James F. Sweeney

Medical malpractice insurance is one of the greatest expenses physicians face during their careers. But knowing what to look for in a policy is a mystery for many physicians, as well as a time-consuming chore that rarely gets the attention it deserves. And buying the wrong type or incorrect amount of insurance-or buying it from the wrong carrier-can be extremely costly. Physicians who take the time to understand how to buy malpractice insurance will not only save money, but ensure that they’ve got the right type and amount of liability coverage.As a primer, here are some basic definitions concerning malpractice coverage that every physician should know. 

Slideshows

Physicians who take the time to understand how to buy malpractice insurance will not only save money, but ensure that they’ve got the right type and amount of liability coverage.

8 medical malpractice terms every physician should know

Sohan Dua, MD, got the bad news in a phone call one morning in February 2017: His practice had been hacked.
	
	The EHR system shared by Dua and his wife, Kiran Dua, MD, had been breached and hackers were holding their patient data for ransom. That attack sent the couple, who practice in Northridge, Calif., on a months-long ordeal that cost their separate practices time, money, and service interruption.
	
	Dua, a nephrologist, never thought he and his wife, a primary care physician, would join the ranks of healthcare providers and organizations that have suffered crippling cyber attacks. Luckily, their losses were at least partially covered by the combined $100,000 cyber coverage they had through their medical malpractice insurance. The insurer also provided them with experts to help recover from the attack.
	
	Even with that assistance, however, their practices were forced to shut down for several months while they dealt with the attack. “We still don’t know how much money we lost,” Dua says. “We lost patients, too.”
	
	The growing threat of being hacked has more primary care physicians buying cyber insurance, according to experts. But what those policies cover, how they work, and how much they cost are mysteries to many healthcare providers, most of whom are only familiar with malpractice and business insurance.
	
	


	
	Cyber insurance covers losses and damages resulting from patient data being stolen, exposed, held for ransom, or improperly shared. It covers deliberate actions, such as hacking or ransomware, as well as accidents, such as a lost laptop containing unencrypted patient information or a coding error that accidentally exposes patient data.
	
	A comprehensive policy will cover paper records as well, since so much information is still stored in physical files. 
	
	Cyber insurance helps providers deal with the consequences of data breaches, which can range from relatively minor to catastrophic. The assistance provided can include:

compensating for loss of income from downtime or lost patients;

hiring IT experts to find and fix the breach;

hiring a call center to handle inquiries from patients;

hiring a public relations firm to deal with unwelcome publicity;

hiring attorneys to represent the practice in any lawsuits filed by patients (as well as any damages awarded); and

In short, it covers almost any loss or expense that can be attributed to the data breach.
	
	For example, the Duas’ coverage helped them when they were forced to write off uncollected bills due to patient payment records that weren’t recovered, a loss that Dua estimates at $40,000 to $50,000.
	
	Coverage typically applies only to the data itself and not the computer hardware a practice uses, such as laptops, smartphones, tablets, or servers, which often are covered under a general business insurance policy.
	
	A complete policy includes first-party and third-party coverage, says Marcin Weryk, vice president of XL Catlin, a cyber insurance vendor. First-party coverage pays for damages suffered by the policy holder, such as lost revenue, business interruption, IT forensics and data restoration.
	
	Third-party coverage compensates for damages caused to others by the data breach, such as the legal costs incurred from lawsuits filed by affected patients.
	
	Practices that haven’t bought cyber insurance often have some coverage through their malpractice or general business policies, but it’s usually limited to about $30,000 in damages and contains exemptions, says Brandon Clarke, co-founder of Affenix, a brokerage specializing in cyber insurance.
	
	Before deciding whether to purchase additional cyber insurance, physicians should know what coverage they already have, Clarke says. Though the Duas have separate practices, they were able to combine their separate $50,000 cyber insurance coverage in their malpractice policies to help compensate for the joint attack.
	
