The right physician advisor can be an ally for case managers, helping to improve communication and cooperation with physicians, bolstering compliance efforts, and helping to avoid delays in care that can keep patients from moving seamlessly through the system.
A breach of PHI is the last thing a privacy or security officer wants but, large or small, breaches can happen. The best-laid defenses can be undermined by simple human error or a cyber-criminal hacking on the cutting edge of technology. When that happens, you need a security incident response plan.
Disaster plan
A formal security incident response plan should be developed and maintained similar to a data center disaster response plan, Kate Borten, CISSP, CISM, HCISPP, founder of The Marblehead Group, Marblehead, Massachusetts, says. IT departments should be accustomed to disaster recovery plans that guide the department's response to any disaster (e.g., fire, flood, earthquake) that affects computer systems. Security incident response plans can be seen as comparable and equally important.
When a breach is identified, the first step should be to stop the bleeding. Take steps to prevent a recurrence or limit the damage. This could be especially important for security breaches that involve hacking or PHI that was accidentally made accessible to the public on a website or cloud service. In such a situation, it would be prudent to shut down affected websites, portals, or remove access to data repositories, according to Frank Ruelas, MBA, principal of HIPAA College in Casa Grande, Arizona.
Follow a plan from the start to ensure that risks are mitigated quickly. The plan should include appropriate steps to take depending on the type of security incident, who should be part of the incident response team, and how information about the breach should be communicated within the organization, according to Chris Apgar, CISSP, president of Apgar and Associates in Portland, Oregon. Having a detailed plan that lists members of the incident response team means more time can be spent addressing the breach than asking questions about who should be involved.
A security incident response plan will also help an organization determine what level of action it needs to take. "There will be some incidents, including breaches, where it's not necessary to pull together the whole team and go through every step in the plan," Apgar says. "For example, if a patient notifies you that she received another patient's EOB [explanation of benefits], it may not be necessary to call everyone together."
In that example, Apgar says, because the organization already knows who was impacted by the breach, the response is simply a matter of following the breach notification steps set by HIPAA and any applicable state laws.
The new modifier -PO (services, procedures, and/or surgeries furnished at off-campus provider-based outpatient departments [PBD]) and the alternative payment provisions under the Bipartisan Budget Act Section 603 are both related to off-campus PBDs but define "off-campus PBD" slightly differently.
CMS recently published FAQs on modifier -PO, giving providers valuable guidance on how the modifier will apply to hospital services. Last week, CMS also indicated that it will wait until the CY 2017 OPPS proposed rule provides further guidance on Section 603. Nevertheless, some of the guidance related to modifier -PO seems to indicate that CMS is trying to bring the requirements in line with off-campus PBDs covered by Section 603, rather than simply relying on preexisting regulatory definitions of off-campus departments.
Modifier -PO was adopted January 1, 2015, with a required use date of January 1, 2016. It was originally adopted as a modifier to track statistics and information related to hospitals' off-campus PBDs. The modifier nominally applies to all items and services provided in an off-campus PBD, according to the Medicare Claims Processing Manual, but there are some significant exceptions.
The recent FAQs make it clear that modifier -PO does not apply to non-OPPS services. These services include therapy and a few other services still paid on other fee schedules, noted with a status indicator A under the OPPS, as well as dialysis, which is paid under the ESRD PPS. This guidance would dovetail with Section 603, which arguably only applies to services that would otherwise be payable under OPPS, exempting them from OPPS and providing alternative payment. Additionally, because critical access hospital (CAH) services are not paid under the OPPS, the modifier will also not apply to any services at PBDs of a CAH.
Similarly, the FAQs and other guidance indicate modifier -PO is not used for off-campus emergency departments. This guidance is in line with Section 603, which excludes the off-campus alternative payment methodology from items and services furnished at dedicated emergency departments.
Creating and conducting an organizationwide risk analysis: Part 1
Editor's note: This is part one of a series about implementing organizationwide risk analyses. Look for part two in an upcoming issue of BOH.
OCR's breach settlements, corrective action plans (CAP), and penalties often take organizations to task for not completing a regular organizationwide risk analysis, yet it's all too easy for this important job to fall by the wayside. A lack of resources and competing demands within an organization can push the risk analysis to the bottom of the list of priorities. But this leaves an organization vulnerable to threats it will only see in hindsight. It also often leads to scrutiny from OCR and the public.
The Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the larger American Recovery and Reinvestment Act of 2009, was created to encourage and regulate the use of technology in healthcare. HITECH brought meaningful use, an incentive plan designed to increase the use of certified electronic medical records, and amendments to the Security Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Although some provisions of HITECH have not been implemented (e.g., the more robust three-year accounting of disclosures for electronic protected health information [PHI]), the following is a list of the major topics that have been amended with the adoption of HITECH:
