To fully understand where your organization's risks lie, you not only need to have a firm grasp on risk analysis and assessment processes, you need to define these processes as well.
There has been some confusion surrounding a possible Recovery Auditor-related provision in the American Taxpayer Relief Act of 2012, also known as the fiscal cliff deal.
Recovery Auditor overpayment and underpayment statistics are released by CMS at the close of each fiscal year (FY) quarter, and with FY 2012 in the books, CMS has published its year-end improper payment figures. In FY 2012, the numbers continued to ascend, as CMS more than doubled its total correction amount from the previous year.
There are six generic approaches to managing risk, and the approach an organization chooses to use will depend on many factors. For example, how real is this risk? Can it actually become a problem, or is it merely theoretical? Management will want to decide whether the risk is likely to happen and whether it is possible to determine when it may happen. This will also assist in appropriate allocation of resources to focus on material risk areas.
One thing is certain: You don't want to wait until you receive a notification letter from OCR before you begin preparing for a HIPAA audit, says Dena Boggan, CPC, CMC, CCP, HIPAA privacy/security officer at St. Dominic Jackson (Miss.) Memorial Hospital.
UK HealthCare’s Chief Compliance Officer R. Brett Short knew he was in for a rough day as soon as he saw the email from his organization’s privacy officer.
Conducting pre-billing audits can be challenging, but when done correctly, it can save organizations from spending time recoding and rebilling claims that payers deny. These audits can be conducted on the front end, in both inpatient and outpatient settings, once records have been coded.
The Office for Civil Rights (OCR) announced December 8, 2014, that it fined an Alaska behavioral health service $150,000 for potential HIPAA violations. OCR entered into a resolution agreement with Anchorage Community Mental Health Services (ACMHS), a nonprofit behavioral healthcare service, per the announcement (see www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/acmhs/amchs-capsettle...).
While organizations should focus on performing regular risk assessments and analyses, there are also other ways in which they must review their systems for compliance. Often, these other evaluations are overlooked despite their value, says Kevin Beaver, CISSP, an information security consultant in Atlanta. In particular, organizations should be careful not to forget about performing vulnerability assessments and penetration tests, which are components of an overall risk assessment or analysis, says Beaver, who is an editorial advisory board member for SHCC's sister publication Briefings on HIPAA.
