What to do before the office for civil rights comes knocking: part I

A comprehensive privacy and security program consists of written policies, standards, training, technical and procedure controls, risk assessment, auditing and monitoring, and the assignment of privacy- and compliance officers who are responsible for the management of the above. The privacy officer serves as the central person who is responsible for overall coordination of policies and procedures of the organization. Entities subject to HIPAA should also review their employee training programs, and determine whether it is time for updated training. The current privacy and security rules require covered entities to train workforce members as well as provide periodic security reminders. It is critical to sensitize employees to the potential consequences of improper uses or disclosures of PHI. As illustrated in this article, PHI must be handled with great care, and entities must respond to OCR inquiries adequately. Increased enforcement activity reemphasizes the need to take HIPAA compliance seriously.

Using third-party financing to help today's patient pay for treatment and care

Patients walking into your practice today are different than the ones you saw a few years ago. Larger deductibles and out-of-pocket costs may cause many of them to put off recommended treatment. What can you do to ease patients' cost concerns and help them move forward with the care they want and need? Creating a comprehensive financial policy that includes a third-party patient financing program is a good place to start. Here's how to ensure that you select the best program for you.

What's that, you say? Employee expectations of privacy when using employer-provided technology--and how employers can defeat them

Two 2010 court cases that determined the effectiveness of policies governing employees' use of employer-provided communication devices can be used to guide employers when constructing their own technology policies. In light of a policy that stated that "users should have no expectation of privacy or confidentiality," one case established that the employer was in the right. However, a separate case favored the employee due, in part, to an "unclear and ambiguous" policy. Ultimately, employers can restrict the use of employer-furnished technology by employees by: 1) clearly outlining that employees do not have a reasonable expectation of privacy in their use of company devices; 2) stating that any use of personal e-mail accounts using employer-provided technology will be subject to the policy; 3) detailing all technology used to monitor employees; 4) identifying company devices covered; 5) not exposing the content of employee communications; and 6) having employees sign and acknowledge the policy.

Medicaid integrity program: what you need to know

Over the last few years, Congress has established more programs for increased Medicaid enforcement activities. One of the earliest of these is the Medicaid Integrity Program, a federal program that was established in 2005 to cause uniform and consistent Medicaid enforcement activities across all states. Since that time, the Centers for Medicare & Medicaid Services (CMS) has been slowly implementing this program. Although it is based within CMS's framework, the vast majority of the work will be done by subcontractors, similar to the Medicare Recovery Audit Contractor program. The actual roll out of this program has been slow, but it is expected that enforcement activities will increase over the next 6 to 12 months.

Some evidentiary considerations for physician billing

In a criminal prosecution for medical billing fraud alleging up-coding and overbilling, the government's evidence may encompass the practice's entire billings and draw inferences from them. In addition, fraud may be demonstrated through statistical analysis comparing a physician's billings relative to other providers of the same specialty. The Federal Rules of Evidence govern the admissibility of evidence during a trial, to provide fairness for both the prosecution and the defense. Physicians and practice managers should be well versed in the billing requirements and particularly careful when CPT codes are expressed in terms of "required times" as opposed to "typical times."

Security breaches: tips for assessing and limiting your risks

As part of their compliance planning, medical practices should undergo a risk assessment to determine any vulnerability within the practice relative to security breaches. Practices should also implement safeguards to limit their risks. Such safeguards include facility access controls, information and electronic media management, use of business associate agreements, and education and enforcement. Implementation of specific policies and procedures to address security incidents is another critical step that medical practices should take as part of their security incident prevention plan. Medical practices should not only develop policies and procedures to prevent, detect, contain, and correct security violations, but should make sure that such policies and procedures are actually implemented in their everyday operations.

eDiscovery is here to stay: is your medical practice prepared for its risks and costs?

The adoption of electronic medical records technology in medical practices is helping to improve quality and decrease costs. While electronic records can increase practice efficiencies, this stored digital information is also playing an increasingly central role in the discovery phase of lawsuits. The sheer volume of electronic files that may be subject to a search and review during the electronic discovery phase (eDiscovery or e-discovery) can be overwhelming to produce. This phase of litigation is costly, too--the average eDiscovery project can run into the hundreds of thousands of dollars. A medical practice can reduce the number of procedural headaches and unnecessary legal costs by designing and implementing an eDiscovery strategy and process to reduce their legal and financial risk.

