Month: June 2021

by Cheryl Coon
Healthcare Attorney

This article was originally published in the May/June issue of the Tarrant County Physician. You can read find the full magazine here.

As we start a new year, health care providers should consider a compliance check.  Health care laws change, new regulations are promulgated, and advisory opinions¹ are issued on a frequent basis.  Healthcare policies and procedures need to be reviewed to make sure they are up to date, and organizations may need to undertake certain necessary actions, e.g., updating their HIPAA security policy.  Compliance checks are ideally performed at least once a year.  

In the past year, for example, the federal Stark anti-referral regulations were amended.²  The Stark amendments made significant changes to the rules, including revising the definitions of “fair market value” and “commercial reasonableness.”  In addition, amendments to the HIPAA regulations have been proposed,³  and the Office of the National Coordinator for Health Information Technology (ONC) finalized rules for electronic records that include provisions relating to patients’ access to their medical records.⁴ 

For a compliance review, HIPAA issues to consider include, but are not limited to:

• Review employee training to confirm it is up to date, including necessary or desirable written documentation;⁵ 

• Review Notice of Privacy Practices provided to patients – is everything current; do new areas need to be added or sections deleted? Are the explanations of possible uses of patient data correct?

• Review the security risk assessment, particularly given the increase in cyberattacks. Review any changes to technology, new equipment such as computers or servers, new software, and what third parties and employees have access to medical records.  Has your location changed?  Is your security contingency plan still accurate?  

• Review to verify patient access to their records complies with the new ONC rules and HIPAA;

• Determine if there are new business associates to add, business associates that need to be deleted, or agreements amended;

• Verify that the named HIPAA privacy and/or security officer is still in that position;

• Review the breach reporting policy and make necessary or desirable changes;

• Determine if any third-party agreements or business associate agreements have been revised or added, and if so, if the agreements in writing include any amendments;

• Assess compliance with state privacy/medical record laws, which often have different provisions than HIPAA.⁶
  
  In other areas, things to consider include, but are not limited to:
  

• Perform an inventory of third party agreements and verify, for new or amended relationships, as applicable, that an appropriate Stark referral analysis was performed and is up to date and that an anti-kickback analysis also was performed and is up to date, i.e., is remuneration fair market value?⁷ 

• Update policies and practices to conform to the new Stark rules and any other applicable new or amended federal and state laws;

• Review continued compliance with any safe harbors relied on under the Stark rules and/or anti-kickback rules, if applicable, e.g., equipment or real estate leases, personnel service and/or management agreements;⁸ 

• Confirm employee background checks are up to date;

• Confirm federal health care exclusion screening is up to date;

• Confirm licensed employees have completed continuing education requirements and any other conditions to maintain licensure;

• Inventory leases and any amendments and make sure appropriate documentation is in place, including, if applicable, a fair market value analysis;

• Verify record retention policies still comply with current laws and that the procedures are being followed;

• Consider whether an audit of the use of appropriate billing codes is necessary;

• Verify required licenses are up to date for personnel and any equipment;

• Verify compliance with federal and state telehealth laws, if applicable, including any provisions related to COVID-19;

• Verify that patient record request policies are up to date and that personnel are complying with the policies;

• Verify appropriate due diligence is being performed for applicable laws when new vendors or contractors are engaged.
  

Your organization should also consult in-house or outside counsel to verify any changes to federal and state laws before beginning the compliance review process.  Furthermore, there is value in engaging an attorney and seeking legal advice on the review in order to invoke the attorney-client privilege where possible.  The privilege will not protect all documents or all communications, but it provides significant protection during the process for covered communications.⁹   

Again, this “list” is not comprehensive, particularly given the plethora of health care laws that could apply and the complexity of such laws.  As an example, this list does not focus on Medicare or Medicaid compliance.   Nonetheless, it should provide a reminder for the key areas to cover when conduct a general healthcare compliance check.

References:

1. This article is not intended to be a comprehensive summary of all final or proposed changes to federal and state health laws and regulations.  Additionally, given the many types of healthcare providers, the article does not address all possible federal and state laws but is intended to provide an example of the type of questions they should ask.

2. See, e.g., OIG Advisory Opinion No. 20-08 (Dec. 20, 2020) ((regarding a federally qualified health center’s proposal to offer gift cards to incentivize certain pediatric patients to attend rescheduled preventive and early intervention care appointments).

