Compliance. In general, compliance means conforming to a rule, such as a specification, policy, standard or law.

Transcription

1 COMPLIANCE TRAINING

2 Compliance In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Regulatory compliance describes the goal that corporations or public agencies aspire to in their efforts to ensure that personnel are aware of and take steps to comply with relevant laws and regulations. Due to the increasing number of regulations and need for operational transparency, organizations are increasingly adopting the use of consolidated and harmonized sets of compliance controls. This approach is used to ensure that all necessary governance requirements can be met without the unnecessary duplication of effort and activity from resources.

3 Compliance Training GBUACO requires all employees and providers to attend specific training upon hire and on an annual basis thereafter. This will include training in: Federal and state statutes HIPAA regulations Program requirements Medicare policies Corporate ethics

4 The training will emphasize the ACO s commitment to compliance with current legal and program standards and any and all legal requirements and policies. The training program will include sessions highlighting The ACO s compliance program Standards of conduct Marketing practices Summaries of fraud and abuse laws Reporting requirements HIPAA and confidentiality requirements

5 Compliance Officer A Compliance Officer is appointed to oversee a Compliance Committee accountable to Senior Management / the Board of Directors The Compliance Officer is charged with the responsibility and authority of operating and monitoring the compliance program.

6 Compliance Committee This committee is responsible: For the organizations compliance with federal and state law, and CMS rules and regulations. To develop procedures, protocols and guidelines to ensure adherence to the GBUACOcompliance program. To identify and address compliance problems related to the ACO s operations and performance. To provide compliance training for the ACO, ACO participants, and ACO providers/suppliers and report probable violations of law to an appropriate law enforcement agency. To create an independent, anonymous compliance concerns reporting system for patients, providers and others.

7 Code of Conduct GBUACO promotes adherence to the Compliance Program as a major element in the performance evaluation of all ACO participants and employees. GBUACO providers and employees are bound to comply, in all official acts and duties, with all applicable laws, rules, regulations, standards of conduct, including, but not limited to laws, rules, regulations, and directives of the federal government and rules policies and procedures of GBUACO. These current and future standards of conduct are incorporated by reference in this Compliance Plan. All candidates for employment shall undergo a reasonable and prudent background investigation, including a reference check. Due care will be used in the recruitment and hiring process to prevent the appointment to positions with substantial discretionary authority, persons whose record (professional licensure, credentials, prior employment, any criminal record) gives reasonable cause to believe the individual has a propensity to fail to adhere to applicable standards of conduct.

8 Code of Conduct All new employees will receive orientation and training in compliance policies and procedures. Participation in required training is a condition of employment. Failure to participate in required training may result in disciplinary actions, up to and including, termination of employment. Every employee is asked to sign a statement certifying they have received, read, and understood the contents of the compliance plan. Every employee will receive periodic training updates in compliance protocols as they relate to the employee s individual duties. Non-compliance with the plan or violations will result in sanctioning of the involved employee(s) up to, and including, termination of employment.

9 Things to Be Aware Of Physician Self Referral Anti Kick Back Beneficiary Inducement

10 Physician Self-Referral Law ( Stark Law ) Social Security Act 1877 Prohibits physician referrals to entities with whom the physician or their immediate family have a financial relationship. Many exceptions An entity must fully satisfy one of the exceptions Civil liability CMS creates policy

11 Anti-Kickback Statute: Section 1128 (b) of the Social Security Act (42 USC 1320a-7b (b)) The federal anti-kickback laws that apply to Medicare and Medicaid prohibit health care professionals, entities and vendors from knowingly offering, paying, soliciting or receiving remuneration of any kind to induce the referral of business under a federal program. In addition, most states have laws that prohibit kickbacks and rebates. Remuneration under the federal anti-kickback statute includes the transfer of anything of value, directly or indirectly, overtly or covertly, in cash or in kind.