Legal considerations for protecting the physician's assets

Most states require that as a consideration of obtaining and maintaining a medical license, all applicants must demonstrate "financial responsibility." Usually this includes: (1) establishing an escrow account of cash and/or readily marketable securities; (2) an irrevocable, non-transferable letter of credit; or (3) in most cases, medical malpractice insurance coverage. In recent years, some states have passed legislation that provides that under certain circumstances, a physician may qualify to forego any of the financial requirements, commonly referred to as "going bare." In this regard, much of the impetus for the recently enacted Obama healthcare plan was the rising cost of healthcare in the United States arising from the extensive, and, to some, unnecessary and extraneous testing and retesting to confirm medical diagnosis and treatment-for the patient's benefit but, as importantly, to forestall a potential medical malpractice claim. As the political challenge to what is commonly referred to as "Obamacare" proceeds, and in the absence of any legislative support for "tort reform" and limitations on frivolous malpractice claims, it is abundantly clear that an integral part of any professional's "estate planning" should include and incorporate the asset protection and exempt property statutes available under the laws of the jurisdiction where the physician resides.

Contract litigation: prepare for war to ensure peace

Contract litigation can prove devastating for all but the deepest of pockets. Physicians need to prepare for war to ensure the most favorable outcome. This includes identifying your risks, negotiating from strength, and hedging your bets. Negotiate and read your contracts carefully. Beware of critical loser pays provisions in your contracts that will require you to pay your adversary's fees in the event of an adverse ruling at trial or summary judgment. Keep your insurance portfolio up to date, including the latest risk management tools, such as contract litigation insurance. Protect yourself and your practice by planning ahead.

Physician ownership of medical equipment

This Data Bulletin presents findings from the Center for Studying Health System Change (HSC) 2008 Health Tracking Physician Survey, a nationally rep­resentative mail survey of U.S. physicians providing at least 20 hours per week of direct patient care. The sample of physicians was drawn from the American Medical Association master file and included active, nonfederal, office- and hospital-based physicians. Residents and fellows were excluded, as well as radiologists, anesthesiologists and pathologists. The survey includes responses from more than 4,700 phy­sicians, and the response rate was 62 percent. Since this Data Bulletin examines the extent of physician practice ownership or leasing of medical equipment, the sample was limited to 2,750 physicians practic­ing in community-based, physician-owned practices, who represent 58 percent of all physicians surveyed. Physicians employed by hospitals, who practiced in hospital-based settings or who worked in hospital-owned practices were excluded.

Identity theft and your practice

Medical identity theft is a growing problem in America. The federal government has passed laws to help "prevent" identity theft. However, several powerful medical associations are fighting the legislation. Americans need to know what is happening with these laws and why these laws are important to protect providers from lawsuits and consumers of healthcare from medical identity theft.

HR policies can protect you from harassment cases

Cultural shifts in the medical profession reflect a positive trend, but a new study shows that professionals encounter racial and sexual harassment. Do you have a human resources policy in place to protect your employees and your practice?

Effectively using a healthcare attorney is critical to your practice's legal health

Attorney jokes are legendary among physicians. However, in today's healthcare climate physicians can benefit by having a collaborative relationship with a trusted legal partner--one who understands the business and regulations of medicine as well as the law.

The false claims act and its impact on medical practices

A lawsuit under the federal False Claims Act can threaten the survival of a medical practice. The Act prohibits a range of misconduct involving the submission of false claims to the government, as well as the knowing and improper retention of overpayments of government funds. Violations of the Act result in liability for treble damages and civil penalties of as much as $11,000 per violation. Although the Act imposes liability only on persons who act "knowingly," the "knowing" requirement is met if the person acts with deliberate ignorance or reckless disregard of the circumstances. The Act contains a "qui tam provision under which a whistleblower, acting on behalf of the government, may file suit to enforce the Act's terms, and if the lawsuit is successful, can receive a substantial percentage of the government's recovery.