Medicare Compliance & Reimbursement

Plus: OCR amplifies focus on HIPAA Right of Access. 

If you thought things were already tough, get ready for more federal scrutiny in the months ahead. The HHS Office of Inspector General (OIG) padded its Work Plan with several new Active Items in October.

Details: OIG reeled back its targets in September with only four new Active Items — but October was a busy month. At press time, the agency had posted 21 additions that run the enforcement gamut from skilled nursing facility (SNF) oversight to telehealth snafus to provider relief audits. And though the Active Items cover a variety of topics, many on the updated Work Plan do have one thing in common: COVID-19.

Some of the OIG highlights now under the agency’s watchful eye include:

• The Centers for Medicare & Medicaid Services (CMS) telehealth expansion during the public health emergency (PHE) to circumvent the spread of COVID-19.
• COVID-19 testing data and protocols across several federal agencies.
• Provider Relief Funding (PRF) payments offered to providers for uninsured individuals through Health Resources and Services Administration (HRSA).
• Medicare providers’ compliance and attestations as related to PRF distributions through HRSA.

Review the OIG’s Work Plan at https://oig.hhs.gov/reports-and-publications/workplan/active-item-table.asp.

In other news …

In 2019, the HHS Office for Civil Rights (OCR) promised to make patients’ rights to their records a priority with its Right of Access Initiative. And though COVID-19 put a kink in OCR’s plans, the agency made good on its pledge of ramping up enforcement.

Now: On Sept. 15, OCR announced five new settlements under its Right of Access Initiative. The agency followed its September rollout with two more settlements on Oct. 7 and 9, respectively. This brings the total number of enforcement cases to nine since OCR launched the Initiative last fall. The program charges that patients deserve the “timely access to their health records at a reasonable cost under the HIPAA Privacy Rule,” reminds an OCR brief.

Reminder: “A HIPAA covered entity must respond to a patient’s request for access to records within 30 days of receiving the request. HIPAA permits covered entities to charge patients a reasonable fee for such access, unless otherwise prohibited by applicable state law,” explains attorney Ada Kozicz with Rivkin Radler LLP in online analysis.

All of the recent enforcements include case-specific penalties and corrective action plans (CAPs). The settlements range from $3500 for a 2018 records’ request issue at King MD, a small Virginia psychiatric services provider, to $160,000 over multiple requests by a mother for her son’s records at St. Joseph’s Hospital and Medical Center in Phoenix.

Read the OCR brief, including links to the five Sept. 15 settlements’ CAPs at www.hhs.gov/about/news/2020/09/15/ocr-settles-five-more-investigations-in-hipaa-right-of-access-initiative.html. Review the Oct. 7 settlement at www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/sjhmc/index.html. Find the Oct. 9 case at www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/nyspine/index.html.