#143 Avoiding Health Care Fraud: Compliance Guidance from the DHHS Inspector General

The Office of Inspector General (OIG) recently issued an updated General Compliance Program Guidance.  This is an important area of compliance that all dental offices need to be aware of.  It includes fraud, waste and abuse as well as HIPAA. Tune into this episode to ensure your practice is up-to-date. 

• OIG General Compliance Program Guidance: https://oig.hhs.gov/documents/compliance-guidance/1135/HHS-OIG-GCPG-2023.pdf
• Free HIPAA Assessment Tool: https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool

                                                 https://www.thecompliancedivas.com

Transcript

Copy Transcript Copied

SPEAKER_00 0:04

Welcome. I'm Leslie Cannon. I'm Mary Gavoni.

SPEAKER_02 0:09

I'm Linda Harvey. I'm Olivia Juan and together we are the Compliance Divas. Welcome to the Compliance Divas podcast. My name is Olivia Wan and I'll serve as your moderator today. In this episode, we are discussing some new information that we thought our audiences would like to be aware of. The U.S. Department of Health and Human Services Office of Inspector General published the General Compliance Program Guidance November 2023. And so in this episode, we will take a brief review of some key issues that you may want some information on. As the Compliance Divas, we bring clarity and simplicity to compliance by navigating regulatory compliance to keep you on course. Please subscribe to the Compliance Divas podcast through your favorite podcast channel or on our website, thecompliancedivas.com. Any resources we mention during this episode can be found on our website. You may also submit your questions to support at thecompliancedivas.com. We also appreciate your reviews. So in looking at this document, it is 91 pages long. And anytime we get updates from the Department of Health and Human Services, it's a great idea to stay up to date and current. In reviewing this document, one of the things that stood out to me is that the Office of Inspector General will no longer publish updated or new compliance program guidance updates in the Federal Register. All current updated and new compliance program guidance will be available on their website with interactive links to resources. Matter of fact, starting in 2024, they will publish industry segment specific compliance program guidance. So I'm anxious to see what they will publish specifically to dentistry. Now our fellow Diva, Mary Gavoni, is not here with us today. However, she wanted to point out some examples of information that was highlighted in the document. And this has to do with the section on healthcare fraud, enforcement, and other standards. Mary noted that they provided information on the federal anti-kickback statute, which has to do with offering or receiving gifts to reward past or future referrals when you're participating in the Medicare Medicaid programs. Also, information was pointed out that may be of more interest to the medical world of physician self-referral law, as well as the False Claims Act, which is a way for the government to recover money when an individual or an entity knowingly submits or causes to be submitted false or fraudulent claims for payment to the government. And then there's a review of civil monetary penalty authorities. And then it goes into information blocking. So we've asked our diva leslie to go over the information blocking, and then we'll interview Linda about the HIPAA privacy and security rules. So, Leslie, what can you share with us from this document that relates to the information blocking?

SPEAKER_00 4:13

Well, Olivia, information blocking would be like information that you need for your medical records or your dental records where you can't see it. In other words, you uh log in maybe to your patient portal, and instead of seeing an image, you might see a bunch of numbers or zeros or X's or binary type of code as opposed to information that you can understand. And so uh the uh inspector, Office of Inspector General takes this very seriously under what they call the 21st Century Cures Act, the Office of the Inspector General has the authority to investigate claims that either health information technology developers of certified health information technology information exchanges and networks and healthcare providers have engaged in constituting what's called information blocking. A health IT developer of a certified health IT and health information exchange and networks would commit what's called information blocking when they engage in a practice that is likely to interfere with, prevent or materially materially discourage the access exchange or use of electronic health information. And they know or should have known the practice is likely to interfere with, prevent or materially discourage the access exchange or use of electronic health information. Now, a healthcare provider commits information blocking when the provider engages in a practice that's likely to interfere with, prevent or materially discourage the access exchange or use of electronic health information. And the provider knows the practice is unreasonable and is likely to interfere with, prevent, or materially discourage the access exchange or use of electronic health information. So this information uh blocking does not include any practice that's required by law or that meets the exception. And the Office of the National Coordinator for Health Information Technology, also known as ONC, has promulgated regulations setting forth important definitions and exceptions, and has also issued several guidance documents. Now it's important to understand that ONC's regulations define the conduct that constitute information blocking. And there's penalties, Olivia, for engaging in information blocking, which could fall back on the provider, the healthcare provider, or the dentist, depending on the type of individual or entity. So a health IT developer, certified health IT, health information exchange or network that engages in information blocking may be subject to civil money penalties or monetary penalties of up to $1 million per violation. And the Office of the Inspector General has issued a final rule on investigations of and the uh imposition of uh civil monetary penalties on healthcare developers certified health IT, which includes entities that offer health IT, health information exchanges, and health information networks. So a healthcare provider like a dentist may be subject to what they call appropriate disincentives as set forth by HHS in future rulemaking. And individuals and entities that meet the definition of healthcare provider, like dentist under ONC's regulations, should be mindful that they may be subject to civil monetary penalties if they meet the definition of health IT developer of certified health IT or health information exchanges and networks under ONC's regulation. So I too will be very interested in seeing what they have in mind and in store for dental specific settings and providers.

