Home Care Law Blog

Increased DOL enforcement on the horizon.

President Obama's FY2011 budget makes it clear that the DOL is going to be continuing to increase its enforcement efforts in the coming years.  Amongst requests in the budget are requests to hire 177 new inspectors and investigators.  Secretary Solis also stated that DOL would be moving about 35 inspectors from compliance assistance roles to enforcement.

One of the areas that will see increased enforcement under the new budget is the misclassification of employees as independent contractors.  The budget includes an additional $25 million dollars which will be used to hire an additional 100 investigators and other enforcement personnel.  These new hires will be tasked with identifying misclassified employees.  The DOL will undertake this effort in conjunction with the Department of the Treasury.  The administration plans to recover $7 Billion over the next ten years from that effort.  That sounds like health care fraud recovery numbers.  This illustrates that the DOL is very serious about this effort and will be working hard to find employers who misclassify.

This is important to home health, hospice, and home care providers, because misclassifying individuals as independent contractors is a mistake many home health, hospice, and homecare employers make.  For example, many employers incorrectly believe that by having an employee sign a "contract", that employee is an independent contractor.  Employers want their employees to be independent contractors, because it limits their liability, saves them money, etc.  (And it would, if they correctly classified them, unfortunately misclassifying employees increases your liability.)

The problem for most home health, hospice, and homecare employers is that the employer is usually wrong when it decides an individual is an independent contractor.  There are several different tests used to determine whether an individual is an employee or an independent contractor.  For example, the FLSA (minimum wage and overtime law) has a test, the IRS has a test, and there are state law and common law ("court created") tests as well.  With all of these different tests, an individual's classification must be carefully considered.  

As a general rule for home health, hospice, and private duty, the individual is going to be an employee, not an independent contractor.  I say as a general rule, because there are exceptions.  (I am not going to attempt to explain the exceptions, because this blog is not the place to plumb the depths of independent contractor v. employee.  The main point here is that you are safer if you classify an individual as an employee.  If you think they might be a contractor, seek the advice of an attorney.  DO NOT ASSUME THEY ARE A CONTRACTOR!!!)

If you are found to have misclassified individuals, you will have a great deal of liability - back pay, taxes, etc.  Employers who have classified members of their workforce as independent contractors, without the advice of counsel, should review that decision with their attorney.  You have been warned that this is an enforcement priority of the DOL, which means you should check to ensure you are in compliance.  You would much rather catch your mistake and take steps to fix it than have the DOL catch your mistake later or worse, have one of your employees retain an attorney who files suit. 

Nurse Charged for Reporting Doc Found Not Guilty

A case that will interest home health and hospice nurses just wrapped up in Texas yesterday.  Two nurses from a hospital in Texas reported a doctor to the Medical licensing board for what they believed was malpractice.  Turns out the doctor they reported was good friends with the local sheriff.  Needless to say, the doctor spoke to his buddy and shortly thereafter, the two nurses were charged with felonies for making the report.  Yesterday, the nurse who actually stood trial was acquitted.  You can read the whole story here and here.  

This is an unusual case, because whistleblowers do not usually get prosecuted criminally and you shouldn't refrain from making a legitimate report out of fear of being prosecuted.  The whistleblowers had legitimate concerns about the care provided by the physician.  They reported these concerns to the hospital and were ignored.  They then determined, correctly in my opinion (and the jury's) that they needed to report the doctor directly to the state medical licensing board.  They were then prosecuted for disclosing patient information to the board.  This case raised a lot of concerns, because the threat of criminal prosecution for reporting would lead many nurses and other healthcare professionals to simply not make the report.  (A point that was raised by the Texas Nursing Board.)  The fact that the jury very quickly determined the nurse had not done anything wrong should provide comfort to health care professionals who might have been concerned about making a report after hearing about this case.

Now this prosecution was clearly the result of the doctor's friendship with the county sheriff (although, you have to wonder why the prosecutor didn't put the brakes on this thing), but the prosecution was able to go forward, in part, by seizing on comments the nurse had made about the doctor over the previous two years.  The prosecution claimed these comments illustrated the nurse was out to get the doctor.  This was important, because if she made the report in bad faith, she was guilty of the felony.

