover any vulnerabilities, and help you understand what information is being transmitted, shared, and how it is being transmitted.
TAKE AWAYS AND THINGS TO CONSIDER:
- Complete a Security Risk Assessment and establish a Corrective Action Plan that is accurate and thorough.
Remediate any potential risks or vulnerabilities.
- A Security Risk Assessment will target vulnerabilities related to what is potentially exposing Protected Health Information (PHI)
- Develop actionable policies and procedures that clearly outline disclosures of PHI
- Ensure all employees have a clear understanding of the HIPAA Privacy rule and its policies and procedures
Live Compliance provides everything you need to become and maintain your organization’s HIPAA compliance requirements. All policies and procedures can be edited and shared directly with staff from your staff portal. Trainings are delivered and monitored within your portal, can be customized, role-based, and be accessed anytime and from anywhere. You can also easily send and monitor HIPAA training with one click.
Failing to implement HIPAA can cause tremendous problems and use precious resources and time to implement. Live Compliance makes it 10X easier than trying to do it on your own.
So, take advantage of Live Compliance’s FREE Organization Needs Assessment to understand your immediate compliance needs. For additional details, e-mail Jim Johnson (at email@example.com), call (980) 999-1585, or visit their website at livecompliance.com/oa
Live Compliance is a partner of EZClaim, a medical billing software company. For more details about their solutions, visit their website at ezclaim.com.
[ Written by Jim Johnson, President of Live Compliance ]
The SIX KEYS to sustaining your practice through the COVID-19 pandemic are online payments, Telehealth, automation tools, cyber protection, financial aid, and a good patient experience.
When Coronavirus first started to impact medical practices across the country, providers quickly put temporary solutions in place to ensure they were still able to see patients safely. As the pandemic endured, some of these “temporary” solutions became a “normal” part of doing business. While we can’t predict exactly how COVID-19 will affect us in the future, one thing is becoming clearer every day: Some of the changes that have been made the past few months will shape how healthcare is managed after the global health crisis is over.
So, it’s time to start thinking long-term with your COVID-19 strategy. Here are six ‘keys’ for sustaining your practice right now that will continue to be important after the pandemic is over.
1. ONLINE PAYMENTS
Most businesses already process a good amount of their payments online (including EZClaim), but healthcare has been slow to adapt in this area. Practices no longer have the luxury of taking their time adopting digital payment options. It’s time to give patients what they’ve been wanting for years: the ability to pay their bills online.
Because the pandemic is still with us, contactless payments have surged. No-touch payments are an easy way to reduce the spread of germs, and most people already have the tools they need to complete these types of payments: phones, computers, and credit cards.
Online payments are encouraged even when you’re meeting patients in the office. EZClaim customers can easily facilitate this with LinkPay. The process is easy and can be done once an appointment is made.
Here’s LinkPay in three simple steps:
1) Create customized payment link with required amount
2) Email or text the link to patient before their visit
3) Patient pays the required amount, which is immediately confirmed and processed
COVID-19 demanded contactless payments for safety, but now patients now expect them for convenience. Medical practices will need online payments if they are to stay relevant in the future.
Telehealth threw providers a lifeline when patients stopped coming into the office. The government acted quickly to relax Telehealth reimbursement policies so providers would be paid just as much for a Telehealth visit as they would for an in-office visit.
Congress is hoping to make these changes permanent. Whether they succeed or not, plan on keeping Telehealth as an option for your patients. Because Telehealth is not just useful during a pandemic, it’s great during normal life, too. Not all visits require an in-person encounter, and patients of all ages can benefit from the convenience of not having to physically leave their homes to get the medical care they need.
Patients have become used to having Telehealth as an option. Keeping it as an option going forward will set you apart from other practices.
3. AUTOMATION TOOLS
Chances are you are working with fewer people than normal. So, with less people to handle your billing and payments, your best option is to automate whatever you can.
This could mean setting up AutoPay for patients you see regularly, so they don’t have to manually pay their bill every time. It could also mean setting up a payment plan, in which a fixed amount will be paid automatically every month until the balance is paid off. It could also mean outsourcing your collections.
Automation doesn’t mean you lose control. Rather, it gives your staff more time to manage other essential operations. EZClaim customers have all of these automation options available to them through BillFlash.
4. CYBER PROTECTION
With digital tools becoming more prevalent, it is more important than ever to make sure your systems are protected. Hackers are out in full force right now, so it is imperative that you have proper malware and anti-virus software in place to protect your practice, your patients, and your employees. Do your homework on the tech companies you work with, too. Protecting your practice and your patients should be a top priority!
Of course, your staff will need to be up-to-date on HIPAA protocols, as well. Make sure you are doing everything you need to to protect patient privacy online as well as offline.
5. FINANCIAL AID
Some practices are struggling financially and may need government aid to get them through the current crisis. Keep an eye on government funds that are available and stay informed on their different requirements.
If you haven’t already, consider applying for a line of credit. This is standard operating procedure—even during normal times—and can help protect you from further financial disruptions in the future. No one knows how long this pandemic will last, so having a line of credit to fall back on during the coming months and years could be a game changer for your practice.
6. A GOOD PATIENT EXPERIENCE
Above all, you need happy patients. That is true whether we are in a recession or not. Happy patients are more likely to pay their bills, more likely to return for future care, and more likely to recommend you to family and friends.
So, as you make some of the changes you made during the pandemic permanent, make sure you are still doing the little things to ensure a positive patient experience. These include:
• Keep wait times short
• Maintain eye contact during visits to assure patients that you care
• Be transparent about payment expectations and insurance, as well as what you’re doing to keep patients and staff safe
• Allow patients to pay using their preferred payment method
• Offer payment plans in lieu of paying large bills in one lump sum
A positive patient experience will be key in bringing your patients back to the office as the global health crisis continues.
NexTrust from BillFlash offers a variety of innovative billing and payments solutions for EZClaim customers. Visit billflash.com or e-mail them at Sales@BillFlash.com to learn more about how you can get paid more, get paid faster, and ensure you have the online tools you need to thrive during the pandemic.
For details and features about EZClaim’s medical billing software, or the other partners they have integrated into their billing solution, visit their website.
[ Written by Kathy Scott, Marketing Manager at BillFlash and NexTrust, Inc. ]
Whether you and your workforce are back in the office, or still working from home, there are new compliance regulations, and your HIPAA Compliance program may be a bit different.
Reliable and Effective Compliance
• Completely online, our role-based courses make training easy for remote or in-office employees.
• Contact-free and accurate Security Risk Assessments are conducted remotely. All devices are thoroughly analyzed regardless of location.
• Policies and Procedures curated to fit your organization ensuring employees are updated on all Workstation Use and Security Safeguards in or out of the office, and updated in real time.
• Electronic, prepared document sending and signing to employees and business associates.
Don’t risk your company’s future, especially when we are offering a FREE Organization Assessment to help determine your company’s status regarding the new compliance regulations. [ Click here to download a “HIPAA Compliance Requirements” document ].
Live Compliance is a partner of EZClaim, and you can contact them directly by either calling them at (980) 999-1585, e-mail Jim Johnson at Jim@LiveCompliance.com, or visit them at LiveCompliance.com
[ Written by Jim Johnson, President of Live Compliance ]