12 Anti-Kickback Statute Who Does It Cover? Hospitals Laboratories SNFs Clinics Physicians Nurses Etc.

13 What is remuneration? Anything of Value $$$ Goods Services Often Disguised

14 Beneficiary Inducement Social Security Act 1128A(a)(5) Prohibits individuals & entities from offering or transferring remuneration to beneficiaries that the individual or entity knows or should know is likely to influence the beneficiary to order or receive from a particular provider, practitioner, or supplier any Medicare or Medicaid item or service. Exceptions exist

15 Beneficiary Inducement Marketing All marketing materials and activities must comply with prohibitions on beneficiary inducements. Prohibited Information/Language Language suggesting that beneficiaries are required to see providers only within the ACO or are in any way prohibited from seeing providers outside of the ACO. Language suggesting CMS endorses one ACO over another. ACOs should not use language suggesting that beneficiaries suffer from an illness or disease.

16 FRAUD, WASTE & ABUSE TRAINING MODULE

17 Training Objectives Upon completion of this training, you should have an awareness of: The impact of health care fraud, waste, and abuse Your obligations to recognize and report potential fraud, waste, and abuse GBUACO s policy on non-retaliation for reporting potential fraud The use of the Office of Inspector General List of Excluded Individuals/Entities Database and the Government Services Administration Excluded Parties List System Medicare Specific Provisions Mitigating Conflict of Interest The Deficit Reduction Act/False Claims Act The Whistleblower Provision and what it means

18 FRAUD, WASTE, AND ABUSE PLAN GBUACO is a contractor to Federal and State governmental agencies. Simply put, we are stewards of government funds. It is GBUACO s obligation to prevent, detect, investigate, and report potential healthcare fraud, waste and abuse. The core elements of the Fraud, Waste, and Abuse Plan are as follows: Provider education Conducting proactive and meaningful investigations Identifying potential monetary losses Maintaining and analyzing system needs Coordinating efforts with law enforcement and special investigative units Training employees on how to identify and report potential fraud, waste, and abuse

19 FRAUD, WASTE, AND ABUSE What is FRAUD? Fraud means an intentional deception or misrepresentation made by a person with the knowledge that the deception could result in some unauthorized benefit to themselves or some other person. It includes any act that constitutes fraud under applicable Federal or State law. (42 CFR 455.2)

20 FRAUD, WASTE, AND ABUSE What is WASTE? Health care spending that can be reduced or eliminated without compromising the quality of care. Waste categories includes: Quality Waste includes overuse, underuse, and ineffective use Inefficiency Waste includes redundancy, delays, and unnecessary process complexity Example The attempt to obtain reimbursement for items or services where there was no intent to deceive or misrepresent; however, the outcome of poor or inefficient billing methods (e.g. coding) causes unnecessary costs to the Medicaid/Medicare programs

21 FRAUD, WASTE, AND ABUSE What is ABUSE? Abuse means practices that are inconsistent with sound fiscal, business, or medical practices that result in an unnecessary cost to the Medicaid/Medicare program or in reimbursement for services that are not medically necessary, or fail to meet professionally recognized standards for healthcare. It also includes recipient practices that result in unnecessary cost to the Medicaid/Medicare program. (42 CFR 455.2)

22 FRAUD, WASTE, AND ABUSE While health care fraud is extremely costly, it is important to understand that fraudulent practices can also create quality of care issues resulting in patients being exploited and/or put at physical risk Federal law provides for longer potential prison terms in health care fraud cases that result in a patient s injury or death

23 FRAUD, WASTE, AND ABUSE Reasons to Control Fraud, Waste, and Abuse: Health care fraud impacts everyone Health care fraud is the second costliest white-collar crime in America after tax evasion Health care fraud results in increased insurance costs Anti-Fraud efforts are Federal & State contract requirements The National Health Care Anti-Fraud Association (NHCAA) estimates 3% 10% of the nation s annual health care outlay is lost to fraud and abuse. In 2009, health care spending projections were $2.5 trillion; therefore the health care fraud and abuse problem is valued somewhere between $77 $255 billion

24 FRAUD, WASTE, AND ABUSE Who commits Health Care Fraud? Health care providers: Any person who intentionally tries to obtain reimbursement for health care services they did not provide, Members: Any person who falsely uses member identification information to obtain medical care. No matter who commits fraud, waste, and abuse, it affects everyone.