This serves to illustrate a key point related to reporting other professionals.  If you have a concern about another healthcare professional, handle it like a professional.  Although the nurse in this case did nothing wrong, one of the facts the prosecutor seized on was that she referred to the doctor as a "witch doctor."  He may very well have been a bad doctor, but name calling does not help your case.  If asked, a specific description of your concerns is more appropriate.  (What about the specific care of the patient concerns you?) A pattern of name calling and other vague hostility probably won't lead to you being prosecuted criminally for making a report, but it can lead to questions about your motivation and veracity when you make a later, legitimate, report of malpractice or other questionable conduct.

If you believe another professional (including a referring physician) has violated professional standards, endangered a patient, committed fraud, or engaged in some other wrongdoing, make an accurate report to the appropriate parties at your agency.  Then let them handle it.  There is no need to talk about the individual or the report once you have made it.  Once the report has been investigated, the individual will "get what they deserve."  Again, talking about the report or making other statements related to the subject of the report will lead the subject to make claims like "they are just trying to damage my reputation."  (It can also lead to retaliatory complaints against your license.)

If no action is taken on the report, then make a report to the appropriate regulatory authorities, medical review board, nursing board, PT board, etc.  They will follow up.  It is hard for someone to question your motives, etc. if you handle a complaint in a professional manner and do not make comments about the subject of the complaint to others in the workplace.   Even if the target is politically well connected, if you make a good faith report and their is no record of "hostility", it makes defending yourself much easier.

HIPAA Enforcement audits are on the way...eventually...maybe?

Earlier this month, the Sue McAndrew, the Deputy Director of Health Information Privacy for the Office of Civil Rights ("the HIPAA Police") spoke at the 18th Annual National HIPAA Summit.  One of the topics she touched on was the HITECH act's requirement that OCR begin auditing providers to measure HIPAA compliance.  This change is one of several changes to enforcement under HIPAA that resulted from the HITECH act.  Even though it has been a year since the HITECH act was passed as part of the ARRA, OCR has not started performing these audits.

Most providers are quite pleased to continue on without any audits, but others are beginning to question why OCR has not followed through on this new requirement.  Ms. McAndrew explained that OCR is still trying to determine when it will conduct these periodic audits as well as how to pay for them.  She stated that there are thousands of ways OCR can implement this new requirement.  Because of this complexity, OCR has retained a HIPAA privacy and security expert to help OCR map out the various options and to determine which would be most effective.

This sounds to me like HIPAA audits are still a thing of the future, perhaps the distant future.  Even after OCR settles on a particular audit process, it sounds like they  have other logistical issues to work out.  It is hard to say how long it will take OCR to sort through its options and settle on a particular model.  I wonder how the models they are looking at determine which providers to audit.  Covered entities range from home health and hospice to hospitals and physician practices.  That is a whole lot of entities to consider.  In my opinion, the delay is not such a bad thing, because it is one less opportunity for providers to have to sit down with an investigator while the investigator goes through files and writes up an audit report.  You already have several other entities doing this.

The fact that HIPAA audits are still "on the horizon" after a year may lead some providers, especially in the home health, hospice, and private duty industries to figure they can put HIPAA on the proverbial back burner.  (Or more accurately, leave it there.)  The concern that providers will do this is leading some privacy advocates (and others) to become very concerned about OCR's delay.  

The "put it on the back burner" mentality and the related concerns of privacy advocates overlooks a key point - audits are not the only means to enforce HIPAA compliance.  Patients who feel they were the subject of an inappropriate disclosure can still make a complaint to OCR.  OCR will still investigate it.  When presented with a substantiated violation, OCR can now impose much steeper penalties and is not as free to simply "encourage the provider to achieve compliance."  In addition, state AG's can now pursue providers as well. (And lets not forget the specific mention of HIPAA in the new hospice COPs.  Thanks CMS.)

This means that providers who are ignoring HIPAA because OCR may be months (or longer) away from implementing its audit process are doing so at their own peril.  Just because they are not auditing does not mean your non-compliance will go unnoticed.  If you are not in compliance, you should be working to get there, because OCR's audit process is not the only HIPAA enforcement game in town.

