was successfully added to your cart.
Category

Compliance

Compliance Consultant

Compliance Consultant Explains Active Treatment

By | Compliance, Compliance Consultant | No Comments

As a compliance consultant,I find that a high percentage of chiropractors are guilty of providing only passive therapies to their patients.

In fact, third-party payers have coined the phrase M.U.S.H. for chiropractic treatment. This is an acronym for manipulation, ultrasound, stem, and heat.

Due to the increasing amount of evidence-based research and increased scrutiny on the chiropractic profession by insurance carriers, prolonged use of passive therapies is frowned upon and could be a red flag for doctors.

Insurance carriers require providers to prove medical necessity of the treatment they provide and show a direct therapeutic relationship to the services rendered.

 

Based on research, carriers feel that prolonged passive therapy leads to dependence by the patient for symptom relief, and do nothing to improve the patient’s complaints in the long run.

Since passive therapies are typically used in the initial, acute phase of care to reduce pain and swelling, their clinical effectiveness tends to decline after one to two weeks of treatment.

In fact, the Council on Chiropractic Guidelines & Practice Parameters, stated, “Although passive care methods for pain or discomfort may be initially emphasized, “active” (ie, exercise) care should be increasingly integrated to increase function and return the patient to regular activities.”

It recommended that physicians limit the use of therapeutic modalities only to, “facilitate the shift from passive-to-active care and not dependency on passive modalities with limited evidence of efficacy.”

 As a compliance consultant, I tell my clients that when moving to active care, the goal of treatment is to improve functional deficits, increase the strength and endurance of a given area, and minimize the potential for re-injury or exacerbation of the patient’s chief complaint.

Therefore, Insurance carriers not only encourage active rehabilitative care, they see it as the natural progression of treatment and feel it justifies the medical necessity of longer treatment.

Additionally, encouraging patient participation in treatment incentivizes the patient to continue treatment once their pain has improved in an effort to prevent future problems.

It’s a win-win for everyone involved because improving the patient’s functional weakness is the best thing for your patients, and insurance companies pay more for active therapies than passive care.

Having taught human performance and sports rehabilitation on the college level, I know there are many different ways to approach active care besides having a full-size gym in your office or employing physical therapists or athletic trainers.

With a little knowledge, you can develop a viable rehab program in your office for less than $200.00. In addition, you make more money while minimizing denials, request for more information to justify treatment, and being flagged for an audit.

If you have any questions or would like additional information, don’t hesitate to contact one of our compliance consultants at 800-509-0538

Get Ready for Medicare Provider Enrollment Revalidation

By | Compliance, Medicare | No Comments

Section 6401 (a) of the Patient Protection and Affordable Care Act established a requirement for all enrolled providers to revalidate their Medicare enrollment information roughly every five years to prevent fraud within the Medicare system by ensuring that Medicare provider records are accurate.

Cycle 2 Revalidation began on February, 2016. Basically this means a physician’s maintenance of the Medicare billing privileges cycle. Simply put, revalidation is re-enrollment and all providers are required to revalidate their enrollment information.

If the provider doesn’t submit a complete revalidation application by their specific due date, the Medicare Administrative Contractor (MAC) may hold your Medicare payments or deactivate your Medicare billing privileges.

Typically, your Medicare Administrative Contractor (MAC) will send a revalidation notice within two to three months prior to your revalidation due date either by mail or to the email address reported on prior applications indicating the providers due date.

Note that your MAC must receive your enrollment application within 60 days of the revalidation request.

The best way to prevent a lapse in coverage is to verify your due date, listed on  Data.CMS.gov/revalidation. The list will include all enrolled providers and will display the provider’s revalidation due date. In addition, a crosswalk to the organizations that the individual provider reassigns benefits will also be available as well.

For providers not up for revalidation, the list will display a “TBD” (To Be Determined) in the due date field. This means the provider’s due date is more than 6 months away.

The list was revised on April 10, 2017. All dates are updated every 60 days at the beginning of the month and are listed up to 6 months in advance. Do not submit a revalidation if you have not received an email/mailed letter from your MAC requesting you to revalidate, or your due date is not listed on the CMS revalidation website. If you do, it will be considered an unsolicited revalidation and will be returned.

If you are within 2 months of the listed due date on the CMS revalidation website and have not received a notice from their MAC to revalidate, as a chiropractic consultant I recommend that you make every effort to submit your revalidation application immediately.

The most efficient way to submit your revalidation information is thru the Internet Based PECOS. Here you can review information currently on file, update and submit your revalidation and electronically sign after uploading the supporting documents. If you wish, you can just print out your revalidation , sign and date it  and then mail your paper certification along with supporting documentation to your Medicare Administrative Contractor (MAC).

It is important that providers check their due date immediately in order to avoid a hold on your Medicare payments.

If you have any questions or need help, don’t hesitate contacting the ACS or Dr. Davenport at complianceandauditingservices.com.

All the Best,

Dr. John Davenport DC, CCSP, FIAMA, MCSP, CIC

Certified Compliance and Insurance Consulting Services

Locum Tenens and Compliance

By | Compliance, Insurance Coding | No Comments

As the compliance officer for Compliance & Auditing Services, I receive questions from chiropractic physicians from all over the country on chiropractic compliance.

This question came to me from a doctor in Florida looking for guidance regarding office coverage. Dr. Jonathan asked, “If I have a doc covering my office that is not in-network when I am out of the office can I still bill under my license/insurance participation? I’m asking about Medicare as well.”

This isn’t the first time I have been asked this question, so to help the other doctors who follow this site for compliance information, here is the answer to the question on locum tenens doctors.

It is a general practice for physicians to retain substitute physicians to take over their professional practices when the regular physicians are absent for reasons such as illness, pregnancy, vacation, or continuing education.

These substitute physicians are generally referred to as “locum tenens” physicians and the regular physician generally pays the substitute physician a fixed amount per diem, with the substitute physician having the status of an independent contractor rather than of an employee.

Medicare and many third-party payers do allow physicians to bill for services performed by locum tenens physicians during their absence and for the regular physician to bill and receive payment for the substitute physician’s services as though he/she performed them.

Under Section 125(b) of the Social Security Act, a regular physician may bill for the services of a locum tenens physicians if:

  • The regular physician is unavailable to provide the services.
  • The Medicare beneficiary has arranged for or seeks to receive the visit services from the regular physician.
  • The regular physician pays the locum tenens for his/her services on a per diem or similar fee-for-time basis. You cannot pay a locum a salary or have a revenue based incentive payment agreement.
  • The locum physician does not provide or bill for services to Medicare patients over a continuous period of longer than 60 days.

Billing Procedures:

Medicare requires claims for services provided by a locum physician to include the Q6 modifier, which designates services were performed by alocum tenens physician, in box 24D of the CMS-1500 form. The regular physician’s provider identification number goes in box 24J.

