16
Dec
Payment Denial Prevention: What Is Software’s Responsibility?

 

stored in: Tim Rowan's Home Care Technology Report and tagged: , , , , , , , , , , , , ,

By Tim Rowan

“We have clinicians complaining that we have them document too much, as if that was a bad thing. Ah, but they are all so happy that they have the documentation when CMS tries to get its money back.”

This front-line analysis by a healthcare at home nurse supervisor summarizes one of the most vexing problems facing the 12,000 plus Medicare certified healthcare at home providers here in the middle of the healthcare reform movement. In response to a shrinking Medicare Trust Fund, the fraud, waste and abuse (FWA) eradication efforts built into the Affordable Care Act, and an exploding elderly population, the Center for Medicare and Medicaid Services has instructed its contractors to put a tourniquet on the fiscal bleeding.

Like literal tourniquets, however, sometimes they save a life at the cost of a limb.

These CMS agents — Medicare Administrative Contractors, Qualified Independent Contractors, Zone Program Integrity Contractors, and Recovery Audit Contractors — either receive and pay claims from Medicare and Medicaid participating clinical providers or review those claims for FWA after they have been paid. They have been commissioned to look for indications that a provider might be intentionally defrauding the government payer. They are also empowered to deny or recoup payments from non-criminal operators who inadvertently waste government money by providing medically unnecessary care. (See the pertinent paragraphs from the 2015 fiscal report, elsewhere in this week’s issue.) [Rowan provides more information about healthcare at home agencies’ claims denials by Medicare, with faulty documentation appearing to be a culprit in this important matter.  The second half of this article pinpoints software companies’ managers’ views on helping to identify and correct documentation problems.]

 

In addition to these two payment denial reasons, contractors have discovered that CMS will back them up if they deny or recoup payments for care that was, in fact, medically necessary and in all other ways legitimate but was not correctly documented as such. Though CMS will not answer any reporter’s question on the subject, speculation abounds that there are quotas imposed on contractors to reach minimum denial percentages, as well as about the existence of per-denial financial rewards, which the contractor may pass along as an incentive to employees.

A recent HHS report revealed the outcome of these incentives. The gross improper payment estimate for FY 2015 is 12.09 percent of claims. In home health, 2015 is projected to see 58.95 percent of payments declared improper, up from 51.38 percent in 2014. The report cites “documentation requirements to support medical necessity of services” as the reason that home health is an extreme outlier.

Nurse’s Documentation? Or Doctor’s?

“It may be almost 60%, but that is 90% because of Face-to-Face denials!” we were reminded by Denise Shaffer, RN, Sandata’s clinical product design specialist.

Ms. Shaffer is a brilliant, common-sense nurse with years of front-line experience as a field nurse and, later, supervisor. She successfully guided Sandata’s ICD-10 compliance project, where teaching clinical principals to software developers apparently taught her to make her points with strength and clarity, as she did with us.

“Look, nurses want to provide the best care; they want to produce the best possible documentation,” she told us. “But it can be so frustrating when they do everything right and then the MAC says, ‘Nope, the doctor didn’t say all the right words on the F2F form so the whole episode is denied.’ Palmetto took the most advantage of this loophole but they all did it until CMS changed the rule.”

She is certain home care’s nearly 60% improper payment rate is a temporary anomaly that will revert to a number closer to the gross healthcare average as soon as common sense returns to the F2F document rule.

Making an auditor’s nefarious task easier is the direct cause and effect line that can be drawn from decreased payment rates, through owner/administrator pressure to slash costs, and ending on demands administrators place on staff to increase productivity. Urged to complete more visits per week, clinicians have no choice but to take documentation shortcuts, which lead to accusations of fraud, waste and abuse…and payment denials. This chain of events strikes one as a classic Catch-22. CMS initiates the problem, then punishes care providers for reacting in the only way that could have been expected.

Technology’s role unclear
Obviously, the tools clinicians use to document assessments, care plans, and visit notes are in a position to mitigate the problem by erecting virtual guardrails to keep clinicians from taking risky shortcuts. Less obvious is whether software should be performing this service, or even whether it is somehow ethically obliged to do so.

