Janet Colwell

Internist Michael Soppet, MD, part of an eight-physician internal medicine practice in Dothan, Alabama, achieved recognition as a patient-centered medical home (PCMH) in 2011. Recently, however, he and his partners opted not to apply for renewal.

	The practice could no longer afford to fulfill all the requirements of a PCMH and go through the time-intensive recognition-renewal process after a major payer dropped its care management fee, says Soppet. Previously, the practice had been receiving a per-member-per-month fee in addition to enhanced fee-for-service payments under a Blue Cross Blue Shield of Alabama PCMH pilot project.

	Like many physicians, Soppet and his partners embrace the principles of the PCMH but struggle to make it work in a fee-for-service environment. However, the Medicare Quality Payment Program-part of the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA)-may offer an alternative for Soppet and others. The program, slated to start in January, outlines two incentive pathways for practices: the Merit-based Incentive Payment System (MIPS) and Advanced Alternative Payment Models (APM). 

	To sustain a medical home practice, smaller practices should look to participate in the Medicare program or to collaborate with payers that offer financial incentives above and beyond fee-for-service reimbursements, says Yul Ejnes, MD, a general internist with Coastal Medical in Cranston, Rhode Island, who chairs the National Committee for Quality Assurance’s (NCQA) PCMH 2017 Advisory Committee. 

	“You can’t run a medical home practice on a purely fee-for-service basis,” he says. “You have to have financial support from payers and look for affiliations with others to share costs.”

	The NCQA launched its PCMH program in 2008 and it has become the main path to recognition for practices across the country, although some private insurers and state entities also offer certification (see sidebar). Specific criteria vary, but generally the model emphasizes team-based care and using electronic health records (EHRs) to track progress and outcomes and coordinate care across providers 

	Nitin Damle, MD, whose eight-physician South County Internal Medicine in Wakefield, Rhode Island, became an NCQA-certified PCMH in 2010, views certification as a step towards improving care for his patients as well as securing the long-term financial health of his practice. “We saw this as a better model for patients and for our office,” says Damle, who also serves as president of the American College of Physicians. “We’ve improved our workflows and efficiency and increased both patient and clinician satisfaction.”

	Damle adds that with those improvements already in place, the practice is well set up to receive incentive payments initially under MIPS and eventually qualify as an APM.

	To get to its current state, it was essential to have financial backing from payers to help build and maintain an infrastructure, he says. Damle’s practice is part of the Care Transformation Collaborative of Rhode Island, under which the state’s major private payers and Medicare provide financial support to practices that meet the standards of a medical home.

	For example, his practice receives a per-dollar-per-month payment for meeting certain quality measures as well as funding for a full-time clinical nurse manager. The nurse manager also serves as a kind of practice champion for the PCMH, handling clinical and administrative tasks and educating other staff members about the concept.

	“You really need someone in the practice who is enthusiastic and committed to making these concepts work across the entire office,” he says. At South County, a nurse manages the infrastructure of the practice and coordinates care for patients as they’re discharged from the hospital and emergency room. 

	Coastal Medical signed its first PCMH payer contract with Blue Cross Blue Shield of Rhode Island in 2011, says Ejnes. The arrangement provided critical operational support, including on-site training in how to track and report on PCMH performance measurements and funding for a full-time nurse manager.

	“The biggest challenges in creating a medical home are time and resource costs,” says Ejnes. “Putting the technology infrastructure in place is costly and there may be some loss of efficiency during the transition.”

	The RAND Corporation recently studied 12 practices involved in a medical home pilot program in Pennsylvania. According to the study, median per-practice costs associated with the transformation were $30,991 in one-time costs and $147,573 in ongoing yearly costs. (See sidebar, “Costs associated with medical home transformation.”)

	Care management activities accounted for more than 60% of these costs, according to the study, and per-physician costs were greater for small and independent practices than for larger system-affiliated ones. The results were published in the July 2016 J

	Teamwork is another important element needed to succeed as a medical home, but it may be a hurdle for some physicians who are used to handling most aspects of the business themselves, Ejnes notes. 

	“We used to get lists from payers about patients who needed mammograms and other routine screenings, and they would sit on my desk until I got around to reviewing them,” he says. “Now, those reports go directly to the medical assistant and I don’t see them unless the assistant has a question or wants advice.”

