Carol Gibbons RN, BSN, NHA

Carol Gibbons brings 30 years of nursing and management experience to CJ Consulting to assist healthcare businesses in revenue cycle management.

Can your employee handbook get you in trouble? Many healthcare businesses have an employee handbook, or employee policy handout, but fail to update them on a regular basis. There have been a large number of changes to employment law over the past couple of years that have forced me to review these documents more closely.
	
	The handbook should be a general overview of your expectations while working in your business.  Sometimes you can get too specific in your guidelines for disciplinary action, which can tie your hands in situations when an immediate action would have been better for your business.
	
	Your handbook is an evolving document and should be reviewed every year after the Supreme Court has ruled on all pending cases and released all their rulings at the end of June. It is not intended to be a comprehensive list of rules, but rather guidelines about how you expect employees to conduct themselves in your business. Here are some items you should be sure to include:

Do you have a social media policy? If you have one, does it prohibit employees from posting negative comments about your business?
	You might be surprised to learn that you cannot prohibit employees from posting negative comments about your business on social media. You can prohibit the use of social media in the work area on business time. You can prohibit the use of company computers to visit social media sites. You should be prohibiting all employees from accessing their personal email accounts on company equipment.
	
	


	
	If your state has an at-will employment law, you should also have a statement that the handbook cannot be considered a contract and that you have the right to make changes in an employee’s status whenever you feel necessary.
	
	The National Labor Relations Board (NLRB) has been critical of these statements in 2016, stating that at-will statements may limit the employee’s right to engage in activity to challenge their at-will status. In other words, the employee might want to negotiate a contract that gave them better benefits or wages. So your statement should include that only the head of the company or organization can negotiate a change in an employee’s at-will status.
	
	The word permanent needs to be removed from your handbook. An example might be a statement that after probation the employee would become a permanent full time. That can be construed as generating a contract, so don’t use it in your handbook
	
	


	
	Do you have a huge list of things employees might do that would result in disciplinary action?
	
	You might want to review that process and delete the list. You might instead have a statement about honesty, ethics, respect and the attributes you expect from them rather than a long list of items they can’t do. Trust me, there have been legal cases won because the termination infraction was not covered by the list in the handbook. You should also have a statement that holds employees to a standard that they should refrain from physical contact, threatening behavior, or violence.
	
	


	
	Do you have a policy about your process and how you will track absences?
	
	Review this policy carefully. Less is nearly always better than extensive. Do you have so much detail in the policy, that in practice you never comply with all of the rules? That could cause a problem if an employee wants to fight a termination and takes your handbook to an attorney. You should always have a statement that your disciplinary process, while liberal in nature, could result in immediate termination depending on the seriousness of the infraction.
	
	Foul language is always grounds for termination, right? Here is an example: An employee discussion gets heated and loud in a room with a closed door and not witnessed by other employees, and the employee is cursing and making disparaging statements about the supervisor. You would think that this is a reason to terminate, but it appears the employee can use foul language and make disparaging statements about the employer and supervisor as long as they are not within hearing of other employees.
	
	That is exactly what happed in the case Banner Health System dba Banner Estrella Medical Center and James A. Navarro. The NLRB ruled that the employee’s behavior in using foul language was not threatening, and an employee should be able to have a discussion about workplace issues.
	
	So be careful about your documentation when an altercation occurs. If you felt threatened by the employee’s behavior, make sure that is included in your disciplinary document.
	
	


	
	Do you have a policy that says harassment should be reported to the manager or supervisor?
	
	Just keep in mind that the manager/supervisor could be the person harassing the employee. You might want the employee to have the option of reporting to any manager. They need a way to report that does not affect their job in any way, so the reporting might be to a manager of a different department, or a supervisor in a different area.
	