To sort out the ethical question, we asked several healthcare at home software company executives and product designers to help us understand software’s proper role in helping, or forcing, clinicians to create audit-proof documentation. We were surprised that what we uncovered was an absence of consensus on the question. Hence, what follows better resembles the beginnings of a lengthy, complex conversation than it does an exposition of concrete solutions and guidelines. (As always, readers are invited to join the conversation by writing editor@homecaretechreport.com)

Where it began…
Before getting into the opposing viewpoints, though, we begin with a complete description of the problem. The best one came to us from HEALTHCAREfirst CEO Bobby Robertson, who said his company has spent many years and millions of dollars trying to understand and solve this problem. He has come to this conclusion:

“Medicare payment cuts are the main culprit. Home Health payment rates have been reduced almost 10% from 2012-2016. Over the same period, the cost to run a home health agency has gone up substantially. The task of compliance alone is a significant expense to an agency (nurse competency testing, training, quality assurance on documentation, ICD-10, etc.), but nurses are more expensive too. Many hospitals are currently turning away patients, not because they don’t have available beds, but because they don’t have enough nurses. They’ve resorted to paying significant sign-on bonuses, increasing salaries and more, all of which puts an additional burden on home health agencies to attract and keep nurses. This additional cost is not optional, and unfortunately comes at a time when their payments are continually being reduced. Certain approaches we software vendors take can fuel the fire or help to solve the problem, but ultimately it’s all about the nurses.

So, how does an agency deal with this dilemma? They can do like Amedisys is doing, sell their lavish office buildings and cut layers of management, but most typical community based home health agencies (80% of HHAs) did this many years ago. They can reduce their visits per patient to cut costs, but again, most have already done this too. This leaves them no choice but to demand more visits per day from the nurses they do have, and this is what creates the documentation nightmare, which results from nurses not having the time to thoroughly review the care plan, planned interventions, and stated goals, etc. at each visit. Many simply do the visit and deal with what is in front of them at the moment. This is a recipe for insufficient documentation and, ultimately, improper payments that are later taken back.”

Several executives agree with Robertson that software can fuel or extinguish the fire. Homecare Homebase COO Tom Maxwell told us that EMR software “goes a long way toward helping or hindering clinicians’ ability to capture accurate, consistent, compliant data – what we refer to as their ability to provide ‘defensible documentation.’ The primary cause of improper payments is lack of documentation to support justification for services or supplies billed and insufficient documentation to determine errors. It includes improper documentation of medical necessity and other errors made by improper coding.”

Helping may not be as easy as it sounds, Maxwell added:

“Home health caregivers are given a harder hill to climb because of the volume of data that must be documented, reviewed and approved at each step of a patient’s care to ensure they are being serviced properly, in the right setting, and within the guidelines of what is medically necessary to achieve their end goal. ‘Defensible documentation,’ simply defined, is a visit note that accurately, consistently and thoroughly documents the status of the patient, their condition, the nature of their service needs and the care plan to support those needs and achieve their ultimate goals. In the process of visiting patients in the home, caregivers collect copious amounts of information and use it to form a care plan that supports the patient’s diagnosis and their physician’s requirements. Caregivers must also be vigilant to ensure that every visit note is in sync with that care plan and directive. Should a patient’s condition change, caregivers must adjust accordingly and seek proper approval.”

So what is software’s proper role?
Here is where opinions begin to diverge. Maxwell answers this question with a software feature list, explaining, “The software used by the agency absolutely makes a difference in the agency’s ability to properly adhere to these guidelines and produce the correct documentation to satisfy CMS requirements. This necessarily requires the software to be somewhat specific and prescriptive in the type of information it requires from the caregiver and must include proper checks and balances along the way to insure oversight into the care of the patient. (See the article elsewhere in this week’s issue for the combined feature list compiled from the generous input we received from Allscripts, Homecare Homebase, HEALTHCAREfirst, Kinnser, and Thornberry.)

“Not so fast,” cautioned David Cole, speaking for himself, he made clear, out of his 30 years of experience in home healthcare as both agency owner and technology vendor, not out of his current role as VP of Sales for HHA Exchange. “It is not the software that has a nursing license or that signs its name on 485s and visit notes. It is not the software that writes, ‘Caregiver instructed in medication management’ or ‘Continue with POC’ or any other inadequate visit note that fails to show payers that the visit was medically necessary. The nurse, the nurse, the nurse is the licensed clinician responsible for knowing the Home Health Conditions of Participation, for assessing the patient, and for submitting professional-level documentation. Whether the nurse is using software that helps or hinders is irrelevant; he or she is still responsible. At the end of the day, you cannot blame the software if a claim is denied because a visit was actually not medically justifiable, or because sloppy documentation made it look as though it wasn’t.”

Is there a middle ground?
Kinnser Software founder and CEO Chris Hester falls squarely between Maxwell and Cole. “We listen closely to what our clients tell us they need,” he explained. “That way, we stay out of the fray. They tell us they want a patient’s schedule to be automatically updated for all caregivers if one nurse on the case submits a transfer OASIS and puts a patient in the hospital, so that no one goes out to the home unnecessarily. But at the same time they say, ‘I don’t want my software to tell my clinician what to do.’

