Home Care Law Blog

OIG Opinion on blood pressure clinics

OIG recently an opinion letter on a hospital run free blood pressure clinic. The opinion's outcome is not really surprising (because I don't think most people thought this was a real risky area anyways), but it does, reinforce the notion that it is ok to provide blood pressure clinics as part of health fairs.  

In this opinion, OIG was asked (by a hospital) about their practice of providing a free blood pressure check to anyone who walks into the hospital and requests it during regular business hours.  (The article did not say how long the average wait time was.)  The hospital does not advertise the service and the service was provided in accordance with the hospital's specific guidelines and procedural checklists.  The check is not conditioned  on the visitor using any other goods or services from the hospital or any other particular health care practitioner or provider.  If a visitor's blood pressure reads outside of normal limits, the individual is advised to see his or her doctor.  The blood pressure check is not billed to any federal health care program or third party payer.

The OIG noted that the hospital did not limit how many times someone could receive a free screening.  OIG said that because of this, it was possible that, even though the value of the service was less than $10, some individuals may receive more than $50 work of blood pressure checks, due to repeated visits.  This mean that the arrangement could not qualify under the minimal value exception.

OIG also stated that the blood pressure might qualify as preventive care, but that it was still necessary to determine whether the free care would promote the provision of other, non-preventive care reimbursed by Medicare or Medicaid.  OIG conclude that these checks were not likely to have this effect.

The OIG then turned to a comment from the preamble to the 2000 final CMP rule.  That comment addressed the provision of free non-covered screening tests.  In the comment, OIG stated that such a test would not violate the CMP rule "so long as the test is not tied to provision of service by the hospital."  OIG found that the circumstances of the blood pressure clinic were analogous to the "permissible screening test" discussed in this comment.  For example, the check was not conditioned on the use of the hospital.  The check would not result in the individual being directed to a particular caregiver or provider.  The hospital did not offer the individual any discounts on follow-up services.  

This provides even more support for the blood pressure screenings performed at health fairs and similar situations. At a health fair, the blood pressure screening is not tied to the provision of other services by the home health agency or hospice.  The patient may be given a card with the results and may be directed to see their physician, but they are not directed to a particular provider.  The patient is not offered any discounts or other perks from the agency for receiving the service.  Thus, OIG has reiterated that blood pressure screenings at health fairs are an acceptable "free non-covered screening test." 

There is one other point in the letter that provides additional support for the use of blood pressure clinics in the home health and hospice industry.  OIG would not find the arrangement was a "minimal value" arrangement, because an individual could return as often as they want.  This took the arrangement outside of the $50 annual cap. (At least theoretically.)  For home health, hospice, and even private duty providers who do these checks at health fairs, this $50 limit is not likely to be exceeded.  Because the checks are done at a health fair, which is a less frequent occurrence, it is very likely that no patients are ever going to obtain $50 worth of health fairs.  

Assuming, as OIG did, that the blood pressure check is worth less than $10, an individual would have to receive at least 6 blood pressure checks.  This would require the patient to appear either multiple times at one health fair, or come to multiple health fairs at which the same provider appeared.  This seems to be highly unlikely.  This means for home health and hospice, the letter reiterates that the blood pressure screening in the context of a health fair is a minimal value service.  Given these parameters, you should be able to evaluate if there is any possibility that a patient would receive more than $50 worth of blood pressure screenings in a  year.

 

More thoughts on the new HIPAA regs

As I have continued to digest the Breach Notification regulation, the revised security guidance came up again.  The security guidance makes it clear that for electronic PHI to be secured, the encryption key and encryption tool need to be kept separate from the encrypted information.  Keeping the encryption key separate does not strike me as that big of a concern.  The encryption key is usually a password that you type into the program to unlock the data.  Keeping the encryption key on your computer is just like putting a post it note with your username and password on your computer.  (Or leaving the keys to your house in the front door.)  It makes your security efforts worthless.  

Keeping the encryption tool separate seems like a bigger issue, especially in home care where the use of laptops is more prevalent.  It appears that CMS's Office of Civil Rights considers the term tool to mean the software that was used to encrypt the data.  (Which is how I would read that term.)  This means that the encryption software must be kept separate from the data on which it was used in order for the PHI to be considered secured.  Any system in which the encryption tool is on the computer, does not meet this standard.  This raises a number of practical concerns for home health and hospice providers who use laptops in the field.  