Regarding all other insurance carriers, the billing procedures would typically be the same, as most carriers follow the same guidelines set forth by Medicare. It is important that you review the contract that you have with each insurance carrier that you are contracted with to make sure of their individual policies for locum physicians.

If you need a question answered or need help with office compliance, Compliance & Auditing Services is here to help. The certified specialist at Compliance & Auditing Services help chiropractors handle compliance issues and you set up a compliance program that meets all state and federal laws with confidence.

If you have any questions about Locum Tenens or  chiropractic compliance leave a comment or just call us.

 

 

Florida Compliance Court Ruling

By | Compliance | No Comments

file451297827287By now, most of you have heard bits and pieces about a Florida Court decision involving Allstate, and ultimately, your practice.  I wanted to take a minute and summarize what has really happened.

Beginning in 2008, Allstate has been reimbursing PIP claims at 200% of Medicare B fee schedule.  Allstate has been challenged about its “subject to” fee schedule language.  The argument has been that the language used by Allstate was insufficient in explaining to providers and insureds about how it would pay 200% of the Medicare fee schedule.

The First District Court of Appeal decided several months ago that Allstate had provided sufficient notice in its policy language, thereby supporting Allstate.

This week however, the Fourth District Court of Appeal found differently – and this is important.  Their opinion conflicts with the prior decision of the First Court of Appeal.  This is encouraging because it provides greater grounds for the Florida Supreme Court to review the first decision.

So, for providers hoping to recoup additional money from Allstate, this is encouraging, but it’s not yet a done deal.  The differing opinions of the two appellate courts provide reason for Supreme Court review; but this hasn’t happened yet.  So, be alert and hopeful, but keep it in perspective (To read the recent court decision in its entirety below)!

As always, feel free to contact me about compliance issues and current events related to the well being of your practice.  You can reach me via email: DrJohn@ComplianceandAuditingServices.com or the FCPA website.



DISTRICT COURT OF APPEAL OF THE STATE OF FLORIDA FOURTH DISTRICT

ORTHOPEDIC SPECIALISTS, as Assignee of KELLI SERRIDGE, Appellant,

ALLSTATE INSURANCE COMPANY,

Appellee.

Nos. 4D14-287, 4D14-288, 4D14-289, 4D14-290, 4D14-291, 4D14-292, 4D14-293, 4D14-294, 4D14-295, 4D14-296, 4D14-297, 4D14-298, 4D14-299, 4D14-300, 4D14-301, 4D14-302, 4D14-303, 4D14-304, 4D14-305, 4D14-306, 4D14-307, 4D14-308, 4D14-309, 4D14-310, 4D14-311, 4D14-312, 4D14-313, 4D14-314, 4D14-315, 4D14-316, 4D14-317 and 4D14-318

[August 19, 2015] Appeal from the County Court for the Fifteenth Judicial Circuit, Palm

Beach County; Ted 502012SC002031XX, 502012SC003172XX, 502012SC003679XX, 502012SC003690XX, 502012SC003696XX, 502012SC004809XX, 502012SC020766XX, 502012SC021284XX, 502012SC021797XX, 502013SC001002XX, 502013SC003154XX,

  1. Booras, Judge; 502012SC002035XX, 502012SC003182XX, 502012SC003682XX, 502012SC003692XX, 502012SC003732XX, 502012SC006658XX, 502012SC020782XX, 502012SC021295XX, 502012SC022899XX, 502013SC001003XX,

and 502013SC005090XX.

L.T. Case Nos. 502012SC003157XX, 502012SC003677XX, 502012SC003683XX, 502012SC003695XX, 502012SC004802XX, 502012SC007634XX, 502012SC020791XX, 502012SC021678XX, 502013SC000982XX, 502013SC001823XX,

Gary M. Farmer, Sr. of Farmer Jaffe Weissing Edwards Fistos & Lehrman P.L., Fort Lauderdale; David M. Caldevilla of De La Parte & Gilbert, P.A., Tampa; and Stephen Deitsch, William Foman and Lindsay Porak of Deitsch & Wright, P.A., Lake Worth, for appellants.

Suzanne Y. Labrit and Douglas G. Brehm of Shutts & Bowen LLP, Tampa; and Peter J. Valeta of Meckler Bulger Tilson Marick & Pearson LLP, Chicago, Illinois, for appellee.

CIKLIN, C.J.

This appeal comprises thirty-two consolidated cases in which PIP claims were brought by medical services providers (“the Providers”) against the appellee, Allstate Insurance Company (“Allstate”), under no- fault insurance policies issued to their insureds. At issue is whether, as asserted by the Providers, the language in the Allstate policy is ambiguous as to Allstate’s election to reimburse the Providers pursuant to certain Medicare fee schedules provided for in section 627.736(5)(a)2., Florida Statutes (2009). The trial court agreed with Allstate and found that the policy language was, in fact, not ambiguous and certified the following question to this court:

Whether the Defendant’s PIP insurance policy language is legally sufficient to authorize [Allstate] to apply the [Medicare fee schedule] reimbursement limitations set forth in section 627.736(5)(a)2., Florida Statutes.

We answer that question in the negative, finding the policy language to be inherently unclear and reverse the summary judgment entered in favor of Allstate.

The only dispute between the parties concerns the meaning of a particular endorsement to the policy. The policy provision language chosen by Allstate resulted in the trial court’s decision to enter the underlying summary judgment for Allstate.

The policy provides the following in pertinent part with respect to PIP benefits:

Allstate will pay to or on behalf of the injured person the following benefits:

  1. Medical Expenses
    Eighty percent of all reasonable expenses for medically necessary medical, surgical, X-ray, dental, and rehabilitative services, including prosthetic devices, and medically necessary ambulance, hospital, and nursing services.

An endorsement to the policy provides the following: Limits of Liability
….

-2-

Any amounts payable under this coverage shall be subject to any and all limitations, authorized by section 627.736, [which would apply a Medicare fee schedule limitation] or any other provisions of the Florida Motor Vehicle No-Fault Law, as enacted, amended or otherwise continued in the law, including, but not limited to, all fee schedules.

(Emphasis added).

The Providers argue that the “shall be subject to” provision in the endorsement is ambiguous, as it is unclear whether Allstate has actually and in fact elected to limit its reimbursements to the Providers under the Medicare fee schedules as provided for in section 627.736(5)(a)2.-5., Florida Statutes (2009), or is simply announcing that it is reserving its right to elect to do so. They analogize the policy at issue here to the ones found lacking in Geico General Insurance Co. v. Virtual Imaging Services, Inc., 141 So. 3d 147 (Fla. 2013) (“Virtual Imaging”), and Kingsway Amigo Insurance Co. v. Ocean Health, Inc., 63 So. 3d 63 (Fla. 4th DCA 2011) (“Kingsway”). In those cases, the courts found that the bare reference to the PIP statute was insufficient to put the insured and providers on notice that the insurer was, in fact, electing to employ the Medicare fee schedules. The Providers argue the language in the instant policy is similarly vague and only permissive in nature and merely incorporates the PIP statute. Our decision hinges on interpretation of contract of insurance language; thus our review is de novo. See Virtual Imaging, 141 So. 3d at 152 (citations omitted).

