Ever wonder if the Office of Civil Rights (“OCR”) is serious about the requirements for a HIPAA Security risk analysis and policy specific to removing hardware and electronic media containing ePHI from a covered entity’s facility? Yes, the OCR is extremely serious about those requirements as Cancer Care Group, P.C. (“Cancer Care”), a radiation oncology private practice, with 13 radiation oncologists discovered after reporting a breach of ePHI.
We provide insights and analysis for physicians, nurses, chiropractors, dentists, physical therapists and other health professionals on issues impacting their practices.
The Affordable Care Act (PPACA) expanded the False Claims Act (FCA) to require providers to report and return any overpayment within 60 days of identification. Just what “identification” means under this rule has been unclear until now. With the SDNY’s recent ruling in Kane v. Healthfirst, Inc., No. 1:11-cv-02325-ER (SDNY Aug. 3, 2015), there is now guidance. The Kane decision, a whistleblower/false claims case, clarifies what constitutes “identification” for purposes of triggering FCA liability related to the 60 day rule to report overpayments.
On June 18, 2015, the US Attorney announced two investigations resulting in a number of accusations of Medicare and Medicaid fraud and abuse. The “Home Alone IV” take-down and the largest national health care fraud take-down to date involving more than 200 subjects accused of defrauding Medicare and Medicaid of more than $700 Million in 14 states. Each of these takedown operations demonstrate just how seriously the Health Care Fraud Prevention and Enforcement Action Team (HEAT) is in its efforts to reduce fraud and abuse in healthcare operations.
The OCR announced a settlement of $218,400 along with adoption of a robust plan of correction with St. Elizabeth’s Medical Center (SEMC) of Brighton, MA for alleged HIPAA violations. Before the settlement, SEMC had two different events leading up to it entering the resolution agreement with HHS. The first allegation involved a complaint to the OCR that employees were using an internet-based document sharing application to store ePHI without analyzing the associated security risks, exposing at least 498 individuals’ ePHI.
Building upon the bundled payment demonstration programs currently underway for Medicare, the Centers for Medicare and Medicaid Services (CMS) announced a proposal for a major shift in the way hospitals will be paid for hip and knee replacements. In an effort to incentivize hospitals to encourage quality and care improvements as patients transition from surgery to recovery, CMS proposed a change in the manner of payment to focus on episodes of care, rather than a piecemeal system.