CMS Extends Deadline For Long-Term & Post-Acute Care Health IT Survey

CMS is extending the deadline for its long-term and post-acute care (LTPAC) health IT survey. The survey applies to home health and hospice providers, and offers an opportunity to share the challenges and opportunities associated with health IT implementation. They survey period for the voluntary LTPAC EHR survey has been extended to April 3, 2015.

Click here to participate in the survey.

Click here to read more from NAHC.

Health IT: Should HIPAA Require Encryption?

According to the Associated Press, federal officials are planning on reviewing whether HIPAA should require encryption. The Senate Health, Education, Labor and Pensions committee said it will take up the matter as part of a bipartisan review of health information security. Recently, information on up to 80 million consumers, including names, birth dates, addresses, email addresses, employment information and Social Security/member identification numbers, were compromised in the attack on Anthem. According to sources, Anthem’s information was not encrypted. However, Anthem has stated that the hacker also had a system administrator’s ID and password, “which would have made encryption a moot point.” Security experts have said that a stolen credential by itself should not be key to the whole data kingdom and information should always be encrypted wherever it resides.

Click here to read more.

Tiptastic Tuesday: Tips For Preventing Major Data Breaches

Major data breaches are becoming more and more common. Here is some helpful information on how to prevent breaches of patients’ protected health information (PHI):

  • Risk assessments. Be sure your practice performs regular, thorough assessments. Make sure mobile devices are secured and encrypted.
  • Changes in operations: Be sure to conduct risk assessments after big changes. Big changes include your office moving or merging with another group.
  • PHI disposal: Have a plan for securely disposing of outdated PHI on devices and equipment.
  • Employee training: Employees who handle PHI should be trained so they understand the necessity of using available safeguards. Training is also important to foster a routine of privacy and security.

Additional tips include revising policies and procedures, revising agreements with business associates who have PHI access, regularly updating passwords, and keeping paper PHI files in secure area.

Hackers Targeting Healthcare Providers

According to security experts, your medical information is worth 10 times more than your credit card number on the black market. Last month, FBI warned healthcare providers to guard against cyber attacks after one of America’s largest hospital operators had been broken into, stealing the personal information of 4.5 million patients. Security experts warn that these cyber criminals are increasingly targeting the $3 trillion U.S. healthcare industry. Hackers sell names, birth dates, policy numbers, diagnosis codes and billing information, sometimes using this data to create fake IDs to buy medical equipment or drugs that can that can resold. They may even combine a patient number with a false provider number and file  made-up claims with insurers. Because medical identity theft is not immediately recognized, criminals have more time to use the stolen credentials. With the shift to electronic medical records, experts predict more cyber attacks.

Click here to read more.

Proposed Rule Provides EHR Certification Flexibility

CMS and the Office of the National Coordinator for Health Information Technology are issuing a proposed rule that would allow providers to use the 2011 edition of certification criteria in 2014. The new rule, released on May 20, will be published in the Federal Register on May 23 and will allow providers to use the 2011 edition of certified electronic health record technology for Stage 1 or Stage 2 in 2014. Additionally, providers will have the option to attest to the 2013 definition of Meaningful Use core and menu items and use the 2013 definition of clinical quality measures.

Providers will need to use the 2014 edition of certification criteria in 2015. The proposed rule “formalizes the agencies’ intention to extend Stage 2 to 2016 and to begin Stage 3 in 2017.”

Click here to read more

CMS: ICD-10 Will Not Be Delayed

Although providers, payers, and claims clearinghouses were looking to delay the ICD-10 deadline, CMS has made it clear that this will not happen. However, CMS did state that it will make some case-by-case exemptions for providers having a hard time meeting their Meaningful Use Stage 2 targets. In addition, physicians and other eligible providers whose EHR incentive programs operate on the calender year, will have more time and three dates: the first days of April, July, and October to start their 90-day clocks. CMS officials also noted that Stages 2 and 3 of the EHR incentive payment program will need to fully meet all criteria by 2015, but providers and health IT vendors with legitimate issues may submit applications to CMS for “hardship exemptions.”

Click here to read more

Tiptastic Tuesday: Creating an Effective Privacy Compliance Program for Physician Practices

Although it seems hard to believe, we’re nearing the new year.  This means it’s time for your practice to have an up-to-date, effective compliance program.  If you want to prevent your practice from scrutiny from auditors and hefty fines, look no further. Here are some quick tips on creating and maintaining an effective privacy compliance program:

  • Your compliance program should address specific areas including: lack of appropriate safeguards for patients’ protected health information (PHI), impermissible use of patients’ PHI, difficulty with patient access to PHI and inappropriate disclosure of PHI
  • It’s extremely important for practices to perform regular self-audits to ensure privacy policies are being followed. Begin this process by reviewing procedures you already have in place to make sure they’re compliant with recent updates.
  • Your policy should address PHI stored on all electronic devices and should note the employees who have access to it.
  • Check with your business associates to make sure their policies regarding PHI are in compliance.  Also, make sure your HIPAA policy is up to date- this applies to business associates, too (see here for more information about business associates and HIPAA).
  • Make sure all usernames and passwords are secure.  Longer passwords with different characters are the most secure.  Never use personal information in a password.  We recommend you change passwords every 90 days (see here for more information about securing safe passwords).
  • Have a policy centered around employee training with a detailed record of how often staff is updated about any relevant changes
  • Evaluate any potential risks with a written assessment

Stay tuned to our blog for more compliance tips!

Study: EHR Could Significantly Impact Physician Services

A new study published in the November issue of Health Affairs found that EHR and e-health use could significantly impact the amount and type of physician services in the future.  Researchers say that the U.S. healthcare system has reached a “digital tipping point” due to factors such as almost 72 percent of (office-based) physicians having an EHR and 17 percent of patients using e-health tools.

According to the researchers, demand for physicians would decrease by 9 percent if 30 percent of community-based physicians implemented health IT in their practices.  In addition, more care would be in the hands of generalists than specialists, lessening the demand for specialists. Also, more care would be given by non-physicians, reducing demand for physicians by about 7 percent.  In general, increased efficiencies brought forth by EHR would help doctors meet the demand of the patient load.  

Click here to read more

Medicare Will Not Conduct End-to-End Testing for ICD-10, MGMA Concerned

As you know, CMS will be switching to ICD-10 but they won’t be testing the system, potentially putting your revenue at risk.  Officials from the Medical Group Management Association (MGMA) state that they are “extremely concerned” and that failure to conduct testing could end in cash flow disruption and “serious access to care issues for Medicare patients.”  Industry pressure could eventually convince CMS to reverse its decision and do some testing.

CMS officials are surprised that anyone expected ICD-10 testing, although they are requiring Medicaid agencies to test the system with providers.  According to CMS, it’s up to health systems, hospitals, and physician practices to ensure they can send data in the correct format.

Some experts recommend that healthcare providers start to perform their own testing with payers to make sure their revenue stays afloat after the switch.

Click here to read more