HealthBlawg

Red Flags Rule: The FTC piles on, because HIPAA, ARRA and overlapping state laws just weren't enough

Update 11/3/09:  The FTC announced that implementation of the Red Flags Rule will be delayed once more, this time until June 1, 2010.  The announcement came on the heels of losing a court case to the American Bar Association -- the court ruled that the rule does not apply to lawyers -- and on the heels of a legislative attempt to bar its applicability to small health care, accounting and legal practices.  Stay tuned.  

Update 7/29/09:  The FTC announced today that implementation of the Red Flags Rule will be delayed once again, this time til November 1, 2009.  The agency promises to roll out additional information targeted at low-risk entities covered under the rule.  Thus far, nothing has changed with respect to the rule and its ultimate effect, so organizations subject to the rule should take the extra time to assess their compliance needs and implement their plans in advance of November 1.

After a couple of delays, the FTC Red Flags Rule will be effective August 1, 2009.  This rule requires "creditors" under certain "covered accounts" to maintain a heightened alertness to numerous categories of "red flags" that may indicate that the consumer who is the rightful account holder is the victim of identity theft.  If a red flag is triggered, the creditor must take steps to notify the consumer and correct any inappropriate information included the creditor's records.

As you probably already know, the FTC is extending its reach with this rule (among others) into the health care sector.  (Cf. the FTC's role in enforcing certain Son of HIPAA provisions.)  The AMA has all but dropped a draft complaint on the FTC's desk, citing assorted legal precedents in its correspondence with the FTC arguing that the Red Flags Rule should not apply to physician practices.  The FTC is unmoved -- except to the extent that it has been willing to delay the effective date twice (from November 2008 to May 2009 to August 2009).

At any rate, the August 1 effective date is around the corner, and affected health care entities need to develop and implement compliance plans now, if they haven't already.  (Even the AMA says so, and has published guidance and a sample policy for members.)

A few more general comments before stepping back and examining the language of the rule and its applicability to health care providers.

The federales are taking something of a common-sense approach here, recognizing that a compliance plan needs to be tailored to the specific entity, the nature of its "covered accounts" and its operations.  Bank of America, N.A. and Springfield Medical Associates, P.C. will have very different compliance plans, because their potential red flags and the potential risks are vastly different.

Affected health care providers need to understand that the Red Flag Rule requirements overlap with HIPAA and state privacy law requirements (and looming Son of HIPAA requirements in ARRA), but will not be satisfied by implementation of existing privacy policies and compliance plans.  Review of the intersection of existing policies and procedures with the new rule's requirements is the first order of business.

As with any other new regulatory scheme, preparing a compliance plan and putting it on the shelf won't cut it.  The rule calls for regular monitoring of the plan and issues that arise by a senior manager.  Furthermore, best practices would dictate the training of staff to deal with individual issues and, most importantly, with the affected consumers.

Even if not clearly subject to the Red Flags Rule, providers should undertake to comply, for a couple of interrelated reasons:

• Good patient PR.  Data security is top of mind these days.  Much of the effort required under the rule should be expended anyway simply to respond to market pressures calling for improved data security.
• Potential liability.  The creative trial attorney will seek to use the Red Flags Rule as establishing a standard of care for the stewardship of personal information.  The incensed jury will go along.  The health care provider caught in the middle between thieves and victims may be the only perceived deep pocket available.

OK, so what is a "creditor" and what is a "covered account?"

Any entity that accepts payment other than payment in full at the time of service is a creditor.  Health care providers that go the cash-on-the-barrelhead route aren't creditors; all others are creditors.

The FTC Guide defines covered accounts as follows: either

• a consumer account you offer your customers that’s primarily for personal, family, or household purposes that involves or is designed to permit multiple payments or transactions; or

• any other account that a financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft, including financial, operational, compliance, reputation, or litigation risks.” Examples include small business accounts, sole proprietorship accounts, or single transaction consumer accounts that may be vulnerable to identity theft. Unlike consumer accounts designed to permit multiple payments or transactions – they always are “covered accounts” under the Rule – other types of accounts are “covered accounts” only if the risk of identity theft is reasonably foreseeable.