	As a result, Ejnes finds he has more time for direct patient care. “When my assistant reviews medication lists at check-in, that’s several more minutes out of a visit that I can use to talk to the patient,” he says.  

	The medical home team extends beyond clinical staff to front desk and billing employees, says Damle. Efficient workflow within a practice is essential to maximizing efficiency. “From the time patients arrive in the waiting room to the time they exit, they need to have a sense that there was a real flow to their visit,” Ejnes says.

	Becoming a medical home paved the way for Coastal Medical to form an accountable care organization (ACO) in 2013, says Ejnes. With 20 sites and approximately 100 physicians across the state, the practice was large enough to form its own ACO, allowing it to benefit from new payment models while remaining independent.

	The practice now participates in the Medicare Shared Savings/ACO Program, says Ejnes. Under that program, practices continue to participate in Medicare fee-for-service but also receive incentive payments if they meet certain quality targets and lower per-beneficiary spending compared with historical norms. “A lot of the building blocks of the medical home are similar to those required for ACOs,” he says. 

	Coastal Medical is now well-positioned to qualify as an advanced APM under MACRA, says Ejnes. In contrast, most practices likely will start in the incentive-based (MIPS) program.

	“In order to meet the standards for an advanced APM, a practice has to take on more than nominal risk,” says Marci Nielsen, PhD, MPH, president and chief executive officer of the Patient-Centered Primary Care Collaborative, a national nonprofit advocacy group focused on primary care and the PCMH. 

	As the rule stands at press time, it’s difficult for small practices to qualify, she adds, because their patient panels are too small to sufficiently spread the risk, yet they could face penalties if they experience losses in excess of the defined nominal amount (proposed as at least 4% of annual medical expenditures.)

	It’s desirable for most practices to participate in MACRA as an advanced APM because the MIPS program has a much heavier reporting burden, Nielsen notes. MIPS will bring the existing Physician Quality Reporting System and Meaningful Use under one umbrella but still will require physicians to report on most of the same quality measures. Practices qualifying as APMs will be exempt from those reporting requirements.

	The proposed rule lists six practice models that would qualify as APMs. Only one of those-Comprehensive Primary Care Plus (CPC+)-applies to non-ACO primary care practices. PCPCC wants the list expanded so there are “multiple on-ramps” for smaller practices to participate, says Nielsen.

	Regardless of what the final rule entails, current medical home practices should be gearing up to participate in at least one of the MACRA programs, says Nielsen. If not certified through NCQA, practices should make sure they are accredited through qualifying state or regional programs, such as those offered in several states by Blue Cross Blue Shield.

	In addition, PCMH practices should look to participate in CPC+ programs now or in the future. These will operate initially in 14 regions across the country, says Nielsen. “If a medical home is a primary care practice on steroids, then CPC+ is the gold standard,” says Nielsen. “Physicians should pay close attention to that program because it is currently the only way for primary care practices to qualify as APMs.”

	However, many small practices might not have access to those programs, notes Soppet. In Alabama, major commercial insurers declined to participate in the CPC+ initiative, which would have restored the care management fee to qualifying practices. The insurer’s announcement was a factor in the practice’s decision to explore acquisition by a hospital, he says.

	“Designation as a PCMH allows practices to receive incentive payments through [the Quality Payment Program] but that can be achieved in other ways as well,” he says. “We decided to give up our PCMH recognition and instead rely upon outside resources to comply with MIPS.”

	While incentive payments under MACRA may help practices increase revenue, other sources of funding are more important to day-to-day operations as a medical home, says Damle.

	“We depend on the per-member-per-month payments from our major payers in order to continue functioning as a medical home,” he says. “Incentive payments alone aren’t enough because they will vary to some degree depending on how well you meet the performance measures.”

	Participating in commercial payer programs can be as important to a practice’s financial health as government incentive programs, agrees Ejnes.  For example, at Coastal Medical, Blue Cross Blue Shield paid for an on-site facilitator to assist with the transformation and paid the salary of a full-time nurse care manager.

	In addition to upfront support, commercial payers allow practices to share in the savings from lowering costs through things like improved chronic disease management and fewer emergency department and hospital admissions.