	The handbook should make clear that you will not tolerate harassment, and if any employee experiences or observes harassment it should be reported immediately. The last thing you need is for a terminated employee to complain about unreported harassment and then enlist another employee to confirm their statement. Since your handbook should require that both employees must report harassment immediately, it would be more difficult for an employee to win a legal case if it was not reported until after the employee was disciplined.
	
	


	
	Have you reviewed your benefits to make sure they comply with federal and state laws?
	
	After the U.S. Supreme Court ruled that same sex marriages are legal in all states, many employers did not look at the wording of their benefits contracts. Several cases were brought against employers for having an insurance policy that did not cover same sex spouses.
	
	If you do not have enough employees to be impacted by the Family Medical Leave Act, leave it out of your handbook and state you are not required to offer FMLA benefits. If you do have to comply with the FMLA, make sure your employees are told who to contact and that they must fill out the proper forms in order to be eligible.
	
	Look at items like bereavement leave and make sure you have taken into consideration same sex spouses.
	
	

7 Vacation, sick leave, personal time off (PTO)

Does your handbook explain specifically how these will be calculated?
	
	Whether you choose vacation and sick leave in your business or PTO, you need to document how they will be calculated and when the employee will be eligible for these benefits.
	
	The handbook should also state whether any benefits can be carried over at the end of the year, or if employees must use or lose benefit time. If your policy allows some leave time to be carried into the next year, then that should be specified in the handbook. It should also address whether leave time survives termination of the employee.
	
	The handbook should not spell out the specific insurance coverage for healthcare. It should only specify that you offer health insurance and a 401K plan if you offer that. The handbook should tell the employee when they are eligible for benefits and have a statement that the benefits could change at any time.
	
	Each year you should give the employees a separate benefit document that covers the specific information about insurance coverage and scheduled vacation days. That way you can modify as needed without requiring employees to read and sign the entire handbook again.
	
	


	
	Does your handbook prevent employees from discussing their pay with other employees?
	
	The NLRB has ruled that companies cannot ban employees from telling other employees how much they are being paid. These rulings are generally aimed at large companies with many employees, but your handbook must be consistent with the current law in your state as well as the latest rulings from the NLRB. The motivation behind this ruling is that when employees have a complaint against management, they need the right to collect data to support their grievance. As a business owner, you should review the handbook yearly, at a minimum, and consult your company attorney to review any changes to make sure you have adequately protected your company from employee lawsuits. Do not just go on the internet and get a do-it-yourself handbook. Your handbook should be common sense guidance to your employees about your specific business, and these handbooks that are available online are not written to match your individual business.

Carol Gibbons, RN, BSN, NHA, is a healthcare business consultant.

Articles

Can your employee handbook get you in trouble? Many healthcare businesses have an employee handbook, or employee policy handout, but fail to update them on a regular basis.

8 tips for avoiding employee handbook crises

Welcome to Medical Economics' blog section 

which features contributions from members of the medical community. These blogs are an opportunity for bloggers to engage with readers about a topic that is top of mind, whether it is practice management, experiences with patients, the industry, medicine in general, or healthcare reform. The series continues with this blog by Carol Gibbons, RN, BSN, NHA, who is CEO of 

, which specializes in healthcare revenue cycle management

. The views expressed in these blogs are those of their respective contributors and do not represent the views of 

	Last week a physician contacted me about setting up a small family practice in Austin Texas.  The practice will be all cash pay and the physician will not have any insurance contracts, having already been down that route in the past. The approach for the practice would be that the physician would see patients in the office or at home, and patient data would not be electronic so it would never be shared on the internet. With the current publicity about medical businesses experience with ransomware and data hacks, the marketing will focus on the safety of patient information.

Physician-designed EHRs work better for doctors

	That caused me to do some research on how much a medical chart goes for on the “dark web.” It was a very enlightening process and gave me a marketing nugget for the practices that I deal with who are still on paper charts. In fact, I was in one of those practices recently and the owner’s wife was adamant about them NEVER utilizing 

 and putting their patients at risk of identity theft.

