Patient Privacy Notice Forms

The HIPAA Privacy Rule gives individuals a fundamental right to be informed of the privacy practices of the health care providers and their privacy rights with respect to their personal health information. Providers are obligated to provide patients with a clear and concise description of their rights.

The HHS Office for Civil Rights and Office of the National Coordinator for Health Information Technology have released model Notices of Privacy Practices for health care providers and health plans. The model was created by collaboration between the two agencies with jurisdiction over patient privacy issues. The models express the views of these agencies concerning what health care providers should be communicating to their patients.

The Model Notices can be found at the following page of the HHS web site. Model Privacy Notices

It is notable that the model Notices of Privacy are not as in depth as the forms that have been used by many health care providers in the past. There is a simplicity to the model which seems to be directed toward communicating basic information to patients as opposed to an approach that includes “everything under the sun” in order to protect the provider. The less complicated approach seems to be more consistent with the regulatory requirement that providers develop and distribute a notice that provides a clear, user friendly explanation of these rights and practices.

The model released by the agencies provides a variety of formats that providers can consider depending on the context and their personal preference. The optional format include:

• Notice in the form of a booklet
• A layered notice that presents a summary of the information on the first page, followed by the full content on the following pages
• A notice with the design elements found in the booklet, but formatted for full page presentation
• A text only version of the notice

The models integrate the regulatory changes contained in the Omnibus Rule. Providers may use these models to serve as the baseline for compliance with the new requirements. For example, relatively new changes to patient access rights to information that is held in an electronic health record is covered. Providers who have not recently updated their notices may not include this information in their disclosure form.

The provided forms are set up so that providers can simply enter their specific information in the model forms. They can then be printed, posted, and otherwise used in connection with their practices.

The agencies seem to be actively encouraging providers to use these standard forms. Providers should take the opportunity to review their Notice of Privacy Policies and consider updating them to conform with the government provided standard forms unless the provider has a compelling reason to be more inclusive in its disclosure.

The Model Notices can be found at the following page of the HHS web site. Model Privacy Notices

Home Health and Hospice Review Areas

There are several areas applicable to home health and hospice that are susceptible to review.  Hospice reviews have tended to focus on whether patients actual meet criteria to be eligible to receive hospice benefits.  The focus on hospice arises, at least in part, due to the expansion of this segment of health care industry and the relatively rapid increase in spending for hospice care.  The government’s audit and enforcement trends indicate a deep suspicion that hospice are admitting patients who are not terminal or do not otherwise meet eligibility criteria.  The government points to the relatively large number of hospice patients who are discharged from hospice care alive.

In order to qualify for hospice benefits, a Medicare patient must have an illness that is terminal.  A physician must certify that the patient is terminal and is unlikely to live longer than six months if the illness runs its expected course.  The patient must also waive their right to receive curative treatment for the terminal condition in order to qualify for benefits.  Physician certification must be provided at two 90-day intervals following hospice admission.  After the first 180 days of hospice care, the patient must be seen “face-to-face” by a nurse practitioner who determines continued eligibility for coverage.  This process of certification and admission qualification creates several obvious pouts of risk for providers.  The government seems to be keying in on a few of these points of risk as evidenced by recent enforcement actions.

Payments to physicians for administrative duties should be carefully scrutinized to assure that the compensation arrangement does not create a referral inducement.  Medical director agreements must be analyzed under the Anti-Kickback Statute and applicable Stark Law exceptions.  Compensation should be at fair market value, cannot take into account he volume or value of referrals, and must meet other regulatory requirements.

CMS Deadline for DME Face-to-Face Certification Rules – October 1, 2013

The CMS extended deadline for DME Face-to-Face encounter requirements is fast approaching. Providers need to be certain that they are in compliance before October 1, 2013.

Concerns that some providers and suppliers needed additional time to establish protocols led CMS to suspend the time when it expects full compliance with DME face-to-face encounter requirements until October 1, 2013. The compliance deadline is approaching fast and providers who are involved in DME should adopt appropriate standards and procedures before CMS commences active enforcement of the requirement.

Section 6407 of the Affordable Care Act requires a face-to-face encounter with a physician, nurse practitioner, physician assistant, or clinical nurse specialist for certain items of DME.

Most DME suppliers and physicians have implemented appropriate policies and are aware of the change in certification requirement. CMS is concerned that some may need additional time to establish operational protocols necessary to comply with this new law. Suppliers and physicians who order certain DME items should have been collaborating to establish processes to ensure compliance with the new requirement. CMS will begin reviewing for appropriate documentation of internal processes and compliance with the face-to-face requirement for DME for all patient encounters beginning on October 1, 2013.

