1. Berrien Mental Health Authority
Compliance & HIPAA Orientation
Self-Determination CLS & Respite

2. What is Healthcare Compliance?
It’s about doing the right thing!
Following the laws & rules that govern healthcare.
Conducting yourself in a honest, responsible & ethical manner.
Reporting healthcare fraud, waste & abuse or any unethical or illegal conduct.

3. Why is Healthcare Compliance important?
The government focuses a lot of their attention on financial crimes & healthcare fraud.
Prosecuting healthcare fraud is a top priority for the Department of Justice (DOJ) & the Department of Health & Human Services (DHHS), Office of Inspector General (OIG).
Healthcare fraud costs the country tens of billions of dollars a year.

4. Seven Elements of Compliance Required by the Office of Inspector General
Written policies & procedures/Code of Conduct
Compliance Officer & Compliance Committee
On-going training & education
Maintaining open lines of communication
Enforcement of standards
On-going auditing & monitoring
Prompt response & corrective action

5. Let’s talk about some of the important laws that impact Healthcare

6. Deficit Reduction Act (DRA) of 2005
Requires education & training for employees, contractors & agents that contains detailed information about the Federal False Claims Act, Whistleblower provisions & information about preventing & detecting fraud, waste & abuse in Federal healthcare programs.
Requires written policies & procedures that include detailed provisions consistent with State & Federal False Claims Acts, Whistleblower provisions & other applicable laws.

7. Anti-Kickback Statute Exclusion Authorities
Healthcare providers may not give or receive money in exchange for the referral of consumers or services covered by Medicaid or Medicare.
Providers must ensure no Federal funds are used to pay for items or services furnished by an individual who is disbarred, suspended or excluded from participation in any Federal healthcare program.

8. Civil Monetary Penalties Law Criminal Healthcare Fraud Statue
Allows the Office of Inspector General (OIG) to impose civil penalties for violations of the Anti-Kickback Statute & other violations including submitting false statements on applications or contracts to participate in a Federal healthcare program.
Makes it a criminal offense to knowingly & willfully execute a scheme to defraud a healthcare benefit program. Healthcare fraud is punishable by prison time of up to 10 years & fines of up to $250,000. Specific intent is not required for conviction.

9. Federal False Claims Act
Federal statue that covers fraud involving any Federally funded contract or program, including the Medicaid program.
Establishes civil liability for certain acts, including:
Knowingly presenting a false or fraudulent claim to the government for payment
Knowingly making, using or causing to be made or used, a false record or statement to get a false or fraudulent claim paid or approved
Conspiring to defraud by getting a false or fraudulent claim allowed or paid
Knowingly making, using or causing to be made or used, a false record or statement to conceal, avoid or decrease an obligation to pay or transmit money or property to the government
“Knowingly” means:
Actual knowledge of the information
Acting in deliberate ignorance of the truth or falsity of the information or
Acting in reckless disregard of the truth or falsity of the information
No proof of specific intent to defraud is required!

10. Federal False Claims Act (continued)
Examples
Up-coding – Billing for more time than what you actually provided. You should only bill for the face-to-face time spent with the consumer.
Billing for services that are not medically necessary
Billing for services that were never provided
Billing for services performed by an excluded individual
Penalties
Civil monetary penalties ranging from $5,500 - $11,000 for each false claim plus three times the amount of damages incurred by the Federal government related to the fraudulent conduct
Exclusion from participation in State & Federal programs; Federal criminal enforcement for intentional participation in the submission of a false claim

11. Michigan False Claims Act
Similar to the Federal False Claims Act, with an expanded definition of “knowledge”
“Knowing” & “knowingly” means that a person is in possession of facts under which they are aware or should be aware that their conduct is substantially certain to cause the payment of a Medicaid benefit. Includes acting in deliberate ignorance of the truth or falsity of facts or acting in reckless disregard of the truth or falsity of facts. Specific intent to defraud is not required.
Allows for constructive knowledge meaning that if the conduct reflects a systematic or persistent tendency to cause inaccuracies then it may be fraud, rather than simply a good faith error or mistake.