“And I agree with them. Software cannot determine, ‘this patient is fine, discharge him.’ It cannot possibly know all the reasons why this patient should or should not be readmitted to another home health episode. Maybe there are still goals to be met. The only way software should help is to predict consequences based on history. For example, it could legitimately say, ‘This exact kind of episode has been denied 500 times by a RAC.’ and then allow the clinician to decide.”

Hester realizes that, regardless of the structure you build into your software around medical necessity, if the agency wants to admit that patient, they are going to find a way to do it. Plus, if you build safeguards into the EMR around documentation accuracy and completeness, he believes, it could potentially inhibit the good actors. “If we built in some kind of ‘insurance policy’ to stop those who want to operate 3 to 5 deviations from the mean, we would too often inhibit those who are only 1 or 2 deviations off.” Hester prefers to provide information that educates, not to handcuff clinicians.

Some say software should be helpful
Marie Finnegan is the Director of Solution Management for Allscripts’ Home Care division. Her comments fall squarely on the side of software vendors accepting their responsibility to put up the guardrails that force clinicians to produce audit-proof documentation.

“First and foremost,” she asserts, “a software solution should ensure data completeness. When a clinician completes an OASIS or HIS (Hospice Information System), the agency should have confidence that all of the required elements have been documented. The solution should provide reference material or guidance on a question or response, should the clinician need clarification while out in the field. It should help clinicians with documentation consistency. If they chart that a patient is alert and oriented, it should prevent them from documenting that the patient is in a coma.

“Software solutions should also drive the type and timing of documentation required. The solution should alert clinicians to what is due and when, so the clinician doesn’t have to remember the rules. The solution should, of course, follow regulatory requirements and, where possible, hide the complexities of the requirements by aligning with the clinicians’ natural workflows as much as possible. For example, if a clinician enters ‘wound care’ into my EHR, it should automatically produce an order.”

Acknowledging that software should also be flexible enough to enable agencies to address their unique programs or initiatives, the Allscripts executive circled back to what many consider to be the core problem. “Lastly, and most importantly, the solution should be easy to use. The most accurate documentation results when charting happens at the point of care. In short, a Home Health or Hospice EHR needs to be easy to use, provide guidance, and enable clinical judgment, so clinicians can focus on caring for their patients.”

Without a doubt, clinician errors that stem from pressure to increase productivity is an issue every supervisor, administrator, and agency owner must address. Nevertheless, human memory is the primary cause of inaccuracy. Notes completed in the patient’s home are always more complete and more accurate than notes completed at the end of the day or, heaven forbid, at the end of the week. If the software clinicians have been given is not, in Marie Finnegan’s words, easy to use, whether it also provides guidance and enables clinical judgment or not, it pushes nurses and therapists to complete their notes after rather than during the visit, which leads directly to payment denials.

More than one way to be helpful
Putting up guardrails that guide a clinician toward best practices may be one way to improve documentation and reduce improper payment accusations but Delta’s Bill Bassett insists that Ms. Finnegan’s final statement is the best way to go. “Maybe we shouldn’t be putting up barriers that force compliance; maybe we should be removing barriers that interfere with a nurse’s natural inclination to be compliant,” he said in an interview. “At Delta, we don’t fuss over laptop vs. iPad or how to get a nurse to document correctly. Nurses will document correctly if you let them. We focus on making our clinical EMR so easy to use that it is more likely that documentation will be completed in the patient’s home.”

He told us stories of nurses who complained about having no home life, working on patient charts until after midnight every night, who switched software and began to get 80% to 90% of their documentation done in the home. “This is how you increase accuracy,” Bassett asserts, “by avoiding the consequences of naturally occurring memory failure caused when charting happens 12 hours after a visit. You don’t so much build barriers to prevent errors as you take down barriers that prevent productivity. You can still offer accuracy and compliance reminders and safeguards, but you don’t have to build them in such a way that they make documentation a burden.”

Compliance vs. popularity
What each of these executives and product managers struggle with is the age-old conflict between what is good and what is popular. Cola outsells juice; sugared corn flakes outsell oatmeal; and less-demanding software outsells software that encourages in-home charting and supports accuracy. To remain in business, software vendors need to make sales, so they have an incentive to give clinicians what they want, which is often less-demanding software that permits behavior that puts the agency at higher risk for payment denials, ADRs, improper payment takebacks, lengthy appeals processes, and crippling financial disorder.

In an example we have used before, if your software sales person demonstrates a feature that makes it easy for clinicians to copy text from one visit verbatim into the next visit, turn and run. Clinicians may love the convenience but ZPIC auditors are trained to look for this exact red flag. When they find it, they assume you are doing many other things wrong and they select your agency as their next pet project.

