Pulmonology Coding Alert

Tip: Devices must be locked down and protected.

Patient privacy has always been at the top of your priority list, but now that many staff members are working from home, you must be as vigilant as ever to keep that information safe and secure.

Here’s why it’s timely: Over the past nine months, remote work has been the linchpin keeping practices afloat. The combination of the Medicare telehealth expansion and regulatory reform have significantly curtailed obstacles to virtual care and allowed many providers to keep their businesses afloat.

If you haven’t taken advantage of the policy shifts and set up remote protocols, now is a good time to lay out a plan as the nation grapples with COVID-19’s third wave. Allowing your coding and billing staff to work remotely is a great place to start. Read on for advice on how to combat compliance and IT issues.

Establish Policies, Write Contracts

If you don’t have any remote employees currently working at your practice, a good first step is to establish a written agreement for telecommuting, says Terry Fletcher, BS, CPC, CCC, CEMC, SCP-CA, ACS-CA, CCS-P, CCS, CMSCS, CMCS, CMC, QMGC, QMCRC, owner of Terry Fletcher Consulting Inc. and consultant, auditor, educator, author, and podcaster at Code Cast in Laguna Niguel, California. The agreement can serve as a foundation for expectations for everyone involved, especially for employees who may not receive much direct supervision, she says.

Fletcher recommends making sure your agreement touches on these issues:

• Spelling out telecommuting as a “management option” instead of a benefit,
• Expectations surrounding confidentiality,
• Productivity,
• Ownership,
• Timeframe for remote work (including any expectations of keeping certain hours),
• On-site availability,
• Mutual understanding that the option to work remotely isn’t guaranteed,
• General reference resources, and
• Information about HIPAA regulations.

With patient privacy and protected health information (PHI) a very real concern, it’s also important to craft a separate agreement around confidentiality, Fletcher says. Security is a huge component of a safe remote working situation, so make sure that the confidentiality agreement underscores the significance of keeping PHI private and secure.

A confidentiality agreement for remote coders should include office or work location within the employee’s home, the use of a computer that only the coder can access, the need for secure storage for the computer when the coder isn’t working, and the understanding that the coder must sign off of the application or software when not actively on the work computer, Fletcher says.

Consider These HR, IT Issues

Figure out how you want to pay a remote coder, Fletcher says. Some options include paying by the chart or paying hourly; make sure you note how the coder should report their work. Don’t forget to address the issue of overtime — define the situations in which overtime will be paid.

On a similar note: Decide whether a remote coder will be a W-2 employee or a 1099 contract worker, she says. Lay out the rules surrounding sick time and vacation time. If you want the remote coder to report to the office on certain days, include that in your reference resources, too.

If you’re worried about productivity, figure out your practice’s stance on productivity incentives, like bonuses, and make that part of the remote package, she says.

Think about how patients currently interact with coding/billing specialists in your practice. Would adjusting the position to a remote position require a separate phone or phone line? Would the practice provide coders with computers, mobile devices, and other IT tools so they can do their jobs efficiently? If so, you may want to ask these IT questions:

1. Hardware and mobile devices: Does the employee have the necessary hardware to set up a home office for coding? Will the coder also be using mobile devices to access patients’ information and practice data?

2. Logging and monitoring: Can coding software be monitored by IT staff to ensure patients’ electronic PHI (ePHI) is secure? Are protocols in place to update systems and perform patching virtually?

3. MFA and passwords: Are multifactor authentication (MFA) and password management utilized to circumvent fraud and data security incidents?

4. Training: Will IT staff be able to train remote coders on technology necessities and keep them in the loop on upgrades and changes? Can compliance officers still adequately educate virtual staff on HIPAA security and associated risks?

5. Incident response: Do remote coders know how to identify a breach and alert IT management?

Address These Procedural Problems

Think about the practicality of getting the necessary information — namely, charts — to the coder remotely. If you need someone to do physical scans, make sure you know who will be responsible and the process involved: Will your practice have to hire an additional employee to get scans to the coder? If any charts will be coded at the practice instead of sent to the remote coder, make sure you make that discernment, too, Fletcher says.

If your practice utilizes multiple coders, make sure you have policies in place to determine whether everyone can switch to remote work or whether you’d rather have some employees in-house.