25 Provider Fraud Falsification of Claims Information Questionable Billing Practices False Coding, Records, or Altered Claims. Billing for services not rendered or goods not provided. Billing separately for services that should be a Single service. Billing for services not medically necessary. Overutilization Medically Unnecessary Diagnostics, Unnecessary Durable Medical Equipment, Unauthorized Services, Inappropriate Procedure for Diagnosis.

26 Beneficiary Fraud Beneficiary Fraud includes the following: Using someone else s insurance card Forging a prescription Knowingly enrolling someone not eligible for coverage under their policy or group coverage Providing misleading information on or omitting information from an application for health care coverage, or intentionally giving incorrect information to receive benefits Altering the billed amount for services Altering the service date

27 Beneficiary Fraud Identity Theft Using a different member s I.D. card to obtain prescriptions, services, equipment, supplies, doctor visits, and/or hospital stays. Individuals who loan their ID card Doctor Shopping Visiting several different doctors to obtain multiple prescriptions for painkillers or other drugs. Might point to an underlying scheme (stockpiling or black market resale). Improper Coordination of Benefits Beneficiary fails to disclose multiple coverage policies, or leverages various coverage policies to game the system Prescription Fraud Resale of Drugs or Black Market Falsely reporting loss or theft of drugs or pretends illness to obtain drugs for resale on the black market. Falsifying or modifying a prescription

28 Other Health Care Fraud Other examples include: An individual or organization posing as Medicare, Medicaid, or Social Security Administration personnel with the intent to steal beneficiaries identification Deceptive telemarketing practices Prohibited sales or marketing practices by health care representatives Fabricating claims

29 Provider FWA Kickbacks & Inducements False Claims Billing for services not rendered or supplies not provided for example, billing for appointments the patient failed to keep. Billing for a gang visit in which a physician visits a nursing home billing for 20 nursing home visits without furnishing any specific service to individual patients. Double billing Such as billing both Medicare and the beneficiary, or billing both Medicare and another insurer The SNF Gang Date of Service Misrepresenting the date services were rendered Identity Misrepresenting the identity of the individual who received the services

30 FRAUD, WASTE, AND ABUSE Internally reducing potential fraud, waste, and abuse GBUACO has developed a Fraud, Waste, and Abuse Plan that works with its members, providers, employees, and business partners to take a proactive approach to reduce fraud, waste, and abuse Employees are trained on fraud, waste, and abuse within 60 days of start of employment, and annually thereafter GBUACO conducts background checks on all employees prior to employment Employees, providers, and business partners are checked to ensure they are not on the Office of Inspector General or General Services Administration exclusion lists

31 FRAUD, WASTE, AND ABUSE Externally reducing potential fraud, waste, and abuse Physicians are checked monthly to ensure they are not on the Medicare/Medicaid exclusion or opt-out list GBUACO monitors claims from providers utilizing specialized software to identify irregular billing practices GBUACO monitors over-and under-utilization patterns GBUACO encourages reporting concerns directly to a Supervisor, Compliance Officer, or Human Resource representative GBUACO has a hotline for confidential or anonymous reporting of potential fraud, waste and abuse directly to the Compliance Officer

32 FRAUD, WASTE, AND ABUSE All employees are required to report potential fraud, waste, and abuse Fraud, Waste, and Abuse can be reported anonymously Any suspected Fraud, Waste, and Abuse reported remains confidential Retaliation against those who, in good faith, report suspected fraud, waste, and abuse is prohibited

33 FRAUD, WASTE, AND ABUSE - Background Checks Office of Inspector General (OIG) & General Services Administration (GSA) Federal law prohibits entities that participate in federal health care programs from entering into relationships with individuals or entities that have been excluded from participation in such federal programs It is against GBUACO s policy to knowingly hire any individual or contract with any entity who is listed by a federal or state agency as debarred or currently excluded from participating in a federal or state health care program. GBUACO reviews the Department of Health & Human Services Office of Inspector General (OIG) and General Services Administration (GSA) exclusion lists to ensure that employees and subcontractors are not included on such lists Many states also maintain an exclusion list. Entities can be prohibited from participating in federal programs and state programs as well. It is GBUACO s policy not to knowingly hire any individual or contract with any entity that is either on the Federal Exclusion list or on YOUR state s exclusion list.

