The Office for Civil Rights (OCR) announced December 8, 2014 that it fined an Alaska behavioral health service $150,000 for potential HIPAA violations. OCR entered into a resolution agreement with Anchorage Community Mental Health Services (ACMHS), a nonprofit behavioral healthcare service, per the announcement (see www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/acmhs/amchs-capsettle...).
CMS designates certain procedures as inpatient-only and identifies them using CPT codes. Hospitals normally only use CPT codes for outpatient coding, so this may be confusing for coders who use ICD-9-CM Volume 3 codes for inpatient procedures. Coders need to know which procedures are on the inpatient-only list to monitor compliance with this rule as they apply inpatient procedure codes.
Even organizations with sound policies, procedures, training, and safeguards can experience a breach. When?not if?a breach occurs, traditional insurance may not be enough to cover the damages. Ensuring that your organization has adopted the appropriate cyber insurance can be valuable in the event of a breach.
There are many misconceptions about HIPAA throughout the healthcare industry. In particular, business associates (BA) who provide cloud services to covered entities (CE) often have the misconception that they do not need to be concerned with HIPAA if they are compliant with the Payment Card Industry Data Security Standard (PCI-DSS). BAs with this school of thought should be prepared to get their checkbooks out when the Office for Civil Rights (OCR) comes calling.
In a concerted effort to move healthcare payments to a system of "quality over quantity," CMS finalized policies that greatly expanded packaging for outpatient providers in the 2015 OPPS final rule (www.gpo.gov/fdsys/pkg/FR-2014-11-10/pdf/2014-26146.pdf). It also introduced complexity adjustments with comprehensive ambulatory payment classifications (C-APCs).