	


	
	The cost of a cyber insurance policy varies, depending on the carrier, the size of the practice, and the extent and amount of the coverage, experts say. The larger the practice, the greater the risk and the more it can expect to pay.
	
	The good news is that cyber insurance is less expensive than malpractice and liability coverage. A typical five-physician primary care practice should have at least a $1 million umbrella cyber policy, Clarke says. That coverage would cost anywhere from $1,200 to $5,000 a year, he estimates.
	
	Christine Marciano, a certified information privacy professional (CIPP-US) and president of Cyber Data Risk Managers, a cyber insurance broker, recommends $1 million to $5 million in coverage for that same practice and says it would cost $1,500 to $8,000 a year. Coverage can be purchased from general insurers or companies that specialize in cyber insurance.
	
	Some insurers will assess a practice’s cyber security practices before deciding whether to write a policy and recommend ways to decrease risk, such as encoding laptops and improving passwords.
	
	


	
	When shopping for cyber insurance, practices should investigate exactly what help they will receive in case of a breach. Unlike a fire, managing a data breach often requires the help of a team of experts, not just a check to cover damages. Depending on the nature and size of the breach, that team can include lawyers, forensic accountants, IT experts, publicists and call center operators, among others.
	
	Besides the coverage itself, the real benefit of cyber insurance is being able to turn over management of the crisis to a carrier with experience in data breaches. Most practices do not have the time or resources to handle it themselves, says Clarke.
	
	Once an insurer learns of a breach, it assesses the situation and decides which corrective actions need to be taken to prevent further damage and deal with the aftermath.
	
	The insurer hires vendors and contractors to provide the necessary services. For example, a lawyer will handle HIPAA notification, while IT specialists locate and fix the breach and a PR firm writes the notification to patients whose data has been affected.
	
	The decision whether to pay ransomware is up to the practice, but the insurer typically recommends a course of action and handles any payment, if one is made. For example, XL Catlin has vendors with Bitcoin wallets, since that is the cryptocurrency usually demanded by ransomware hackers, Weryk says.  
	
	


	
	Patient data is exchanged between practices, insurers, hospitals, and labs every day. The more places data is stored, the more vulnerable it is to attack and accidental disclosure. Even a practice not targeted directly can be liable for data lost by a partner or vendor. 
	
	For example, in April, the state of New Jersey levied a fine of nearly $418,000 against Virtua Medical Group, a physician network, after a vendor error left the records of more than 1,650 patients visible online. 
	
	Many data breaches are going to involve EHR systems, and while the system vendors usually work with IT experts to find and fix the breach, it does not mean the vendors are legally or financially responsible, experts say. “Many practices expect their EHR system to handle breaches or pay for damages and that’s not always the case,” Clarke says.
	
	Practices should investigate what sort of cyber protection and coverage their partners and vendors have, with an eye toward working together to keep data safe, says Lee Kim, JD, CIPP-US, director of privacy and security at the Healthcare Information and Management Systems Society.
	“It’s really a shared responsibility between you and your vendors,” she says, “and you each have a responsibility to keep it secure.”

Articles

Cyber insurance covers losses and damages resulting from patient data being stolen, exposed, held for ransom, or improperly shared. Is your practice properly protected?

What practices need to know about cyber insurance

Doctors are fond of complaining that they didn’t go to medical school to practice business, but independent physicians do spend much of their time on their practices’ finances. 
	
	That requires mastering revenue cycle management (RCM), the financial process practices use to administer all the functions associated with claims processing, payment, and revenue generation.
	
	At the level of the individual patient, RCM begins when that patient makes an appointment and ends when all claims and payments resulting from that appointment and subsequent services have been settled. At a higher level, it means ensuring that the practice generates enough income to pay  its expenses and yield a profit. 
	
	RCM has never been easy, but the move to value-based care and reimbursement, as well as more risk-based payer contracts, has made it harder than ever. A 2016 survey by research firm Black Book found that 90 percent of small, independent practices were unprepared financially and technologically to implement value-based care.
	