While all of us recognize the advantages of an electronic record

 in the respect of data retrieval, the risk has become greater because many practices do not secure their network. They do no emphasize training their staff on how to prevent phishing attacks that result in a hack of their data bases. We see new fines disclosed every month on healthcare operations that did not comply with HIPAA Security regulations. A number of these breaches have been caused by third party vendors who have access to your data remotely, but do not protect their own network sufficiently.  

 in a blog called Krebs on Security, by Brian Krebs. Tenet Health Hilton Medical Center had a breach of about 10,000 records, but the breach came through a company called In Compass. The breach was actually of a subcontractor for In Compass called PTS Services, which was a subsidiary of McKesson. This was a billing service that failed to protect a server and left the data open to a Google search for four months.

Top 10 workplaces for PCPs to earn higher salaries

	The moral of this story is that you should limit the number of companies that have access to your data and do your yearly due diligence through your HIPAA Security audit in verifying their network protection. All business associates should be able to give you a list of all their subcontractor companies that will also have access to your data. As I started advising clients to ask for this information last year, they have discovered a web of companies that have access to their information whom they know nothing about.     

Next: What's the value of a medical chart on the dark web?

	Next, I looked at the current value of a medical chart on the dark web. It did not take much research to find security businesses that have blogs and articles about items being sold on the dark web. A complete chart with a copy of driver’s license and insurance card can go for as much as $1,000 to thieves setting up a new identity for someone. On average, however, medical charts can be obtained fairly inexpensively.

 I found a recent article from Trend Micro 

that showed you could purchase a single identity with insurance card for under $10. If the record includes a driver’s license, the cost increases to $170.

It's time for everyone to stop talking interoperability and actually achieve it

	The real money is in purchasing an entire database. An EHR database can go for as much as $500,000, and who knows how many times the data can be sold. A

, there is so much data available on the dark web, the price per complete chart has dropped from $75 to $100 in 2015 to the current price range of $20 to $50. 

	If you have been a victim of identity theft as my husband was, you know that the cost of repairing your credit is much more than the actual theft. I am sure that many of you already contract with a company to assist you in monitoring your personal accounts to prevent theft, but what have you done for your business? Who is monitoring those accounts regularly to make sure they have not been accessed? What about that line of credit that you rarely use? How long would it take for you to notice if someone accessed that account and transferred money out? When was the last time you changed the password on your commercial business accounts, and do you have a list of people who have access to those accounts? 

	The bottom line is that the healthcare business owner is where the buck stops both operationally and financially. A major breach could bankrupt a business through fines and a loss of business.  One of the things I researched while investigating the cost of a chart on the dark web was to see if there were identity theft products that were geared to businesses and found multiple companies that do so. I encourage you to check them out and enlist the same protections for your company that you would to protect your personal identity.

Top 10 tips to unlock telehealth's potential in your practice

	The business owner also needs to review business insurance and evaluate coverage for cyber theft. I recently looked at a couple of business policies and saw that they only had $20,000 to $50,000 in coverage. That is not nearly enough for a healthcare business that can be fined by the chart that is affected. This insurance is reasonably priced and I advise on at least $1 million in coverage. Look at the number of medical practices that have paid fines between $500,000 and $750,000 to help you decide on the amount of coverage you need. Many malpractice policies also provide some coverage for cyber theft, which could combine with your business insurance coverage.

	The most important things to take away from this analysis of the cost of medical charts on the dark web is that your focus must be on prevention all the time. 

	·      Ask your business associates who their subcontractors are and what is their process to evaluate the security of the network for those businesses.

	·      Educate your staff regularly on internet security in your office. That means more than once a year.

	·      Change passwords for all your accounts when an administrative person leaves your employment. You may need to invest in a password management product to assist you in keeping up with all your passwords, but frequently changing your passwords is an essential protection.

	·      Make sure that all terminated employees also lose their access to your software and your website.