SPEAKER_02 8:16

Thank you, Leslie, for covering that. That's it's really complex and it's it's difficult. The only thing I can relate to is the fact that I really do like the portals as a patient. Uh when I'm when I go to the hospital for a procedure or some kind of screening or my medical doctor, I like using those portals where I can access those results, the information, the doctor's notes. And we know that's coming in the future for dentistry. So most of the clinical information in the medical world is already digitized. It should be accessible and shareable, and that's made possible through the technology, uh, allowing that information to be exchanged. And as you mentioned, Leslie, this is all part of the 21st Century Cures Act that made sharing the electronic health information the expected norm. So, in other words, it's not just some fancy hospital or fancy clinic. It is now the standard that a patient should be able to access their information. And when it comes to blocking, as you so beautifully pointed out, Leslie, uh, it's against the law to knowingly block that information where the patient could not access, exchange, or use that medical information. And for healthcare providers, the law applies the standard of whether they know the practice is unreasonable and is likely to interfere with the access exchange or use of that information. So likely they're depending on their IT providers. And if those platforms are unreasonable and block that information, as you pointed out, a million dollars per violation, it's unbelievable. So I want to look at now this guidance from the perspective of HIPAA privacy and security. And we've asked Linda to interpret those paragraphs for us. Linda, what can you share with our audience?

SPEAKER_01 10:19

Olivia, first I'd like to say kudos for developing this topic for our audience because when you look at the general compliance program, I think all dental practices realize they have to be in OSHA HIPAA compliance. And, you know, OSHA, we've been, you know, more than more decades than we have with HIPAA. But I think many offices still struggle with some aspects of HIPAA compliance, whether it's the security rule andor the privacy rule. So it's important to realize some distinctions here. And what when HHS published this document, I want everyone to kind of be aware of that OSHA is not included with this document because OSHA is a separate federal agency and it doesn't come under the umbrella of HHS. Well, many other agencies do, such as the Office of Inspector General that you mentioned, Olivia, and Leslie, when you mentioned ONC, the Office of National Coordinator for Health Information Technology. So when we talk about this today, that's why we're not speaking about OSHA. OSHA complies didn't go away, right? I just I want to just kind of draw some attention to that, maybe a little levity, like, okay, if anybody's confused. So that being said, the Office of Inspector, uh, pardon me, the Office of Civil Rights, who is the HIPAA enforcement agency, and the Office of the National Coordinator, ONC for Health Information Technology, came together and created this HIPAA security risk assessment tool. And this tool is very important because everyone is aware that they should be conducting an annual security risk assessment under the pro the security rule requirements. And as such, it's now something that your IT partner should be doing for you. They may be providing a free assessment tool with a checklist, or they may come and say, should we check your technology annually to make sure everything's, uh you don't need new hardware? We're constantly checking the software for updates. And they're doing all kinds of things in the background, but none of that constitutes a true security risk analysis. And Olivia, I love something that you shared with us. I think it was in a conversation, not in a podcast, when the um Office of Civil Rights did a webinar recently on what constitutes a security risk analysis. And I think you shared that one example the presenter gave was that someone had submitted a four-page security risk assessment, and that counted maybe the table of contents and the and the cover page. So I'm kind of tongue in cheek because you and I are used to doing those, and we know that's a lot more involved than that. So, what I'm going to share with our listeners now is that there is a free security risk assessment tool that's available on the ONC website, and we'll make that tool available to you in our resources. But it does take time to go through it and to use it. It's not something you can sit down and figure out in 10 or 15 minutes because it's a very specific process. Because when you think about this general guidance from this compliance program, it's very important that your privacy and your security procedures be tailored to fit the entity's size and needs. And that's the wording that's used on this document. So, to draw a brief comparison, when you think about a solo practitioner that maybe has 10 or less employees, or maybe 15 or less employees, versus multiple practices or even different size DSOs. So there's different size policies and procedures and proceeds and protocols when it comes to privacy and security in your practice that has to fit your size and needs. So that's why when you purchase an off-the-shelf book, a manual, or some compliance guide like that from a, you know, and you haven't read it, have it customized it, how do you know it fits your needs? And this is a really important piece to kind of keep in mind with. So another thing that I want to share with everybody, Elizabeth, is that with the increasing number of cybersecurity attacks aimed at all these HIPAA-regulated entities, and by that I mean healthcare facilities, hospitals, insurance companies, university centers, dental practices, imaging centers, um, all this, well, let's look at Henry Schein. Even they're related in healthcare, but they're not, you know, they're not providers. So compliance with the privacy, the security rule, and the breach notification rule requirements has to be a top priority in all of your risk assessments. So please stay current with that. We will put this link into the show notes for you. So if you want to use this, um, then this would be a great resource for you to conduct your own security risk analysis. So, Olivia, thank you for bringing this topic up today.