The healthcare at home agency owner has a hard decision to make when considering a new EMR: invite the ire of nurses or of auditors, risk losing clinicians or risk lowering defenses just as Medicare contractors are revitalizing their offenses for a renewed attack. Just as the software vendor has an incentive to be popular, so does the agency owner.

Black, white, or gray?
The opinion David Cole presented, which, it must be stated, is not his alone but widespread, is correct. In the end, the nurse puts her license on the line with every document she signs, no matter what tools her employer puts in her hands. At the same time, Bobby Robertson’s analysis cannot be ignored. The employer who wants to put a strict software tool at the nurse’s disposal is the same employer who wants her to complete 30 visits in a week. The employer who wants to cut costs by selecting low-end software is the same employer who expects nurses not to invite the attention of auditors.

It gets worse, so much worse that we have to tell this final chapter without naming names.

We have also been made aware that one popular software vendor, with a product that is known to be extremely lax in supporting documentation compliance, has made a corporate decision to win market share at all costs. In the course of one of our interviews, we were asked this rhetorical question, “How do you compete with this? A home health administrator tells me, ‘I like your product much better than these other guys, but they offered me a three-year contract with an opt-out after 12 months and the first 12 months are free!’ I told him he was inviting ADR problems but he said, ‘How can I turn down free?'” This interviewee’s answer? “Ask your sales person to give you the names of ten or twenty customers who exercised their option to cancel after the first twelve months. They will tell you how you turn down free.”

There has to be an answer somewhere in the middle. We will keep looking for it.

©2015 by Rowan Consulting Associates, Inc., Colorado Springs, CO. All rights reserved. This article originally appeared in Tim Rowan’s Home Care Technology Report. homecaretechreport.com One copy may be printed for personal use; further reproduction by permission only. editor@homecaretechreport.com

(more…)

Comments Off
09
Dec
MatrixCare and AOD Software Join Forces to Create Largest LTPAC Technology Provider

 

stored in: Tim Rowan's Home Care Technology Report and tagged: , ,

By Tim Rowan

MatrixCare®, provider of EHR software for long-term care and senior living providers, has entered into a definitive agreement to acquire AOD Software of Fort Lauderdale, including its home care EHR software subsidiary, Soneto, which AOD acquired in 2014. (See HCTR 7/16/14)

AOD serves over 800 Continuing Care Retirement Communities (Life Plan Communities) and other long-term care facilities, in addition to 1,400 home health and home care locations. The closing of this transaction is subject to customary closing conditions (including obtaining regulatory approval).

John Damgaard, MatrixCare President and CEO, commented, “MatrixCare and AOD share many key values. Both organizations are energetic, fast growing, profitable, innovation-driven businesses that are addressing the fundamental challenges facing providers and consumers in the long-term post-acute care [LTPAC] businesses are also very complementary, with each having a strong market position in each of its areas of strength, and together having a portfolio of ancillary solutions that apply very well across care settings. [Details about the types of care provided by MatrixCare and AOD are described by these companies’ principals, along with assurances that all existing products and customer services processes will remain unchanged amidst this merger.]

 

“MatrixCare provides top-of-the-line solutions for skilled nursing and senior living facilities while the AOD product is the best in market for CCRCs. By integrating our collective technologies under a common care coordination platform, we will be able to offer the industry’s first true full-spectrum solution for helping the emerging set of conveners and diversified LTPAC operators to deliver superior care and better outcomes. While the LTPAC sector has historically been forced to make due with disparate technologies from sub-scale vendors and other vendors whose business models call into question their long-term viability, the combination of MatrixCare and AOD offers providers a stable long-term partner as we transition to a fee-for-value system.”

Aric Agmon, AOD President and CEO, added, “AOD has experienced tremendous growth and profitability over the last twenty years by focusing on the needs of our industry, sustaining innovation to meet those needs, and by providing superior customer service. With our combined technology, resources, and industry experience, I am excited to work with John to offer providers an innovative solution that truly covers their entire scope of services and levels of care including Skilled Nursing, Assisted Living, Memory Care, Adult Day Care, Independent Living, Continuing Care Retirement Communities, Rehabilitation, and Healthcare at Home. We are fully aligned in dedication to the LTPAC industry and meeting the evolving needs of providers with continued innovation.”

Other than benefiting from the combined resources of a larger organization, for MatrixCare and AOD customers and employees, it will be business as usual, both CEOs asserted. All existing products, touch points and customer service processes remain the same.

We spoke with Soneto founder Joe Kraus about the acquisition and found that he is positive about it. “When I learned this merger was a possibility, I pushed for it,” he told HCTR. “There was a little overlap between the two companies — MatrixCare had a few CCRC clients and AOD had a few SNF clients — but MatrixCare was not in home care and was very interested in what we at Soneto bring to the table. Now that we are part of a much larger company, Soneto will have the resources we need to develop our products for and enhance our services to private duty and certified healthcare at home providers.”