Companionship services exemption in the news.

Just when you thought that health care reform had completely diverted attention away from the companionship services exemption, the exemption rears its head again.  The New York Times published this editorial recently advocating for the removal of the companionship services exemption.  It is yet another plea (they have published several similar editorials over the years) to end the companionship services exemption's availability for the homecare industry.

Of course, the editorial is long on "schmaltz", mentioning the pen President Obama gave to Lily Ledbetter and how Evelyn Coke's recent passing prevents a similar event for her, but short on substance.  It fails to address any of the economic realities regarding the exemption, its use in home care, and how eliminating it would impact the cost of providing home health care and the availability of home health care.  (Funny how critics of the exemption never mention any of the results of eliminating it, like the increased costs to state Medicaid programs or the decrease in incomes for aides.)

This editorial was quickly followed by a letter to the editor written by Steven Dawson, President of PHI.  (PHI is closely affiliated with everyone's favorite union - SEIU.  PHI has long advocated the elimination of the companionship services exemption.) Mr. Dawson's letter states that it is "long past time" for President Obama to instruct the DOL to reverse itself on the Companionship services exemption.  Mr. Dawson also mentions that one in three homecare workers are without health insurance. (Ahh, there' the health care reform tie-in.) 

Reversing the companionship services exemption continues to be a goal of SEIU and Labor.  It has not gotten a lot of attention lately, due to health care reform, but clearly it is still a target. Providers should continue to keep an eye on this.  Given the pressure Congress is currently under, I don't know if we will see this addresses legislatively, but this is the second time time in the past year the idea of having the DOL eliminate the exemption through the rulemaking process has been proposed.  (You may recall a group of 15 senators asked the President to do this very thing last summer.)  DOL would have to go through the rulemaking process to do this, which would give providers a chance to comment.  Unfortunately, as anyone who has participated in this process knows, the agency does not have to listen to your comments.

Of course, this may continue to be a non-issue, due to the fading prospects for Big Labor's agenda.  As this trend continues, it may be harder and harder for the Big Labor to convince the administration to move on some of these issues, especially with health care reform still on life support.  This is just one more thing to keep an eye on, and to be ready to take action on, as the year goes forward. 

Home Care Law Blog receives some more recognition

I don't usually like to talk about myself.  (Okay, those of you who know me don't need to point out that that statement may not be entirely true.)  However, I do try to keep this blog about the industry, but yesterday I received an e-mail notifying me that this blog had been selected as one of the Top 50 Hospice Care Blogs.

It's always nice to receive a little recognition, but I thought you might be interested in the whole list, not just my place on it.  There are a number of blogs, especially from the caregiving perspective, that you might find interesting.  (Or you may already know about.)  

NIOSH Issues Home Healthcare Occupational Hazards Review

The National Institute for Occupational Safety and Health ("NIOSH") just issued its Home Healthcare Occupational Hazards Review.  The Review concludes that one of the biggest risk areas for home health care workers is for musculoskeletal Disorders due to transferring patients.  This likely does not come as a huge surprise to anyone who has worked in home health, home care, or hospice care for any period of time.  Lifting patients, moving patients, etc., can all lead to back and other injuries for homecare workers.  The review discusses a number of "interventions" designed to help reduce the risks to employees.

The article states that while using two trained employees to transfer patients can reduce the risks of injury, it does not reduce the risks sufficiently.  NIOSH advocates a "zero lift" policy.  This policy grows out of a study performed at seven nursing homes and one hospital in which patients were lifted or transferred only with the use of appropriate equipment.  This led to significant reduction in employee injuries.  NIOSH concludes that "[w]henever possible, devices should be used to help with patient transfers."  This is a good point, but the authors seem to have overlooked a key problem - home health and facilities are different - they go into a patient's home and often rely upon the equipment the family has obtained.  For example, a patient may have a hoyer in the home, but refuse to allow the agency to use it or not have sufficient slings.  (The family has one sling to use for showering, but after the shower, there are no dry slings.  So much for the hoyer.)