12. Whistleblowers’ Protection Act
There is a Federal Statue & Michigan Statute.
Designed to protect against the fraudulent use of public funds by encouraging people with knowledge of fraud against the government to “blow the whistle” on wrongdoers.
Provides protection to those who report a violation or suspected violation of State or Federal law, rule or regulation to a public body; unless the person knows the report is false.
Persons reporting a violation or suspected violation may not be discharged, threatened or discriminated against for reporting a violation or suspected violation.

13. Important Definitions to Remember
Fraud – Intentional deception or misrepresentation by a person with knowledge the deception could result in unauthorized benefit to that person or some other person.
Abuse – Practices that are inconsistent with sound fiscal, business or medical practices resulting in unnecessary cost to the payer, or in reimbursement for services that are not medically necessary or fail to meet professionally recognized standards of care.
Waste – Overutilization of services or other practices resulting in unnecessary costs. Misuse of resources.

14. What does Medical Necessity mean?
The services you provide must be “reasonable & necessary for the diagnosis or treatment of illness or injury or to improve the functioning of a malformed body member.”
Medical necessity is used to describe care that is reasonable, necessary & or appropriate, based on evidence-based clinical standards of care.
Accepted healthcare services provided by healthcare providers, appropriate to the evaluation & treatment of a disease, condition, illness or injury & consistent with applicable standards of care.

15. Service Documentation
Per Michigan Medicaid Provider Manual requirements, documentation must be sufficiently detailed to allow reconstruction of what transpired for each service billed.
Documentation must be signed & dated by the person providing the service.
Documentation, including signatures must be legible.
If a signature is not legible, the person’s name should be printed or typed below.
Documentation must include a start & end time.
Only face-to-face time with consumers should be billed.
If you make an error, draw a single line through the error, mark as error, make the correction & date & initial it.

16. Health Insurance Portability & Accountability Act (HIPAA)
HIPAA is a Federal law enacted by the United States Congress in that provides data privacy & security provisions for safeguarding Protected Health Information (PHI).
It gives consumers rights over their health information & limits who can look at & receive their health information.
It has two main parts, the Privacy Rule & Security Rule.
The Department of Health & Human Services (HHS) Office of Civil Rights (OCR) is responsible for enforcing HIPAA.

17. HIPAA Security Rule
“Covered entities must ensure the confidentiality, integrity & availability of all ePHI (electronic PHI) the covered entity creates, receives, maintains or transmits.
The Security Rule applies to safeguarding ePHI (e.g. PHI stored on computers, sent via ).
Requires covered entities to protect against any reasonably anticipated threats or hazards & reasonably anticipated unpermitted uses or disclosures, to the security or integrity of ePHI.
Requires covered entities to have Administrative, Physical & Technical safeguards in place.

18. HIPAA Privacy Rule
“A covered entity may not use or disclose PHI, except as permitted or required…”
“Use” means internal review of use of PHI (e.g. customer service, quality improvement activities).
“Disclose” means release of PHI externally (e.g. faxing records to a provider).
The most common use or disclosure of PHI is for “TPO,” or treatment, payment or health care operations.
HIPAA allows for the use or disclosure of PHI for the purpose of TPO without consumer consent.
However, the Michigan Mental Health Code does NOT.

19. Michigan Mental Health Code
“Information in the record of a recipient & other information acquired in the course of providing mental health services to a recipient, shall be kept confidential & shall not be open to public inspection. The information may be disclosed outside the department, community mental health services program, licensed facility, or contract provider, whichever is the holder of the record, only in the circumstances & under the conditions set forth in this section or section 748a.
Amended effective April 10th, 2017 to allow for disclosure of PHI for Treatment, Payment & Coordination of care in accordance with HIPAA.
Best Practice: Always obtain a valid Release of Information to ensure compliance with the MI Mental Health Code!

20. Michigan Mental Health Code (continued)
Treatment: The provision, coordination or management of healthcare & related services by one or more healthcare providers, including the coordination or management of healthcare by a healthcare provider with a 3rd party; consultation between healthcare providers relating to a consumer; or referral of a consumer for healthcare from one healthcare provider to another.
Payment: Activities undertaken by (1) A health plan to obtain premiums or to determine or fulfill its responsibility for coverage & provision of benefits under the health plan; or (2) A healthcare provider or health plan to provide reimbursement for the provision of healthcare.
Includes: eligibility/coverage determinations, adjudication of claims, billing, medical necessity review, utilization review activities including pre-authorization & concurrent & retrospective reviews.