	“We’ve seen an increase in revenue to our physicians,” says Ejnes. “The quality and incentive payments we receive for better care have more than paid for the cost of implementing the medical home.”  

Articles

The hard work and cost of becoming a PCMH will benefit practices as they begin value-based pay.

Medical home pros and cons for small practices

physician Jeffrey Gold, MD, followed a traditional career path when he finished his residency about 10 years ago. He started at a private clinic then joined a large physician group in the Boston, Massachusetts area. Five years into that job, however, he became disillusioned by the system and began to consider striking out on his own.

	âWorking as an employee worked well for about five years when I was busy and starting a family and wanted the guaranteed salary,â says Gold, a family physician and owner of Gold Direct Care in Marblehead, Massachusetts. âThen one day I realized I was actually annoyed at a patient for talking too long and realized it wasnât really her I was annoyed with, but a healthcare system that gives me about 10 minutes with each patient.â

	It was around that time that he heard about the direct primary care (DPC) movement that was beginning to gain traction in a few states. The model is similar to concierge care, in which patients pay a premium for better access and extra services, but with a couple of key differences. 

	In concierge practices, physicians typically collect monthly or annual fees for extra services while also billing third-party insurance, whereas most DPC practices operate on a cash-only basis and do not work with third-party payers (although patients are encouraged to have catastrophic coverage.) In addition, DPC practices typically charge much lessâabout $77/month, on average, compared with an average of around $180/month at concierge practices.

	Gold eventually left his job to launch Gold Direct Care in February 2015. He hopes to break even by the end of this year if membership continues to grow at its current pace of 12 to 15 enrollees per month.

	Gold is part of a small but growing segment of primary care physicians who have adopted the DPC model, says Julie Gunther, MD, a Boise, Idaho-based DPC family physician who serves on the steering committee of the DPC Coalition, a national advocacy group. DPC first started to take hold in the United States in the late 1990s. Today, there are about 345 DPC clinics in 45 states, up from 300 in 39 states about a year ago, says Gunther.

	The biggest barriers to entry for many physicians are fear of losing income during the transition and aversion to taking risks, says Gunther. âYou do need to have some tolerance of risk and interest in entrepreneurship but we have a very supportive community that can help you get started.â

	For Gold, visiting an established practice was instrumental in his decision to convert to DPC. As part of his market research, he flew to Wichita, Kansas, to meet with family physician Josh Umbehr, MD, founder of
	Atlas MD, and returned home completely sold on making the transition.  

	âI was seeing 25 patients a day and they were seeing 25 patients in a week between three physicians,â Gold recalls. âThey had some wealthy patients but they also had many working-class patients who were looking for affordable, high-quality care where they wouldnât be treated like a numberâthatâs what really convinced me to give it try.â

	Umbehr launched Atlas MD straight out of residency in 2010 and has since taken on four partners and grown to 600 patients per physician. Perceiving a lack of DPC resources and help for new practices, he created an online DPC curriculum for start-ups and has provided free consulting to more than 165 physicians over the past two years. 

	âMost doctors we talk to are afraid of change,â says Umbehr, who also has a DPC podcast and blog. âTheyâre often afraid of the business side, such as how to set prices or how to handle medications and labs. We walk them through all these issues and show them how it works in actual practice.â

	His online curriculum outlines the basic costs of starting up as well as tips on buying equipment and answering common patient questions, among other topics. Umbehr considers it a worthwhile investment of his time if it helps promote and grow the DPC movement and raise public awareness of how it works.

	Gold modeled his fee structure after Atlas MD, with five membership tiers based on age, ranging from $30 to $125 per month.  The fee includes all office visits, unlimited communication with physicians, same or next-day appointments, and discounts on labs, procedures and prescription medications.

	Some DPC practitioners, including Gunther, charge a flat monthly rate to all patients, regardless of age. However, all practices share a commitment to keeping fees low enough to be affordable to most patients. 

	In 2015, almost 60% of the patients in DPC practices earned household incomes of less than $95,000, which is still above the median but less than the average at concierge practices, which ranges from $125,000 to $250,000, according to data collected by industry trade publications DPC Journal and 

 On average, the majority (68%) of DPC practices surveyed charge fees ranging from $25 to $85 per month.