Any creditor with covered accounts must have a red flags rule compliance plan in place with policies and procedures for dealing with "red flags" -- i.e., signs that personal information may have been compromised.  The World Privacy Forum suggests that the following red flags are the ones most applicable in the health care context:

• A complaint or question from a patient based on the patient’s receipt of:
   o a bill for another individual
   o a bill for a product or service that the patient denies receiving
   o a bill from a health care provider that the patient never patronized or
   o a notice of insurance benefits (or Explanation of Benefits) for health services never received.
• Records showing medical treatment that is inconsistent with a physical examination or with a medical history as reported by the patient.
• A complaint or question from a patient about the receipt of a collection notice from a bill collector.
• A patient or insurance company report that coverage for legitimate hospital stays is denied because insurance benefits have been depleted or a lifetime cap has been reached.
• A complaint or question from a patient about information added to a credit report by a health care provider or insurer.
• A dispute of a bill by a patient who claims to be the victim of any type of identity theft.
• A patient who has an insurance number but never produces an insurance card or other physical documentation of insurance.
• A notice or inquiry from an insurance fraud investigator for a private insurance company or a law enforcement agency.

If a situation is flagged, a creditor must take steps to mitigate the risk of identity theft or continued identity theft.  Again, the World Privacy Forum notes:

There need to be uniform but appropriately flexible answers to these questions:

• What do we do when a patient claims fraud is in their files?
• What do we do when a patient says the bills are for services she did not receive?
• What do we do for patients and other impacted victims when we uncover a fraudulent operation?
• When we have a real case of medical identity theft, how can we work with patients to fix the records and limit future damages?
• What do we do when a provider has altered the patient records?
• How do we handle police reports and requests for investigation from victims?

The answers to these questions need to viewed not just from the provider’s perspective, but also from the victim’s perspective, which can differ substantially.

There are a number of useful resources available for health care providers seeking to take stock of their situation, establish Red Flags Rule compliance policies and procedures, and undertake staff training on the subject.  For example, the FTC, the AMA and the World Privacy Forum have all released valuable guidance documents (all linked to above) that would assist any organization with coming into compliance. 

As with any effort of this sort, it is often valuable to have someone outside the organization come in to review existing policies, procedures and workflow in order to highlight potential risks and opportunities for improvement.  The HealthBlawger and members of the HealthBlawger's virtual consulting network are available to come in and assess, plan and help implement compliance strategies for organizations large and small touched by the Red Flags Rule.

Whatever the size or nature of your business, please take a moment to consider how the Red Flags Rule may apply to its operations, and how it may relate to other regulatory schemes such as HIPAA and state laws.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

2010 MPFS: CMS proposes 21.5% physician pay cut (yes, really)

Let's go down the rabbit hole with the federales. 

Remember the Sustainable Growth Rate, that congressional hedge against inflation of health care costs, specifically payments under the Medicare Physician Fee Schedule?  Well, the CY 2010 MPFS went on display yesterday, and is due to be published in a couple weeks.  As written, the rule would (among other things) fully implement the SGR by cutting physician payments 21.5% (see the press release).  That's because Congress has overridden every other cut mandated by the law since 2002, yet has not taken the time to rethink it -- even though it called for a review in 2005's DRA, and MedPAC obliged in 2007.  To cut to the chase, MedPAC recommended that Congress either (a) come up with another cockamamie formula or (b) repeal the SGR and develop incentives for providers to provide higher quality care at lower cost.  Yes, they've done a fine job so far . . . .

So, we all know that Congress will step in before the rule takes effect January 1, 2010; perhaps it will be in a systematic way this time, however, with a real replacement for the SGR wrapped into a broader health care reform bill.  The Tri-Committee bill in the House (see sec. 1121, p. 181) is the only leading bill that addresses this issue head-on, as far as I know (please let me know if I'm missing something), though it does not include a radical enough reformation and seems to fall in line with MedPAC recommendation (a).

As the WSJ Health Blog notes, another part of the crazy logic at work in the draft rule is a CMS proposal to carve out reimbursement for physician-administered drugs ($87.5B over ten years, per the CBO) from that which is subject to the SGR.  That would help with the narrow issue of how-many-percentage-points-of-the-SGR-can pass through the eye of a needle, but obviously doesn't address the fundamental systems issue.  (I'll take (b) for $2.4 trillion, Alex.)