34 FRAUD, WASTE, AND ABUSE Obligations of Medicare Plans: To implement a Fraud, Waste, and Abuse program To ensure that Fraud, Waste, and Abuse training is provided to employees, contracted providers and delegated entities To take appropriate corrective actions according to any circumstances or problems that may arise To refer potential Fraud, Waste and Abuse to the Compliance Officer

35 FRAUD, WASTE, AND ABUSE Conflicts of Interest: GBUACO strives to prevent situations in which the impartiality of an employee in discharging his/her duties could be called into question because of the potential, perceived, or actual improper and impermissible influence of personal considerations The GBUACO Code of Conduct articulates the commitment to comply with all federal laws regarding employees and subcontractors to act in an ethical and compliant manner GBUACO recognizes that in the normal course of affairs an employee may encounter personal interests or relationships that create potential conflicts of interest with the Company. In those instances, the Company requires the employee to take affirmative steps to alert the Company of the potential conflict of interest

36 FRAUD, WASTE, AND ABUSE Reviewing and understanding the GBUACO Healthcare Fraud, Waste, and Abuse and Compliance Plan Providing suggestions to the Compliance Department on how to improve the program Reporting potential fraud, waste, and abuse Asking questions when you do not know the answer!

37 Reporting Potential Fraud, Waste, and Abuse To anonymously, confidentially and/or privately report potential fraud, waste and abuse an individual may use one of the following methods:

38 The Deficit Reduction Act/False Claims Act The Deficit Reduction Act (DRA) was enacted to bring monetary spending under control Medicare and Medicaid programs are now growing faster than the economy and the population. Currently, it is nearly three (3) times the rate of inflation The DRA aims to cut $11 billion from the Medicare and Medicaid programs by 2012 by deterring and preventing fraud, waste, and abuse

39 Federal False Claims Act Policies are required to provide detailed information about: The Federal False Claims Act and any state laws pertaining to civil or criminal penalties for false claims and statements including whistleblower protections granted in these laws How the health care entity will detect and prevent fraud, waste, and abuse The right of the employee to be protected under the whistleblower provision and from non-retaliation of the entity s policy for detecting and preventing fraud, waste, and abuse

40 Federal False Claims Act Under the Federal False Claims Act, any person who engages in the following is liable for his/her actions, such as: Knowingly presents, or causes to be presented, to an officer or employee of the United States Government a false or fraudulent claim for payment or approval Knowingly makes, uses, or causes to be made or used, a false record or statement to get a false or fraudulent claim paid or approved by the Government Conspires to defraud the Government by getting a false or fraudulent claim allowed or paid

41 Federal False Claims Act - Penalties False Claims Act/The Deficit Reduction Act: False Claims Act violations can be subject to civil penalties including and not limited to: Monetary penalties ranging from $5,500/$11,000 for each false claim submitted Potential requirement to pay three (3) times the amount of damages the Government sustains because of the violation

42 Federal False Claims Act In order to understand the Federal False Claims Act, certain terms need to be defined: Knowing and Knowingly mean that a person: Has actual knowledge of the information Acts in deliberate ignorance of the truth or falsity of the information Acts in reckless disregard of the truth or falsity of the information No proof of specific intent to defraud is required

43 The Deficit Reduction Act/False Claims Act Health care entities who receive or pay out $5 million or more from Medicaid per year are required to have written policies in place for employees, contractors, and agents

44 Whistleblower Provision To encourage individuals to come forward and report misconduct involving false claims, the False Claim Act includes a whistleblower provision. An employee who has been discharged, demoted, suspended, threatened, harassed, or otherwise discriminated against due to their role in furthering a false claims action are entitled to all relief necessary to make the employee whole.