	Besides low fees, DPC practices tend to maintain small patient panels, the journal reports. As of June 2015, 60% of practices had panels of fewer than 300, although the goal is more than that. (Gold hopes to reach 600-800 per physician.)

	Financing can be a major barrier for many physicians looking to transition from traditional fee-for-service practice to a relatively new model. According to Atlas MD, purchasing equipment such as EKG machines, ultrasound, lasers or bone scanners can cost about $250,000. The other major cost is leasing and furnishing an
	office, which varies by location.

	However, notes Umbehr, most of that equipment is optional or can be leased, and physicians can add items as their budget allows rather than purchase everything at once.

	Goldâs situation is unusual: he obtained start-up funding from a wealthy patient who was interested in supporting the DPC movement. The patient loaned Gold about $400,000 at a reasonable interest rate and terms specifying payback at 75% of practice profits until paid off. He used the money for office space, new equipment and salary support in the practiceâs first year.

	As a result, Gold was able to avoid taking  on a high-interest bank loan and didnât have to worry about closing his doors in the early  months when patient enrollment was low.

	However, itâs possible to make the transition without that kind of help, says Gunther, who opened her DPC office in June 2014. By scrimping and saving during the early months, she managed to break even in January of this year.

	âMy business plan revolved around making it through the first three years,â says Gunther. âWe put more personal finances into it than we planned but Iâm definitely happier now because I can be the kind of physician I want to be.â

	In addition, DPC offers savings over traditional practice models that balance out some of the start-up costs, says Umbehr. For example, DPC practices do not need extra staff to handle third-party billing and they can eliminate the cost of pharmacy services by purchasing medications at wholesale rates and dispensing them from their offices.

	Physicians are often hesitant at first to establish an in-house pharmacy even though most states allow doctors to dispense controlled substances internally, he says. However, negotiating wholesale prices with labs and drug companies and selling directly to patients are keys to staying profitable. 

	Wholesale discounts can be quite substantialâup to 95% off retail costsâmaking the cost to patients less than a typical insurance copayment, says Umbehr. For example, Atlas charges $4.60 for a complete metabolic panel compared with $52 retail, according to the price list posted on its website, and passes along wholesale discounts on prescription drugs to its patients.

	âWe get our medications from the same wholesalers as the pharmacies do,â he says. âEverything is transparentâour patients see all of our costs and prices and can decide for themselves whether to choose generic or brand-name medications.â

	Physicians can also provide greater value to patients by performing common procedures in-house, says Umbehr. Atlas includes procedures such as EKGs, spirometry, lesion removal and blood sugar testing, among others, in patientsâ membership fees.

	One of the toughest parts about getting started as a DPC practice is convincing current and prospective patients of its benefits. Consumers often assume that membership practices are more expensive than fee-for-service primary care and often equate DPC with concierge models.

	Itâs helpful to put the costs into perspective when talking to prospective patients, says Gold, noting that the price of DPC membership is roughly the same as a monthly cell phone bill. When paired with catastrophic insurance coverage for serious events and emergency department visits,  membership can provide comprehensive primary care and full access to physicians at a cost that is often less than a traditional insurance plan, he says.

	However, not all patients from his previous employment were convinced by the value proposition of DPC, says Gold. Only about 100 out of 2,500 patients chose to join the new practice.

	âIt was very difficult emotionally,â he recalls. âYou feel rejected and abandoned by patients that you might have gone through a cancer diagnosis with. Despite all the financial challenges of this transition, the hardest part was the emotional aspect of patients not sticking with me.â

	Legislative issues also have slowed growth of the DPC movement. For example, although the Affordable Care Act defines DPC as a primary care service, current IRS policy treats it as health insurance because of the monthly fee structure. That prevents patients from using their health savings accounts (HSAs) for DPC membership because HSA funds cannot be used to purchase insurance.

	However, changes are in the works. About a dozen states have adopted legislation that clearly defines DPCs as non-insurance arrangements that qualify as medical expenses payable through  HSAs. Similar legislation has been introduced at the federal level.

