Healthcare Fraud Recovery $4.2B for 2012

Attorney General Eric Holder and HHS Secretary Kathleen Sebelius released a report today indicating that for every $1 spent on healthcare fraud and abuse recovery, $7.90 has been returned to the treasury over the past three years. With the Obama administration making recovery a top priority, this is the highest level of return in the 16-year history of the program.

Health Care Fraud Prevention and Enforcement Action Team (HEAT) was created in 2009 to reduce fraud, waste and abuse in the Medicare and Medicaid programs and to crack down on individuals and organizations that are bleeding the system. Last year, the Justice Department opened 1,131 new criminal fraud investigations involving as many as 2,148 defendants. Convictions have been achieved on 826 defendants in fraud-related crimes during the year. In the same year, the department opened 885 new civil investigations.

In 2012, CMS began screening all 1.5 million Medicare-enrolled providers through the new Automated Provider Screening system. APS fingers ineligible and potentially fraudulent providers and suppliers prior to enrollment or revalidation. Nearly 150,000 ineligible providers have been eliminated from Medicare’s billing system so far. 

CarePrecise's standard database of healthcare providers includes a field that indicates providers who may still be active, but have been added to the federal List of Excluded Individuals and Entities, tying excluded providers to their NPI numbers.

Exchange and Medicaid IT Contract Tracker

State Refor(u)m has created a chart that tracks states' choices of firms to build health insurance exchanges and Medicaid systems, with details on technical roles performed by vendors and on some of the software components vendors will use. The chart was produced by the Office of Health Policy and Technology at the University of Massachusetts Medical School. States can help State Refor(u)m keep the tool updated by using the page's comments section to post information about similar contracts awarded in their states.

CarePrecise provides healthcare provider information to state insurance exchanges, health information exchanges, Sunshine Act programs, healthcare fraud investigations and other state and federal healthcare projects.

Visit the Exchange and Medicaid Systems Contracts Chart to see who's doing what on whose project, and to add your own.

______
CarePrecise is a sponsor of Big Data for Healthcare Forum, April 29 - May 1, 2013. Join us there!

15 Types of Medical Billing Fraud & Abuse

Estimates of U.S. medical fraud and abuse go as high as $80 billion. It contributes significantly to rising healthcare and insurance costs.  The complexity and fragmentation of the American healthcare billing landscape is frequently a culprit makes fraud and abuse easier to commit and more difficult to detect.

One of our long-time clients, PayerFusion, has just published an article on its blog highlighting fifteen different forms of fraud and abuse, including upcoding, cloning, phantom billing, and a dozen more. Read the article for useful and timely information on this important subject.

CarePrecise provides software, data and services employed by law enforcement, including the Federal Bureau of Investigation, in ongoing investigations. To report fraud or abuse, go to http://oig.hhs.gov/fraud/hotline/
______
CarePrecise encourages you to attend the Big Data for Healthcare Forum, April 29 - May 1, 2013.

Data Security: An Online Hacking Primer

Medical records security has been rising to the top of mind among the healthcare IT community. As HIPAA now has some teeth and has been extended to contractors, it is wise to remember that three in four Americans have fallen or will fall victim to cyber crime as a result of having been hacked. Among the systems that have infamously leaked personal information are those of universities and hospitals. The following infographic offers an overview of the personal information leakage going on out there. Thanks, Allison!

Infographic courtesy OnlineCollegeCourses.com.

______

CarePrecise encourages you to attend the Big Data for Healthcare Forum, April 29 - May 1, 2013.

Patients Resist Digital Doctoring

Modern Physician reports that "The pull-down menus, alerts and point-of-care information contained in computerized clinical decision-support systems [CDSS] can distract physicians from their face-to-face encounters and leave patients feeling ignored and dissatisfied with their care." This comes from a study at the University of Missouri at Columbia that evaluated patient perceptions of doctors using digital diagnostic tools.

