Sarah Q. Wirskye

In December 2013, HHS' Office of Inspector General (OIG) issued a report entitled

 "Not All Recommended Fraud Safeguards Have Been Implemented in Hospital EHR Technology."

 The government conducted the study in response to a concern that EHRs, which are quickly replacing traditional paper medical records, can make it easier to commit fraud.



In order to complete the study, the government gathered data from hospitals and EHR vendors. It also conducted on-site interviews and observed hospitals' certified EHR technology.

The first objective of the study was to assess the extent to which hospitals that received EHR Medicare incentive payments implemented the recommended fraud safeguards for EHR technology in the following categories: audit functions; user authorization and access controls; data transfer standards; and  patient involvement in anti-fraud activity. The second objective was to assess the extent to which hospitals have implemented policies to address appropriate copy/paste functions in EHR.

Nearly all hospitals with EHR technology had the recommended audit functions in place, but were not always being used to their full extent. For example, the audit log captured the recommended data. However, almost half of the hospitals had an ability to delete their audit logs. Moreover, the audit logs' data was being analyzed to ensure privacy of patient data, as opposed to detecting and preventing fraud and abuse.

Second, all hospitals employed a variety of recommended user authorization and access controls. One of the concerns in this area, however, was limiting outside entities' access to EHR data to ensure that the appropriate individuals are actually making the entries. Third, the study found that nearly all hospitals were using recommended data transfer safeguards. However, only approximately a quarter of the hospitals reported that they require users to provide a reason before exporting, transferring or printing data. The resulting recommendation was to institute safeguards to restrict such. Fourth, almost half of the hospitals had begun implementing recommended tools to include patient involvement in anti-fraud efforts.

One of the report's most significant findings was that only about a quarter of the hospitals had policies regarding the use of the copy-paste feature in EHR technology. Recognizing this feature can greatly enhance efficiency of data entry, there is a concern that it is easier to inflate, duplicate, or even create fraudulent health claims by merely cutting and pasting a prior entry.  The second area of concern with this function is that auto-population features that generate extensive documentation on the basis of a simple click may generate information that is not accurate for the specific patient encounter and over represent what the practitioner performed. The study recommended that the use of such tools be captured in the audit log and more careful use of this function.

HHS' recommendations were as follows, and CMS concurred with those recommendations:

1. Audit logs be operational whenever EHR technology is available for updates or viewing;

2. Office of National Coordinator for Health Information Technology (ONC) and CMS strengthen their collaborative efforts to develop a comprehensive plan to address fraud vulnerability in EHRs; and

3. CMS develop guidance on the use of the copy-paste function in EHR technology.

Based upon the report and recommendations, expect to see further scrutiny and crackdowns of EHR abuses. There will be adjustments to payments to professionals and hospitals, beginning in 2015, for failing to successfully demonstrate meaningful use of certified EHR technology. Both HHS and the U.S. Attorney General recently warned medical providers who commit billing fraud with EHR that they will be prosecuted. Additionally, insurance companies will also likely begin more closely scrutinizing EHR and possibly even reject claims if they believe that the copy-paste function is not being used appropriately. In order to protect themselves, healthcare providers should attempt to follow the recommendations in the report with a focus on the cut-paste function and potential abuses.

Articles

A recent report from HHS warns physicians about improper use of their EHRs, especially the copy-paste function.

Physicians Need to Be Aware of Heightened Scrutiny of EHRs

Technology is playing a growing role in helping the government identify and combat potential healthcare fraud. It not only helps the government identify areas of fraud, but also makes it easier to share the results of its investigation with other agencies and health insurers.

Recently, the chief counsel of HHS' Office of Inspector General (OIG) testified before Congress regarding the growing role of information technologies and analytics - including data mining, trend evaluation, and modeling- to better identify fraud vulnerabilities and target their oversight efforts.  The OIG's data warehouse integrates data from Medicare parts A, B, and D so that the government can develop a comprehensive picture of beneficiaries' medical care and providers' billing patterns. The data warehouse also allows the government to work more quickly.

In fraud investigations, technology and databases have been increasingly used by Medicare Fraud Strike Forces, allowing quicker identification of fraud schemes and trends. The data-driven approach of the strike force is to pinpoint fraud hotspots through the identification of suspicious billing patterns and quickly target potential criminal behavior. Since their inception in 2007, strike force teams have charged more than 1,000 individuals with seeking to defraud Medicare of more than $2.4 billion.

As a healthcare provider, this will impact how you, your peers, and the healthcare sector overall are targeted for investigation. As always, many healthcare investigations will continue to be opened based upon personal tips or whistleblower actions.

However, technology more easily allows the government to identify a provider as an outlier as far as billing a particular code. The government will also be able to use the integrated data to identify providers with certain billing patterns that appear suspicious. The fact that a provider services a certain segment of the population may make him a statistical anomaly that will have to be explained to the government. Mere dollar amounts may also put a provider on the government's radar. So a multi-office practice or a particularly busy office may be suspect based upon data alone.

One of the biggest changes is something we are already seeing. State agencies and insurance providers are increasingly becoming more active in investigating potential fraud. Because it is easier to share data, for example, an investigation that was not big enough for the federal government may be more likely handled at the state level. State medical boards are expected to become more active as well. And there likely will be more exclusions based upon state and private investigations for the same reasons.