	In addition, federal regulators have yet to define the criteria under which a DPC practice would qualify as a primary care medical home on state and federal healthcare exchanges. That uncertainty has prevented many large insurers from creating so-called wraparound plans for the exchanges, which would pair DPC with catastrophic coverage.

	âOur goal is to have insurers start writing policies that are true wraparounds with DPC,â says Gold. âThen I, as a DPC provider, could be on the state exchange as a product and insurers would save money by eliminating spending on routine care.â 

	Another avenue for growth is marketing to employers, says Umbehr. DPC can be an appealing option for companies looking to reduce healthcare costs by allowing employees to pair DPC membership with high-deductible plans. âWe can help an employer reduce its insurance premiums by 30%-60% in the first year,â says Umbehr. âBecause we remove the cost of working with insurers.â 

Entrepreneurial docs make it work by cutting out third-party payers and negotiating with suppliers

Physicians chart new path into direct primary care

had been in private practice for almost 15 years when he was recruited to lead a urology division in the employed physicians group owned by Phoenix Children’s Hospital in Arizona in 2011. Although he might not have entertained the idea a decade earlier, Bailey decided that joining a larger system made sense from both a clinical and financial perspective.

	Like Bailey, many physicians see employment with a medical group or hospital as a way to escape the administrative burdens of running a private practice. Surveys show a steady migration away from independent practice as physicians grapple with new delivery models and more complicated billing and coding requirements-on top of the everyday concerns of running a small business (see sidebar, “An Exodus From Private Practice.”)

	While moving to a hospital or health system eliminates those burdens, physicians should count on making a few trade-offs, according to their peers and hiring executives. In exchange for more financial security and freedom from paperwork, physicians must accept less control over the way they practice medicine. The key is going in with open eyes, having made a conscious decision to give up some things in exchange for others that are more important to overall job satisfaction. 

	“Physicians who were partners in a practice and used to making their own decisions face the biggest challenges when they become employees,” says Tommy Bohannon, vice president of sales operations at Merritt Hawkins, a Dallas, Texas-based national healthcare search and consulting firm. “They may no longer have a say in who to hire, what hours the clinic is open, or what hours they work-that’s the biggest adjustment for many.”

	Even when physicians are cognizant of those trade-offs, they might underestimate the difficulty of switching from an entrepreneurial to a corporate culture, says Gail Gazelle, MD, a physician career coach and an assistant professor of medicine at Harvard Medical School in Boston, Massachusetts.

	“One of my clients thought he had his dream job but he hadn’t thought it through,” says Gazelle. “When he found out how stifling the corporate culture was at his new job, with very little room for creativity or input on how many patients he would see, he was in a state of shock.”

	Taking some time to find the right fit can help minimize the culture shock that some physicians experience. Experts advise performing due diligence in the months leading up to accepting and starting a new job in order to vet prospective employers and weigh the pros and cons of different options.

	The key to happiness as an employee is going into the job with realistic expectations, says Allan Cacanindin, senior vice president at physician recruitment firm
	Cejka Search, based in St. Louis, Missouri.  He recommends connecting with physicians who already work at the organization. 

	Ask them about the work environment, whether they feel restricted in the way they deliver care, and how productivity-based bonus structures have affected their income, he says. Get a sense of what it’s like to work as part of a care team and how that might affect your interactions with patients. “For many physicians, the concept of sharing the care of their patients and developing relationships as a team is new,” notes Cacanindin.

	The prospect of losing control or “being asked to practice in a way that doesn’t meet their own moral compass,” is the biggest fear for many physicians when they contemplate leaving private practice, says Gazelle. 

	For example, while there’s pressure to stay on schedule in private practice, physicians generally make their own decisions about how much time to spend with individual patients, she says. As employees, however, their every decision may be recorded on a computerized dashboard where the entire team can see how far behind they are, how many charts are still open, or how many patient messages are in their inbox.

	For many physicians that kind of accountability seems like a reasonable trade-off for having a more stable income and better work-life balance, notes Bob Collins, managing partner in charge of physician recruitment for The Medicus Firm, based in Dallas, Texas. 

	A larger company might offer more income and career advancement potential, whereas a smaller employer might pay less but offer physicians more control over their day-to-day practice, such as scheduling, staffing, and time spent with patients.

