Kusserow on Compliance: A definition of health care compliance

A good starting point for meeting the obligations of a compliance officer’s position is to define health care compliance. This can be useful in developing plans and objectives for the program, as well as explaining the meaning to executive leadership and the board.

  1. Health care compliance is defined as adhering to laws, rules, regulations, and program requirements, as well as the Codes of Conduct, policies, and procedures for the organization. Meeting this definition means identifying and meeting all applicable legal, regulatory, program requirements, and payment standards that vary considerably depending on type of organizations and the services they provide. To achieve this requires promoting not only compliance with rules, but ethical conduct and a culture that promotes prevention, detection, and resolution of conduct that does not conform to the established rules.
  2. Health care compliance can also be defined also as the ongoing process of meeting, or exceeding the legal, ethical, and professional standards applicable to a particular health care organization or provider. The HSS Office of Inspector General (OIG) has helped with the definition of health care compliance through its compliance guidance documents, which call for compliance efforts to be designed to establish a culture within organizations that promotes prevention, detection, and resolution of instances of conduct that do not conform to federal and state law; federal, state, and private payor health care program requirements; and ethical and business policies. The scope extends to many areas including patient care, billing, reimbursement, managed care contracting, research standards, Occupational Safety and Health Administration (OSHA) standards, the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) standards, and the Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules, to name a few. The biggest challenge for health care organizations and their compliance officers is keeping track of all these numerous requirements and regulations.

Meeting the definition for health care compliance means meeting all of the rules and requirements set forth and applicable to them across a broad range of criteria, including all applicable legal, regulatory, program requirements, and payment standards that vary considerably depending on type of organizations and the services they provide.  As one examines the meaning of health care compliance, it becomes clear that it embraces a great variety of things, including adhering to laws, rules, regulations, and program requirements, as well as organization Codes of Conduct, policies, and procedures governing the day to day operations. Because health care has become so complex in recent years, the industry is under constant scrutiny. Compliance programs promote not only compliance to rules, but to ethical conduct and the promotion of a culture that encourages prevention, detection, and resolution of conduct that does not conform to federal and state law; federal, state, and private payor health care program requirements; and the organization’s ethical and business policies. It is nearly impossible to define the extent or complexity of the ever changing healthcare compliance world. New laws and regulations come into play on a daily basis from all level of government.  Some of these have far ranging implications such as HIPAA and HITECH laws that are designed to protect the privacy of patient information.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2018 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: HIPAA enforcement update

At the 2018 HCCA Compliance Institute HIPAA Policy and Enforcement Update, it was reported that since September 2009 through the end of 2017 there were 2178 reports filed with the HHS OCR involving breaches affecting 500 or more individuals. In addition to large breaches, there were over 300,000 reports of breaches of protected health information (PHI) affecting fewer than 500 individuals. Individuals affected by the large breaches were about 177 million. So far, OCR’s website has posted 38 breaches as of April 2018. In all, nearly one million patients may have had their PHI put at risk by these incidents with the number continuing to grow. The breakdown of type of large breaches includes:

  • Loss/Theft continues as the most often reported problem; nearly half of the cases.
  • Laptops and other portable storage devices represented one fourth of large breaches.
  • Hacking/IT Incidents account for about one in five reported incidents.
  • Paper records accounted for another fifth of the large breaches

10 largest 2018 incidents to date by number of patient records affected

  1. 582,174 – California Department of Developmental Services, 4/06/2018, Unauthorized Access/Disclosure Incident
  2. 279,865 – Oklahoma State University Center for Health Sciences, 1/05/2018, Hacking Incident
  3. 134,512 – St. Peter’s Ambulatory Surgery Center LLC- d/b/a St. Peter’s Surgery & Endoscopy Center, 2/28/2018, Hacking Incident
  4. 70,320 – Tufts Associated Health Maintenance Organization, Inc. reported on 2/16/2018 an Unauthorized Access/Disclosure Incident
  5. 63,551 – Middletown Medical P.C.,  3/29/201 an Unauthorized Access/Disclosure
  6. 53,173 – Onco360 and CareMed Specialty Pharmacy, 1/12/2018, Hacking Incident
  7. 36,305 – Triple-S Advantage, Inc., 2/02/2018, Unauthorized Access/Disclosure Incident
  8. 35,136 – ATI Holdings, LLC and its subsidiaries, 3/12/2018, Hacking Incident
  9. 34,637 – City of Houston Medical Plan reported on 3/22/2018 a Theft of Laptop Incident
  10. 30,799 – Mississippi State Department of Health, 3/26/2018, Unauthorized Access/Disclosure