In a number of previous seminars, I have discussed the idea of encrypting laptops as a way to secure the information on them.  I have even given examples of software, such as Filevault on the Macintosh, that is built into the operating system and will encrypt files or the entire hard drive.  If you used such a built-in software tool on the laptop to encrypt the information on it, CMS would not consider that to be secured for purposes of the breach notification rule.  If your point of care software has a built in encryption feature, this would also be considered not secure by this standard.

I will confess that I do not know the specifics of how most point of care software deals with encryption, if at all, but for HIPAA purposes, you will need to run an encryption program from somewhere other than the hard drive of the laptop to avoid the breach notification issue.  

This will add several steps to the encryption process and make it less operator friendly.  Think about it, the aide or nurse will need to put in a CD or flash drive, open the program, run it, then close the program and remove the disk or drive.  This disk or drive would then be placed back in the computer bag the aide is using.  Which raises another question - is keeping the encryption tool in the same bag as the computer containing the encrypted files storing them "on a device or at a location separate from the data".  It seems there is a strong possibility that the answer to this question is no.

This may mean that for most home health providers, encryption as a way to avoid the breach notification requirement is not really an option.  This is an interesting development which will hopefully be clarified as part of the comment period.  (Although CMS stated that any updates to the security guidance would not be published until next April.)  Simply going forward with the notification procedures may not be that difficult, but it would be nice if home health at least had the option.  

HIPAA Regs Published

The new HIPAA Breach Notification Regulations were officially published in today's federal register.  You can download a copy here.

The new regulations are effective on September 23.  The comment period ends on October 23.  In the comments to the rule,  HHS states that they are not going to impose sanctions on providers for non-compliance during the first six months after the rule goes into effect.  During this six month period, they will work with providers to assist them with getting into compliance.  This is a welcome announcement, as many providers were concerned about getting new policies and procedures into place on such short notice.

The rule also includes further clarification to the April 17, 2009 guidance document on securing protected health information.  In this clarification, HHS notes that access controls are not equal to encryption.  HHS also states that redacting PHI does not make it secured PHI.  However, HHS does recognize that properly redacted PHI may simply stop being identifiable, in which case it would stop being PHI at all.  This means that redacting PHI does not secure it, but redacting PHI to the point that it is no longer identifiable, as set forth in the HIPAA rules, removes the information from the definition of PHI.  If it is not PHI, a breach would not trigger the notification requirements.  Of course, this will not work for day-to-day security, because your patient information needs to be identifiable.  HHS's point is simply that some redaction is not sufficient to secure what is otherwise considered to be PHI.

For home health, hospice, and private duty providers you should use the next thirty days (and as necessary the six-month grace period) to get started.  Many of you are subject to similar state breach notification laws.  If so, and if you have implemented a policy and procedure to respond, you should evaluate whether your state law is preempted by HIPAA or whether complying with state law is sufficient.  For example, does your notification policy and procedure meet the requirements of HIPAA?  Or does your encryption software meet the guidance requirements?

If you have not taken any action now is a good time to start evaluating whether encryption makes sense in your environment.  Remember, this rule does not require encryption, it only requires you to provide notice of breaches of unsecured protected health information.  Encryption is simply your method for securing electronic protected health information.  If you determine encryption is not reasonable, then you need to begin implementing appropriate notification policies and procedures.  This include drafting, training, etc.

Interesting Article on Overtime

I saw this article yesterday.  It discusses a recent trend of employees suing for overtime for time spent checking e-mails after hours and on weekends.  I know plenty of home health agencies who give certain employees blackberries or iPhones so they are "always available."  This article raises some questions that providers may not have considered.  (Although any provider who has hired a patient's family to provide care may have run into a similar situation - when does the work day end?)  In home health use of these devices is more often due to employees who are away from the office during regular hours as opposed to after hours contact, but it can still lead to this issue.  This issue can also arise from the use of laptops by field staff.

If an employee who is checking e-mail is an exempt employee (say a registered nurse who is exempt as a "learned professional) this is not an issue.  Exempt employee's are not entitled to overtime.  But a non-exempt employee, say a nurse who might qualify as a "learned professional", but is paid on an hourly basis, could qualify.  For home health agencies and hospices, you should take a look at your policies regarding after hours e-mails and who has these kinds of devices.

HHS issues Breach Notification Regulations

Amongst other changes to HIPAA, the ARRA included provisions relating to the notification of individuals in the event of a breach involving unsecured protected health information.  These requirements were to go into effect after HHS issued regulations regarding the notification provisions.