	“Physicians have to be comfortable with the framework they’re entering into knowing that there will be give and take in any situation,” says Collins. “Your ability to influence change in a large organization is likely to be minimal because the larger the company, the more likely they are to need standard processes and procedures to operate efficiently.”

	As an employer, John Hamilton, senior vice president and chief operating officer of Phoenix Children’s Medical Group, believes in confronting physicians’ concerns head-on during hiring negotiations. He urges prospective employees to think carefully about the pros and cons of becoming employed before making a move.

	“I’m very upfront with people that this will change their lives and there’s no surefire way to know how it will go,” says Hamilton. “But you can work through a lot of the tough issues and start to form a relationship and build trust in the due diligence process.”

	Signing on with an organization that you already know and trust makes the adjustment a bit easier, notes Bailey. Prior to joining Phoenix Children’s, Bailey and his partners had served on committees at the hospital and formed personal relationships with administrators and physician peers.

	“We knew what we were joining and that it wasn’t just some big faceless corporation that we had no track record with,” he says. “We knew this was a group that we truly wanted to partner with.”

	The same factors that are driving many physicians out of private practice are increasing demand for physicians’ services. As hospitals and health systems form accountable care organizations and implement population health management strategies, they are rapidly adding employed physicians, especially family practitioners and general internists (See sidebar, “An exodus from private practice, on page 46).

	Retaining those physicians is just as important, if not more so, as getting them in the door, recruitment experts say. Consequently, many employers are becoming more sensitive to physicians’ concerns and offering programs and benefits aimed at helping them make the transition from private practice.

	To prevent physicians from feeling alienated and keep them on board, the larger systems are making significant efforts to give physicians a say in the running of their practice, says Bohannon. 

	Phoenix Children’s is one example. It has tried to achieve a balance between integrating new physicians into its system and allowing them to retain some measure of independence, such as developing their own scheduling templates, says Hamilton.

	“Our strategy is to maintain as much of an independent practice’s individual brand as we can, particularly in primary care,” he says. “We want them to focus on good quality care while we eliminate some of the headaches.”

	It’s also important for employers to keep physicians engaged well past the honeymoon period. After some time on the job, physicians often start to get a little disconnected and employers have to be mindful of engaging them down to the individual provider level, says Hamilton. Physicians have a tendency to want to lead and drive change, or at least participate in discussions, so they can get frustrated if they’re not part of the decision-making.

	At Cleveland Clinic’s main campus in Ohio, new hires participate in a week-long orientation process designed to educate them about the history and culture of the system as well as its employee benefits and programs. It also offers a coaching and mentoring program in which new employees are assigned individual peer mentors to help them navigate the workplace.

	Moving to an employed situation is a trade-off for many physicians says Bradford Borden, MD, Cleveland Clinic’s associate chief of staff and chair of the Emergency Medicine Institute, who leads the clinic’s recruiting efforts. After years of being their own boss, it’s not always easy to adjust to a team environment.

	While acknowledging that physicians will have to relinquish some control as employees, Borden points out that working for a larger organization also opens up opportunities for leadership, education and research that might not be available to physicians in private practice.

	Those opportunities present an attractive trade-off for many physicians who see working for a large employer as a way to advance their career, says Cacanindin.  

	“Physicians who are business-savvy are drawn by the potential to stand out and perhaps take on a medical directorship that will provide extra income,” he says. “We’re now starting to see physicians who want a seat at the table and organizations are responding to that desire because their voices carry weight with other providers in the organization.”

	When hiring, employers look for qualities in physicians that indicate a good fit with the corporate culture, says Bohannon. They want expert clinicians who are also willing to be good corporate citizens, operate effectively in a team environment and pay attention to customer service.

	“No organization wants to hire a physician who will have trouble working with others and collaborating,” says Bohannon. “It may seem like a cliché but being a team player can go a long way toward determining whether someone succeeds or fails when they make the transition to employee.”

	Ultimately, transitions from private practitioner to employee work out when there’s flexibility on both sides, he says. 

	“The more sophisticated employers treat physicians as partners and value their feedback,” says Bohannon. “If you’re coming from an environment with a lot of autonomy, you need to pay attention to that and find out the philosophy of your potential employer in order to set yourself up for success.” 