©2015 by Rowan Consulting Associates, Inc., Colorado Springs, CO. All rights reserved. This article originally appeared in Tim Rowan’s Home Care Technology Report. homecaretechreport.com One copy may be printed for personal use; further reproduction by permission only. editor@homecaretechreport.com

(more…)

Comments Off
09
Dec
Sutter Health Acquires Competitor

 

stored in: Tim Rowan's Home Care Technology Report and tagged: , ,

By Tim Rowan

According to a news release in The Sacramento Bee, Sutter Health’s home care division has acquired Salinas-based Alliance Home Health. The acquisition expands Sacramento-based Sutter Health’s home health programs and services in Monterey County. The deal follows a formal partnership in April between Sutter and Santa Clara County-based Hospice of the Valley. Sutter Care at Home is part of Sutter Health and delivers care to more than 150,000 patients a year in 24 Northern California counties. About 2,200 employees support patients and their families with skilled home health care, hospice, home medical equipment, respiratory therapy and home infusion services. [The much-increased demand for healthcare at home services by residents of Monterey and Santa Clara counties is noted in this short article by John Cullen, vice president of mergers and acquisitions for Sutter Health.]

 

“Demand for health care services continues to increase across the United States due to a number of factors, including an aging population,” said John Cullen, vice president of mergers and acquisitions for Sutter Health, in an email to The Bee. “Our partnerships with Alliance Home Health and Hospice of the Valley enable us to expand our capacity to provide timely, affordable and high-quality home care services to the residents of Monterey and Santa Clara counties.”
The organization provides home care services throughout the communities Sutter serves, including patients from non-Sutter hospitals and facilities, he said.

©2015 by Rowan Consulting Associates, Inc., Colorado Springs, CO. All rights reserved. This article originally appeared in Tim Rowan’s Home Care Technology Report. homecaretechreport.com One copy may be printed for personal use; further reproduction by permission only. editor@homecaretechreport.com

(more…)

Comments Off
09
Dec
OCR Audits Coming, Check Your HIPAA Readiness

 

stored in: Tim Rowan's Home Care Technology Report and tagged: , , , , ,

 

by Roger Shindell, CEO of Carosh Compliance Solutions (Crown Point, IN)

The audits are coming! The audits are coming! The Office for Civil Rights has given fair warning that its 2016 round of compliance audits are about to unfold. OCR is responsible for administering and enforcing HIPAA Privacy, Security, and Breach Notification Rules. While OCR investigates complaints and compliance issues, it also maintains an audit program, which is mandated by the HITECH Act.

2016 will be the year that OCR will finally relaunch its “Random Audit” program, under pressure from Congress.

At the same time, the Department of Health and Human Services Office of the Inspector General completed a study in September that was titled in bold broad letters:“OCR SHOULD STRENGTHEN ITS OVERSIGHT OF COVERED ENTITIES’ COMPLIANCE WITH THE HIPAA PRIVACY STANDARDS.” In the report, OIG stated that it had found OCR was not properly doing its job of pro-actively auditing HIPAA Covered Entities.

One can only imagine that with combined pressure from Congress and public lashing by the OIG, that OCR will launch audits with renewed vigor. Indeed, OCR has already announced plans to conduct comprehensive on-site audits as well as desk audits in 2016. [Shindell provides detailed information for healthcare at home agencies about potential audit components: security risk assessment & risk management, appropriate IT systems and services, information access management, an assigned security official with documented responsibilities, workforce security and verification of proper access to electronic PHI. among other important features healthcare at home agencies should have in place.]

 

Given this compliance pressure, this article re-introduces basic HIPAA requirements. While the information presented here may be more then anyone really cares to know about HIPAA, it is critical to every healthcare practice. If the depth of the information appearsoverwhelming, there is good news: There are resources available to help you through the compliance process, and demystify it to address your compliance needs so you will have a successful encounter with OCR in the event of an onsite or desk audit.

What is an OIG audit?
The audit protocol covers all the aspects of your compliance efforts including:

  • Your notice of privacy practices
  • Patient rights to request privacy for Protected Health Information (PHI)
  • Access of individuals to PHI
  • Administrative, physical, and technical safeguards
  • Uses and disclosures of PHI
  • Amendment to PHI
  • Requirements of the breach notification rule

With desk audits, an on-site visit does not occur, but OCR asks for documentation regarding various aspects of your compliance. The document requests must be satisfied in a 20-day period, which may seem like a lot of time. Consider, however, that the document request can ask for up to 6 years of information, on such things as your security risk assessments and remediation plans, your policies and procedures, your training logs, and any other documentation related to your HIPAA privacy and security program.