SPEAKER_02 14:36

Well, that you did a great job summarizing that. And I think one of the key points you made, Linda, is that the policies and procedures should be tailored to fit the size of the practice. Uh, that really says it all, Linda, in evaluating this compliance program. Another thing we wanted to point out with this compliance guidance is that the government listed some program infrastructure which includes seven elements of a successful compliance program. And that would include the written policies and procedures, compliance leadership and oversight, training and education, effective lines of communication with the compliance officer and disclosure program, enforcing standards, consequences, and incentives, risk assessment, auditing and monitoring, and responding to detected offenses and developing corrective action initiatives. So I think that this is a good way to review the elements, the way it's listed in the document to see if our own compliance program matches up and make sure that it aligns with the most current information that is available. And as far as these policies are concerned, all relevant individuals should be able to easily access their practices, policies, and procedures. They should know where they are located, whether they are paper documents or digital documents, and know uh when they can review them and provide uh input as well. And keeping them up to date is one issue. They should be reviewed and revised. We never get finished with our policies and procedures. They are much like living documents that continue to change and be updated as new information is available, and that's actually a very critical element of our compliance program. Leadership is, of course, important in large organizations. There's multiple layers of leadership that those would answer to, but even the compliance officer is actually in a leadership position because they are leading the entity's compliance program. Training and education is also a vital component of effective compliance program, and the training topic should be delivered to the target audience. So we have to think about you know, the size of our practice, the needs, the individual needs based on our assessment, and provide training that is effective. Additionally, we want to have the compliance team agenda prepared so that the meetings are productive and that it's a good way to share information. And I like how the program update provided information that it really should underscore your practice's commitment to compliance. So we should not take the attitude that this is such a burden, it's more red tape, it's more time that's spent, but it's really a commitment to compliance and developing that culture of compliance, and that involves frequent communication with the compliance officer, with the practice and other layers of uh management. And also, it mentioned about enforcing standards. Really, what good is having some rules and policies if people just can break them day to day? So I think this is a critical point that in order for a compliance program to be effective, then the practice should establish appropriate consequences when there is non-compliance. So not only discipline for non-compliance, but what about, and I'd never thought about this, Linda and Leslie, what about having incentives for those that are in compliance? You know, what are what are the rewards? Maybe there, you know, like there's near misses in infection control. What about there's near misses with the protection of data and someone prevented that from happening? You know, what kind of incentives are there for them? So think about that when you're coming up with sanctions, not only discipline, but also having incentives and then keeping people trained that there are consequences in enforcing compliance. And then the risk assessments, as you pointed out, uh, we've got the free one that's available. I think you made a good point, Linda, making sure they allocate enough time because it is pretty uh detailed and thorough. And I believe our diva leslie wanted to share something with our audience.