Employees give up some control but gain freedom from paperwork along with new career opportunities

Surviving the transition from independent physician to employed

After more than $27,000 goes missing from his business account, a Texas physician learns that

 initiated a wire transfer using a fake domain name and an email almost identical to his own. Another physician returns from an international trip to find that criminals hacked his email and used it to transfer more than $30,000 from his medical group’s account to an unknown bank in Hong Kong.

	In both cases-taken from the files of a cyber liability insurance underwriter associated with Austin, Texas-based Medical Liability Trust (TMLT)-the victims’ banks were not liable for the losses because an authorized account holder approved the transfers, says John Southrey, CIC, CRM, manager of consulting services at TMLT, which provides medical professional liability insurance to Texas Medical Association members.

HIPAA: How to protect yourself and your practice

	“Cyber fraud is the most underestimated and underappreciated risk faced by small businesses, particularly in healthcare,” says Southrey. “Most physicians are not budgeting enough for computer data security because they think their practices are too small to attract the attention of cyber criminals. However, losses incurred as a result of a data breach can be worse than a direct tangible property loss such as from a fire or tornado … Many cyber-criminals consider physician practices to be low-hanging fruit because they have not kept up with technology.”

	Sara Hempfling, vice president of treasury management at St. Peters, Missouri-based Enterprise Bank and Trust, recommends that all of her clients purchase cyber liability insurance. Large companies may pay about $2,500 per month for $1 million in coverage, but smaller business often pay much less and some coverage is often included in standard professional liability policies, says Hempfling, who works with the bank’s medical clients.

Legal and ethical considerations for managing your online reputation

	TMLT added cyber liability coverage in 2011. Since then it has handled more than 250 incidents, with more coming in nearly every week, Southrey says. The majority of cases involve data breaches of personal health information (PHI), which can take a financial toll on a practice, exceeding the base cyber liability coverage limit.

Next: Lax security leaves small practices vulnerable

	Lax security leaves small practices vulnerable

	Criminal attacks are the leading cause of healthcare data breaches, ahead of employee negligence and lost or stolen devices, according to the Ponemon Institute, a nonprofit research group based in Traverse City, Michigan. Criminal attacks have risen by 125% over the past five years as cyber criminals increasingly recognize the vulnerability of medical organizations that store a trove of potentially lucrative personal data, according to the institute’s 2015 Fifth Annual Benchmark Study on Privacy and Security of Healthcare Data.

	More than 90% of the healthcare organizations included in the study reported experiencing a data breach, with 40% reporting more than five over the past two years, the report says. At the same time, only half of survey respondents reported feeling confident that they had the resources or processes and technology in place to detect loss or theft of patient data.

	Theft of electronic PHI (ePHI) has substantial financial implications, because victims are responsible for the costs of investigating the breach, notifying customers, paying any government fines, and other crisis-management activities.

Flashback: Healthcare and pharma cyber security rated worst in S&P 500

	It can take months or years to recover from the financial damage of a data breach, Southrey says. Under the Health Insurance Portability and Accountability Act (HIPAA), for example, practices can be fined for failing to conduct a comprehensive risk analysis of their policies and procedures and not having appropriate safeguards in place to protect ePHI.

	As a case in point, Phoenix Cardiac Surgery in Phoenix, Arizona, agreed to pay the U.S. Department of Health and Human Services (HHS) $100,000 and implement new security measures in 2012 after an Office of Civil Rights (OCR) investigation found that it had violated HIPAA rules, according to HHS. In the OCR investigation, which lasted more than three years, investigators found that the practice had been posting surgical appointments on a publicly accessible Web-based calendar and had not taken appropriate measures to protect the information.

	In addition to potential fines under federal and state privacy laws, practices must take steps to mitigate the effects of the breach, Southrey says. These can include notifying patients, providing credit-monitoring services, hiring a public relations firm, working with an attorney, and contracting with a forensics specialist to trace the source of the breach and recover unduplicated data.

	“That’s not to mention the potential lost revenue due to an interruption in business or staff overtime to reconstruct files and recover data,” he says. “And you may lose patients if they come to view your practice as a security risk.”