	Difficult though it may be, efficient and disciplined RCM is key to a practice’s ability to remain independent. “Effective revenue cycle management isn’t going to guarantee your practice’s financial success, but neglecting revenue cycle management might result in its failure,” says Melissa Lucarelli, MD, a family physician in Randolph, Wis., and a member of the Medical Economics editorial advisory board.
	
	


	
	As RCM becomes increasingly demanding, more practices are turning to vendors to handle part or all of it.
	
	The Black Book study predicted that the U.S. market for physician and ambulatory RCM outsourcing and extended business office services would grow by 42 percent between the end of 2016 and the beginning of 2019. The same survey of 2,000 independent physician practices found that 59 percent of providers intended to outsource some or all of their billing.
	
	“High-impact drivers of the physicians practice outsourcing market include the increasing emphasis on compliance and risk management, and the need for more efficient and cost-effective processes,” Black Book Managing Partner Doug Brown says in the study.
	
	The rising costs of operating a practice also underscore the importance of RCM. A 2018 Medical Group Management Association study found that over the past five years median operating costs for primary care practices have risen by 13 percent, from $391,798 to $441,559 per physician. And while revenue can fluctuate, expenses such as salaries, rent, insurance, and equipment payments must be paid on a regular, fixed schedule.
	
	Outsourcing RCM is comparable to a primary care physician referring a patient to a specialist, says Todd Van Meter, senior vice president, ambulatory care, for Optum360, a revenue cycle management firm based in Eden Prairie, Minn.
	
	The specialist has greater resources, knowledge, and expertise than the generalist to handle the situation, he says. And unlike a practice whose primary mission is providing healthcare, a vendor is focused solely on RCM, making it easier for them to stay current on regulatory and reporting requirements while discovering new efficiencies.  
	
	Lucarelli says outsourcing much of her RCM has been a boon for her small, rural practice. “These are tasks we could do and we used to do, but the system does the heavy lifting and the drudgery stuff that keeps us away from the medical stuff we want to do,” she says.
	
	She uses her EHR vendor for coding, billing, verifying insurance coverage, interfacing with payers, and other functions. The system has been particularly helpful for meeting reporting requirements under the Merit-based Incentive Payment System, as well as providing upgrades, such as free interfaces with labs.
	
	“There is no way that I would go back to the old way and be able to provide medical care the way I want to,” she says.
	
	


	
	Not all practices find it beneficial to outsource RCM, however.
	
	Associated Physicians is a 20-doctor independent practice in Madison, Wis., that offers comprehensive primary care services, including physical therapy, nutrition counseling, and diabetes education while operating its own lab.
	
	The accompanying volume and complexity of paperwork, reporting, and regulations would push some practices to outsource their RCM, but Associated Physicians does nearly everything with its own employees. “We want to remain independent. Part of that independence is wanting to do as much inside as possible,” says Executive Director Terri Carufel-Wert, RN, MHA.
	
	The practice employs 11 back office personnel, including coders and billing and payment specialists. While that’s a substantial amount of overhead, Carufel-Wert and Business Operations Manager Margaret Wilkinson, CMC, say the team saves money by performing at a very high level.
	
	Communication and coordination are key, Carufel-Wert says. Everyone, from physicians to billing clerks, works from the same guidelines, and new providers are quickly trained on office procedures. The coders are so well-versed in regulations that they seldom make billing errors and even occasionally correct commercial payers, she adds.
	
	Employees are cross-trained on jobs so there’s no drop-off in performance when  someone is absent. The staff analyzes potential new practice offerings and equipment to determine if reimbursement will make them profitable.
	
	The practice is proactive with patients as well. Whenever possible, it obtains payment upfront and frequently has to educate patients about what their insurance covers and how much it pays.
	
	The hard work pays off. The average time between billing and reimbursement from payers and patients is 22 days, which Wilkinson says is much less than average.
	