45 FRAUD, WASTE, AND ABUSE A Successful Anti-Fraud Program Depends on Every Employee to Remember that accusations can either be true or false Know it is against the law to report matters with malicious intent Provide an objective, comprehensive explanation when reporting an allegation including supporting evidence (e.g. claims, call logs, medical records) Keep in mind these questions when reporting potential matters: What laws and/or statutes were potentially violated? Who was involved? When did the occurrence take place? Where did the occurrence happen? What was the violation? How did the violation occur?

46 Reporting Potential Fraud, Waste, and Abuse To anonymously, confidentially and/or privately report potential fraud, waste and abuse an individual may use one of the following methods:

47 Quick Reference Chart (Print a copy for your desk) Examples of Fraud¹ Billing for services not furnished Billing for services at a higher rate than is actually justified Soliciting, offering or receiving a kickback, bribe or rebate Deliberately misrepresenting services, resulting in unnecessary cost, improper payments or overpayment Violations of the physician selfreferral ( Stark ) prohibition Source: 1. Medicare Physician Guide: A Resource for Residents, Practicing Physicians, & Other Health Care Professionals, 10th Edition (10/08) Examples of Abuse² Charging in excess for services or supplies Providing medically unnecessary services Providing services that do not meet professionally recognized standards Billing Medicare based on a higher fee schedule than is used for patients not on Medicare Source: 2. CMS Medicare Fraud and Abuse Web-based Training (April 2007) Examples of Waste Over-utilization of services Misuse of resources

48 Health Insurance Portability and Accountability Act of 1996 HHS was mandated to adopt or develop: Specific transaction standards (claims, enrollment, etc.) including code sets Security and electronic signatures Privacy Unique identifiers for employers, health plans, and health care providers The HIPAA HIPPO

49 Key Elements of Privacy Rule Covered Entity Uses and Disclosures Research Individual Rights Administrative Requirements Compliance and Enforcement

50 Privacy Rule The Privacy Rule applies to health plans, health care clearinghouses, and those health care providers who conduct electronically certain financial and administrative transactions that are subject to the transactions standards adopted by HHS. See 45 C.F.R (definition of covered entity ). The Privacy Rule requires covered entities to protect individuals health records and other identifiable health information by requiring appropriate safeguards to protect privacy, and by setting limits and conditions on the uses and disclosures that may be made of such information. The Privacy Rule also gives individuals certain rights with respect to their health information.

51 Who Must Follow These Laws We call the entities that must follow the HIPAA regulations covered entities. Covered entities include: Health Plans - including health insurance companies, HMOs, company health plans, and certain government programs that pay for health care, such as Medicare and Medicaid. Most Health Care Providers - those that conduct certain business electronically, such as electronically billing your health insurance including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists. Health Care Clearinghouses - entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa.

52 What Information Is Protected Information doctors, nurses, and other health care providers put in medical records Conversations about a patients care or treatment with nurses, doctors and others including family Information in the health insurer s computer system Billing information at the clinic Most other health information held by those who must follow these laws

53 Individually Identifiable Health Information Health information, including demographic information Relates to an individual s physical or mental health or the provision of or payment for health care Identifies the individual Transmitted or maintained in any form or medium by a Covered Entity or its Business Associate

54 Examples of PHI Print a copy for your desk Patient Name Phone # SSN All geographical identifiers smaller than a state Dates (other than year) directly related to an individual Vehicle identifiers and serial numbers, including license plate numbers; Medical Record Numbers Certificate/license numbers Health Insurance Beneficiary Numbers Device identifiers and serial numbers Account numbers Web URL s IP Addresses Finger, Voice prints Full Face Photos Any other unique identifying number, characteristic, or code except the unique code assigned by the investigator to code the data

55 Not PHI Employment records of Covered Entity Family Educational Rights and Privacy Act (FERPA) records

56 De-Identify the Data Removal of certain identifiers so that the individual who is subject of the PHI may no longer be identified Application of statistical method or Stripping of listed identifiers such as: Names Geographic subdivisions < state All elements of dates SSNs