The focus for both on-site and desk audits will be on those areas that OCR compliance investigations have historically found to be lacking. These include:

  • The existence of an adequate Security Risk Assessment
  • An adequate and approved Remediation Plan
  • An adequate training program appropriately documented
  • Adequate and available policies and procedures

New this year is a focus on Business Associates. As part of the audit protocol, OCR will be collecting information on Business Associates, and with that information select BAs to audit. Why does this matter to you? Under the Final Omnibus rules, which went into effect in 2014, your relationship with your Business Associates significantly changed! Now you have an obligation to assure yourself that your BA are complying with HIPAA Regulations, just like you. And if they are not? Welcome to “double jeopardy.”

But that is only the beginning. OCR has published its intent to investigate specific security regulations, including:

Security Risk Assessment & Risk Management
OCR will inquire about your policies and procedures to conduct an accurate security risk assessment of vulnerabilities to confidentiality, availability, and integrity of patient PHI.

They will check to see if your risk assessment covers any regulation updates, or if it has evaluated changes to the operational or material changes for your organization, and if the assessments have been done on a periodic basis.

They will examine your remediation plan for addressing potential risks and vulnerabilities to PHI, decreasing them to an “acceptable” level, as well as whether or not it has been updated on a periodic basis.

Security policies and procedures need to address specified criteria of the security rule; CE/BAs should be clear to address data that is transported in and out of the organization.

Appropriate IT Systems and Services
The security rules is technology neutral and does not mandate any particular technology, but OCR will assess whether your IT solutions are appropriate for protecting the PHI that you create, receive, maintain, or transmit.

They will also want to ensure that you have protected against threats or hazards to security and integrity of your PHI, and that you have protected your against unauthorized disclosures.

Lastly, they will want to ensure that you have trained your workforce in your policies and procedures in this area. Security measures for CEs and BAs can be adopted in relation to an entity’s size, complexity, and capabilities of the CE/BA, and the CE/BAs technical infrastructure, hardware, and software security capabilities, as well as probability and criticality of potential risks to ePHI. 

An Assigned Security Official with Documented Responsibilities
OCR will check to see whether you and your BAs have assigned a specific security official to oversee the development, implementation, monitoring, and communication of security policies and procedures. A job description must clearly document assigned responsibilities.

The content of the job description should both match the requirements of the security rule, and Official’s responsibilities (e.g., job description) and evaluate the content in relation to the specified criteria. OCR will determine if the responsibilities of Security Official have been clearly defined and communicated to the entire organization.

Workforce security and verification of proper access to electronic PHI
OCR will be evaluating if your staff have the knowledge, skills and abilities to fulfill their roles, and that management verified their experience and qualifications. Policies and procedures for granting access to ePHI will be evaluated, as well as evidence of this approval process. You must provide evidence that the workforce member do in fact have access appropriate to their job function.

Evidence of policies and procedures for terminating access to ePHI when employment of a workforce member ends (e.g. voluntarily or involuntarily) or job functions change (e.g. transfers, promotions), and procedures for monitoring this process must be available.

Note, workforce security is an addressable standard, that means if you have not fully implemented workforce security measures, as required in the regulations, you must provide your rationale for not doing so, but rather justify the measures you have substituted.

Information Access Management
You must provide evidence that there are specific criteria for granting access to ePHI, as well as access controls (and security measures around access controls), and that they are periodically reviewed and updated. Criteria on security measures for access controls must be in place. OCR will determine if the entity’s IT system has the capacity to set access controls to ePHI.

Criteria must also be established for standards to authorize access and document, review, and modify a user’s right of access to a workstation, transaction, program or process. Since access authorization, like access establishment and modification, are addressable specifications, if you have not fully established workforce security measures, you must provide evidence as to your rationale for not doing so. You must be able to provide documentation as to how this process is evaluated, documented, and periodically reviewed.

Workstation Use
You must identify types of workstations, analyze their physical surroundings, establish procedures limiting access to workstations, and implement physical safeguards for the workstations. These practices must be established in policies and procedures with evidence of periodic reviews.

Device and Media Controls
You must provide evidence of policies and procedures that address methods for final disposal of ePHI, accountability for all movement and disposal of your hardware and electronic media, data backup and storage procedures, and procedures for reuse of electronic media.

Encryption and Decryption
OCR will assess your policies and procedures around encryption standards, which must be reasonable and appropriate, based on the size and complexity of your organization. As an addressable specification, at least for ePHI you store, if you have not fully instituted encryption measures, you must provide evidence as to your rationale for not doing so.