There's plenty of other goodies in this draft rule -- especially around imaging -- but the big across-the-board cuts certainly deserve the headline.  For example:

• Capital reimbursement for physician-office diagnostic equipment was originally calculated by CMS based on the assumption of a 50% utilization rate.  Since the actual utilization rates are much higher, that assumption is now being formally thrown out the window.

• Under MIPPA, imaging providers will be subject to new accreditation requirements as of January 2012; accreditation organizations are identified in the rule, and additional controls will be forthcoming in separate rulemaking.

• Finally, more measures are being added to the PQRI set, and automatic EHR-to-CMS reporting is being explored (as is the case with hospital RHQDAPU reporting), as pay-for-reporting (in lieu of meaningful pay-for-performance) continues at the Federal level.

Bottom line: This is a complicated set of issues, but it is only one of many that Congress and the President hope to have all wrapped up neatly by November.  Perhaps a post-SGR approach to physician payment will help build the coalition necessary for meaningful systemic reform.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

David Harlow quoted in Medicare Compliance Alert on pre-employment background checks

Take some advice from the HealthBlawger in screening new employees.  Check out some specifics in the current edition of DecisionHealth's Medicare Compliance Alert, offered in point-counterpoint format with tips from my friend Bill Mandell.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

Constabulary notes from all over

The ever-vigilant law enforcement community meets the health care system:

Item: Massachusetts state trooper pulls over woman in labor; asks "what's under your jacket?" while writing ticket for driving in breakdown lane en route to hospital.

Item: New Hampshire state trooper pulls over man after PET scan; asks for proof of medical procedure after radioactive isotope detected by anti-terrorist hardware.

Can't be too careful, eh?

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

CMS imaging efficiency measures released for public comment

The latest comment period for imaging appropriateness measures is underway.  CMS announced last week that through The Lewin Group and its subcontractors, the National Imaging Associates, Inc., (NIA) and Dobson | DaVanzo & Associates, LLC, it is developing a preliminary set of outpatient imaging efficiency measures, and is seeking input through December 14, 2008 at the Imaging Measures website, which has a wealth of information on the measures (descriptions of the four measures are excerpted below) which, interestingly enough, are entirely different from the four measures featured at the same URL a year ago.  The measures may be used by CMS under MIPPA as part of the accreditation regime and are certainly preferable to the prior authorization regime currently in favor.

Here are the four measures:

MEASURE ONE: SPECT MPI AND Stress Echocardiography for Preoperative Evaluation for Low-Risk Non-Cardiac Surgery Risk Assessment

Setting: Outpatient
Numerator: Patients having a low-risk surgery (i.e., endoscopic procedure, superficial procedure, cataract surgery, breast biopsy) preceded, within 30 days, by a single-photon emission computed tomography (SPECT) myocardial perfusion imaging (MPI), Stress Echocardiography, or Stress magnetic resonance imaging (MRI) study
Denominator: Patients having a low-risk surgery (i.e., endoscopic procedure, superficial procedure, cataract surgery, breast biopsy)

A review of stress echocardiography appropriateness criteria for specific clinical scenarios was recently completed and published by The American College of Cardiology Foundation (ACCF) and the American Society of Echocardiography (ASE). Review of SPECT MPI appropriateness criteria for specific clinical scenarios was completed and published by ACCF and the American Society of Nuclear Cardiology (ASNC). The purpose of the published criteria is to "help guide a more efficient and equitable allocation of health care resources."

The proposed measure seeks to calculate relative use of stress echocardiography, stress MRI, and SPECT MPI prior to low-risk non-cardiac surgical procedures.

The appropriateness criteria provided specific guidance that use of stress echocardiography and SPECT MPI are not appropriate tests for preoperative evaluation of patients undergoing low risk non-cardiac surgical procedures. The appropriateness score assigned to the use of stress echocardiography and SPECT MPI for the indication is the lowest at one (1). Scores of 1-3 are defined as inappropriate (the test is generally not indicated).

The criteria define low risk surgery as cardiac death or MI in less than 1 percent of performed procedures — endoscopic procedures, superficial procedures, cataract surgery, and breast surgery (biopsy).