"Get over it!" is the first thing that comes to mind. Would you begrudge your mechanic hooking up your car to the diagnostic computer and scrutinizing the bars and gauges and charts on the screen? The physician has to use tools, just like everyone else, to achieve peak performance in treating patients. Personally, I'd rather see the back of his head researching my complaint to take advantage of every inspiration and precaution, than to look at a smiling face telling me "Shucks, I don't know, let's try some drugs!"

The time has come for us as patients to embrace the new technology, just as we insist that our doctors do the best job possible in our behalf, and to get used to some changes in the doctor-patient relationship.

Surprise: You May Now Be Liable Under HIPAA

When the HIPAA privacy rule first went into effect, business associates of hospitals, physicians, etc. didn't have to worry about getting in trouble for releasing data in ways that violate patients' privacy.

No more.

In light of several years of clumsy handling of patient data by contractors and employees, it's perhaps not surprising that HHS is changing the rules to extend the strict HIPAA privacy rules -- and penalties for violations -- to external vendors and IT communities.

If you work in any way with patients' medical data -- whether as a data processor, consultant, IT contractor, EHR installer, whatever -- you'd better get familiar with the new rule that goes into effect March 26. It clarifies when breaches need to be reported to the Office for Civil Rights, scraps the old standards for the use of patient-identifiable data for marketing and fundraising purposes, and expands direct liability under the law to so-called “business associates” of HIPAA-covered entities.

Perhaps equally interesting is that patients once again will have the right to limit release of treatment records to insurance companies if they paid out-of-pocket on that treatment. Look out for problems and potential fines related to goof-ups related to granting access to the wrong business partners on the wrong data. Greatly increased penalties for privacy and security violations under the ARRA are explained in the new ruling.

Read the HHS news release.
Read the rule in the federal register (you've still got time to comment).

$1.25 Billion in December EHR Incentives

The Centers for Medicare and Medicaid Services announced that a record $1.25 billion was paid in December to hospitals, physicians and other professionals in electronic health-record (EHR) incentive payments. The program awards healthcare providers for adopting electronic health records systems.

The December pay out is three times the size of the previous largest one-month awards total. Medicare and Medicaid awarded $255 million to physicians and other professionals, and $1 billion to hospitals. So far, EHR incentive programs have paid out $10.3 billion to improve the quality of US healthcare information technology, which for decades has lagged behind other industries.

HIPAA Grows Teeth II

You could be forgiven for thinking that the seminal law underpinning U.S. healthcare reform has been aggressively enforced. Alas, most within the healthcare industry have wondered when the federal government would begin taking HIPAA's most blatent offenders to the woodshed. If ever. But action this week by the HHS Office for Civil Rights suggests that the government may begin pursuing violations in earnest.

HHS has announced that Massachusetts Eye and Ear Infirmary (MEEI) and its physician group, Massachusetts Eye and Ear Associates, agreed to pay $1.5 million to settle HIPAA security-rule violations. The case involves the theft of a laptop computer storing 3,621 patient records, and HHS' allegation that MEEI and the physicians not only failed to secure data on the laptop but also failed to comply with other HIPAA security requirements. According to the Office for Civil Rights brief, MEEI failed to execute “thorough analysis of the risk to the confidentiality” of provate patient information stored on the laptop and had not adopted and implemented "policies and procedures to restrict access to ePHI [electronic protected health information] to authorized users of portable devices.”

The initial installment of $500,000 is set to be paid to the government on October 15, with two subsequent payments scheduled through 2014. The offenders will also have to submit to independent monitoring of a "corrective action plan" twice a year for three years. Read the Resolution Agreement here.

Time to lock down that patient data, folks. And maybe download free open source encryption software for those laptops while you're thinking about it.

Population Healthcare Is Health Reform

Michael Christopher
Chief Chigger, CarePrecise Technology

We have heard many people say that the Affordable Care Act is not health reform, but an attempt at health insurance reform. But a broad shift in the focus and delivery of healthcare has begun, shaped in part by the ACA, and poised to bring significant change to American healthcare. At the heart of that change is population-based healthcare.