Yesterday, HHS issued the breach notification regulations.  You can download it here.  I will have comments after I have had a chance to read it and digest it.

For now, you should be aware that the regulations have a sixty day comment period and are effective thirty days after publication in the federal register.  The regulation was not published in today's federal register. As soon as it is published, I will let you know it was published and what the compliance deadlines is.  For now, keep in mind that sometime around September 20th or so the HIPAA breach notification provisions will go into effect.

More movement on the RAC Front

Last week, Health Data Insights, the RAC for Region D posted a list of CMS approved issues on its website.   The issues listed as approved are all unrelated to home health and/or hospice care.  This means that home health agencies and hospices in Region D should not yet start worrying about receiving RAC recoupment letters.  However, it is further proof that the RACs are moving forward and that RACs will be an issue in the coming months.  

Although they are not home health or hospice related, it is interesting to note the issues that are listed for example, once in a life time services.  Health Data Insights will be checking for patients who received a once in a life time service more than once.  This is the classic issue for RAC data mining efforts.  They will review the data and look for things like a patient who has had his appendix removed twice.  They are also looking at a number of excessive units claims.  Again, this is a data-centric review that can be performed by a computer.  

When they first start looking at home health and hospice, they may look for similar data-centric claims, such as claims from two agencies during the same episode or a patient showing as admitted to home health while also admitted to the hospital.  Because of the episodic payment methodology, many issues in home health will require more than simply data mining.

For now, Home health and hospice providers in Region D should bookmark Health Data insights web sight and check it frequently.  Eventually, they will post home health and hospice related issues, which will signal the beginning of home health and hospice RAC audits in that region.

HHS Designates Regional Privacy Advisors

As you may recall, one of the changes to HIPAA under the HITECH Act was the requirement that HHS appoint Regional Privacy Advisors.  These advisors are supposed to provide education and guidance to covered entities, business associates, and individuals.  This is supposed to help individuals know what their rights are under HIPAA and to help providers and business associates to comply with HIPAA.  With a Regional Privacy Advisor, there is now someone you can go to when you have a question for HHS on a HIPAA Privacy or Security compliance issue.

On Friday, the Office of Civil Rights of the Department of Health and Human Services announced it had designated these Privacy Advisors.  OCR designated the OCR Regional Manager in each region as the Regional Privacy Advisor.  They have posted an announcement of this designation as well as a list of the names and contact information for the Regional Privacy Advisors.  You will note the list is simply the web page on OCR's website that lists each region and its regional manager.

It will be interesting to see how this program works.  Will there be limits to the questions OCR will answer? How many providers will seek guidance from OCR?  How long will it take to get a response and whether OCR will commit their guidance to writing or will this be handled more informally, like a FAQ?  If they offer written opinions, will OCR have a repository of guidance opinions like the OIG has for advisory opinions?  If they offer written responses, it would seem that Director would need to be involved in a response.  Hopefully, we will learn more soon about this guidance process.  If nothing else, it is very likely that we will learn more about how OCR views HIPAA as regional offices start providing guidance and education.  (Whether that is good or bad is a completely separate question.)  

I suspect that this may be more like a FAQ, than a formal advisory opinion process, but only time will tell.

Interesting FLSA retaliation case

Earlier this summer, the Seventh Circuit Court of Appeals issued an opinion regarding retaliation under the Fair Labor Standards Act ("FLSA").  In the case, a former employee sued his former employer.  The Employee was disciplined on several occasions for issues relating to punching in and out.  He made several verbal complaints to his supervisors regarding the legality of the locations of the clocks that were used to punch in and punch out.  He was ultimately terminated by the employer.  He sued alleging that his termination was in retaliation for his verbal complaints to his supervisors regarding the clocks.

Under the FLSA, an employer may not "discharge or in any other manner discriminate against any employee because such employee has filed any complaint or instituted or caused to be instituted any proceeding under or related to this chapter,...".  The employee argues that his verbal complaints were the kind of activity that the FLSA was intended to protect.

The Seventh Circuit disagreed and stated that by using the phrase "filed any complaint", the FLSA required complaints to be in writing to be subject to the FLSA non-retaliation provisions.  The Court noted that if Congress had intended to include verbal complaints they could have used broader wording, as Congress has done in several other statutes.