	·      Investigate identity theft protection for your business and insurance to cover a data breach.

	·      Enlist a trusted company to monitor your network and prevent breaches of your data.  That company should also be able to back up data and provide restoration services to get you back in business in the event of a data breach.

	Diligence in protecting your data is the best defense against data breaches, but you also need to protect your business against the errors of others that may have access to your data. Staff education can organize all of your employees into an army focused on defending the security of patient data in your practice.

While all of us recognize the advantages of an electronic record in the respect of data retrieval, the risk has become greater because many practices do not secure their network. 

What is the price of a medical record?

done an audit of your employee personnel folders 

to review the actual information that has made its way into these folders? There have been many Department of Labor changes in the past couple of years, so now would be a good time to pull several folders and analyze the contents.

	While performing an audit of clients’ personnel folders, it became very clear that the staff did not understand what should be in them. Many things in that folder ( whether on paper, or electronically stored, are subject to being copied and given to the employee if there is a discrepancy, so clear rules needed to be established regarding not only what was in the folder, but also how they are stored and who has access.

	The first step is to know what should be in the folders. The employee application is the most important item. It  gives you a history of the employee’s past experience and permission to verify work information. Next would be any  job offer that was extended to the employee prior to hiring.  Verification of previous employment and references contacted regarding the employee are very important and should be documented in the folder. It may be difficult at times to get previous employers to reveal more than dates of employment and if the employee is eligible for rehire. Some will even ask for a signature from employee to give permission to disclose information.

Top 10 highest, lowest paying states for internal medicine

	You should at least make an attempt and document the information. Understand that previous employers may refuse to do more than verify dates of hire, because of legal challenges and you may need to ask for personal references. A red flag on the references given might be that the reference noted on the application is a co-worker rather than a supervisor or owner of the business.  Always try to verify employment with an owner, manager or supervisor if possible.

	Once you have offered the future employee a position, a demographic form should be filled out and placed in the folder listing emergency contact numbers, information about dependents (if the company provides insurance), and other physical data about the future employee, such as height and weight. This information cannot be legally requested prior to the offer of employment.

	After the job offer is also the time when you can require pre-employment drug testing and criminal background information. These activities require a separate consent form signed by the employee. If a criminal background check results in information that impacts the job offer, this information must be shared with the employee. The employee has the right to dispute the information with the agency who prepared the background check prior to the withdrawal of the job offer.

	Once the employee starts working, there should be several items that need to be completed, first being an I-9 form which verifies the employee can legally work in the US. If you need help filling out that form, here is a link to the U.S. Customs and Immigration website (

) where you can download the handbook for employers. The I-9 form does not belong in the employee folder, so keep it in a separate binder.  

	You are required to keep I-9 forms for three years or one year past termination. Putting these in a binder by year helps you keep up with the process. You do not have to get new I-9 forms signed by current employees. Also, if you have not signed up for the free service eVerify, you should do that to confirm all employees are legal to work in the United States (

	Additional forms you should place in the folder are a W-4 form to identify tax deductions, a voided check or deposit slip for direct deposit along with consent to allow direct deposit, a contract for uniforms if you pay for them and a contract for tuition reimbursement if you pay for that. If you offer insurance coverage for your employees, there should also be a declination form in the employee’s folder for those who are declining coverage, as well as insurance enrollment forms.

	Medical reports should NOT be in the Employee folder. If an employee is injured on duty and requires medical care, those reports should be in a separate folder including the incident report.  Medical folders should not be stored in the same drawer as the employee folders. All folders should be secure, but medical information gets a higher security process being in a different location from regular employee folders and fewer supervisory employees having access because it contains personal health information.

	If you receive medical information related to a medical leave of absence, it should also be stored in the medical folder. Any incidental release of medical information or genetic testing will fall under the HIPAA guidelines, as well as specific Department of Labor rulings, so limit the access to this information.

