What to do before the office for civil rights comes knocking: part I

A comprehensive privacy and security program consists of written policies, standards, training, technical and procedure controls, risk assessment, auditing and monitoring, and the assignment of privacy- and compliance officers who are responsible for the management of the above. The privacy officer serves as the central person who is responsible for overall coordination of policies and procedures of the organization. Entities subject to HIPAA should also review their employee training programs, and determine whether it is time for updated training. The current privacy and security rules require covered entities to train workforce members as well as provide periodic security reminders. It is critical to sensitize employees to the potential consequences of improper uses or disclosures of PHI. As illustrated in this article, PHI must be handled with great care, and entities must respond to OCR inquiries adequately. Increased enforcement activity reemphasizes the need to take HIPAA compliance seriously.

Using third-party financing to help today's patient pay for treatment and care

Patients walking into your practice today are different than the ones you saw a few years ago. Larger deductibles and out-of-pocket costs may cause many of them to put off recommended treatment. What can you do to ease patients' cost concerns and help them move forward with the care they want and need? Creating a comprehensive financial policy that includes a third-party patient financing program is a good place to start. Here's how to ensure that you select the best program for you.

What's that, you say? Employee expectations of privacy when using employer-provided technology--and how employers can defeat them

Two 2010 court cases that determined the effectiveness of policies governing employees' use of employer-provided communication devices can be used to guide employers when constructing their own technology policies. In light of a policy that stated that "users should have no expectation of privacy or confidentiality," one case established that the employer was in the right. However, a separate case favored the employee due, in part, to an "unclear and ambiguous" policy. Ultimately, employers can restrict the use of employer-furnished technology by employees by: 1) clearly outlining that employees do not have a reasonable expectation of privacy in their use of company devices; 2) stating that any use of personal e-mail accounts using employer-provided technology will be subject to the policy; 3) detailing all technology used to monitor employees; 4) identifying company devices covered; 5) not exposing the content of employee communications; and 6) having employees sign and acknowledge the policy.

Medicaid integrity program: what you need to know

Over the last few years, Congress has established more programs for increased Medicaid enforcement activities. One of the earliest of these is the Medicaid Integrity Program, a federal program that was established in 2005 to cause uniform and consistent Medicaid enforcement activities across all states. Since that time, the Centers for Medicare & Medicaid Services (CMS) has been slowly implementing this program. Although it is based within CMS's framework, the vast majority of the work will be done by subcontractors, similar to the Medicare Recovery Audit Contractor program. The actual roll out of this program has been slow, but it is expected that enforcement activities will increase over the next 6 to 12 months.

Some evidentiary considerations for physician billing

In a criminal prosecution for medical billing fraud alleging up-coding and overbilling, the government's evidence may encompass the practice's entire billings and draw inferences from them. In addition, fraud may be demonstrated through statistical analysis comparing a physician's billings relative to other providers of the same specialty. The Federal Rules of Evidence govern the admissibility of evidence during a trial, to provide fairness for both the prosecution and the defense. Physicians and practice managers should be well versed in the billing requirements and particularly careful when CPT codes are expressed in terms of "required times" as opposed to "typical times."

Security breaches: tips for assessing and limiting your risks

As part of their compliance planning, medical practices should undergo a risk assessment to determine any vulnerability within the practice relative to security breaches. Practices should also implement safeguards to limit their risks. Such safeguards include facility access controls, information and electronic media management, use of business associate agreements, and education and enforcement. Implementation of specific policies and procedures to address security incidents is another critical step that medical practices should take as part of their security incident prevention plan. Medical practices should not only develop policies and procedures to prevent, detect, contain, and correct security violations, but should make sure that such policies and procedures are actually implemented in their everyday operations.

eDiscovery is here to stay: is your medical practice prepared for its risks and costs?

The adoption of electronic medical records technology in medical practices is helping to improve quality and decrease costs. While electronic records can increase practice efficiencies, this stored digital information is also playing an increasingly central role in the discovery phase of lawsuits. The sheer volume of electronic files that may be subject to a search and review during the electronic discovery phase (eDiscovery or e-discovery) can be overwhelming to produce. This phase of litigation is costly, too--the average eDiscovery project can run into the hundreds of thousands of dollars. A medical practice can reduce the number of procedural headaches and unnecessary legal costs by designing and implementing an eDiscovery strategy and process to reduce their legal and financial risk.

Legal considerations for protecting the physician's assets

Most states require that as a consideration of obtaining and maintaining a medical license, all applicants must demonstrate "financial responsibility." Usually this includes: (1) establishing an escrow account of cash and/or readily marketable securities; (2) an irrevocable, non-transferable letter of credit; or (3) in most cases, medical malpractice insurance coverage. In recent years, some states have passed legislation that provides that under certain circumstances, a physician may qualify to forego any of the financial requirements, commonly referred to as "going bare." In this regard, much of the impetus for the recently enacted Obama healthcare plan was the rising cost of healthcare in the United States arising from the extensive, and, to some, unnecessary and extraneous testing and retesting to confirm medical diagnosis and treatment-for the patient's benefit but, as importantly, to forestall a potential medical malpractice claim. As the political challenge to what is commonly referred to as "Obamacare" proceeds, and in the absence of any legislative support for "tort reform" and limitations on frivolous malpractice claims, it is abundantly clear that an integral part of any professional's "estate planning" should include and incorporate the asset protection and exempt property statutes available under the laws of the jurisdiction where the physician resides.

Contract litigation: prepare for war to ensure peace

Contract litigation can prove devastating for all but the deepest of pockets. Physicians need to prepare for war to ensure the most favorable outcome. This includes identifying your risks, negotiating from strength, and hedging your bets. Negotiate and read your contracts carefully. Beware of critical loser pays provisions in your contracts that will require you to pay your adversary's fees in the event of an adverse ruling at trial or summary judgment. Keep your insurance portfolio up to date, including the latest risk management tools, such as contract litigation insurance. Protect yourself and your practice by planning ahead.