This means that if an employee verbally complains about something related to wages and hours, they have not filed a complaint under the FLSA and the retaliation provisions do not apply.  This means an employee cannot, as this plaintiff did, raise an issue verbally when he is being disciplined and attempt to transform legitimate discipline into retaliation.  Some employees will start making allegations about your failings under the FLSA when they are being disciplined, but unless they are in writing, they are not "filed complaints" as required under the FLSA.  (Of course, just because they are not protected under the statute does not mean you should engage in retaliation either.)

Of course, you should remember, that other statutes that have non-retaliation provisions do not require a written complaint.  For example, the statutes prohibiting discrimination have been interpreted to not require a written complaint.

One last point, this is a Seventh Circuit case. If you are not in Illinois, Wisconsin, or Indiana this case is not binding on your courts.  The Fourth and Second circuits, which include Connecticut, New York and Vermont as well as Maryland, North and South Carolina, Virginia and West Virginia have reached the same conclusion as the Seventh Circuit.  If you are outside of these jurisdictions, you may have an employee make a verbal complaint in order to make disciplining them more difficult.  As always, whether you are in the Seventh Circuit or not, I highly recommend you talk with an attorney whenever an issue like this comes up, to make sure you do not violate the law.  In employment law, an ounce of prevention is much cheaper than the cost of litigation.

More RAC activity

I have been a little behind on updating the blog, but things have been a little busy here.  Anyway, on with the regularly scheduled post.

Last week I mentioned that one of the RACs posted its first list of audit issues.  Later last week, two of the other RACs updated their websites as well.  The RAC for Region B, CGI, posted a form demand letter it will use when it has identified overpayments.  You can download the letter here.  The letter spells out the overpayment and the reason for the overpayment.  It also spells out the appeals process and how a provider can stop the recoupment process.  If you are in Region B, Minnesota, Wisconsin, Michigan, Illinois, Indiana, Ohio, and Kentucky, this is the letter you will receive if the RAC identifies an overpayment.  Although CGI is continuing to prepare for audits, it has not yet posted any CMS approved audit issues to its website.  This means that providers in Region B still have time before the RAC process begins.  As I have said before, you should be using this time to review your compliance efforts related to billing and claims so that you minimize your potential exposure to the RAC.

CGI is not the only RAC that has been working on its website.  Diversified Collection Services or DCS has added several new pages to its website as well.  Its website now has a FAQ page.  DCS has also posted a sample demand letter, which can be downloaded from its website.  DCS has also provided instructions on responding to requests for additional documentation.  These instructions can be viewed here.  It includes a discussion of how to submit records on CD/DVD.  Like CGI, DCS has still not posted any specific audit issues, which means providers in DCS' region are not yet going to be subjected to the RAC process.

One other note from both of these websites is a reaction to looking at the FAQ page.  Home health and hospice providers who look at these pages may notice a number of specific references to hospitals and hospital standards but no mention of home health and/or hospice.  For example, the word hospital appears 26 times on DCS' FAQ page.  The phrase home health does not appear once.  This may not mean anything, but it does appear to reinforce the idea that the RACs are focused on the hospital providers more than home health and hospice.  (At least for now.)  We will have to wait and see if this is in fact how things play out.  Home health and hospice providers should be aware that even if you enjoy a longer reprieve from the RAC process then the hospitals and physicians, you should not mistake this for anything other than a delay.  RACs will be looking at home health and hospice, they just may take a little longer to do so.  Do not let this delay give you a false sense of security.  You need to be aware of what is going on with the RAC project and preparing your agency for it.

CMS approves first list of RAC issues

As part of the revised RAC (Recovery Audit Contractor) process, CMS was going to approve issues before RACs audited for them.  This week a RAC posted its first list of audit issues on its website.  You can see it here.  If you look, you will not see any home health or hospice issues.  All of the approved issues are outpatient hospital and physician issues. 

CMS has stated that RAC audit activity will not begin in a state until after outreach activity has been completed and audit issues has been approved.  If you are an outpatient hospital or physician in Connolly's region, you should expect to see audit activity now.  

For home health and hospice, you should be monitoring this website, if you are in Connolly's region.  ONce you start to see home health and/or hospice issues that are approved by CMS, you would expect to see audit activity shortly thereafter.  This means you have been granted a "reprieve" and have time to take additional action to prepare for the RACs.

If you are in the other RACs regions, they do not yet even have any issues listed.  Only one other RAC, Diversified Collection Services, even has an issues page.  You can see it here.  If you follow the link, you will see it is blank.  Providers in these other regions have even more time to prepare for the coming RACs.