MEASURE TWO: Use of Stress Echocardiography or SPECT MPI Post-Revascularization Coronary Artery Bypass Graft

Setting: Outpatient
Numerator: Patients who have had a stress echocardiography or SPECT MPI study in the five-year period following a coronary artery bypass graft (CABG) procedure.
Denominator: Patients who have had a CABG procedure.
Exclusions: All tests performed in the first six months post-CABG; any patient with clinical risk predictors for silent ischemia or accelerated coronary artery disease (CAD) (e.g., diabetes); and any patient who undergoes a catheterization, percutaneous coronary intervention (PCI), or CABG procedure in the six months following the post-revascularization Stress Echocardiography or SPECT MPI.

A review of stress echocardiography appropriateness criteria for specific clinical scenarios was recently completed and published by The American College of Cardiology Foundation (ACCF) and the American Society of Echocardiography (ASE). Review of SPECT MPI appropriateness criteria for specific clinical scenarios was completed and published by ACCF and the American Society of Nuclear Cardiology (ASNC). The purpose of the published criteria is to "help guide a more efficient and equitable allocation of health care resources."

The proposed measure seeks to estimate relative use of stress echocardiography and SPECT MPI in asymptomatic patients less than five years after a CABG procedure.

The appropriateness criteria provided specific guidance that use of stress echocardiography is not appropriate for risk assessment within five years for asymptomatic patients. The appropriateness score assigned to the use of stress echocardiography for the indication is two (2). Scores of 1-3 are defined as inappropriate (the test is generally not indicated). Use of SPECT MPI for the indication was scored at six (6). Scores of 4 -6 are defined as uncertain.

MEASURE THREE: Use of Computed Tomography in Emergency Department for Headache

Setting: Emergency Department (ED)
Numerator: ED visits with a presenting complaint of headache with a coincident brain CT study
Denominator: ED visits with a presenting complaint of headache
Exclusions: Patients who are hospitalized (admitted), patients who are transferred to another acute care hospital, patients with a lumbar puncture, diagnosis codes indicative of dizziness, paresthesia, lack of coordination, subarachnoid hemorrhage, or thunderclap.

Clinical guidelines and literature indicate that there is a general consensus that neuroimaging is rarely productive for [headache] patients with normal physical and neurological exams and medical histories. Unnecessary CT is costly financially, in false positive interpretation, and in excess radiation. This measure seeks to identify inappropriate practice patterns.

MEASURE FOUR: Simultaneous Use of Brain Computed Tomography and Sinus Computed Tomography

Setting: Outpatient
Numerator: Patients with a presenting complaint of headache who have a brain computed tomography (CT) and sinus CT study performed simultaneously (i.e., on the same date at the same facility)
Denominator: Patients with a presenting complaint of headache who have a brain CT study
Exclusions: Patients with trauma diagnoses, tumor, or orbital cellulitis

Clinical guidelines and literature indicate that there is a general consensus that neuroimaging is rarely productive for patients with normal physical and neurological exams and medical histories. Even when neuroimaging is required, there are no indications for simultaneous Brain CT and Sinus CT. Moreover, unnecessary CT imaging is costly financially, risks false positive interpretation, and exposes patients to excess radiation.

(Emphasis supplied.)

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

David Harlow quoted in Radiology Today on HIPAA compliance reviews

I spoke last month with Radiology Today on the question of HIPAA compliance, in light of increased, or at least more public, enforcement.  HIPAA security compliance audits are underway, and providers need to be aware of what to expect.  The best defense is still a good offense, which in this case means conducting an audit and beefing up policies and procedures, as necessary.  For further information, see an earlier HealthBlawg post. 

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

DRA advanced imaging cuts examined by GAO; MIPPA accreditation rules welcomed by industry

Advanced diagnostic imaging reimbursement (i.e., payment for MRI, CT and nuc med) has taken a beating under the DRA (Deficit Reduction Act of 2005), and last week's GAO report looking at the impact of the legislation on this slice of the health care economy -- specifically, technical fees for advanced diagnostic imaging in physician office settings -- confirmed that there have been deep cuts.  The cuts were a response to a couple of key factors.  First, the rapid increase in Medicare expenditures in this sector -- at an average annual inflation rate of 13% from 2000 to 2006 (i.e., doubling in that time), compared with a general Medicare physician-billed services inflation rate of 8% over the same time period.  Second, the geographic distribution of services rendered seemed, in the eyes of the regulators, to be related more to the distribution of physician-office-based diagnostic imaging services than to anything else.  The OPPS cap resulted in a cut of $1.7 billion -- a 12.7% drop, from $13.8 billion to $12.1 billion -- in Medicare reimbursement for physician imaging services (2007 vs. 2006).  These cuts were more than intended by Congress, according to the Access to Medical Imaging Coalition, an industry group.

The questions of the moment: Were the cuts too deep, and what does the future hold for physician-office-based advanced diagnostic imaging?

AMIC says that CBO scoring anticipated lesser cuts as a result of the DRA OPPS cap.  The GAO seeks to pre-empt the claim that the cuts are too deep by noting that the volume of tests subject to the cap grew (from 2006 to 2007) at a rate four times that of tests not subject to the cap.

The future of physician-office-based advanced diagnostic imaging will be played out under the accreditation provisions of MIPPA (Medicare Improvements for Patients and Providers Act of 2008) -- initially under a two-year pilot program, and eventually under accreditation provisions that will be applicable to all by 2012.  The provider community -- as represented by certain specialty societies -- prefers the accreditation approach over the prior authorization approach to quality and cost control. (See HealthBlawg post re: recent related GAO report and industry response.)  Some accreditation bodies (e.g., certain specialty medical societies) would prefer that the federales not even impose standards and criteria, noting that few, if any, applicants for their accreditations fail to meet their standards, reaching the conclusion that lesser providers don't even bother to apply.  (Of course, alternative interpretations are possible.)   In any event, some professional societies (e.g., American College of Cardiology) are in on the development of the pilot accreditation standards.  Industry groups such as the Medical Imaging & Technology Alliance would also prefer to see the OPPS cap reversed, and allow quality and cost control to be implemented through accreditation alone.

Another notable finding in this report is that advanced diagnostic imaging has migrated out of the hospital and into physician offices.  While many similar migrations have been due to providers (at the behest of payors) finding the least expensive setting in which to provide a service, this migration seems to have been due to an inverse incentive -- higher reimbursement in a physician office setting.  While physician office imaging volume has continued to grow despite the reimbursement cuts, it remains to be seen whether that trend will continue (or whether the growth was based in part on expectations of higher reimbursement that is no longer available), and whether industry and government can agree on a set of guidelines that can promote cost control and quality control without jeopardizing the economic viability of providers and appropriate access to diagnostic services.       

On a related note, the latest OIG advisory ruling, blessing an arrangement that outsourced the obtaining of prior authorizations for diagnostic imaging services from payors (since the contractor was neither drumming up business for the providers nor a supplier to the providers in question), addresses a business arrangement that may not be around five years from now, if the MIPPA accreditation approach takes hold on time and percolates into the private sector as well.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

Contractual joint ventures: the OIG hangs tough

The OIG released an advisory opinion today finding that a proposed block leasing arrangement between two physician group practices -- one a practice providing cancer treatment services, including IMRT, the other a urology group -- whereby the urology group would bring the IMRT services in-house through a series of contracts, would be barred as an impermissible contractual joint venture, assuming the requisite intent (to exchange payment for referrals) were present. 

There has been very little advisory opinion activity related to the contractual joint venture special advisory bulletin issued by the OIG in 2003.  Only three advisory opinions before today's even mention the special advisory bulletin.  One of those, however, trod the same ground as today's advisory opinion.  The 2004 advisory opinion regarding pathology lab contractual joint ventures is essentially identical to the most recent opinion. 

In the opinion, the OIG observes that

the Special Advisory Bulletin describes an arrangement very similar to the Proposed Arrangement:

[A] health care provider in one line of business (hereafter referred to as the “Owner”) expands into a related health care business by contracting with an existing provider of a related item or service (hereafter referred to as the “Manager/Supplier”) to provide the new item or service to the Owner’s existing patient population, including federal health care program patients. The Manager/Supplier not only manages the new line of business, but may also supply it with inventory, employees, space, billing and other services. In other words, the Owner contracts out substantially the entire operation of the related line of business to the Manager/Supplier – otherwise a potential competitor – receiving in return the profits of the business as remuneration for its federal program referrals.

In these circumstances, the OIG is unimpressed by claims that each element of the arrangement fits into a safe harbor.  Also, significantly, the OIG notes that the analysis of the proposed arrangement requires not only a review of each component of payment running from the urologists to the other physician group, but an analysis of the remuneration running from the cancer care group to the urologists, equal to the difference between the federal program payments to the urology group for services and the contract prices paid by the urology group.

For all of these reasons, the proposed arrangement failed to gain the approbation of the OIG.

Providers with existing or proposed contractual arrangements anywhere the zip code of the arrangements described in these advisories would be well advised to review them carefully in light of this most recent opinion, which seems to reinvigorate a somnolent area of enforcement.

-- David Harlow

Yes Virginia, the GAO points a finger at diagnostic imaging providers

"Round up the usual suspects!" 

Once again, diagnostic imaging providers are singled out by the federales. This time the GAO says controls on diagnostic imaging utilization are needed -- including (yikes!) prior authorization requirements -- because diagnostic imaging costs have doubled between 2000 and 2006.  Sounds serious. Well, guess what?  While some advanced imaging costs have increased at a faster rate, the cost of employment-based health insurance has also doubled in the same time frame.  (In addition, this rampant growth story is half of an unintended consequences story -- service settings have changed: less hospital, more physician office.  Also, imaging, while expensive, is cheaper -- and easier on the patient -- than exploratory surgery . . . . )

My inbox has been graced with a couple of press releases on this topic from, yes, the usual suspects -- MITA and AMIC -- decrying the government's heavy-handedness. MITA referred to an interesting report on diagnostic imaging released last week by Avalere Health, which MITA had commissioned.  (Coincidentally, I met Avalere's founder, Dan Mendelson, last weekend -- but that's another story entirely.) 

The Avalere imaging report (an interesting read, by the way) points to the utility of a number of strategies worthy of wider consideration, rather than focusing like GAO on layering prior authorization requirements on top of retrospective utilization review.  These are,   

primarily [, ] three sets of approaches – updated and more comprehensive appropriateness guidelines; enhanced accreditation and certification programs; and expanded education and training – [which are] programs [that] can influence provider behavior, imaging quality, and patient care.

The first of these really caught my interest.  To the extent such a system can be implemented without adding significantly to the ordering clinician's administrative burden, I'm all in favor.  In fact, that's the sort of thing that should be propagated across the entire medical-industrial complex, not just imaging: expert EHR systems incorporating evidence-based medicine (EBM) into computerized physician order entry (CPOE). 

-- David Harlow

CMS contractors seek to bring evidence-based medicine to diagnostic imaging

In last week's mail bag:

L&M Policy Research, LLC, and its partners, the National Imaging Associates and the Lewin Group, have been contracted by the Centers for Medicare & Medicaid Services to develop imaging efficiency measures. In preparation for additional work on this project, L&M would like to take the opportunity to ask the public for suggestions for imaging efficiency measures that could potentially be considered for development. For this project, the development of the efficiency measures is focused on applying evidence-based medicine to improve the efficient use of imaging technologies based on clinical practice guidelines and tied to health care quality outcomes.

The form for responses is on line.  This work is a continuation of a project initiated last year and discussed in an earlier HealthBlawg post on the imaging efficiency study. 

While the imaging provider community goes under the microscope, the Medicare FFS plans, sold (at least in part) through some unsavory marketing practices and getting at least 12% more than what it costs traditional Medicare for a beneficiary's care march forward, with some plans to regulate marketing, but no plans to limit spending (and a presidential promise to veto any such limit).  The Health Affairs blog reported on this problem a couple months ago and served up one potential solution from the journal -- an alternative approach to setting Medicare FFS plan rates. 

Here's hoping that the federales don't shy away from some potentially enormous savings as a result of the political clout of the managed care lobby and the home district politics of rural-state Senators.  (By the way, would you like to buy a bridge?)

-- David Harlow
.