	Many of those costs are covered by cyber insurance up to certain limits (see sidebar), he says. For example, one physician insured with TMLT filed a cyber extortion claim involving more than 6,000 patient records after a hacker demanded several thousand dollars to decrypt his files. After reporting the breach to HHS, the physician received notice of an OCR investigation and a request to provide extensive documentation on his security practices.

Juggling patient finances and caring for the sick

	“He blew through his $50,000 limit in cyber liability coverage in less than two months,” Southrey says, noting that TMLT now offers up to $1 million or higher in coverage limits. “And he had to continue to pay other out-of-pocket costs, such as installing a new server.”

	In many cases small practices are particularly vulnerable to fraud because they do not implement procedures that might prevent errors, says Hempfling. In addition, they lack the resources to dedicate one computer exclusively to banking.

	“In smaller offices, one office manager might have full control over online banking and there is no system set up to have a second person authorize big transactions,” she says. “From a banking standpoint, that’s a risk.”

	While your employees might be fully deserving of that trust, mistakes can happen, she adds. For example, many cyber crimes involve tricking someone into disclosing financial information.

	One of her manufacturing clients fell victim to a fraudulent wire transfer. The client received a phone call from someone they believed to be an employee of a vendor notifying the client that the vendor’s bank account had changed. Hempfling’s client requested a bank verification letter, which was immediately provided and looked legitimate. Trusting that the contact was who they said they were, the finance manager then changed the vendor’s bank account information on the company’s computer system.

	“Our bank called the owner and warned him to double check the transaction before verifying it because it might be fraud,” Hempfling says. “But he was in a hurry and OK’d it anyway, trusting that his staff had already done their due diligence.”

HIPAA breach: Secure data and prevent fines now

	Employee training is a critical part of protecting your practice from cyber fraud, says Rebecca Busch, RN, president and CEO of Westmont, Illinois-based Medical Business Associates and a faculty member of the Association of Certified Fraud Examiners. Employees should learn how to recognize spam emails that appear to be from a payroll company, for example, and not to open or download programs from unknown sources that could be malicious software giving criminals access to the practice’s records.

	Cyber criminals might also install “ransomware” on your computer, which prevents you from accessing your data unless you pay a fee to unlock it. Such incidents led TMLT to add cyber extortion coverage to its medical malpractice policies.

	“Cyber extortion can be devastating from a revenue perspective,” Southrey says. “If you can’t access your data, how do you do your billing or conduct your patient exams?”

	Notifications about changes to your bank account should be verified “100% of the time,” Hempfling says. Remember, as soon as the business owner verifies a wire transaction, the money is sent and it is very difficult to reverse the process.

	“Consumers always get reimbursed but banks have discretion over whether or not to cover business losses,” she says. Banks are governed by very specific rules relating to check fraud, she adds. For example, the bank is exempt from liability if the business uses a signature stamp to sign a check instead of the account holder’s actual signature.

	Mitigation and awareness are critical to protecting your practice from fraud, Busch says. Physicians should inventory where their financial information is stored and have constant access to their financial accounts.

	“Your inventory should include any data that has a connection to your banking accounts,” she says. “You need to know when those accounts are accessed and how, and constantly monitor those channels.”

	The Texas Medical Liability Trust created the following checklist to help medical practice administrators assess their readiness to combat cyber crime:

		Is there a cyber risk management plan in force?

		Are all mobile devices that contain electronic personal health information (ePHI) encrypted? And is your network monitored for intrusion attempts?

		Are Risk Assessments conducted annually, including HIPAA Privacy, Security, and Breach Notification assessments?

		Have all previously identified vulnerabilities been addressed?

		Do you have up-to-date written policies and procedures that address the HIPAA Privacy, Security, and Breach Notification Rules?

		Are new employees receiving privacy and security awareness training to comply with federal and state medical privacy and security laws?

		Have you vetted the cyber security of your third-party vendors/business associates who have access to your PHI?

		Have you purchased suitable cyber liability insurance to cover potential first party and third party data breach claims?

Small practices often have the weakest security, experts say, leaving physician vulnerable to considerable threats.

Author | Janet Colwell

Articles

Medical home pros and cons for small practices

Physicians chart new path into direct primary care

Surviving the transition from independent physician to employed

Tips to improve cyber security and protect your practice's finances