Health Information Compliance Alert

Software Vendors Now Have Steeper Fines For HIPAA Breaches

Your software vendor will face steeper penalties for HIPAA breaches, as recent changes to the regulations will increase the maximum penalty for negligence-related incidents from $250,000 to $1.5 million per violation. The U.S. Department of Health and Human Services released the rule to toughen up on noncompliance of companies that provide electronic health record, billing and transcription services, including contractors and subcontractors, which are "business associates" of providers.

The final rule, which takes effect on March 26, will also strengthen the Health Information Technology for Economic and Clinical Health Act’s breach notification requirements by specifying when entities and their BAs must report to HHS any breaches of unsecured protected health information, according to NAHC (National Association for Home Care and Hospice). HHS may also change the threshold that a BA uses to determine whether a breach could harm patients and if the company must report that breach.

Phase 2 of ‘Ordering/Referring’ Edits Coming Soon

If a new CMS (Centers for Medicare & Medicaid Services) podcast is any indication, the agency might soon follow through on its longstanding threat to deny claims that fail the ordering/referring provider edits. Although CMS has had this on the horizon for several years now, the agency has never actually formalized a date when the denials would start.

However, a Dec. 13 CMS podcast indicates that CMS "will soon begin denying Part B, DME, and Part A Home Health claims that fail the ordering/referring provider edits." Although CMS notes in the podcast that the agency "does not have a date at this time," it warns providers that once it does, it will offer at least 60 days’ notice before the edits are turned on, so you should prepare now.

Background: Currently, if you submit claims for services or items ordered/referred and the ordering or referring physician’s information is not in the MAC’s claims system or in PECOS, your practice will get an informational message letting you know that the practitioner’s information is missing from the system.

Reminder: MACs will take two steps before denying your Part B claims. First, the carrier will check whether the ordering/referring physician is in PECOS. If not, the MAC will try to find the provider in the Claims Processing System Master Provider File. If the physician is in neither system, the claim will be rejected once the edits are turned on.

To listen to the complete podcast, visit www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/MLN-Multimedia-Items/2012-12-17Phase-2-of-Ordering-Referring-Requirement-Podcast.html.