57 Disclosures Covered Entity may not use or disclose PHI, except as permitted or required by Privacy Rule Required Disclosures To individual when requested & required by Section (Access) & Section (Accounting) To HHS, to investigate or determine compliance with Privacy Rule

58 Minimum Necessary Requirement The minimum necessary standard, a key protection of the HIPAA Privacy Rule, is derived from confidentiality codes and practices in common use today. It is based on sound current practice that protected health information should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. The minimum necessary standard requires covered entities to evaluate their practices and enhance safeguards as needed to limit unnecessary or inappropriate access to and disclosure of protected health information. The Privacy Rule s requirements for minimum necessary are designed to be sufficiently flexible to accommodate the various circumstances of any covered entity.

59 Minimum Necessary Requirement The Privacy Rule generally requires covered entities to take reasonable steps to limit the use or disclosure of, and requests for, protected health information to the minimum necessary to accomplish the intended purpose. The minimum necessary standard does not apply to the following: Disclosures to or requests by a health care provider for treatment purposes. Disclosures to the individual who is the subject of the information. Uses or disclosures made pursuant to an individual s authorization. Uses or disclosures required for compliance with the Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification Rules. Disclosures to the Department of Health and Human Services (HHS) when disclosure of information is required under the Privacy Rule for enforcement purposes. Uses or disclosures that are required by other law.

60 How Is This Information Protected Covered entities must Put in place safeguards to protect your health information Reasonably limit uses and disclosures to the minimum necessary to accomplish their intended purpose Have contracts in place with their contractors and others ensuring that they use and disclose your health information properly and safeguard it appropriately Have procedures in place to limit who can view and access your health information as well as implement training programs for employees about how to protect your health information

61 Health IT E Mail Fax Computer Screens Passwords EHR

62 What Rights Does The Privacy Rule Give Me Over My Health Information Health Insurers and Providers who are covered entities must comply with your right to: Ask to see and get a copy of your health records Have corrections added to your health information Receive a notice that tells you how your health information may be used and shared Decide if you want to give your permission before your health information can be used or shared for certain purposes, such as for marketing Get a report on when and why your health information was shared for certain purposes If you believe your rights are being denied or your health information isn t being protected, you can File a complaint with your provider or health insurer File a complaint with the U.S. Government You should get to know these important rights, which help you protect your health information. You can ask your provider or health insurer questions about your rights.

63 Who Can Look at and Receive Your Health Information The Privacy Rule sets rules and limits on who can look at and receive your health information Your information can be used and shared: For your treatment and care coordination To pay doctors and hospitals for your health care With your family, relatives, friends, or others you identify who are involved with your health care or your health care bills, unless you object To make sure doctors give good care To protect the public's health, such as by reporting when the flu is in your area To make required reports to the police, such as reporting gunshot wounds Your health information cannot be used or shared without your written permission unless this law allows it. For example, without your authorization, your provider generally cannot: Give your information to your employer Use or share your information for marketing or advertising purposes Share private notes about your health care

64 Safeguards Implement appropriate administrative, technical, and physical safeguards to protect the privacy of PHI Mitigate any harmful effect of use or disclosure of PHI in violation of its policies and procedures or the Privacy Rule that is known to the Covered Entity, to the extent practicable

65 Criminal Penalties for Wrongful Disclosures For knowingly obtaining or disclosing identifiable health information relating to an individual in violation of the Rule: Up to $50,000 & 1 year imprisonment Up to $100,000 & 5 years if done under false pretenses Up to $250,000 & 10 years if intent to sell, transfer, or use for commercial advantage, personal gain or malicious harm Enforced by DOJ

66 When a Problem is Found Anyone can file a complaint alleging a violation of the Privacy or Security Rule Address issues to the Compliance Officer HIPAA Prohibits Retaliation Under HIPAA an entity cannot retaliate against you for filing a complaint

67 More Information Or Contact your Compliance Officer

68 What did we learn? 15 Question Test Will review after everyone is finished