Historical Context

Provisions of the PIP statute, section 627.736, Florida Statutes, are at the center of the instant controversy. The statute lays out the benefits that a personal injury protection policy must provide and the methods of calculating reimbursements thereunder. Subsection 627.736(1)(a), Florida Statutes (2012), provides that “[e]very insurance policy . . . shall provide personal injury protection” to specified individuals as follows: “Medical benefits – Eighty [80] percent of all reasonable expenses for medically necessary medical . . . services.” As recognized by the Florida Supreme Court in Virtual Imaging, this provision requiring reimbursement of eighty percent of reasonable expenses for medically necessary services is “a basic coverage mandate” which is “the heart of the PIP statute’s coverage requirements.” 141 So. 3d at 155. Section 627.736(5)(a)1., Florida Statutes (2009), recites factors to consider in determining reasonableness.

-3-

As explained in Virtual Imaging, the statute was amended in 2008 to provide an additional method of calculating reasonableness. Virtual Imaging, 141 So. 3d at 156. Section 627.736(5)(a)2., Florida Statutes (2008), provides an alternative way in which “[t]he insurer may limit reimbursement to 80 percent” of a recited schedule of maximum charges, many of which are tied to Medicare fee schedules. For example, subsection 627.736(5)(a)2.f., Florida Statutes (2008), provides that insurers may limit reimbursement to “200 percent of the allowable amount under the participating physicians schedule of Medicare Part B.”1

In Virtual Imaging, the Florida Supreme Court explained that an insurer’s Medicare fee schedule election under section 627.736(5)(a)2. does not conflict with the basic “reasonable expenses” coverage mandate of section 627.736(1). Id. at 157. By electing to utilize the Medicare fee schedules, an insurer meets the mandate of providing “reasonable expenses” coverage. Id. The court further explained the effect of the 2008 amendments:

[T]he 2008 amendments provided an alternative, permissive way for an insurer to calculate reimbursements to satisfy the PIP statute’s reasonable medical expenses coverage mandate, but did not set forth the only methodology for doing so.

The 2008 fee schedule amendments used the word “may” to describe an insurer’s ability to limit reimbursements based on the Medicare fee schedules. See § 627.736(5)(a)2., Fla. Stat. . . . [I]f an insurer is not required to use the Medicare fee schedules as a method of calculating reimbursements, the insurer must have “recourse to some alternative means for determining a reimbursement amount” if it chooses not to use the Medicare fee schedules. . . .

This alternative calculation mechanism is the same mechanism that was in place before the Legislature amended the PIP statute to incorporate the Medicare fee schedules: in the event of a dispute, a fact-finder must determine whether

1 The statute was again amended in 2012 to add the following requirement: “Effective July 1, 2012, an insurer may limit payment as authorized by this paragraph only if the insurance policy includes a notice at the time of issuance or renewal that the insurer may limit payment pursuant to the schedule of charges specified in this paragraph.” Virtual Imaging, 141 So. 3d at 154 (emphasis in original) (quoting section 627.736(5)(a)5., Fla. Stat. (2012)).

-4-

the amount billed was reasonable. The permissive language of the 2008 amendments, therefore, plainly demonstrates that there are two different methodologies for calculating reimbursements to satisfy the PIP statute’s reasonable medical expenses coverage mandate.

….

Accordingly, we conclude that the 2008 amendments were clearly permissive and offered insurers a choice in dealing with their insureds as to whether to limit reimbursements based on the Medicare fee schedules or whether to continue to determine the reasonableness of provider charges for necessary medical services rendered to a PIP insured based on the factors enumerated in section 627.736(5)(a)1. In other words, we do not conclude that payment under section 627.736(5)(a)2. could never satisfy the PIP statute’s basic “reasonable expenses” coverage mandate, set forth in section 627.736(1). Instead, what we conclude is that the fee schedule payment calculation methodology in section 627.736(5)(a)2. was permissive.

Id. at 156-57 (footnote and internal citations omitted). Analysis

Insurance Contract Interpretation

The Florida Supreme Court has elaborated on insurance contract language interpretation:

Where the language in an insurance contract is plain and unambiguous, a court must interpret the policy in accordance with the plain meaning so as to give effect to the policy as written. In construing insurance contracts, “courts should read each policy as a whole, endeavoring to give every provision its full meaning and operative effect.” Courts should “avoid simply concentrating on certain limited provisions to the exclusion of the totality of others.” However, “[p]olicy language is considered to be ambiguous . . . if the language ‘is susceptible to more than one reasonable interpretation, one providing coverage and the other limiting coverage.’”

-5-

Washington Nat’l Ins. Corp. v. Ruderman, 117 So. 3d 943, 948 (Fla. 2013) ((alteration in original) (internal citations omitted). “Further, in order for an exclusion or limitation in a policy to be enforceable, the insurer must clearly and unambiguously draft a policy provision to achieve that result.” Virtual Imaging, 141 So. 3d at 157.

‘“Whether a document is ambiguous depends upon whether it is reasonably susceptible to more than one interpretation. However, a true ambiguity does not exist merely because a document can possibly be interpreted in more than one manner.’” Smith v. Shelton, 970 So. 2d 450, 451 (Fla. 4th DCA 2007) (citation omitted). “In the event policy provisions are ambiguous . . . then well-established rules of construction must be applied. The most basic of these rules is that ambiguous policy provisions are to be construed in favor of the insured and against their drafter, the insurer.” Discover Prop. & Cas. Ins. Co. v. Beach Cars of W. Palm, Inc., 929 So. 2d 729, 732 (Fla. 4th DCA 2006) (citations omitted).

Alleged Ambiguity of Subject Policy Language

The Providers argue that the language in the endorsement is ambiguous, and that the trial court’s ruling is contrary to Kingsway and Virtual Imaging. Those cases did not involve policies that referenced the Medicare fee schedules, as does the policy here. Instead, those policies broadly referenced the PIP statute. The policy in Kingsway “cite[d] the No-Fault Act, state[d] it will pay ‘80% of medical expenses,’ and define[d] medical expenses as those that it is required to pay ‘that are reasonable expenses for medically necessary . . . services.’” Kingsway, 63 So. 3d at 67. This court rejected the argument that “because the PIP statute is incorporated into the policy, [the insurance company] had the unilateral right to ignore the only payment methodology referenced in the policy.” Id. We adopted the trial court’s reasoning, which relied on State Farm Florida Insurance Co. v. Nichols, 21 So. 3d 904 (Fla. 5th DCA 2009):

If the [insurer] wanted to take advantage of the permissive fee schedule, it should have clearly and unambiguously selected that payment methodology in a manner so that the insured patient and health care providers would be aware of it.