The article discusses a number of ergonomic devices an agency can use (it even has pictures) as well as other strategies.  For example, using a rolling toileting/shower chair reduced the number of patient transfers from six to two.  Properly identifying equipment for the patient, and considering the patient transfer issue when assessing and care planning can reduce the number of times your employees have to lift the patient.  This reduces the potential risk of injury.

One thing I do think the article gets right is the suggestion to consider these assistive devices during care planning.  You might consider if the patient would be able to obtain some of this equipment through Medicare/Medicaid.  The provider may not be able to afford it, but if the patient can obtain it through Medicare/Medicaid, it would be beneficial for the patient, family, and agency to obtain them.  Working with the family in this fashion and helping them to understand the importance of this type of equipment and to obtain the equipment benefits everybody.

The review also touches on other areas of risk including latex allergies, exposure to bloobdorne pathogens, occupational stress, violence, infectious disease, animals, hygiene, and other risks. 

The review is worth reading, if for no other reason, than as a tool to review and rethink your safety policies and procedures.  There are a number of interesting studies they cite and statistics on occupational safety.  You may not agree with all of it, but it might give you a few ideas that reduce employee on the job injuries (and your worker's comp claims.)  It also has a multiple page "Chekclist" that you can use as an worker safety assessment tool.   Going through the checklist will help you to see how your current safety plans compare to what NIOSH thinks you should have.  This will help you to identify any  deficiencies so that you can correct them.

Providers ask FTC for Exception to Red Flags Rule

On Friday, a four trade associations for health care professions issued a press release announcing that they had requested the FTC specifically exempt members of their organizations from the Red Flags Rule.  You can read their letter here.  This group includes the American Dental Association, the American Medical Association, the American Osteopathic Association, and the American Veterinary Medical Association.   

This request is based upon a recent federal court ruling that found the Red Flags Rules do not apply to lawyers. This ruling came out of a lawsuit filed by the American Bar Association(Hey, We control Congress and The courts, you didn't think lawyers would really have to comply did you?)  These providers argue that the court's rationale for excluding lawyers applies equally to them.   This makes sense, because the court determined that lawyers did not fit the definition of creditor and that it appeared the FTC was attempting to regulate monthly invoice billing.   Personally, I think the judge is correct.  

The ABA case and the AMA letter are worth keeping an eye on in the coming months, because the same rationale would apply to home health, hospice and private duty providers.  The FTC's rationale has always been that invoice billing amounted to an extension of credit which made you a creditor.  If a lawyer does not become a "creditor" by virtue of invoice billing, it is hard to see how a home health agency, hospice, or private duty provider would.  Hopefully, the court ruling and pressure from the AMA and others will lead the FTC to dial back the rules.

Some privacy advocates are lamenting the AMA's move in this case.  They think the Red Flags Rule is another needed tool to protect patients from the loss or disclosure of information that leads to identity theft.  In my opinion, this is not as big of a concern as some might think.  

The Red Flags Rule is more about detecting indicators of identity theft than protecting patient information from loss.  Safeguarding and securing patient information is addressed by HIPAA.  Regardless of what happens with the Red Flags Rule, HIPAA will still be in place and still require providers to protect patient's PHI. In addition, HIPAA's effectiveness has been enhanced, due to the new breach notification requirements, expansion of business associate coverage and the much steeper penalties allowed.  Increased HIPAA enforcement alone will do a great deal to curtail disclosure of patient information that leads to identify theft.  

Limiting the application of the Red Flags Rule as the AMA is requesting will not lead to less security of patient's PHI.  

Health Care Fraud in the News Again

Last week, the President hosted a Medicare Fraud summit to evaluate new ways to combat Medicare Fraud. During the summit, one of the attendees noted that he government "cannot prosecute its way out of the Health Care Fraud problem."  On the heels of the summit, the Administration announced its FY 2011 budget.  The budge includes $1.7 billion for Medicare Fraud enforcement.  This money will be used for a number of efforts:  it will more than double the Health Care Fraud and Abuse Control discretionary funding, it will expand the DOJ/HHS joint strike force efforts, it will provide for better data sharing, and increase oversight and prevention.