Top 10 Recurring Compliance Issues

  1. Pattern of disclosure with sensitive paper PHI
  2. Business Associate Agreements
  3. Risk analysis issues
  4. Failure to manage identified risk, e.g. Encryption of data
  5. Lack of transmission security
  6. Lack of appropriate auditing
  7. No patching of software
  8. Insider threats from employees and contactors
  9. Improper disposal of data
  10. Insufficient data backup and contingency planning

HHS OCR calls for health care organizations to establish contingency plans to keep patient data secure and mandate that covered entities and business associates have such plans. In their March newsletter, OCR officials urged health care organizations to figure out which IT systems are critical, to understand how to function in a disaster, and to back up PHI so it can be retrieved if the original data are lost or taken offline. Once developed, the plan should be routinely tested to identify gaps and ensure updates for plan effectiveness and increase organizational awareness. The plan should be reviewed and updated on a regular basis when there are changes: technical, operational, or in personnel.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2018 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Using sanction-screening tools vs. outsourcing the entire process

In order to save time and costs, more and more health care organizations have been moving to outsource functions that are not core business activities. Compliance programs have been part of that trend: (1) 80 percent of compliance offices use vendors to provide hotline services, (2) 50 percent of compliance offices use vendors to provide policy development tools, and (3) two-thirds of compliance offices use vendors to provide E-learning tools. Included in the growing list of outsourced tasks has been the movement to address the rapidly growing cost and time commitment obligations related to sanction-screening. Two-thirds of compliance offices use a vendor search engine tools to assist in sanction-screening that saves an organization from downloading the sanction databases and developing a search engine. This is a trend driven by the rapid development of many new databases against which to screen employees, medical professionals, contractors, vendors, etc., including the following:

  • OIG List of Excluded Individuals and Entities (LEIE)
  • GSA Excluded Parties List System (EPLS)
  • 40 Medicaid states now have sanction data bases requiring monthly screening
  • Drug Enforcement Administration (DEA)
  • FDA

All this has increased the burden of sanction-screening exponentially, not only for the compliance office, but also human resource management for new hires and periodic screening of current employees and procurement with vendors and contractors. Medical credentialing is involved as result of having to screen physicians who are granted staff privileges. Using vendors has been a great help, but the most difficult part of the process is resolving “potential hits.” This can be a considerable effort and many organizations have to dedicate staff for investigation and resolution of these hits. It is complicated by the fact that most sanction data does not provide sufficient information to make positive identification. As a result of this heavy burden, many have moved beyond simply using a vendor tool to outsourcing the entire process to vendors. The following address selecting a sanction-screening vendor and outsourcing the process.

 

Tips for selecting sanction-screening vendor

 

Tips for outsourcing the sanction-screening process

  • Determine the cost of moving from use of a vendor search engine tool to outsourcing the screening, along with investigation and resolution of “potential hits.”
  • Inquire as to the methodology they follow in resolving potential “hits,” a critical part of any screening effort.
  • Ensure the vendor provides a certified report of the results that can be made part of the compliance office records.
  • Review an example of the type of reports they would provide to determine if it meets the documentary needs of the organization.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2017 Strategic Management Services, LLC. Published with permission.

Kusserow on Compliance: Human resources compliance—update on EEOC investigations

Most hotline complaints received relate to HR related issues, including harassment, discrimination, and unfair treatment, making this one of the most common compliance issue areas. Many employees go on to report their complaints to the Equal Employee Opportunity Commission (EEOC) that is responsible for addressing workplace harassment complaints. Media reports have focused on the long delays in resolving allegations of discrimination (1.5 years for federal employees and 500 days for the private sector). An increase of $15 million was authorized this year in the EEOCs budget, which may help with the backlog. The reason for the longer wait for federal employee complaints is that that a federal employee must first file a complaint with his or her agency’s equal employment office, which conducts an investigation. The employee may then file a lawsuit or request a hearing with an EEOC administrative judge.  The staffing level for the Commission is about 2,000, of which there are 549 investigators responding to allegations and complaints. For 2017, the Commission reported:

  • Resolution of 99,106 charges, an increase of 1,660 over 2016
  • Reduction of the inventory of pending charges by 16 percent to 61,621
  • Secured $484 million for victims of discrimination
  • 7,218 successful mediations resulting in over $163.7 million in benefits to charging parties
  • Resolution of 6,661 federal employee hearing requests with $73 million in their relief
  • Resolution of 4,284 appeals of agency decisions
  • Resolution of 85 percent of appeals over 500 days pending
  • $13.3 million in remedies secured
  • 4,500 individuals received monetary relief as a direct result of litigation resolutions
  • 184 lawsuits filed, including 124 suits on behalf of individuals

In most cases, the EEOC has found that there was not sufficient evidence to make a finding that discrimination occurred. Only about 3 percent of cases were found to have reasonable cause.  Also reported was an increase in the number of complaints being received that may be fueled in part by the emergence of the #MeToo movement.

 

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2018 Strategic Management Services, LLC. Published with permission.