Kingsway, 63 So. 3d at 68 (alteration in original).

In Virtual Imaging, the insurance policy also merely referenced the PIP statute and with no specific reference to the Medicare fee schedules. It provided the following:

-6-

Under Personal Injury Protection, the Company [GEICO] will pay, in accordance with, and subject to the terms, conditions, and exclusions of the Florida Motor Vehicle No- Fault Law, as amended, to or for the benefit of the injured person:

(a) 80% of medical expenses . . . .

Virtual Imaging, 141 So. 3d at 157. In finding that this language was not sufficient for the insurance company to utilize the fee schedule limits, the Florida Supreme Court pointed out that “[t]he . . . policy does not include any reference to the Medicare fee schedules . . . .” Id. at 158. The court agreed with the reasoning in Kingsway and held that in order to limit coverage to the Medicare fee schedules, “the insurer must clearly and unambiguously elect the permissive payment methodology . . . .” Id.

Here, providing that any amounts payable would be “subject to” “any and all limitations” authorized by the statute or any amendments thereto, Allstate did nothing more than state the obvious by indicating that there was a possibility (and the statutory authorization) for Allstate to apply a specific reimbursement limitation. The only reasonable way to read the language is as a general recital of Allstate’s reservation of its right to apply limitations authorized by law, with the accompanying and corresponding obligation to notify its policy holders of the election.

We cite to the solid reasoning contained in a final judgment penned by County Judge Robert W. Lee, who cogently parsed the language at dispute here and found it to be ambiguous:

The “subject to provision” is intrinsically ambiguous, with many possible meanings. In context all of them create ambiguity. See Affinity Internet Inc. v. Consol. Credit Couns. Serv., Inc., 920 So. 2d 1286, 1289 (Fla. 4th DCA 2006) . . . (subject to means “liable, subordinate, inferior, obedient to; governed or affected by; provided; answerable” (quoting BLACK’S LAW DICTIONARY 1425 (6th ed[.] 1990)). In fact its customary legal use is really only to “indicate a condition to one party’s duty of performance and not a promise by the other.” BGT Group Inc. v. Tradewinds Eng. Serv. LLC, 62 So. 3d 1192 (Fla. 4th DCA 2011) . . . (because of lack of detailed description of terms in document referred to as subject to, terms could not be deemed binding on party). Allstate’s “subject to provision” just incants a statutory truism, namely that all PIP policies are subject to the PIP statute. Allstate’s

-7-

“subject to provision” fails to state anywhere in clear, plain text that it will not pay 80% of medically necessary services – which its primary coverage clause requires. Nor does Allstate express in any way that it pay no more than FS 627.736(5)(a)(2)(a-1) allow. Giving due effect to all relevant words, Allstate fails to state anywhere in explicit, plain, simple, apt words that Allstate will not pay 80% of reasonable charges and will actually limit payment to FS 627.736(5)(a)(2)(a-f).

In DPI of North Broward LLC (a/a/o Lauren Goldstein v. Allstate Fire and Cas. Co., 20 Fla. L. Weekly Supp. 161a (Fla. Broward County, Cnty. Ct. 2012) (Lee, J.) this Court held:

By use of the phrase “subject to,” Allstate has not incorporated the optional provisions of the Medicare fee cap into the policy. See St. Augustine Pools, Inc. v. James M. Barker, Inc., 687 So. 2d 957, 958 (Fla. 5th DCA 1997) . . . (the words “subject to” in a contract are distinct from “incorporating” provisions of another document). Allstate has said nothing more than what is already true. All PIP policies are “subject to” these provisions; however, Allstate must clearly and unambiguously take the next step to incorporate these optional provisions into the policy if it desires to use the alternative methodology provided.

….

For Allstate to be allowed, after the fact, to pick and choose which ‘limitation’ amongst “any and all limitation” would render the Supreme Court’s ruling in [Virtual Imaging] meaningless.

Synergy Chiropractic & Wellness Ctr., Inc. v. Allstate Prop. & Cas. Ins. Co., 22 Fla. L. Weekly Supp. 750a (Broward County Court, Jan. 20, 2015) (footnote omitted).

The Word “Shall”

Allstate relies on the placement of the word “shall,” to precede the words, “be subject to.” According to Allstate, the use of the word “shall” removes any possible ambiguity regarding whether the fee schedule limitations were to be applied: “This is a clear election which puts the insured on notice of Allstate’s intent to limit reimbursements in

-8-

accordance with the fee schedules.”

We agree with the Providers that this single word, read in the context of the entire policy, does not transform an ambiguous provision to one that is unambiguous. The word “shall” is meaningless because it simply emphasizes the obvious. Broken down to its most simple form, Allstate’s policy says that “any amounts payable under this coverage shall be subject to any and all limitations” in the PIP statute. The policy text does not say that the limitations “shall be applied”; only that they shall be subject to being applied. The word “shall” does not make it clear whether Allstate will utilize the alternative method or is simply recognizing its entitlement to do so.2

The First District’s Opinion in Stand-Up

Our sister court recently found the provision at issue here to be unambiguous and legally sufficient to give the required notice to policy holders. In Allstate Fire & Casualty Insurance v. Stand-Up MRI of Tallahassee, P.A., 40 Fla. L. Weekly D693 (Fla. 1st DCA Mar. 18, 2015), the First District reasoned that the plain language of the “subject to” provision “gives sufficient notice of [Allstate’s] election to limit reimbursements by use of the fee schedules.” Id. at 694. The court was persuaded by the use of the word “shall” in the provision. Id. The court also opined that Virtual Imaging provides for a “simple notice requirement,” and that the policy in Virtual Imaging was found deficient because it “failed to ‘indicate in any way . . . that it intended to limit its reimbursement to a predetermined amount of set reasonable medical expenses’ using the fee schedules.” Id. (quoting Virtual Imaging, 141 So. 3d at 158-59).

Although the Virtual Imaging court took note that the policy at issue was devoid of any indication that the insurer elected the Medicare fee schedules, this does not in turn mean that any type of reference to the fee schedules will suffice. Virtual Imaging’s central holding is clear: To elect a payment limitation option, the PIP policy must do so “clearly and unambiguously.” A policy is not sufficient unless it plainly and obviously limits reimbursement to the Medicare fee schedules exclusively. The policy cannot leave Allstate’s choice of reimbursement method in limbo under the guise of the words, “subject to” without incorporating specific words to that effect. The policy must make it inescapably discernable

2 Allstate’s policy language simply incorporates the PIP statute (including but not limited to all fee schedules) into its insurance contract. Allstate reserves a plethora of options for itself but does not specify or enumerate anything.