 Regulatory Noncompliance Does Not Equal FCA Liability

In U.S. ex rel. Hobbs v. MedQuest Associates, Inc., the Sixth Circuit recently reversed an $11 million False Claims Act judgment against Medquest, a multi-location diagnostic imaging facility, and declared that the Government’s attempt to use the False Claims Act as a tool to police “false certification” cases was inappropriate.

The Medquest case began in 2006 when a former employee filed a whistleblower suit under the FCA. The Department of Justice soon intervened and asserted two allegations:

1. Medquest violated Medicare program requirements by allowing unapproved physicians (who were not certified in radiology) to supervise certain testing procedures; and
2. Medquest inappropriately billed the Medicare program under the prior owner’s billing number instead of obtaining its own.

In a forceful decision that expressed “little sympathy” for Medquest, the Court found that regulations underlying Medicare certifications were not “conditions of payment” and did “not mandate the extraordinary remedies of the FCA.” The Court observed that these violations were “instead addressable by the administrative sanctions available.”

This decision could limit certain FCA cases. It is powerful evidence against those who argue every Medicare regulation enrollment agreement breach or error is a violation of an express or implied condition of payment and creates FCA liability. Instead, if there is no contractual or regulatory language making Medicare payments contingent on fulfilling Medicare enrollment or participation conditions, the Sixth Circuit appears to apply a common sense approach – that FCA’s “extraordinary penalties” should be reserved for more offensive regulatory violations.

What is the Period of Disallowance In Stark Law Self Disclosures?

When considering making self disclosure of arrangements under the Stark Law, the concept of “period of disallowance” is of central importance.  The period if disallowance generally refers to the period of timing during which a compensation arrangement is out of compliance with a Stark Law requirement.

To understand this concept, it is important to understand what the Stark Law prohibits.  The Stark Law prohibits an entity, such as a hospital, from billing for certain “designated health services” when a disqualifying compensation arrangement exists between the entity and a physician.  During the period of disallowance, designated health service cannot be billed and are considered to be an overpayment if billed and received.

When an entity makes a self disclosure, it is essentially admitting that a Stark Law violation took place.  Amounts collected for designated health services resulting from tainted referrals during the period of disallowance must be returned to the government as an overpayment.

CMS regulations define an outside limit for when the period of disallowance can be deemed to have ended.  Different rules apply depending on whether the arrangement involves excess compensation.  For example, in cases involving excess compensation, the period of disallowance can be assured to have ended when the nonqualifying arrangement is brought back into compliance and repayment of excess compensation is made.  However, CMS recognizes that every case is different and that there are cases when repayment will never be possible or compliance can never be completely attained.

CMS rules create an “outside time” when the parties can be assured that the period of disallowance will be deemed to have ended.  Each case is judged on its own facts and circumstances and the parties can argue that the period of disallowance has ended before repayment is made.  This permits DHS providers to take advantage of the self disclosure process in cases where they have no legal basis to require the physician to return the excess compensation.

In any event, issues regarding the period if disallowance must be addressed whenever Stark Law self disclosure is being considered by a health care provider.

So what is really going to happen if I don’t have health insurance?

Effective January 1, 2014, the choice for most people will be to either purchase health insurance or pay a penalty.  The IRS recently clarified what the individual mandate means for an individual taxpayer.

Under the new rules, if you choose to not carry health insurance, you will be subject to a penalty of $95 per person each year, or 1% of household income, whichever is greater.  However, over time, the penalty increases so that by 2016 it is $695 per person, or 2.5% of household income.  The IRS will assess and collect this penalty the same way as other taxes.  That is, unless you qualify for one of several exceptions.  A few of the exceptions are:

• Those who lack insurance while temporarily unemployed;
• Individuals whose health care is supplied by a temporary staffing agency;
• Those who are opposed to having insurance coverage for religious reasons;
• People with income below the threshold that is required to file an income tax return; and
• Individuals who qualify for Medicaid, but live in a state that has opted out of the new expanded program, such as Texas, Pennsylvania, or Wisconsin.

The final regulations also include information on what constitutes the required minimum essential coverage and describe how individuals are responsible for spouses, children, and other dependents.

Whether you agree with the controversial individual mandate or not, the penalty is real and implementation is fast approaching.

A full version of the IRS final regulations is available online.