	“We had to do a lot of training and educating, but we are now able to deliver quality care at an affordable price,” Wilkinson adds.
	
	


	
	Newton Family Physicians has done its own RCM for its entire 37 years of existence and expects to continue to do so, says practice administrator Melissa White.
	
	“We find it just works better for us,” says White. The practice in Newton, N.C, has six physicians and four nurse practitioners. Doing its own RCM requires three full-time equivalent employees doing coding, billing, and other back-office tasks, while White and a part-time employee handle collections.
	
	The practice has considered using a vendor and probably would save money by doing so, White adds, but worries that introducing a third party would hurt long-standing patient relationships in the rural communities it serves.
	
	For example, the practice, which offers no-interest payment plans, knows when a patient has lost a job or been sick and will take that into consideration during billing, White says. “It’s not always about saving two cents,” she says. “From a community perspective, we just have better reception.” 
	RCM patterns
	As part of his RCM, Jeffrey Kagan, MD, an internist and member of the Medical Economics editorial advisory board, meets with his accountant annually to project income and expenses for his two-physician practice in Newington, Conn.
	
	The accuracy of those predictions determines whether the practice is profitable or if Kagan must tap into a line of credit to pay himself and employees. After 25 years in practice, he has identified reimbursement patterns, such as slower and fewer patient payments in the first half of the year because people have not yet met their insurance deductibles. This trend has gotten worse as more employers switch to high-deductible plans, he says.
	
	The practice uses an outside vendor for billing and occasionally hires a collection agency, but performs other functions itself.  Kagan does everything he can to get patients to pay co-pays and other costs at the time of their appointment.
	
	“If I can get my money in three months, I’m thrilled,” he says. “There are some who take longer, but none of my expenses get held up for three months.”
	
	He has had to get stricter with non-paying patients. His staff also knows to verify insurance eligibility before an appointment. “It only takes a few minutes, but it probably takes an hour to fix it later,” he says.

What you need to know to boost your profits.

Mastering revenue cycle management

How physicians behave after learning that they’re being sued for medical malpractice can determine the outcome of the case, regardless of its legal and medical merits.
	
	That’s why it’s important for physicians to know how to act upon being served notice of a lawsuit. Medical Economics spoke to malpractice defense attorneys and insurers to determine the do’s and don’ts to follow. The experts are:

Ericka Adler, a malpractice defense attorney with Roetzel & Andress in Chicago

Richard Cahill, JD, vice president and associate general counsel, The Doctors Company, a medical malpractice insurer

Sam Rosenberg, a malpractice defense attorney with Rosenberg Jacobs Heller & Fleming, P.C. in Morris Plains, N.J.

Notify your insurer as soon as you’re served.


	
	Not only does that get your insurer working on your behalf as soon as possible, it also means you’ll have legal representation faster, and that provides a protective shield for some conversations, says Adler. If doctors learn of a likely lawsuit before it’s filed, they should alert the insurer, she says.
	
	Employed physicians should notify their employers immediately as well.
	
	


	
	This protects conversations between legal counsel and their clients from disclosure in lawsuits. However, it only applies once a client has retained or had counsel appointed, and only in conversations regarding the case. Defendants should talk about the case only when their attorney is present and only with those people who are relevant to the case, says Rosenberg, who adds, “Everything you say can be used against you.”  
	 
	


	
	Doctors should review their malpractice policy to know exactly what is covered, the amount of coverage and what rights and responsibilities they have. Employed physicians should examine their contracts to determine their own and their employer’s responsibilities. While many policies give the physician final say in whether a suit is settled, many employment contracts give the employer that discretion.
	
	


	
	It’s natural upon being sued for physicians to have multiple questions for their attorneys. Physicians should ask their attorney about how long the process will take, the steps involved, and any other questions they have.
	
	

Talk to a mental health professional, if necessary.


