You Must Meet the Requirements for Core Measure #15

I need a Security Risk Analysis? What is that? I get calls from Chiropractors or their staff with this question every week. Here is the information and links to help you better understand Core Measure 15.

But first, from: http://www.healthit.gov/providers-professionals/certification-process-ehr-technologies

“The Office of the National Coordinator for Health Information Technology (ONC) Certification Program provides a defined process to ensure that Electronic Health Record (EHR) technologies meet the adopted standards and certification criteria to help providers and hospitals achieve Meaningful Use (MU) objectives and measures established by the Centers for Medicare and Medicaid Services (CMS).

Eligible professionals and eligible hospitals who seek to qualify for incentive payments under the Medicare and Medicaid EHR Incentive Programs are required to use certified EHR technology.”

Translation: The Certified Software you purchased is required to meet certain criteria in order to be a Certified Technology by the ONC. The job of the software is to help you meet all of the requirements. They are all set up basically the same and have training requirements, video tutorials, how-to documents, and support staff available to you. It is important and necessary to use not only the software but to use the training and support available to your office.

The Core Measure #15, also referred to as “Protect Electronic Heath Information”, or “Security and Risk Analysis”

This Core Measure has been wreaking havoc on Chiropractors. It isn’t a number to report found on your Dashboard. It’s a report or template that should be provided by your software company and completed in your office during the reporting period. A security risk analysis comprises the following parts: Risk Analysis, Risk Management, Sanction Policy, and Information Systems Activity Review. Think of it as an audit of your software and how you and your staff are protecting the fragile information contained therein. It should be easy to get these 4 templates or forms, run the audit, complete the forms, and file them in a safe place. The problem is most offices skip this step, and attest “YES” anyway. Later, when asked by CMS to provide their Risk Analysis they fail to provide and have to pay their incentive back.

The Measure states: “Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1) and implement security updates as necessary and correct identified security deficiencies as part of its risk management process.”

Going further, below you will find better description of the 4 things you need:

(From: http://www.gpo.gov/fdsys/pkg/CFR-2003-title45-vol1/pdf/CFR-2003-title45-vol1-sec164-308.pdf)

164.308(a)(1)(i) Standard: Security Management Process. Implement policies and procedures to prevent, detect, contain, and correct security violations.
(ii) Implementation specifications:
(A) Risk analysis (Required) - Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity
(B) Risk management (Required) - Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with 164.306(a). (Link found here: http://www.gpo.gov/fdsys/pkg/CFR-2010-title45-vol1/pdf/CFR-2010-title45-vol1-sec164-306.pdf)
(C) Sanction policy (Required) - Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity.
(D) Information system activity review (Required) - Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

*****

More links regarding Core Measure #15. Some are full of long explanations, but still full of information.  

http://www.hitechanswers.net/meaningful-use-measure-and-hipaa/
http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Downloads/SecurityRiskAssessment_FactSheet_Updated20131122.pdf
http://www.healthit.gov/sites/default/files/pdf/privacy/privacy-and-security-guide.pdf
http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidancepdf.pdf
http://www.youtube.com/watch?v=ml4okcBxN6c
http://www.youtube.com/watch?v=1fDvzznChhg

4010-to-5010 ~ My Filing Nightmares ~ Rejected Claims, Unreadable Reports, and Error Messages, Oh My!

4010-to-5010 My Filing Nightmares
Rejected Claims, Unreadable Reports, and Error Messages, Oh My!

Has the 4010 to 5010 transition confused you or your office staff with rejected claims, unreadable reports, and/or error messages? The following are some helpful websites and information my staff gathered while making the fun transition.

http://www.ama-assn.org/resources/doc/washington/4010-to-5010-claim-data-reporting-comparison.pdf

If you upload your claims using a clearinghouse your should get a human readable electronic report. (If you are getting a human readable report, count yourself lucky!) However, if you upload your claims directly to the Medicare Carrier you might only get a 999 file and a 277CA file. Acknowledgement for Health Care Insurance (999) and Claims Acknowledgements (277CA) will open in Notepad and contain a couple lines of code in your report because they no longer require themselves to send human readable reports. Talk to your software company and ask if they can provide the translation software. There HIPAA EDI Viewer software companies out there. More info about this topic:
http://www.wpsic.com/edi/5010-Readiness.shtml
https://www.cms.gov/Versions5010andD0/Downloads/2nd_National_Provider_Education_Call_HIPAA_Versions_5010_and_D0.pdf

If you have any questions, or suggestions please feel free to post them below. We are always looking for more information to share.

~Dr. Street

Quitting Medicare

First of all, you must understand that if you continue to provide the payable service of 98940, 98941 or 98942 to any patient that has Medicare coverage, you cannot "Quit" or disassociate yourself from the Medicare Program. 

The only way to avoid the Medicare rules is to provide your covered services for "free" to the Medicare patient, or refer them to other offices that accept Medicare. If you have a Medicare Provider Number, that means you signed a contract giving you privilege to provide Chiropractic adjustments for Medicare consumers, and that you will know and follow all Medicare guidelines.

Chiropractors cannot "OPT-OUT" of Medicare.  You can either adjust Medicare patients and follow the guidelines or provide "free" adjustments or not adjust Medicare patients. How do you get out of paying taxes? You don't. Remember: Medicare is a U. S. Government Program.  Do it correctly or don't do it at all!

If you are correcting vertebral subluxations that is a covered service in Medicare. When you provide a covered service, you must bill Medicare in a reasonable amount of time, one year or less.  Both participating and non-participating providers must collect the 20 % not paid by Medicare, from your patient or their supplemental insurance.  It is against the law to practice "NO out of pocket expenses" with Medicare.

Chiropractic Audits Gone Wild!

Chiropractic Medicare
Audits...Audits...Audits!

My phone calls are increasing especially from New York, California, Nevada, and now Alabama!

Palmetto Medicare Carrier in California and Nevada broke the ice and requested thousands of Chiropractic records as both pre-payment and post payments audits. Then, the New York Medicare Carrier went wild with requesting records on every patient.

Now the Alabama Medicare Carrier is following suit with audit after audit on Chiropractors, requesting records/documentation for a specific period of time and any portion of the preceding 6 months prior. 

These audits, first, eat up the small profits we get in Medicare. Secondly, they stress both the doctor and the staff effecting the quality of Chiropractic care delivered.  The major problem is that most Chiropractors lose some or all of their audit because of mistakes or lack of knowledge in Medicare procedures. 

Speaking with hundreds of Chiropractors dealing with audits, they all have made the following errors that cost them big time:

1. Date of current (HCFA item #14) must never be over 60 days old.


2. X-ray date must be less than 12 months old (364 days or less), or when no x-ray present, a P.A.R.T. form must be completed each and every visit. 


3. Diagnosis must make sense and match S.O.A.P. Notes to support the care rendered.


4. Lack of complete documentation by Federal Standard to proven Medical Necessity.

S.O.A.P. Notes are not the only Chiropractic documentation necessary to make a claim payable.  (Documentation is a federal document.)

Need help and/or assistance so that you can survive a Medicare audit? Please give me a call at (618) 395-3800 or consider ordering or Chiropractic Medicare DVD and booklet - Dr. Street