-9-

that it will not pay the “basic” statutorily required coverage and will instead substitute the Medicare fee schedules as the exclusive form of reimbursement.

Dozens of courts have weighed in on the meaning of the language at issue in this appeal, and there is a sharp divide as to whether the language is legally sufficient to invoke utilization of the Medicare fee schedules and thereby meet its statutory duty to provide clarity and specificity. And to be sure, Allstate owns the burden to avoid latent ambiguity. See Ruderman, 117 So. 3d at 950 (recognizing, with regard to ambiguous language, that ‘“[i]t has long been a tenet of Florida insurance law that an insurer, as the writer of an insurance policy, is bound by the language of the policy, which is to be construed liberally in favor of the insured and strictly against the insurer’” (quoting Berkshire Life Ins. Co. v. Adelberg, 698 So. 2d 828, 830 (Fla. 1997))). While we recognize that a lack of consensus among the courts does not raise a presumption of ambiguity, it would be disingenuous for us to say that this widespread debate does not make us question Allstate’s suggestion that its policy is, as it argues, “crystal clear.” As Judge Klein said in State Farm Fire & Casualty Insurance Co. v. Deni Associates of Florida, Inc., 678 So. 2d 397, 408 (Fla. 4th DCA 1996): “If Judges learned in the law can reach so diametrically conflicting conclusions as to what the language of the policy means, it is hard to see how it can be held as a matter of law that the language was so unambiguous that a layman would be bound by it.”

Conclusion

Virtual Imaging and Kingsway both make clear that insurance statutes require clarity and specificity in electing fee schedules with respect to PIP medical benefits coverage. Allstate’s post hoc explanation of its intent as to the policy language it chose does not now remake clarity or dispel ambiguities. Based on the foregoing, we find the language at issue is ambiguous and that it must therefore be construed in favor of the Providers. We reverse and remand for further proceedings and certify conflict with Allstate Fire & Casualty Insurance Co. v. Stand- Up MRI of Tallahassee, P.A., 40 Fla. L. Weekly D693 (Fla. 1st DCA Mar. 18, 2015).

Reversed and remanded for further proceedings. Conflict certified.

LEVINE, J., concurs specially with opinion. MAY, J., dissents with opinion.

– 10 –

LEVINE, J., concurring specially.

I concur with the majority opinion and find that the language drafted by Allstate in its policy is ambiguous and thus compels a reversal.

In considering the specific provisions of this insurance contract, this case at its core rests on the following determination: if the provisions are unambiguous, then the insured has the sufficient notice required by the Florida Supreme Court in Virtual Imaging. However, if the provisions in question are ambiguous or can be susceptible to differing interpretations, then the insured does not have the sufficient notice mandated. “Policy language is considered to be ambiguous . . . if the language ‘is susceptible to more than one reasonable interpretation, one providing coverage and the other limiting coverage.’” Washington Nat’l Ins. Corp. v. Ruderman, 117 So. 3d 943, 948 (Fla. 2013) (quoting State Farm Mut. Auto. Ins. Co. v. Menendez, 70 So. 3d 566, 570 (Fla. 2011)).

The policy included a provision, in accordance with the Florida Motor Vehicle No-Fault Law, stating that Allstate would pay to or on behalf of an injured person the following benefits for medical expenses: “Eighty percent of reasonable expenses for medically necessary medical, surgical, X-ray, dental and rehabilitative services, including prosthetic devices, and medically necessary ambulance, hospital and nursing service.”

In a policy endorsement amending the provision, the Allstate policy included the following: “Any amounts payable under this coverage shall be subject to any and all limitations authorized by 627.736, or any other provisions of the Florida Motor Vehicle No-Fault Law, as enacted, amended or otherwise continued in the law, including but not limited to, all fee schedules.”

Thus, our reading of the policy depends on what words or phrases would dominate the review. Is it “shall” as a mandatory command, is it “subject to” as a permissive instruction, or is it “shall be subject to” which is an amalgamation of both mandatory commands and permissive suggestions? The basic rules of contract interpretation instruct us to read the provisions in whole and not in isolated parts. Blackshear Mfg. Co. v. Fralick, 102 So. 753, 754 (Fla. 1925). “Courts should ‘avoid simply concentrating on certain limited provisions to the exclusion of the totality of others.’” Ruderman, 117 So. 3d at 948 (quoting Swire Pac. Holdings v. Zurich Ins. Co., 845 So. 2d 161, 165 (Fla. 2003)). Further, ambiguities are to be construed against the drafter. Hurt v. Leatherby Ins. Co., 380 So. 2d 432, 434 (Fla. 1980).

– 11 –

These principles of contract interpretation share a commonality with the principles of statutory interpretation. See OB/GYN Specialists of Palm Beaches, P.A. v. Mejia, 134 So. 3d 1084, 1093 (Fla. 4th DCA 2014) (stating that a statute is ambiguous “[w]here there is more than one reasonable interpretation”); Daneri v. BCRE Brickell, LLC, 79 So. 3d 91, 94 (Fla. 3d DCA 2012) (“When interpreting a statute, we interpret its language and the resulting operation of its terms by reading the statute as a whole to give it meaning in its entirety.”); Traci Commc’ns, Inc. v. Fla. Dep’t of Revenue, 737 So. 2d 1255, 1256 (Fla. 4th DCA 1999) (recognizing rule that ambiguities in tax law are to be construed against taxing authority and in favor of taxpayer); DeRoin v. State, Dep’t of Bus. & Prof’l Regulation, Bd. of Veterinary Med., 160 So. 3d 516 (Fla. 4th DCA 2015) (recognizing that statutes authorizing sanctions or penalties against a person’s professional license are to be interpreted in favor of the licensee). Because of these commonalities, it is useful to examine cases involving statutory as well as contractual interpretation in analyzing the case at bar.

Courts have through the years interpreted the phrase “shall be subject to” with obvious contradictory results. Some cases state that “shall be subject to” is a clear mandatory command. See Leslie Salt Co. v. United States, 55 F.3d 1388, 1397 (9th Cir. 1995) (majority finding “shall be subject to” imposes mandatory civil penalties); Beardsly v. Chicago & N. W. Transp. Co., 850 F.2d 1255, 1264 (8th Cir. 1988) (finding “shall be subject to” is mandatory); Jersey Cent. Power & Light Co. v. Melcar Util. Co., 59 A.3d 561, 568 (N.J. 2013) (reading phrase “shall be subject to” as mandatory to give effect to entire provision); Tilcon Conn., Inc. v. Town of N. Branford, 37 Conn. L. Rptr. 750 (Conn. Super. Ct. 2004) (listing cases finding “shall be subject to” is mandatory); TJX Cos., Inc. v. Superior Court, 77 Cal. Rptr. 3d 114, 118 (Cal. Ct. App. 2008) (stating “shall be subject to” imposes a mandatory obligation). See also Allstate Fire & Cas. Ins. v. Stand-Up MRI of Tallahassee, P.A., 40 Fla. L. Weekly D693 (Fla. 1st DCA Mar. 18, 2015) (finding, without analyzing phrase “shall be subject to,” that insurance policy gave sufficient notice as required by statute).

