Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved 1 Chapter 02 Compliance, Privacy, Fraud, and Abuse in Insurance Billing Insurance Handbook for the Medical Office 13 th edition
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Protected Health Information and the Privacy Rule 1. Define compliance. 2. Name the two provisions of the Health Insurance Portability and Accountability Act (HIPAA) that relate most to health care. 3. Explain the difference between Title I Insurance Reform and Title II Administrative Simplification. 4. Describe the Privacy Rule under HIPAA. 2 Lesson 2.1
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Protected Health Information and the Privacy Rule (cont’d) 5. Define protected health information (PHI). 6. Identify the difference between disclosure and use of PHI. 7. Illustrate the difference between privileged health information and nonprivileged information. 3 Lesson 2.1
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Compliance Defined All regulations, recommendations, and expectations of regulating agencies must be met to be in compliance. The professional elements of the principles and practice include: Regulations and recommendations to protect individuals Supporting system-wide stability Streamline processes A compliance strategy provides a standardized process to enable consistent and effective compliance management. 4
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Health Insurance Portability and Accountability Act Two provisions of HIPAA Title I: Health Insurance Reform Provides continuous insurance coverage for workers and their insured dependents Title II: Administrative Simplification Development and implementation of standardized electronic transactions Implementation of privacy and security procedures Clearinghouse 5
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Health Insurance Portability and Accountability Act Key terms Covered entity Electronic media Healthcare provider Security officer Transaction HIPAA in the Practice Setting Privacy Officer (PO) Business Associate Policies and Procedures (P&P) State Preemption 6
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved The Privacy Rule: Confidentiality and Protected Health Information Key terms Protected health information (PHI) Privacy Confidentiality Disclosure Consent form Authorization form Individually identifiable health information (IIHI) Use 7
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved The Privacy Rule: Confidentiality and Protected Health Information Authorization for Release of Information Form 8
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved The Privacy Rule: Confidentiality and Protected Health Information Consent Form for Use and Disclosure of Information 9
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved The Privacy Rule: Confidentiality and Protected Health Information Confidential Information Billing specialist is responsible for maintaining the confidentiality of patients’ protected health information (PHI) Certain information or communications are excepted from the HIPAA rule Breach of confidential communication Considered a HIPAA violation 10
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Confidential Information 11
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved The Privacy Rule: Confidentiality and Protected Health Information Privileged Information Relates to the patient’s treatment and progress Patient must sign an authorization to release this information Nonprivileged Information Ordinary facts unrelated to the patient’s treatment Example: Name, address, insurance information, etc. Patient’s authorization is not needed for most information Information is disclosed on a legitimate need-to- know basis 12
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Health Insurance Portability and Accountability Act (HIPAA) 8. Explain patient rights under HIPAA. 9. Explain responsibilities of the health care organization to protect patient rights under HIPAA. 10. State the guidelines for HIPAA privacy compliance. 13 Lesson 2.2
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Health Insurance Portability and Accountability Act (HIPAA) (Cont’d) 11. List the three major categories of security safeguards under HIPAA. 12. Define the provisions of the HITECH act. 13. List the civil and criminal penalties of noncompliance with HIPAA regulations. 14 Lesson 2.2
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Patients’ Rights Privacy Rules: Patients’ Rights Under HIPAA Right to Notice of Privacy Practices (NPP) Right to request restrictions on certain uses and disclosures of PHI Right to request confidential communications Right to access (inspect and obtain a copy) PHI Right to request an amendment of PHI Right to receive an accounting of disclosures of PHI 15
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Obligations of the Health Care Provider Policy and Procedures Verification of Identity and Authority Validating Patient Permission Training Safeguards Complaints and Workforce Sanctions Mitigation Refraining from Intimidating or Retaliatory Acts 16
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved The Security Rule: Administrative, Physical, and Technical Safeguards Three Safeguards (security measures encompassing an information system) Administrative Protect through administrative actions Technical Protect and control access to information on computer systems Physical Prevent unauthorized use or disclosure due to physical events 17
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Health Information Technology for Economic and Clinical Health Act Provision of American Recovery and Reinvestment Act (ARRA) Strengthens HIPAA Privacy protections and rights Brought compliance changes to three areas Business associates Notification of breach Civil penalties for noncompliance 18
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Consequences of Noncompliance with HIPAA and the HITECH Act Civil Monetary Penalties (CMP) Law Monetary fines (civil and/or criminal) Imprisonment (criminal) 19
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Fraud and Abuse 14. Identify the difference between fraud and abuse. 15. Identify the Federal and State laws that regulate health care fraud and abuse. 16. List the various fraud and abuse audit programs. 17. Describe the basic components of an effective compliance program. 20 Lesson 2.3
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Fraud and Abuse Laws OIG promotes “efficiency and economy in departmental operations” Fraud: Knowingly, willingly, and intentionally submit false information See Box 2-9 in textbook for specific examples Abuse: Inconsistent with accepted medical business or fiscal practices 21
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Fraud and Abuse Laws Federal False Claims Act Qui Tam Provision Criminal False Claims Act Stark I and II Anti-Kickback Statute Safe Harbors Additional Laws and Compliance 22
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Compliance Program Guidance for Individual and Small Group Physician Practices Compliance Plan Internal monitoring and auditing Implementing compliance and practice standards Designate a compliance officer Training and education Responding to offenses and developing corrective action Open lines of communication Enforcing disciplinary standards 23
Copyright ©2014 by Saunders, an imprint of Elsevier Inc. All rights reserved Questions? 24