Whether you work at a hospital or own your own practice, it is vital that you establish a compliance program designed to help you avoid fraud, abuse, and privacy violations. Federal regulations around these activities include the
The anti-kickback statute makes it illegal for providers (including physicians) to knowingly and willfully accept bribes or other forms of remuneration in return for generating Medicare, Medicaid or other federal health care program business.
A physician cannot offer anything of value to induce federal health care program business. The anti-kickback statute has been revised to allow exceptions or safe harbors.
Stark II is Phase II of the law that prohibits physician self-referrals.
The law applies to any physician who provides care to Medicare, Medicaid or other federal health program recipients and says that the physician cannot refer the patient for certain designated health services to any entity with which the physician has a financial interest. That is, unless one of Stark's exceptions apply.
Stark III is short for Stark II, Phase III of the physician self-referral prohibition. Stark III provides further clarifications and modifications to Stark II, Phase II, especially regarding physicians in group practice and the relationships between physicians and hospitals.
Obligations to notify patients of a breach of their protected health information (PHI) has been expanded and clarified under the new rule. Under the previous rule, a breach was not presumed reportable and was determined by whether or not there was a likelihood of “harm to the individual.”
Under the new rule, a breach is presumed reportable unless a covered entity can demonstrate low probability that the patient’s privacy or security of PHI was compromised based on a four-factor risk analysis. The new rule does not change the actual reporting and timeframe requirements.
Practices must amend their NPPs to reflect the changes to privacy and security rules, including those related to breach notification, disclosures to health plans, and marketing and sale of PHI. In addition, if a practice participates in fundraising, an amendment will also need to be made to the NPP to inform patients of their right to opt-out of those communications.
The new rules eliminate the requirements to include communications concerning appointment reminders, treatment alternatives, or health-related benefits or services in NPPs. However, the rules do not require this information be removed either.
Amended NPPs will need to be posted in the office. Copies should be provided to all new patients and do not need to be redistributed to existing patients. Copies should be made available to anyone by request. Practices that maintain a website should post the updated NPP on their website, which is a requirement of the existing HIPAA Privacy Rule.
The new rules expand the list of individuals and companies who are considered business associates to include:
All entities transmitting and receiving electronic health care transactions must use the 5010 version of the standards, which require upgrading or replacing software used to conduct electronic transactions, such as claims submissions, eligibility inquiries, and receipt of electronic claims acknowledgments and reports.
Some standards that physician practices should take note of are:
One provision of the 21st Century Cures Act goes beyond the parameters of HIPAA to make blocking health information illegal.
Under HIPAA, covered entities such as physicians and other health care providers may share protected health information (PHI) that pertains to treatment, payment, or operations but are not required to do so. In contrast, under the Information Blocking Rule that CMS and the former Office of the National Coordinator for Health IT (ONC) (now known as Office of the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health IT, or ASTP/ONC) published to implement that provision of the Cures Act, health care providers must share electronic health information (EHI) with other authorized entities, including patients, unless a specific exception applies.
The rule applies to the full scope of EHI as defined in 45 CFR §171.102, which includes all electronic protected health information (ePHI) in a patient’s designated record set. This replaces the earlier limited scope that applied only to a core set of data elements, defined as the United States Core Data for Interoperability (USCDI). For reference, the current USCDI data elements are available here.
The rule outlines categories of allowable exceptions, including preventing harm and protecting patient privacy and security. Details about these exceptions are available in ASTP/ONC’s official guidance.
The Information Blocking Rule is now actively enforced. As of July 31, 2024, CMS began applying financial disincentives to health care providers found to have committed information blocking, including reductions in Medicare payments and exclusion from federal programs such as the Merit-based Incentive Payment System (MIPS) and the Medicare Shared Savings Program (MSSP). Additional information can be found on the ASTP/ONC FAQ page dedicated to information blocking disincentives.
Physicians and practices should ensure they are in full compliance with the rule and maintain documentation when invoking any exceptions.
If you suspect a health care provider, EHR vendor or other organization is information blocking, the preferred reporting method is through ASTP/ONC’s Information Blocking Portal. Reports may also be submitted online through the OIG Hotline or by calling 1-800-HHS-TIPS (1-800-447-8477).
Have additional questions? You may also consult the following resources: