HIPAA “minimum necessary” - Health Care Compliance Association

a look out for the World Health OrganizationInternational Statistical Classification ofDiseases and Related Health Problems-10thRevision (ICD-10).Other training pitfalls abound. The way inwhich the enforcement process works is commonlymisunderstood. It is the antithesis of thebasic concept “innocent until proven guilty.”Teaching the typical enforcement effort (whichidentifies a potential problem, investigates, andthen requires payback) leaves many concerned,if not outraged. Some will never recover.With others, an opportunity presents itself toenlighten them to the importance of attentionto detail and adherence to the rules.The Recovery Audit Contractor (RAC)programs, which are coming online now, areanother problem. Although we would expectthat big fish will get fried first, because this isa program where the contractor gets a piece ofthe recovery, we find that it is our documentation,which is often not concrete, that maycause us many take backs.Behavioral health operations face huge risks.Paramount is the potential for fraud in fieldoperations. Often, case management services ortherapeutic services are needed outside of theoffice. Fraught with risk regarding the actualdelivery of service and the length of service, administratorsneed to watch carefully and to putrestrictions in place. If you don’t start with thesecontrols, they can be difficult to put in place.What was provided and to whom and for howlong are the questions that will be asked.The question of how long the service was providedis a common one and easily becomes aproblem. The standard requirements foundin the CPT environment include “up to 20minutes” or “less than 20 minutes” or “20 to30 minutes.” The code set used in a Medicaidplan may expect “15 minutes” or “15 to 30minutes,” etc. These multiple requirements,not found in the purely medical setting whereCPT is exclusive, create additional confusionand potential for error, as does the structureof the work — the 30 minute session, the 50minute hour, etc.Identifying the targets of OIG is the easiestpart. Each year, the OIG proffers its WorkPlan for the coming year and literally tells uswhat is on the target range. The risk, however,does not lie here, but in our organizations. Itis the employee who files a complaint or blowsthe whistle who can cause serious problems.Continued on page 63Want to include a Stark review in your audit plan this year,but don’t know how to get started?Consider our new STARK COMPLIANCE - GUIDED SELF ASSESSMENTWe provide your staff with classroom training on theStark law and regulations and on what to look forwhen conducting a Stark audit; We supply audit toolsthat allow your staff to review the most commonfinancial relationships with physicians; and we makeour experts available to answer questions as youconduct your self-assessment, and to help with orconduct review of unique financial relationships thatyou discover. Package pricing starts at $7,500.For more information visit www.meaderoach.com orcall Steve Ortquist at 312-285-4850.Steve OrtquistPartner, Meade & Roach, LLP312.285.4850SOrtquist@MeadeRoach.comHealth Care Compliance Association • 888-580-8373 • www.hcca-info.org47April 2008