The data sharing plan is discussed more fully here.  Essentially, Medicare is continuing its efforts to consolidate all of its claims data into one place.  Then they can use datamining techniques to look for patterns in the data.  In the statement, Secretary Sebelius mentions the use of benchmarking to identify questionable practices.  I have mentioned this plan on this blog before - essentially, they will use the data to identify providers/areas with questionable practices and then focus on these providers.  This allows them to "target" their investigations.  

Of course, smart criminals will account for this and strive to keep their billing within certain parameters or go wild, get as much as they can as fast as they can and get out before the investigators arrive.  (I don't mean to be negative, but my my years doing primarily criminal defense led me to conclude that "locks only keep honest people out.")  Another area they might focus on more is in the area of enrollment and controlling who gets into the system.  OIG mentioned this twice in testimony to Congress this year.  Although as with every other anti-fraud system, criminals can manipulate this one as well.  (Although as you make it harder and harder on the criminals, Medicare stops being "easy money.")

It is not clear how effective this will be, as one of the main topics of the Fraud Summit was the amount of fraud that is still being perpetrated on the Medicare/Medicaid system, even after the government's recent efforts to crack down on fraud. One speaker commented that the recent successes is simply the "low hanging fruit".  He was implying that there is much more fraud to be identified and stopped. Another issue that raises questions about the effectiveness of the programs is the statistic mentioned in the USA Today article - for all the additional fraud enforcement efforts, prosecutions are only up 2%.   

Regardless of whey prosecutions are only up 2% over last year, the real point from all of these articles is that HHS and the DOJ are continuing to ramp up their MEdicare fraud enforcement efforts.  This should serve as a warning to everyone in the home health and hospice industries.  The HHS/DOJ strikeforces and HHS in general are already focused on you.  They are now adding to the resources at their disposal to investigate and prosecute Medicare fraud.  

This means you should be focusing even more on your compliance efforts.  Given the ever increasing focus on reviewing claims data, a good place to start is auditing and monitoring your claims.  Are there any reasons your claims might stand out?  Do you have a large number of outliers?  Does your documentation support your billing practices?  These are the kinds of questions you should be asking yourself, especially now that you know what they will be looking at.  If you have not looked at your compliance plan in a while (or longer) now is an excellent time to start.  Fraud and Abuse enforcement is only going to become more aggressive in the future.  The time to prepare is now.

HIPAA Security Breach Rule Deadline Just Around the Corner

With everything else that has been going on - the holidays, health care reform, etc. - you may have forgotten that the HIPAA Security Breach Notification Rule deadline is February 22, 2010.  With less than a month before the deadline, many providers may not have started their compliance efforts yet.  If you don't recall what the Security Breach Notification Rule says or requires, you can take a look here and here.   

If you haven't started working on this yet, you still have close to a month, so don't panic.  You should begin looking at this issue and putting together a timeline for compliance by February 22.  You may have already addressed breach notification, due to state law requirements.  If so, you can start by reviewing what notification policies and procedures you have in place and comparing them to the notification rules requirements.  

If you do not have any notification procedures in place, I would recommend reconsidering the reasonableness of encryption as your first step.  As part of your original Security Rule compliance efforts you should have assessed the reasonableness of encryption.  At that time, you may have determined it was not reasonable to implement.  If you go back and revisit this consideration, the advances in technology, combined with the incentive of avoiding the notification issues, may change your assessment.

If you implement encryption, you eliminate the notification provisions, because you do not have any unsecured protected health information. Don't forget that the encryption guidance from HHS includes guidance on destroying PHI.  If you are not properly destroying old files, you still have a source of unsecured PHI and would still need notification procedures.

If you do not implement encryption, you need to implement notification policies and procedures.  There are a few things you should consider when implementing notification.  For example, you are required to provide a way for the individuals who are affected to contact you for more information.  Who will be responding to these calls.  You need to be sure that whoever is fielding contacts about the breach is comfortable dealing with the public (and potentially the press), understands what they can and cannot say and will stick to that.  You do not want your point of contact to create any more problems for you by giving bad answers.