3. 85 Fed. Reg. 77,492 (Dec. 20, 2020).

4. See 85 Fed. Reg. 6,446 (Jan. 21, 2021).  The proposed changes largely relate to the new ONC rules regarding access to patient records.

5. See 85 Fed. Reg. 25,642 (May 1, 2020).

6. According to many experts, training should be performed at least annually.

7. For example, the Texas Medical Record Privacy Act has a much broader definition of “covered entity” than HIPAA, being any person who engages in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information and including any person who obtains or stores protected health information.  See also 15 Tex. Admin. Code § 390.2 which lists various statutes that could be applicable to Texas covered entities.

8. The definitions of “fair market value” and “commercial reasonableness” have changed under the new Stark rules that were effective January 19, 2021 (with limited exceptions).

9. The new Stark rules also made changes in these areas. 

10. Generally, the elements of attorney client-privilege are: (1) the person asserting the privilege must be a client or someone attempting to establish a relationship as a client; (2) the person with whom the client communicated must be an attorney and acting in the capacity as an attorney at the time of the communication; (3) the communication must be between the attorney and client exclusively; (4) the communication must be for the purpose of securing a legal opinion, legal services, or assistance in some legal proceeding, and not for the purpose of committing a crime or fraud; and (5) the privilege may be claimed or waived by the client only.

by Shanna Combs, MD

This article was originally published in the May/June issue of the Tarrant County Physician. You can read find the full magazine here.

One of my favorite roles as a physician and medical educator is the opportunity to be a mentor.   At the TCU and UNTHSC School of Medicine we recently kicked off our 2021 Diversity and Inclusion Mentoring Network Series.  As with everything in life, our mentoring network had been put on the back burner due to the COVID-19 pandemic.  It was so refreshing to get back into the mentoring groove again with our latest event, even if it was virtual.

Mentoring is a critical piece to the development of aspiring physicians, not just at the medical training level but also at the college, high school, and school age level.  Unfortunately, over the past few decades the decision to become a physician has all too often been met with negativity…

. . . too much schooling, too much debt, no time for a family or a life, medical-legal concerns, too much paperwork, financial concerns, and ultimately, physician burnout.   

I still remember telling physicians that I wanted to be a doctor when I grew up and immediately hearing how that was not a good career choice, and if they had to do it all over again, they would choose another field.  Thankfully, I occasionally met a doctor or two who showed me how much they loved their work and encouraged me in my pursuits.  This is why mentorship matters.

During this crazy year of a global pandemic, we have truly seen the importance of our healthcare team members and have even named them heroes.  I only hope that this will continue.  While our path as physicians is not always easy, I feel that it is an extremely rewarding one, and I want to help others see how amazing it is to be a doctor.  Mentorship comes in all forms, and one just needs to be willing to share their guidance and expertise to become a mentor.  Mentoring can be formal, peer-to-peer, developmental, instructional, or informal.  No matter the form, mentorship is extremely important and provides benefits to the mentor as well as the mentee.

At our recent mentoring event, not only was I able to provide guidance and nurture our up-and-coming physicians, but I was also able to learn a lot about our community.  Some of the amazing features of the TCU and UNTHSC School of Medicine Diversity and Inclusion Mentoring Network are that it crosses multiple areas in Medicine, includes mentors from a variety of backgrounds and journeys in life, and is made up of physicians, researchers, administrators, and leaders in the community.  In addition, due to the need to meet virtually, it now includes mentors from across the country who have a connection to our school.  It was exciting to hear about others’ successes, failures, and varied experiences in Medicine as well as to hear about their “why” for pursuing it as a vocation.  It was also refreshing to see the joy on the students’ faces as they were able to interact in small groups with mentors and hear the various pearls of wisdom each one had to share.  

By mentoring medical students, you can provide opportunities for growth and professional development, demonstrate the various careers and specialties in Medicine, and give career advice and counseling.  Most importantly, though, you can see the enthusiasm for your chosen profession. So, if you need a little more joy in your life, I highly recommend finding a way to be a mentor to those in need of guidance and encouragement.  Please feel free to join our Diversity and Inclusion Mentoring Network at the TCU and UNTHSC School of Medicine.  As with everything in life, a village can only make you stronger.

To join the TCU and UNTHSC School of Medicine Diversity and Inclusion Mentoring Network, please go to https://tcu.co1.qualtrics.com/jfe/form/SV_eA8Gugmvl5wg69w.