Alternatively, other cases declare that “shall be subject to” is permissive and thus discretionary in nature. Fallis v. City of N. Miami, 127 So. 2d 883, 884 (Fla. 1961) (finding that “shall be subject to referendum” permits a referendum); Leslie Salt, 55 F.3d at 1397-98 (dissent concluding that “shall be subject to” imposed a discretionary civil penalty); Pace Props., LLC v. Excelsior Constr., Inc., 3:08CV345/MCR/EMT, 2008 WL 4938412, at *3 (N.D. Fla. 2008) (listing cases finding “shall be subject to” is permissive); City of Rochester v.

– 12 –

Corpening, 907 A.2d 383, 387 (N.H. 2006) (majority finding that clause “shall be subject to” granted authority rather than imposed an obligation); Mena Films, Inc. v. Painted Zebra Prods., Inc., 831 N.Y.S.2d 348 (N.Y. Sup. Ct. 2006) (finding “shall be subject to” language in jurisdiction-conferring clause permissive).

Once again, by demonstrating there is more than one reasonable interpretation of this provision, the basic rules of contract interpretation, which we are bound by, instruct us to find against the drafter, and find for more expansive insurance coverage.

The case of Fallis v. City of North Miami is instructive. In Fallis, taxpayers attempted to contest a municipal bond by stating that the bond issuance required a referendum by the voters, where the provision stated that “[a]ll bonds or other evidence of indebtedness issued hereunder shall be subject to referendum . . . .” 127 So. 2d at 884.

The Florida Supreme Court stated,

A casual examination of the quoted provision might suggest merit in appellants’ position. However, upon closer scrutiny, it will be seen that all that this section provides is that the described evidences of indebtedness ‘shall be subject to referendum.’ The provision is not mandatory; it is obviously intended to permit a referendum on a bond ordinance when such is demanded in accordance with other provisions of the municipal charter.

Id. Similarly, in the present case, an initial or “casual examination” may seem to suggest a mandatory provision, but under “closer scrutiny,” the provision “shall be subject to” is “not mandatory.”

Further, judges and commentators have recognized that even the solitary use of the word “shall” is “in short . . . a semantic mess. Black’s Law Dictionary records five meanings for the word.” Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 113 (2012). As Scalia and Garner noted, to solve the problem of the diverse meanings of “shall,” there has been a movement “to rewrite the federal rules . . . to remove all the shalls and otherwise restyle them. . . . Each shall became must, is, or may.” Id. at 114. See also Bryan A. Garner, Legal Writing in Plain English 106 (2001) (“[T]he Federal Rules of Appellate Procedure and the Texas Rules of Appellate Procedure have

– 13 –

recently been revamped to remove all shalls.”).3 “In just about every jurisdiction, courts have held that shall can mean not just must and may, but also will and is. Even in the U.S. Supreme Court, the holdings on shall are cause for concern.” Id. at 105 (footnotes omitted).4

Of course, Allstate could have written its policy to explicitly say that it “must” or “will” pay according to the limitations authorized by the statute. Then the policy would be clear and unambiguous. At oral argument, Allstate stated that in order to explicitly write in its policy that it will pay a certain rate as allowed by statute, such as 80% of 200% of the Medicare rates, Allstate would have to amend its policy each time the legislature changed the statute. Although that is an understandable concern, it does not make the language of that provision any less ambiguous or make the drafter of the policy any less required to write unambiguously if it wants to rely on such a provision as a binding interpretation.

The logic and reasoning of Judge O’Scannlain is also persuasive in Leslie Salt v. United States, where he, like Justice Scalia, recognized that even terms such as “shall” can lack precision and clarity. Salt concerned a statute with the same common phrase that confronts us here, “shall be subject to.” The Clean Water Act provided that “[a]ny person who violates [one of the enumerated sections of the Act] shall be subject to a civil penalty not to exceed $25,000 per day for each violation.” 55 F.3d at 1397.

Judge O’Scannlain dissented from reading “this language to mean that civil penalties are mandatory.” Id. He stated, “If section 309(d) had provided ‘Any person who violates . . . shall pay a civil penalty,’ I would readily agree with the majority’s interpretation. However, it does not so provide, and we cannot ignore the three words following the word ‘shall.’” Id. Similarly, in the present case we cannot ignore the same three words following the word “shall,” that being “be subject to.”

3 “As Joseph Kimble, a noted drafting expert, puts it: ‘Drafters use it [shall] mindlessly. Courts read it any which way.’” Garner at 106 (citation omitted). Garner concludes that one should adopt the style of “transactional drafters [who] have adopted the shall-less style” with remarkable clarity. Id.

4 See Garner at 105-06 n.5-10 (citing Moore v. Illinois Cent. R. Co., 312 U.S. 630, 635 (1941); Railroad Co. v. Hecht, 95 U.S. 168, 170 (1877); W. Wis. Ry. V. Foley, 94 U.S. 100, 103 (1876); Scott v. United States, 436 U.S. 128, 146 (1978) (Brennan, J., dissenting); Gutierrez de Martinez v. Lamagno, 515 U.S. 417, 434 n.9 (1995); United States v. Montalvo-Murillo, 495 U.S. 711, 718 (1990)).

– 14 –

Judge O’Scannlain went on to state that the applicable section

did not use the words “shall pay”; it used the words “shall be subject to.” The latter phrase is synonymous with “shall be liable to” or “shall be answerable to.” Read literally, the section merely states that a violator is liable to be assessed a civil penalty, not that he or she must be. In other words, civil penalties are discretionary.”

Id. at 1397-98 (citation omitted). He concludes that “[i]f Congress had meant civil penalties to be mandatory, it could have written [the section] to state that a violator ‘shall pay’ a civil penalty.” Id. at 1398.

Similarly, in the present case, if the drafter wanted to notify the insured that the medical bills would be paid pursuant to a particular statutory provision, the policy would state “shall pay” (or “must pay” or “will pay”) according to that provision, and not state “shall be subject to.”

In summary, I concur and would reverse the trial court and find the language in the policy ambiguous.

MAY, J., dissenting.

I respectfully dissent. For me, this issue was correctly decided in Allstate Fire & Casualty Insurance v. Stand-Up MRI of Tallahassee, 40 Fla. L. Weekly D693 (Fla. 1st DCA Mar. 18, 2015), and South Florida Wellness, Inc. v. Allstate Insurance Co., No. 13-61759-CIV, 2015 WL 897201 (S.D. Fla. Feb. 13, 2015). Both courts encountered the same insurer and the same policy language. Without struggling to create an ambiguity, the First District held “that Allstate’s policy language gave legally sufficient notice to its insureds of its election to use the Medicare fee schedules as required by Virtual Imaging.” Id. at D694. And as Judge Dimitrouleas found, “the relevant language unambiguously provides notice of Allstate’s election to use the Subsection 5(a)(2) fee schedule method.” S. Fla. Wellness, Inc., 2015 WL 897201, at *4. I agree with the conclusions reached by both courts and would affirm.