	If you have a handbook, it should be reviewed with your team annually. The goal is to make sure the handbook policies and guidelines match your current behavior with employees. Remember that your handbook is designed to protect your business, but if you regularly do not follow the policies as written, then employees can use that against you in the future.

	It is useful to periodically have your handbook reviewed by an attorney as new laws and Department of Labor guidelines go into effect every year. Once an employee has reviewed the handbook, they need to sign a form that says they reviewed, understand and had an opportunity to ask questions about the information in the handbook.  This consent form belongs in the employee folder, not a copy of the handbook. 

	Evaluations and disciplinary forms and documentation belong in the folder, along with personal time off requests if required by the business. If you have a written process that says you do evaluations on a yearly basis, make sure they are in the folder. You are not required to do evaluations on a yearly basis, but you are required to follow your policy. This might be a good time to pull out the policy and meet with all supervisory staff to make sure the policy is being followed. 

	You should have a master binder (paper or electronic) for your handbook with a copy of each dated version. If you change a particular item in the handbook, all employees must sign a memo or confirm email receipt of the new information. That copy of the signed email goes in the employee folder, and a copy of the memo goes in your handbook binder.

	Employee folders should be in a locked drawer and a limited number of employees should have access to the information. Again, review your policy to update the employees that should have access to folders. The medical folders should be in a separate area with even fewer employees having access like an owner, practice manager, or HR director.

	Some practices have moved to maintaining their employee folders electronically either on their equipment or cloud-based through the payroll company. Either is acceptable, as long as they are password protected and that password is changed regularly. Again, the fewer people who have access, the less likely information could be disclosed accidently.

	If a disgruntled employee leaves your practice and then requests a copy of their employee folder, consult your attorney immediately. Each state has guidelines regarding what documents in the folder an employee is entitled to have copied. Never give the employee a copy of the entire folder-it belongs to you unless you get a legal request like a subpoena for the information.  Even then, make sure you release only the listed information.

	Hopefully, this information can guide you in assessing the current state of your employee folders and can help you identify corrective steps that might need to be taken to protect your business. 

Have you ever done an audit of your employee personnel folders to review the actual information that has made its way into these folders? There have been many Department of Labor changes in the past couple of years, so now would be a good time to pull several folders and analyze the contents.

Tips for auditing physician employee personnel folders

	Recently, I was working on credentialing with a client who is starting a practice in South Texas. I was shocked when we started getting contract proposals from the carriers and most of the major carriers were all at 80% of the current 

. I have been very vocal about the rates carriers pay physicians and the resultant physician’s search for ancillary services to generate enough revenue to pay the bills.

GOP Obamacare replacement bill puts physicians, patients in charge

	A medical practice cannot survive on visit revenue alone without seeing an extraordinary number of patients every day. We see practices struggling financially that have high 

 or Medicaid populations because of the complexity of their 

 without appropriate reimbursement for managing these highly complex patients. The only way for practices to survive is to add equipment and/or staff to provide additional ancillary services, develop cash pay services in their practice or see so many patients that the provider has little time with the patient. 

	Without ancillary services, the physicians only have time to push more medications to solve health problems and little time to coach patients to lifestyle changes that could reduce the numbers of medications they are on. If they do add ancillary equipment to their practice, many times they over order studies to generate enough revenue to pay the increasing cost of running a practice.

	As a consultant, I vet best ancillary services every month for practices. There are so many people knocking on their door to sell them the next piece of equipment or weight loss product, the overwhelmed providers are calling consultants to vet these services. There is a direct correlation to the move toward ancillary services and the dramatic reduction in reimbursement to physicians to actually take care of patients over the past 10 years. Certainly, this ancillary tsunami adds cost to our healthcare system and does not always provide an outcome that actually improves patient care.