"With the Supreme Court upholding the ACA, we all now understand that population healthcare is what we're all going to be doing going forward," says Dr. Steven Davidson, senior vice president and chief medical informatics officer for New York's Maimonides Medical Center in a June 28 Modern Healthcare article. What is "population healthcare," what does it have to do with the Affordable Care Act, and what does it mean to industry vendors?

The term refers to "the ability to assess the health needs of a specific population; implement and evaluate interventions to improve the health of that population; and provide care for individual patients in the context of the culture, health status, and health needs of the populations" according to the Association of American Medical Colleges. Population healthcare is a broadening of focus to see beyond the individual patient to the broad context of that patient's health issues, and to understand the issues of the patient's population to better serve both the individual patient and broader communities of patients.

This perspective becomes ever more critical when cost efficiencies are taken seriously into account, as they must be in an "affordable care" paradigm. In a Tufts Managed Care Institute's white paper on population health, we find

"Population-based care involves a new way of seeing the masses of individuals seeking health care. It is a way of looking at patients not just as individuals but as members of groups with shared health care needs. This approach does not detract from individuality but rather adds another dimension, as individuals benefit from the guidelines developed for the populations to which they belong.* Members with a particular disease must be prioritized so that disease management interventions are targeted toward those members most likely to  cost-effectively benefit.**"

The Affordable Care Act package as it now stands places the emphasis on results, rather than on specific means to obtain results. Despite what has been said by opponents, providers are given wide freedom in achieving improved quality and reach of care, and are provided with new resources, such as advanced electronic health records, paid for in part by the taxpayer. Population healthcare is a strategy for deploying these resources and creative latitudes, in a package of practical tactics and achievable objectives, and at scale.

When viewed through the lens of health reform's quality focus, public health data collection and bringing the technologies that enable collection to every point of care, population healthcare is seen as a key - if not the key - strategy for both implementing the provider side of health reform, and rewiring its financial backbone of health insurance.

* Boland P., editor. Redesigning Heath Care
Delivery. Boland Health Care, Berkeley,
1996. pp. 159-163.
** Zeich R. Patient identification as a key to
population health management. New
Medicine. 1998;2:109-116.

Now We Know: Time to implement the Affordable Care Act

As the Tennessee Medical Association puts it, there is now a "certain finality" to the Affordable Care Act following the Supreme Court decision upholding the law. A huge win for the Obama administration, the decision yesterday was like kicking a hornet's nest among conservatives. The Christian Medical Association said the decision "sounds an alarm across the country to people with faith-based and pro-life convictions" and called on Congress to repeal the law.

An article in Modern Physician characterizes the response among physicians as "mixed," but the vast majority of our MD, DO, PA and RN contacts have come down strongly in favor of the law, in one case saying "The government did something right... 50 million healthier Americans is going to look pretty good here in a few years."

Whichever political side one is on, it is now clear that work can move forward on implementing the law. The Tennessee Medical Association's statement concluded "Today's decision allows us to make more definitive plans regarding reforms to our healthcare system in Tennessee." The sentiment seems to be fairly widespread through the provider side of the industry.

Some states - among them our own Oklahoma - elected to refuse federal funding ($54 million in Oklahoma's case) to establish health insurance exchanges. The decision, taken on the part of Governor Mary Fallin, appears to have been politically motivated, but Oklahoma is, in fact, developing an exchange, without the federal dollars. An agency head, speaking with an Oklahoma radio station, said "It would have been good to have the money, so we could have a more user friendly and effective system, but we'll have something, anyway."

The justices struck down provisions in the law that would empower the federal government to force states to comply with the planned Medicaid expansion or lose all of their Medicaid funding. Now states will be eligible for basic Medicare funding even if they choose not to accept the additional dollars to provide expanded care. Numerous states have sworn to refuse expanded Medicaid funding, but it remains to be seen whether any will ultimately deny this added coverage for hundreds of thousands of their citizens. The federal dollars are being offered with no required match for three years. Medicaid is often one of the biggest lines in states' budgets, and that share is growing as healthcare costs continue to rise.