As Judge Osterhaus noted: “The crux of the PIP dispute here concerns whether Allstate’s policy language adequately notifies insureds of its election to limit reimbursements via the Medicare fee schedules in § 627.736(5)(a)2., as required by Virtual Imaging.” Id. The First District’s conclusion “stem[med] from the policy’s plain statement that reimbursements ‘shall’ be subject to the limitations in § 627.736, including ‘all fee schedules.’” Id. That is precisely what Allstate has

– 15 –

done here. It has placed the insured on notice that reimbursements are subject to the Medicare fee schedule-based limitation set forth in the PIP statute. There is nothing ambiguous in the policy’s language.

Unfortunately, the providers have led the majority down the yellow brick road. The issue is not whether the policy is ambiguous, but rather whether the policy adequately put the insured on notice of the insurer’s election to limit reimbursements according to the Medicare fee schedules set forth in section 627.736. See Geico Gen. Ins. Co. v. Virtual Imaging Servs., Inc. (Virtual Imaging), 141 So. 3d 147, 149–59 (Fla. 2013). Instead of simply reading the policy’s plain language for what it says, the majority spends fourteen pages trying to convince the reader that an ambiguity exists.

After all, let’s remember the purpose of PIP coverage. “[T]he purpose of the no-fault statutory scheme is to provide swift and virtually automatic payment so that the injured insured may get on with his [or her] life without undue financial interruption.” Id. at 153 (second alteration in original) (quoting Ivey v. Allstate Ins. Co., 774 So. 2d 679, 683–84 (Fla. 2000)) (internal quotation marks omitted). Providers, however, look to get paid as much as possible, but that does not inure to the insured’s benefit. The less costly the services provided, the more services the insured can receive. While some providers may choose to not treat an insured if their fee is limited to the Medicare fee schedules, that problem is one of the provider’s making, not that of the insurer.

Since its inception, the PIP statute has been the playing field where providers and insurers battle over the meaning of its language. The legislature continues to amend the PIP statute so that it serves the purpose for which it was intended. Indeed, the majority notes the numerous times the PIP statute has been amended. Each time that happens, insurers are required to review their policies and change language. That comes at a cost. And it is the insured that bears that cost.

Yet, time after time, the battle rages on. As the Pope once asked Michelangelo during the painting of the Sistine Chapel: “When will there be an end?”

Our supreme court noted that “[t]he permissive language of the 2008 amendments . . . plainly demonstrates that there are two different methodologies for calculating reimbursements to satisfy the PIP statute’s reasonable medical expenses coverage mandate.” Id. at 156. The majority suggests that the policy must make it “inescapably discernable”

– 16 –

what methodology will be used. As the First District articulated, “the language of [Allstate’s] policy makes reimbursements subordinate to the fee schedules in rather unmistakable terms.” Stand-Up MRI of Tallahassee, 40 Fla. L. Weekly at D694.

Here, Allstate specifically elected the limitations provided by the Medicare fee schedules and gave notice to the insured that it will pay according to their limitations. In short, the policy language is unambiguous.5 I would affirm.

***

Not final until disposition of timely filed motion for rehearing.

5 In my view, it is unclear whether Virtual Imaging actually required an election of one of the two methodologies provided by the PIP statute as long as the insured is given notice that it would opt for one of the methodologies provided. That would still not make a policy ambiguous; it would simply allow the insurer discretion in choosing the methodology to be used.

The Protected Health Information Cyber Attack Threat (Part 2)

By | Compliance | No Comments

business man in office BE 1With the increasing use of EHRs, practices are facing increased liability with regard to breaches of Protected Health Information (ePHI).

At the same time, increased HIPAA and HITECH security regulations and penalties for violations, also increase the healthcare provider’s liability for breaches of ePHI.

In part two of this series we are discussing simple steps to reduce most major threats to the safety of your ePHI.

Limit Network Access:

Web 2.0 technologies like peer-to-peer file sharing and instant messaging are popular and make networking tools appealing.  Wireless routing is a quick and easy way to set up broadband capability within an office.

However, because the sensitivity of healthcare information is protected by law, small practices that intend to rely on wireless networking must use special precautions.

Unless the wireless router is secured, its signal can be picked up from some distance away, including, for example, the building’s parking lot, other offices in the same building, or even nearby homes.

Therefore, it is crucial to secure the wireless signal so that only those who are permitted to access the information can pick up the signal.

Devices brought into the practice by visitors should not be permitted access to the network, since it is unlikely that such devices can be fully vetted for security.

Setting up a network to safely permit guest access is expensive and time-consuming, so the best defense is to prohibit casual access.

In configuring a wireless network, each legitimate device must be identified to the router and only those devices are permitted access.

Peer-to-peer applications, such as file sharing and instant messaging can expose the connected devices to security threats and vulnerabilities, including permitting unauthorized access to the devices on which they are installed.

Make sure these applications have been installed, reviewed and approved. It is not sufficient to just turn these programs off or uninstall them. A machine containing peer-to- peer applications may have exploitable bits of code that are not removed even when the programs are removed and should be encrypted.

 

Mobile Device Protection:

  • Examples of mobile devices are laptop computers, handheld pads, smart phones, portable storage media (Disk, Thumb drives, external hard drives, etc.). They can make things easier, but they also present threats to information security and privacy. Some of these threats are similar to those of the desktop world, but others are unique to mobile devices.
  • Because of their very mobility, these devices are easy to lose and are very vulnerable to theft.
  • Mobile devices are more likely to be exposed to electro-magnetic interference (EMI), which can corrupt the stored information.
  • Not all mobile devices are equipped with strong authentication and access controls.
  • Mobile devices are frequently used to transmit and receive data wirelessly and must protect the information being intercepted.
  • Mobile devices that carry ePHI and that cannot support encryption should not be used. This includes thumb drives. Encrypted versions of these devices are available but are more expensive.
  • Staff members that that take ePHI home on mobile devices have responsibility for protecting patient data and must follow good security practices.
  • If it is necessary to remove a laptop containing ePHI from a secure area, the laptop’s hard drive should be encrypted.
  • Office Policies should specify all situations under which mobile devices can be removed from the facility, and care must be taken in developing and enforcing these policies.

 

In the next issue, we will go over a security risk analysis checklist to help you review your compliance activities.

If you would like to learn more about having an office that’s bullet proof, email me at drjohn@the complianceman.com to see if we can help you.

These are trying times for all doctors and ignoring the new regulations is no longer an option.