Therefore, as a healthcare provider it is more important than ever:

• That your charting justify the codes you are billing, especially if you are billing for a more complex procedure;

• That you have a compliance program already in place;

• That you are able to show proactive measures to identify and return overpayments; and

• That you remember just because you do not accept Medicare or Medicaid, you are not automatically protected from a potential investigation.

Health IT and its data is rapidly becoming a powerful tool for the federal government in combating potential healthcare fraud nationwide.

The Latest Weapon to Fight Healthcare Fraud: Health IT and Analytics

Most people think of "cybercrime" as actions by someone who wrongfully gains access to electronic information and then uses it for their benefit illegally. However, "cybercrime" cases also include enforcement actions regarding data breaches against reputable entities who allegedly did not take adequate protection measures safeguarding client data. Both the federal and state governments have pursued such actions and published requirements in dealing with sensitive, and particularly HIPAA-related, information.

HHS' Office for Civil Rights (OCR) entered into several major settlements of HIPAA-based enforcement actions in 2012. The entities include a major health insurance provider in Tennessee, a hospital in Massachusetts, and the Alaska Department of Health and Human Services. All of these cases settled for between $1.5 million and $1.7 million. These cases stem from reported data breaches involving lost or stolen electronic storage media allegedly containing protected health information (PHI). These settlements also generally include corrective action plans, some with third-party compliance monitoring, in addition to the monetary payments mentioned earlier.

Recently, WellPoint settled a similar case and agreed to pay $1.7 million for leaving information accessible over the internet. OCR began its investigation following a breach report submitted by WellPoint as required by the HITECH Act. The HITECH Breach Notification Bill requires HIPAA-covered entities to report a breach of unsecured PHI. The report indicated that the security weakness in an online application database left electronic PHI of over 612,000 individuals accessible to unauthorized individuals over the Internet. OCR’s investigation indicated that WellPoint did not implement appropriate administrative and technical safeguards as required under the HIPAA Privacy Rule.

Notably, the government is not only pursuing actions against large insurance carriers or hospital systems. A cardiac surgery practice in Phoenix settled a case for $100,000 with OCR resulting from allegedly posting PHI on a publicly accessible, Internet-based appointment calendar. State attorneys general have also pursued "smaller" cases, which have resulted in six-figure settlements. Therefore, it is clear that physician practices must take adequate measures as well.

Whether system upgrades are conducted by covered entities or their business associates, OCR expects organizations to have in place reasonable and appropriate technical administrative and physical safeguards to protect the confidentiality, integrity, and availability of electronic PHI -especially information accessible over the Internet. Moreover, beginning September 23, 2013, liability for many of HIPAA’s requirements will extend directly to business associates that receive or store PHI, such as contractors and subcontractors.

On November 26, 2012, OCR released guidance regarding methods for de-identification of PHI in accordance with the HIPAA Privacy Rule. The Privacy Rule essentially establishes two methods to de-identify PHI. The first is removing 18 specific identifiers, including name, address, and social security numbers. The second is obtaining a professional statistical analysis and opinion that the risk of identification of an individual is very small.

With the government focus on "cybercrime" becoming an increasing area of scrutiny, physicians who have access to and record PHI should ensure they are familiar with and implement the appropriate procedures in securing and protecting PHI.

. However, the rules are not always clear and ideally you should contact a healthcare attorney to ensure you are HIPAA-compliant and what to do if there may be a potential breach.

You may not equate a HIPAA violation with a cybercrime, but if you have patient records, you need to secure and protect that information electronically.

Why Your Medical Practice May Have Exposure to a Cybercrime

While the Affordable Care Act is not generally characterized as healthcare fraud legislation, there are some aspects of the Act that certainly affect healthcare fraud. Nowhere is this more evident than the ACA’s provisions that make the failure to return an overpayment a basis for a False Claims Act violation.

The Act requires anyone who has received a Medicare or Medicaid overpayment to report and return it and to notify the government for the reason of the overpayment. Generally speaking, the overpayment must be reported and returned within 60 days. The deadline for reporting and returning payments is 60 days from the date on which the overpayment was identified or the date any corresponding cost report is due, if applicable. Notably, the False Claims Act definition of knowledge applies to this provision - so a provider cannot avoid having actual knowledge, and therefore liability, if they act in reckless disregard or deliberate ignorance of the overpayment.

Significantly, the failure to do so within the deadline could be a basis for a False Claims Act violation. Penalties under the False Claims Act could include civil penalties between $5,500 and $11,000 per violation, plus treble (or triple) damages. Any person who fails to report and return the overpayment may also be found liable under the Civil Monetary Penalties Law and could be excluded from participation in federal healthcare programs.

The potential liability under the False Claims Act is particularly important because the ACA is the basis of most whistleblower actions. This change in the law coupled with the 2011 amendments to the False Claims Act statute make it easier than ever for a whistleblower to file a False Claims Act violation.

It is imperative that procedures are implemented or modified to identify overpayments. This may include payments for non-covered services or payments in excess of allowable amounts. This may also include situations where there may be a duplicate payment in error or receipt of payment when another payor had the primary responsibility of the payment.

This change in the law is just another example of increased healthcare legislation attempting to target healthcare fraud and abuse. Notably, the ACA appropriated over $350 million for fighting healthcare fraud. Therefore, it is more important than ever to ensure that you are compliant with all applicable laws and regulations.

It is imperative that procedures are implemented or modified to identify overpayments at your medical practice to avoid a False Claims Act violation.