21. Michigan Mental Health Code (continued)
Coordination of Care: Not specifically defined by HIPAA or the MI Mental Health Code
If PHI is being shared between healthcare providers, it may fall under the purpose of, “Treatment.”
If PHI is being shared between entities that are not healthcare providers (e.g. PIHP & MHP), then disclosure of PHI is limited to entities that have a current or past relationship with the consumer who is the subject of the PHI & the PHI must pertain to such relationship (45 CFR (c)(4)).
The MI Mental Health Code allows for “Coordination of Care” which is just a piece of HIPAA, “Healthcare Operations.”

22. Substance Use Disorder (SUD) Records
“Records of the identity, diagnosis, prognosis or treatment of any patient which are maintained in connection with the performance of any drug abuse prevention function conducted, regulated or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e) of this section, be confidential & be disclosed only for the purposes & under the circumstance expressly authorized…”
Prohibits even acknowledging an individual as a recipient of services
Requires a very specific, detailed Release of Information (ROI)
Requires information that is disclosed to include a Prohibition on Redisclosure
No information regarding a consumer should be release without a valid, 42 CFR Part 2 – compliant ROI

23. Confidentiality of HIV/AIDS Information
“HIV-related information is confidential & cannot be released unless the consumer authorizes disclosure, or a statutory exception applies. This confidentiality statute applies to all reports, records & data pertaining to testing, care, treatment, reporting & research & information pertaining to partner counseling & referral services (formerly known as partner notification) under section 5114a, that are associated with the serious communicable diseases or infections of HIV & AIDS.”
The consumer must sign a release of information containing a SPECIFIC statement if the release is to cover HIV-related information in the records before the information can be released.

24. What is Protected Health Information (PHI)?
Any individually identifiable health information transmitted or maintained in electronic, paper or oral form by a covered entity or its business associate (e.g. consumer name, DOB, SSN).
It includes the reason a person is seeking treatment or any observations about their condition or past health condition.
It is any information that identifies the individual or a reasonable assumption can be made as to the identity of the individual.

25. What is a breach of PHI?
A breach of PHI is the unauthorized access, use or disclosure of PHI that compromises the security or privacy of that information (e.g. faxing consumer information to the wrong place).
A breach can be deliberate or accidental.
All MUST be reported immediately to Riverwood Center’s Compliance Department.
If you suspect or know of any situation involving a potential breach, it is your responsibility to report it.

26. Important Things to Remember
You must keep consumer information safe at all times!
Best practice is to always obtain a release of information to ensure compliance with HIPAA & the Michigan Mental Health Code.
Do not access consumer information or disclose it to anyone unless your job requires you to do so & the consumer has indicated it is okay for you to do so by signing an authorization to release their information.
Protect consumer information as if it was your own!

27. Consequences of Violations
Civil & Criminal actions brought on by law enforcement agencies
Exclusions from participating in Federal healthcare programs
Penalties under the Civil Monetary Penalties Law (hefty fines)
Corporate Integrity Agreements (CIAs) could be imposed
Reputation in the community
Termination of contract
On-going reviews at the local, State & Federal level of CLS/Respite services & documentation
Costly litigation/legal fees
Personal harm to the consumer

28. Reporting Responsibilities
If you are aware or suspicious of any type of Compliance/HIPAA violation including, but not limited to:
Fraud, Waste or Abuse
Violations of Whistleblower protections
Violations of HIPAA or the Michigan Mental Health Code regarding the privacy & confidentiality of consumer information
Conflicts of Interest
Unethical conduct
It is your right & responsibility to report it to Riverwood’s Director of Regulatory Compliance, Cynthia Bingaman.

29. When in doubt, point it out!
Thank you
Cynthia Bingaman or
Dana Skidmore or
Deb Olsen or
Anonymous Hotline
When in doubt, point it out!