Again if you have any questions, don’t hesitate to contact me.

All The Best,

Dr. John Davenport

Chief Compliance Officer

Compliance & Auditing Services

The Protected Health Information Cyber Attack Threat

By | Compliance | No Comments

3d rendering of a monit with a chain around it.

Reports of cyber attacks on large corporations such as  Nationwide, JPMorgan Chase and even the Pentagon have been make big news. Yet, every day there are attacks aimed at small to mid-size organizations.

With the increasing use of EHRs, practices are facing increased liability with regard to breaches of protected Health information (ePHI). Hackers know that healthcare providers are less likely to fully protect themselves.

At the same time, increased HIPAA and HITECH security regulations and penalties, for violations, also increase the healthcare providers liability for breaches of ePHI,

Many Doctors simply lack the knowledge and training needed to protect their offices against a cyber attack or meet HIPAA Security Rule requirements.

In this three part series we will discuss simple steps to reduce most major threats to the safety of ePHI. This should be considered basic computer security 101 and not a course on the HIPAA/HITECH rules.

Firewall Protection:

First, unless your practice is totally disconnected from the Internet, it should have a Firewall to protect against threats from outside sources.

Basically, a Firewall is a system that prevents unauthorized access to a private network and works like a filter between your computer network and the Internet. Anything that goes into or out of the network must pass through the firewall.

The firewall examines each message and can be configured to prevent employees from sending certain types of emails or transmitting sensitive data outside of the network.

Additionally, firewalls can be programmed to prevent access to certain websites (like social networking sites) and can prevent outside computers from accessing computers inside your network.

Most computer operating systems come with a firewall installed and firewall software is also available at stores that sell computer products. Both types of firewall software normally provide technical support and guidance for users without the technical savvy.

Anti-virus Protection:

In small offices, attackers compromise computers primarily through viruses, spyware and malware. Computers can become infected by outside sources such as CD- ROMs, e-mail, flash drives, and web downloads. Even a computer that has all  the latest security updates to its operating system and applications can be at risk because of system flaws.

Anti-virus software is used to scan files to identify and eliminate computer viruses andmalicious software. It can also let you know when there has been an attempted threat to your system.

Anti-virus software analysis’s system files to look for known viruses, by means of a virus dictionary, and identifies suspicious behavior that might indicate an infection. Therefore, providing protection against brand-new viruses that do not yet exist in any virus dictionaries.

Without anti-virus software to identify infections, data may be stolen or destroyed. Reliable Anti-virus software is available at most stores that sell computer products, and are relatively inexpensive to buy.

Once you’ve down loaded anti-virus software to your computer, this includes hand held devices, make sure to keep it updated. Anti-virus products require regular updates in order to protect from new computer viruses.

Chained laptop from the frontPasswords:

Passwords are a first line defense in preventing unauthorized access to any computer and should be required to log into your system.  In addition, passwords can be reviewed, using an audit trail log, to see who is accessing specific information and what changes where made to that information.

Passwords can also limit what information individual people have to certain information. This can include certain staff members, your IT contractor, your billing company or anyone who has remote access to your computer system.

Because criminals use special software to try to guess a password, it is important to use strong passwords. A Strong password should:

  • Be at least 8 characters in length
  • Include a combination of upper case and lower case letters, at least one number and at least one special character, such as a punctuation mark
  • Be changed periodically.

You should also have policies in place to remove passwords on staff that leave or are terminated.

An administrator password is used only when you need to make changes or updates to your operating system. This means that anyone with this code can go anywhere and change anything in your system.

To decrease the chance that the administrator password gets stolen, the person in your office authorized to make changes to your system should have a separate user code that is used for daily system access.

Audits And On-site Inspections

By | Compliance | No Comments

HIPAA-DETECTIVEIt seems that surprise visits by special investigative units seem to be on the rise. Though providers are required to cooperate with the investigation, they do have certain rights when complying.

With this in mind, how should you respond to investigators?

First take the time to train your staff before an investigation occurs. You should ask for identification of anyone demanding protected information or access to your office. Your staff should make copies of the investigators identification and document the behavior of any investigator who makes demands or insinuates a threat.

This can help your defense with regard to improper behavior.

Secondly, it is important that you and your staff establish what authority they may have to inspect your office and for what purpose. This is so that you can verify their right to review protected information and see written proof of who they are representing.

This is your right and the office’s responsibility under HIPPA law. If and when you receive a surprise visit by an inspector, the following is a list of options to consider and to give your office some control of the situation.

1) Even with a subpoena, you have the right to defer an unannounced visit and schedule a more convenient time for their request.

2) Once they arrive, if they request additional information, you may ask to schedule another time to complete the inspection to allow adequate administrative staff to comply with the request.

3) You may request legal counsel at any time during the investigation. I would recommend this especially with federal or state agencies.

4) Get a list from the investigator of the information that they intend to inspect.

5) Provide the investigators with a private place to use for the inspection. This should be a place in your office away from your normal operating procedures and any other records, information or office marketing material that may draw their attention to other issues which are not a part of of the purpose of their visit.

6) Make available only the files and documents that they have requested. If they request additional information, you may ask to schedule another time to complete the inspection to allow adequate administrative staff to comply with the request.

7) Remember an investigator is not your friend. Think and remember to shut up. It is natural to attempt to defend your actions and to make sure that the investigators understand your side. However, it can jeopardize your opportunity for an effective defense.

8) If possible, have a compliance consultant available during the investigation. They should meet with you and your staff to review the investigation and to be present during the proceedings. If the consultant feels that there is a chance you could incriminate yourself, he will stop the interview and recommend that the interview be deferred until your attorney can be present.

9) If possible, always be present with the investigator for the duration of the visit. Even better, have a qualified compliance consultant who will stay with the investigator and obtain any information that may be needed to minimize you and your staffs member exposure to the investigator. The consultant may also review the records to give valuable information to determine what the worst case scenario might be.

10) Call or email me with concerns.Remember that the longer you’re in practice, the more likely you will to be investigated. By taking some careful steps when investigated, you can help ensure that your rights are safeguarded and it may result in a better outcome for your practice.

With investigations, CMS audits, OCR audits and MU audits on the rise the best advice that I can give you is to be prepared. So many doctors wait until an investigator walks into their office or until they receive a letter in the mail before doing anything about complying with the laws.

Have your compliance manual up-to-date, including your office policies and procedures as mandated by the OIG. Have copies of your most recent risk assessment and your risk assessment policies and procedures on file in your office as mandated by title II of HIPAA under the Security Rule.

Also, make sure that your office is using the new version of the Notice of Privacy Practices and that your privacy policies and procedures manual have been updated, as mandated by Title II of HIPAA The Privacy Rule.

Finally make sure that you understand the documentation requirements mandated by the CMS, private carriers and most States laws.

Dr. John Davenport DCM, MCS-P