SPEAKER_00 19:48

Olivia, first when I first looked at this document and it's 91 pages, I thought it was quite overwhelming. But as we went through this podcast, I realized that much of it is a good framework for setting up uh your systems and your office, your training, and some giving some great ideas. And I just have a comment about for my own health care, I'm thrilled with that I can get information at my fingertips. I forget many times what my healthcare provider tells me. I can look up my test results, I can see how I'm doing with my various cholesterol levels and things like that. And and I'm I'm angry when I can't access that information where I either don't have the know how or or whether the systems give me grief. And so um I would uh encourage everyone to let uh think about this. Your patients are coming into a new uh realm of being able to access their information. And it's just like a cell phone. You carry your cell phone with you and everything is easy. It's not like you have to stop and use a payphone anymore, and your phone numbers are easy to find and your links are easy to click on your cell phone. But when that becomes um confounded by some kind of a glitch, you get really angry. And as I think, Olivia, you had said to me earlier before we began this podcast, that that uh this would be a patient complaint driven type of issue if a dental practice actually had to deal with having to uncover what is considered information blocking and and and get to the bottom of it. So I'm I I have a uh you know, I'm excited about having this finger, this information at my fingertips. I'm disappointed when I can't get to it. So I think our patients would be too. And just a little rant here to add to it. I took my husband for a visit to an oral surgeon that we hadn't been to before in their very high tech office, and they had all of the forms online. So I filled out everything from his health history to the medications he was taking, everything, insurance, the works. And I thought to myself, you know, this is a 20 minute job. And then I thought, you know what? I used to do that 20 minute job when a new patient would come into a dental office. I would sit there as the dental receptionist and key in all this information. Well, now our patients are keying it in for themselves so that it makes it easier for us. We are saving a lot of time in dentistry. And I wouldn't be worried about having to go through and look at a 91-page document and try to fit it into a program that we can implement in our practice because we are saving time in the long run with having our electronic records. So there it is a rant and appraise at the same time.

SPEAKER_02 22:29

Great feedback, Leslie. Linda, what can you add?

SPEAKER_01 22:33

Leslie, I love both of those as well, rant and appraise. That's good because we can all do that. We've had good experiences with the online portals as well, from my perspective. But Olivia, I want to circle back to a comment that you made about effective programs. You were sharing something that was in the document from the general compliance program about being effective. And from what I'm reading lately, is that's how the Office of Inspector General and the Department of Justice, DOJ, gets involved in these federal complaints and investigations as well, or looking for evidence that it's an effective program. So when you mentioned like education and training and communication, those are all parts of that effective compliance program. It's not a matter of developing some compliance plans, having them in place, they're sitting on a shelf, you've never looked at them, nobody knows how to access them. So all the things that you mentioned, Olivia, you have to be living, breathing documents. And I thought that was a great analogy. I would also like to mention to our listeners that if you are accepting any kind of federal reimbursement from any insurance companies, you are obligated by law, federal law, to have a corporate compliance plan. So today's podcast really provides some good insights for you on what all needs to be included in it and just the urgency of keeping it up. But anybody, even though you may think you're not accepting federal dollars, because sometimes they're routed through a private payer and you say, oh, I'm getting my payments from Blue Cross and Blue Shield or Aetna or whoever, it doesn't matter if that if that patient has any tie to the federal government as a veteran, a retiree, a post worker, you know, any of those types of folks, um, military, then you're accepting federal money into your practice. And I know right now that the Medicare Advantage plans are becoming very popular. Um, I want to share with the divas that in our neighborhood, there's a lot of new development going on. So we're getting new flyers from dental practices all the time. And one that came into our mailbox recently, bold print said we accept Medicare Advantage because they're looking to recruit the baby boomer patients with these Medicare programs. So please, everybody that's listening, be be very mindful of that. And I know that for our clinical teams that are that are listening to our podcast, I hope we didn't make your eyes roll back today. But this is an important feature because everybody in the practice has plays a role in compliance and being that strong human firewall. So thanks again, Olivia, for bringing this topic up today.

SPEAKER_02 24:55

Yeah, you made some great points, Linda. I mean, if you for sure, if you take federal money, then you have to play by the federal government's rules. It's as simple as that. And then as it relates to that information blocking, you know, I get complaints at my office regularly about violation of the right to access, which is a HIPAA rule, the right to access their record, where they've requested of a dental office, the patient's records, and only part of the record was supplied and not the complete record that they've requested. So the information blocking as that digitize aspect where maybe the information is there, but it's not accessible, it's not in a readable format. So a lot of a lot of interesting discussions with the compliance divas on this general compliance program guidance. So I hope that our listeners will go to the link that we've provided on the Office of Inspector General Department of Health and Human Services website and download the guidance, take a look at it, and also the risk assessment tool. If you're looking for a freebie that you can go through on your own, it is available there. And that's really our goal. The compliance divas are bringing clarity and simplicity to compliance by navigating regulatory compliance to keep you on course. Please submit your questions to support at the compliancedevas.com and please access the resources that we've provided for you in the show notes. Thank you for tuning in and don't forget to leave a review.