Access Controls
OCR will assure themselves that you have adequate access controls that come from your having analyzed workloads and operations, identifying the needs of all your users, technical access control capabilities, ensure all your users have been assigned a unique identifier, and have developed an access control policy.

Hardware and software related to access controls will be evaluated. Policies and procedures should address user access, reviewing and updating of user access, and emergency access procedures.

Automatic logoff, termination of access as needed, determination of which activities will be tracked or audited, as well as auditing and system activity review tools, and standard operating procedures will be evaluated.

Integrity
Policies and procedures around integrity of ePHI must be in place, including identification of all users who have been authorized to access ePHI, mechanisms to authenticate ePHI, authentication methods, and the applicability and evaluation of authentication method to current systems and applications.

Overwhelmed yet?
The writer Jane Wagner says, “Reality is the leading cause of stress amongst those in touch with it.”

Again, the information presented in this article is probably more then you really care to know about HIPAA. It is important, and it is reality. At this point you may feel stressed by the depth of the information. If so, take heart – there are resources available to demystify the process, so that you can comply with the regulations and have a successful encounter in the event OCR lands on your doorstep.

Tune in next month when we will discuss some of these resources, as well as how to evaluate their usefulness to help you successfully address HIPAA requirements.

Roger Shindell is CEO of Carosh Compliance Solutions, which specializes in HIPAA compliance consulting for small to midsize practices and their business associates. Shindell currently is a member of both the HIMSS Risk Assessment and HIT in Rural/Underserved Region WorkGroups and sits on the AHIMA Privacy and Security Council.  Shindell more than 30 years of multidisciplinary experience in healthcare and has served as an advisor and principal in healthcare, technology, and service companies. Contact him at MailTo:rshindel@carosh.com.

Comment on this article by writing to editor@homecaretechreport.com

©2015 by Rowan Consulting Associates, Inc., Colorado Springs, CO. All rights reserved. This article originally appeared in Tim Rowan’s Home Care Technology Report. homecaretechreport.com One copy may be printed for personal use; further reproduction by permission only. editor@homecaretechreport.com

(more…)

Comments Off
08
Dec
Why Wait? Start Early to Ready Seniors’ Homes for Aging in Place

 

stored in: Tim Rowan's Home Care Technology Report and tagged: , , , , , , , ,
 
 By Audrey Kinsella, HCTR’s Telemedicine Reporter

In his introductory keynote speech to the recent Partners-sponsored Connected Health Symposium, organizer Joe Kvedar, MD noted the many tools available for scrutiny by attendees. He stressed that that scrutiny should involve visualizing how to actually make these tools work.

For me, there was no better place to start than by investigating tools for use in a place we already know well — the family home. So I targeted a workshop titled, “Aging in Place: Home-Sweet-Connected-Home.” Here, four panelists focused not on grab bars and throw rugs but on setting up mechanisms, through the use of high- and low-tech tools, for keeping at-home seniors active and engaged. [Contributors by this panel  on topics like the need to keep seniors “activated,” and tools for helping them stay safe and comfortable while aging in place are identified in this article,]

 

David Inns, President and CEO of Great Call, called this strategy “Active-ation Solutions.” He acknowledged that many of these tools are still on the drawing board, ready to be customized to address the needs — and comfort levels — of seniors living alone.

We got a sense, though not yet a glimpse, of some of these could-be-here-soon tools in a presentation about the new “WellLiving Lab” at the Mayo Clinic Center for Innovation (newsnetwork.mayoclinic.org/discussion/well-living-lab-opens-during-mayo-clinic-transform-2015).

This is a 750-square-foot, sensor-rich test bed in which collaborative work is performed with Mayo staff and Delos®, an 8-year-old engineering company. Together, they are studying how the home environment — its lighting, noise, air quality, and temperature — can affect healthy living. Teams research the idea of moving attention onto patients and out of physicians’ offices. As one panelist said, thus moving the center of gravity into patients’ homes.

Getting these new tools to work means they have to be used, they have to be tested, which was a symposium theme addressed during several sessions: Listen to patients/residents to help them live at home more safely and comfortably.

Listening to patients/residents, it was asserted, will help inventors and clinicians learn what tools seniors not only need but will actually use. Panelist Heather Sobko, Ph.D, RN and Vice President of Medical Solutions presented one new-fangled tool that happens to work well for this group: the rotary telephone! It is familiar and comfortable to use, and it connects people with a real person, features, Sobko said, that turn out to be most important so for elderly patients living at home with multiple chronic diseases.

She finds the rotary telephone to be the engagement tool of choice, adding, “Patients who are engaged just do better.” Engaged patients are likely to be more comfortable sharing information about themselves, which in itself can improve patient/clinician rapport. As GreatCall’s David Inns pointed out, this gathering of information is a necessary but daunting task. Today, the 60+ population in the U.S. numbers 44 million. They have diverse needs and, he noted, their comfort level with technology varies greatly. Of particular note, those with the greatest healthcare needs are likely to have the most trouble with new technologies.