Apple looking to expand healthcare presence

	We should not stop the use of ancillary services. We only need to analyze the use of ancillary services to determine if this allows the provider to spend more time with each patient and improve their overall health status. If the service is just to generate income and the time with each patient does not show health improvements, then that just adds cost to our healthcare system. I have found the practices that are the most successful in changing patient behavior through ancillary services are those that teach the entire staff to be “health coaches.”  Everyone has to be focused on improving health, not just medicating illnesses.

	I also get angry when I look at the year-end financials of the major carriers in comparison to the fees they are paying new physician practices. If you pay attention to recommendations from investment advisors, Humana, Aetna, United Health Care, Cigna, etc., are recommended to investors because the company stocks are paying good dividends and have an increasing stock value. This is good for their investors but happens at the expense of their providers and to the detriment of their customers. It has not resulted in an improvement in population health that could drive down the overall cost of healthcare in our country.

Next: How do we fix this part of our healthcare system? 

	Eight or nine years ago, when we started seeing most commercial carrier contracts being tied to the Medicare rate, they ranged from 105% to 120% of the Medicare fee schedule or they were a proprietary fee schedule below the Medicare rates that have not kept up with inflation. 

 have been gradually reducing these contract rates over time to the point where today, as I contract new providers, the new contracts are significantly less than the Medicare rates. This is even in underserved areas where there are not enough physicians. In the particular instance that had me start this blog, the client is a general surgeon that has moved to a very poor county and is the only general surgeon in the town. Even with that scenario, the contracts are almost all below the Medicare fee schedule and could be the reason previous surgeons have not stayed in this community.

Physicians react to Trump's new vaccination safety committee

	The Accountable Care Act has to take some responsibility for this situation as well. The overall reimbursement to the physician for these patients is lower than a patient covered by other commercial or Medicare rates. In some instances, these products pay similar rates to Medicaid, plus, the deductible after the first visit applies to all services, leaving patients with large balances that many of them will never be able to pay. Because of the ACA, there are virtually no PPO policies available to individuals through the major carriers. Consumers are forced into HMO products with limited markets that many physicians will not take due to the low fee schedules.

	How do we fix this part of our healthcare system? Well, there will be much discussion over the next few years as the new administration moves to “repeal and replace” the current law. My humble opinion, however, is that there needs to be more competition. I would suggest that large carriers who have gobbled up multiple small insurance companies at the same time they are reducing provider payments, be forced to split up rather than allow more mergers. The outcome to all the mergers and acquisitions currently has been a major reduction in payments to the providers who provide the care to their customers, and in many cases, higher cost for patients. Patients also suffer when they are forced to change healthcare providers over and over, which defeats the goals of improvement in population health. 

Dear President-elect Trump: It's time to bring doctors to the table

	So, who benefits from the mergers? Insurance premiums have increased dramatically and individual PPO plans are either not available or have a huge deductible that must be met before the policy pays any bills. Providers are being paid less than at any time in the past for the services they render despite the increased cost to run their business. Patients have to frequently change providers because of the changes in the exchange market and because of narrower provider panels in all commercial HMO products. The insurance carriers tend to limit the HMO market to low-cost providers, but low cost generally is not quality care. I cannot think of anyone that benefits from these mergers but the investors and the top employees in the insurance companies.

	I hope the new administration can focus on the overall improvement of population health as the goal while it evaluates the healthcare agenda. If it allows the mergers of the carriers, there should be a stipulation that the fee schedule should increase 10% since, over the past few years, their fee schedules have decreased more than 10% to improve THEIR profitability. That could reduce the number of mergers and provide more competition in the market. Maybe I will send that suggestion to the new administration. 

I hope the new administration can focus on the overall improvement of population health as the goal while it evaluates the healthcare agenda.

Author | Carol Gibbons RN, BSN, NHA

Articles

8 tips for avoiding employee handbook crises

What is the price of a medical record?

Tips for auditing physician employee personnel folders

How did Medicare become the highest paying carrier?