	
	Being sued for malpractice is a mental and emotional blow, and not being able to talk to friends and colleagues about it can place enormous stress on the physician. “To have an adverse event is bad enough; when it results in a lawsuit that’s even worse,” Cahill says. Conversations with mental health professionals are, of course, privileged.
	
	


	
	Rosenberg estimates that 10 percent of defendants continue to treat the patients who are suing them. In those cases, they should treat them only for conditions unrelated to the lawsuit. Dropping the patient can be seen as an admission of guilt, he warns.
	
	


	
	Malpractice settlements and adverse judgments are reported to the National Practitioner Data Bank (NPDB) and state medical boards. This information follows physicians throughout their careers. Adler says she tries, when negotiating employment contracts with hospitals, to give doctors the right of approval for the language in the NPDB report. Doctors can appeal notification wording to the NPDB if they feel it’s unfair or inaccurate.
	
	


	
	Being sued is common and the odds are in your favor. A 2012 study published in the Archives of Internal Medicine found that about 55 percent of claims resulted in a lawsuit. Of those litigated claims, more than half were dismissed by the court. Of the rest, most were settled before a verdict; less than 5 percent were decided by a trial verdict. And the verdict was in favor of the doctor 80 percent of the time.
	
	

Don’t talk to anyone other than your attorney.


	
	This is one of the most difficult rules to follow, but also one of the most important, says Cahill. It’s natural to want to discuss the case with colleagues, friends and others, but those conversations can come back to hurt the defense because they’re not privileged.
	
	“Conversations with other providers, including employees, partners, colleagues, hospital administrators and consultants, are generally subject to discovery and may create an adverse inference that the witnesses were somehow colluding to get their story straight and thereby avoid liability,” Cahill says.
	
	


	
	It’s tempting to go back and complete or correct the relevant medical records, but doing so is a big mistake. Plaintiff attorneys will seize upon any alterations and make them look like a doctor’s attempt to conceal or destroy evidence, says Rosenberg.
	
	Any change made to records should be dated, initialed and accompanied by an entry noting who made the change and why. Cahill recommends segregating the relevant original paper records and severely limiting access to them.
	
	“Physicians with electronic health records should exercise similar care,” he says. “Changes to electronic entries should not be made without a clear notation that it is an addendum or a late entry-those should be made only on rare occasion, should be objective and not self-serving and should never attempt to falsely contradict prior entries.”
	
	


	
	The natural impulse upon being sued is to go back and review the case, looking for errors, incomplete records, the involvement or liability of other providers, etc. This could involve talking to colleagues, staff and others involved in the case, which can be seen as an effort to block the investigation or cover up wrongdoing. 
	
	

Don’t talk to the plaintiff’s attorney.


	
	It’s not uncommon for a plaintiff’s attorney to call or email the office of the defendant doctor with a request for records or other information, says Rosenberg. Do not respond to such requests or talk to anyone on the plaintiff’s side, because the conversation can be used against you, he says. Let your attorney handle all records requests. And, of course, don’t offer a settlement.
	
	


	
	Unless a doctor has been sued so often that his or her personal attorney is a malpractice specialist, it’s safer to be represented by an attorney appointed by the insurer or employer. They’re experts in malpractice law and are familiar with the tactics used by plaintiff’s attorneys. “Using your own attorney is like going to a podiatrist to treat your heart disease,” says Rosenberg.
	
	


	
	Most malpractice cases are settled out of court, often with no admission of wrongdoing. These settlements usually are driven by the insurer’s decision that it’s easier and less expensive to settle than to go to trial, Adler says.
	
	“For anyone to have to settle something when they’ve done nothing wrong is hard,” she says. “A lot of it is really about money. It’s a business decision and not about whether the doctor is good or bad.”

Author | James F. Sweeney

Articles

8 medical malpractice terms every physician should know

What practices need to know about cyber insurance

Mastering revenue cycle management

What to do if you are sued for malpractice