Rotary phones? Maybe. If that is what it will take to make the connection between patient/resident and clinician work. (Editor’s note: rotary phones work on modern lines and switches, an FCC regulation requires it.  You can also go really old-fashioned and have the operator dial the number for you. People who are blind or have other handicaps that would make it difficult to dial a phone can sign up with the phone company to have their calls dialed for no additional charge.) What is most important in this interaction, though, as Thomas Goetz, CEO of Iodine Research said in his keynote address, is matching tools with patient needs. Foremost in this is listening to people, he said, “Listening to people is key; and measuring wellness has to take into account the complexity of living.”

By listening, we learn more about people’s lives at home than is ever observed or shared in physicians’ offices. What we must do to help make tools work for them is to assess details about their lifestyles and information about their happiness. Information pertaining to their engagement across the full range of their lives is one of the building blocks caregivers need to properly select and customize tools for patients to use to live well at home as they age in place.

“Why wait?” was the question with which we began. It was posed because, as the person who introduced the symposium’s Age-in-Place workshop noted, today more than 50% of people in the U.S. are re-modeling their homes, long before they reach 65, to prepare for their own needs in advancing age. That is, they are not just making cosmetic modifications but installing double railings on stairways, improving lighting, and replacing doorknobs with lever-handles. These modifications are only examples of the growing array of life-made-easier-for-all-ages tools in a category dubbed “universal design,” which by no means includes tools for seniors only. These prescient Boomers want to feel comfortable and safe now but will one day count on clinicians and technicians to select the right tools to meet their advancing needs when the time comes.

These preparations, by “young seniors” and by their future caregivers, can be seen as an early investment in serving the Triple Aim, reducing U.S. healthcare costs and improving patient satisfaction. Clinicians who listen to patients will play a key role in meeting this target. Goetz used the term “precision medicine” to describe the fit of right remedies for the right patient. Precision medicine implies customized treatment choices, high-tech and low, for each patient based on each patient’s observed preferences, experiences, and tolerances.

Audrey Kinsella, MA, MS, is HCTR’s telemedicine reporter. She has written on home telehealthcare and new technologies for home care service delivery for 20 years, in 6 books, multiple web sites, and more than 150 published articles. Audrey can be reached at audreyk3@charter.net or 828-348-5308.

©2015 by Rowan Consulting Associates, Inc., Colorado Springs, CO. All rights reserved. This article originally appeared in Tim Rowan’s Home Care Technology Report. homecaretechreport.com One copy may be printed for personal use; further reproduction by permission only. editor@homecaretechreport.com

 

(more…)

Comments Off
04
Dec
NAHC Board Expulsion Controversy Festers, Expands

 

stored in: Tim Rowan's Home Care Technology Report and tagged: ,

by Tim Rowan, Editor/Publisher

According to sources involved in the events of October 22-27, the expulsion from the Board of Directors of the National Association for Home Care and Hospice involved two board members, not only the one we reported in our special October 30 issue. The following update has been verified and the facts cross-checked with several sources close to the persons involved, all of whom requested anonymity, which we agreed to respect. (more…)

Comments Off
02
Dec
Clinician Feedback Shapes Mobile Application Design

 

stored in: Tim Rowan's Home Care Technology Report and tagged: ,

In health care, usability of software is a patient safety issue. (more…)

Comments Off
02
Dec
Google is Changing the Rules Again

 

stored in: Tim Rowan's Home Care Technology Report and tagged: , ,

In a world where over 80 percent of prospective consumers will see your ad, but look you up online before calling your place of business, your placement in a local Google search is critical. (more…)

Comments Off
02
Dec
Congress Hints at New Hope for Medicare Telehealth Reimbursement

 

stored in: Tim Rowan's Home Care Technology Report and tagged: ,

Two bills currently making their way through Congressional committees, one in each chamber, would lift the ban on clinicians caring for patients across state lines with telehealth technologies. (more…)

Comments Off
02
Dec
Medalogix Releases End-of-Episode Planning Tool

 

stored in: Tim Rowan's Home Care Technology Report and tagged:

By Tim Rowan

Nashville, Tennessee, November 23, 2015 — Medalogix, a Nashville-based healthcare technology company, has announced the release of its new analytics-based, end-of-episode (EOE) planning solution for home health agencies. The tool just concluded its beta-testing stage with two clients, Alternate Solutions Health Network and Great Lakes Caring. (more…)

Comments Off
« Previous Page — « Previous Entries Next Entries » — Next Page »