Medical Data Breaches Unnecessary

The problem of breaches involving healthcare data is getting worse, not better. As more medical information is stored electronically, the risk of unauthorized access grows. But a significant portion of the risk could be reduced to near zero if the primary users of the data - practitioners, healthcare information technology staff and contractors, administrative staff - would take one simple step. One simple and completely free step. Really; it costs nothing, and places nearly zero burden on the user.

We made this same recommendation about six years ago, when reports of stolen laptops first began coming in. But it seems as though no one in the industry has applied our simple fix. In January of 2012, a contractor copied the records of 34,000 patients of Howard University Hospital, containing SSNs, birthdates, and diagnosis-related information, onto a laptop. The data was not encrypted; the laptop, of course, was stolen from the contractor's car. This same scenario has been reported numerous times. Data, laptop, car, repeat.

Last month, federal prosecutors charged a worker at the same hospital with selling hospital data. She's set for a plea hearing on June 12. Clearly, this is a different situation, and would not have been mitigated by encrypting the data, since the worker was entrusted with full access. But you can be sure that Howard University Hospital wishes that the stolen laptop had not preceded this incident. Patients and regulators are rightly outraged.

Simply put, had the data been stored on an encrypted drive partition on those laptops, it would have been safe from prying eyes. How difficult is it to do that? If a free, open source program like TrueCrypt is installed on the computer, it's as easy as typing in a password to open the protected drive, copying the data onto it, and using the data just as though it were on any ordinary drive. After so many minutes of idleness, or when the computer sleeps, hibernates or is shut down, the program can be set to close the protected drive, rendering its contents completely unusable until the password is given again.

Along with encryption, passwords must be strong, which means hard to guess. But they don't have to be hard to remember and type. A good rule is to have 20 or more characters, but a simple phrase can be easy to remember. Stop thinking pass word, and think pass phrase instead. Here's an extremely strong password: Theylike2bheld/theseKitties ("they like to be held, these kitties"). Easy to remember and type, but it has upper and lower case letters, a numeral and a punctuation character, and totals 27 characters in all. That's one strong password. It works in TrueCrypt and virtually all other encryption programs. And it even has kittens!

Some encryption software, including TrueCrypt, offer an additional important feature.  Let's say you are carrying extremely valuable data, being mugged, and are forced to enter your password to start the computer. Let's go so far as to say that the mugger is savvy enough to search the computer for an encrypted file, and finds it. TrueCrypt actually lets you use a different password when you mount the protected drive, which opens a phony data trove on which you've stored some bogus data. Plausible deniability saves you and your data.

There is simply no reason not to require all staff members and contractors to use encryption for all medical and other personal data. Essentially zero ownership cost, and it doesn't slow anybody down. No excuses.

Encryption and strong passwords. Take these two pills and sleep better tonight.

TrueCrypt is a free open source project, available at http://www.truecrypt.org/

The Sunshine List

As lawmakers continue to push CMS to implement the Physician Payments Sunshine Act, and CMS mildly demurs out of concern that drug and equipment manufacturers won't be able to comply any time soon, CarePrecise has been busy getting prepared for a run on the databank.

As most of the players are beginning to realize, an accurate and up-to-date source of provider information will be a necessity in reporting payments properly. The CarePrecise master provider list contains all the hooks required to positively identify specific providers, and connects provider licensing and NPI numbers to such pertinent information as PECOS enrollment, Medicare billing eligibility, and the Office of Inspector General's excluded providers database. The current version of the CarePrecise Access Complete database identifies multiple providers practicing at a single location, using super-conformed location coding.

Sunshine Incoming

CarePrecise can process incoming lists of payments to providers using the advanced record-linking technology we use to build our master databases. Whether companies have NPI numbers or not, our system can use other data to identify payees.

CarePrecise data is already in use is installations where states have various types of Sunshine laws in place, and where organizations are preparing for the federal act to take effect. When we can all finally see who's paying what to whom (to whatever extent that will be truly possible), CarePrecise data will be part of this vital next step in controlling healthcare costs and abuses of influence.