Another thing to consider now - if you use the toll-free number contact option, how do you want to set up the call-in number?  If you already have a toll-free number, you may not want to just use it as the contact number in the event of a reportable incident.  Depending upon the number of individuals involved, this may make it difficult to take normal business calls and may result in someone fielding questions that you would rather not have fielding questions.

You will want to be sure to get everybody who would be involved in detecting and reporting a breach involved in training.  Everyone should know that on February 22, you have new policies and procedures going into effect and what this means.  There is no point to having these new policies and procedures if no one is aware of them or understands them.

Remember - even if you have not started working on this yet, there is still time.   You just need to be sure that you use this last month wisely - develop a plan, set deadlines and stick to them.  This is not at all like implementing HIPAA compliance from scratch, so try not to let this ruin your weekend - just don't forget about it come Monday.    (Another resource you might consider is this template my partner put together.  I apologize for the shameless plug, but if you haven't started yet, you could probably use the assistance.)

The RACs are coming

Well, it has taken some time, but the Recovery Audit Contractors have finally started posting issues that relate to home health and hospice. 

Health Data Insights, the Region D Recovery Audit Contractor (Region D covers: "Alaska, Arizona, California, Hawaii, Iowa, Idaho, Kansas, Missouri, Montana, North Dakota, Nebraska, Nevada, Oregon, South Dakota, Utah, Washington, Wyoming, Guam, American Samoa, and Northern Marianas).  Has posted three issues related to hospice and home health.  One issue (Hospice Related services) was approved last September, the other two issue have been approved since December 22, 2009.  They all apply to claims billed after October 1, 2009

HDI has added two hospice related issues:  DME while in hospice and Hospice Related Services - B.  For both of these, Health Data Insights  explains that:"Services related to a Hospice terminal diagnosis provided during a Hospice period are included in the Hospice payment and are not paid separately."  The RAC will be looking at claims for DME and "Related Services" paid for separately by Medicare during a hospice admission.  Obviously, if it is equipment and services related to the terminal illness and was paid for outside of the hospice reimbursement, Medicare should not have paid for it again.

This audit will likely be triggered by an automated review.  They can churn through the numbers and identify claims submitted by non-hospice providers during a hospice episode. Whether or not a repayment is owed depends upon whether the claim is for DME or services related to the terminal illness.  The RAC cannot determine that simply by an automated review.   I say this, because, as anyone who has dealt with a hospice patient in a nursing home realizes, the question of what is and is not related to a terminal illness can often be disputed.  It requires looking at the documentation for the additional services and comparing to the terminally ill patient's diagnosis and needs.  Of course, if the hospice and the DME or other service provider both list the same illness, the issue becomes much simpler.

Health Data Insights has also added issues related to home health.  This issue is titled "Medical Supplies and Consolidated Billing".  Like the Hospice issue, this is an effort to identify services or supplies covered by the PPS episodic payment that were paid for separately.  For example, a patient receives physical therapy during a home health episode from a provider other than the home health provider - that is covered under the episodic payment and should not be billed separately.  This is another issue where the RAC can churn through the numbers and identify overlapping claims.  This is one that is actually easier for the RAC, because certain supplies and services are covered by the episodic payment, without much room to quibble.  (It's not like hospice where hospice patients can have other medical issues.)

Home health and hospice providers should be looking at their claims and trying to identify situations where other providers claims overlap for services that are covered under the payment they receive.  The RAC may pursue the entity that provided the additional service (which seems like the correct response to me), but they may come after the HHA or Hospice.  The best course of conduct is to attempt to avoid these overlapping claims.

Now that one RAC has identified home health and hospice issue, the others won't be too far behind.  You may expect to start seeing letters form the RAC (in region D at least for now).  When you receive a request for information, be sure to respond promptly.  One of my favorite statistics from the RAC demonstration was the percentage of claims recouped simply because the provider failed to provide documentation.  You should never have to pay back money because you just did not respond in time.  The government already pays you too little and routinely asks for more back - don't help them out by not being ready for the RACs.