There's good news and bad news on the 2-midnight rule front. The good news: CMS has put short-stay inpatient audits related to the 2-midnight rule on hold as of May 4. The bad news: This isn't a free pass, and it isn't going to last.
PHI is a bankable commodity. Hackers steal data and sell it to fraudsters. Individuals borrow or trade health information to fraudulently obtain coverage for services. Medical identity theft is a highly personal crime that can impact the victim's finances, personal and professional life, and health. Protecting this data is a tall order and involves staff in diverse departments, from front desk registration to information security.
"It doesn't take much to steal a credit card and use it for a hit-and-run buying spree, but healthcare data includes far more personal information," says Kate Borten, CISSP, CISM, HCISSP, founder of The Marblehead Group in Marblehead, Massachusetts. PHI often includes the individual's name, address, and Social Security number, along with medical record numbers and insurance identification number.
Understanding how to detect medical identity theft and how to mitigate its effects can help organizations reduce the prevalence of such crime.
Medical identity theft can be difficult to detect, says Chris Apgar, CISSP, founder of Apgar and Associates, LLC, in Portland, Oregon.
"There is no national tracking system in place like there is with, say, theft of credit card data. I could perpetrate Medicaid fraud using the same data in multiple states, and unlike with credit cards, there is no national system to detect and shut down medical identity theft," he says.
Q: If my medical waste includes PHI, do I need a BAA with our waste management vendor?
A: Yes. For example, clinics and hospitals contracting with bio-waste disposal vendors that dispose of IV bags execute a BAA with the bio-waste disposal vendors. It's no different than the requirement to execute a BAA with a document shredding vendor. If the vendor will come in contact with PHI, a BAA is in order.
Editor's note: Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are that of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Nicole Votta at nvotta@hcpro.com.
It's no secret that hospitals struggle with assigning the most appropriate status for patients, and this challenge is compounded by CMS' frequent changes to its regulations and guidance. To combat incorrect patient status assignments, one hospital has developed a system that rewards employees for speaking up when they suspect a patient's status is incorrect.
Observation services are an ongoing point of confusion for hospitals and patients, many of whom have become fearful of out-of-pocket costs and SNF coverage eligibility associated with outpatient observation services. Developing a workflow to comply with the Notice of Observation Treatment and Implication for Care Eligibility (NOTICE) Act and the Medicare Outpatient Observation Notice (MOON) is essential and is intended to help hospitals ease patients' concerns by clearing up the implications of observation.
