Nicole Lewis

	Small physician practices can expect their IT vendors to add new revenue cycle management (RCM) tools that will improve patient billing processes. But physicians shouldn’t expect technology alone to solve all their problems.

	In fact, physicians should be cautious when vetting RCM software, warns Mutaz Shegewi, research director covering provider IT transformation strategies at IDC Health Insights, a division of Framingham, Mass.-based IDC Research Inc.

	At a time when many physicians struggle with inefficient billing processes that often contain errors and are labor intensive, Shegewi said doctors are increasingly looking for systems to simplify bridging the patient encounter with administrative data to streamline payment.

	Implementing RCM systems are gaining a renewed sense of urgency as small physician practices enroll in programs like Medicare’s Quality Payment Program, including the Merit-based Incentive Payment System, as well as other pay-for-performance initiatives.  In this environment, Shegewi said, physicians are demanding RCM tools to automate financial processes and medical billing tasks.

	“Typically, vendors offer physician practices everything beyond the patient encounter, including scrubbing the codes, generating and submitting claims, and then posting the payment to the practice. In return, vendors ask for a percentage of the practice’s revenue and for some practices that’s a very appealing offer,” Shegewi said.

	However, this arrangement comes with many challenges because oftentimes vendors and their clients don’t communicate effectively and set the right expectations, Shegewi said. He added that too often, practices think if they do nothing beyond the clinical aspect of the patient encounter and outsource RCM to the vendor, they have no role to play. This view, however, causes problems.

	“There are best practices that need to be followed to facilitate the billing process. For example, there are coding processes and tasks that need to be streamlined to ensure practices properly code items prior to the end of the encounter, which with the aid of the vendor and their capabilities can be identified and continuously improved on,” Shegewi said.

Next: Four strategies to improve RCM operations

Four strategies to improve RCM operations

	As small physician practices engage more deeply with vendors  in an effort to improve efficiency, reduce costs and increase revenues, Shegewi recommends four key strategies that small practices can deploy that will help them improve their RCM operations.

1.  Understand your goals and the IT solution.

  Physicians at small practices must understand their revenue targets, and vet technologies that help them meet their goals. The finances and overall health of a practice will be impacted by the performance of the solution. Therefore, it is important to ensure the solution is well-aligned with practice expectations.

 There’s a wide range of RCM systems on the market and some vendors are involved in mergers and acquisitions to enhance their RCM solutions. If a vendor touts themselves as having the ability to outsource a practice’s RCM system, physicians should find out exactly what processes the vendor or the solution will address and take an informed decision about it. Remember, the revenue cycle is a multifaceted and multi-step process that includes everything from pre-registration and registration to charge capture and claim submission, the remittance process, collections, as well as an evaluation of the utilization of a practice’s revenues.

3. Stay vigilant during an RCM implementation project. 

During the installment of RCM software there may be minor areas or issues that could lead to catastrophic results. For example, if you are missing certain information and codes in your claim submission that could result in errors and claim rejections. The front  and back-end office operations of the practice still have a role to play alongside the vendor to identify and ensure proper information is captured, and that best practices are followed prior to and after the software is installed and being used.

4.  Learn from, continually improve on and optimize your RCM solution.

 The solution should reduce the amount of time for receiving payments on the services rendered. Some examples of ways RCM solutions do so are through automating real-time tasks, sending reminders about appointments and balances, offering reports and dashboards for enhanced visibility, as well as rule engines that increase the likelihood for first pass claim acceptance.

	“As physicians choose the right RCM system for their practice, it’s very important that they determine what they want in an RCM system,” Shegewi said. “There has to be a lot of transparency and visibility into the features of the software to understand how the technology works, what the technology will achieve and what business processes physicians want automated.”

Articles

Before physicians buy a revenue cycle management system they should do more than listen to a vendor’s sales pitch.  

Physicians need to be vigilant when choosing RCM solutions

	Small physician practices that participate in programs like the Merit-based Incentive Payment System (MIPS), or population health initiatives will suffer revenue cycle disruptions, as well as lost revenues as they seek to improve their pay-for- performance operations.

	This is according to David Nash, MD, MBA, dean of the Jefferson College of Population Health at Thomas Jefferson University in Philadelphia, Pennsylvania.

	Reflecting on the fact that both programs are based on variables that can change during the course of an episode of care such as cost, patient outcomes and quality of care, Nash said physician practices are left with a high degree of uncertainty about how much they’ll get paid after insurers analyze their performance metrics.

	“Unpredictability is the theme moving forward,” Nash said. “In both MIPS and population health initiatives, the revenue will be tied to outcome measures and the outcome measures are going to be complicated.”

	In the case of population health, which monitors and treats groups of patients with specific illnesses to improve outcomes among the group, Nash said the measures are going to be based on which insurance company’s population health program the physician practice joins.

	In the case of MIPS, he said we still don’t know how the Centers for Medicare & Medicaid Services (CMS) will score practices performance measures and what the impact will be on small practices and their revenue cycles. MIPS is one payment track under the Medicare Access & CHIP Reauthorization Act of 2015 (MACRA).

	Physicians participating in MIPS, will send data to Medicare beginning January 1, 2018, and no later than March 31, 2018 to qualify for a positive or neutral payment adjustment, affecting their 2019 Medicare Part B payments, helping them avoid up to a 4% negative payment adjustment in 2019.

	As small practices seek to follow groups of patients more closely, collect data and change business processes to meet the components of MIPS  Ì¶  quality, improvement activities, advancing care information and cost  Ì¶   small practices will have to redesign their operations to meet performance standards.

	According to Nash, raising the performance of a physician’s practice requires investments in skills and technology, and he foresees practices that participate in pay-for-performance programs losing money in the near-term.

	“Overall, revenue will decrease for at least another year or two as small practices build the inter-professional skills necessary to practice population-based care or improve the quality of care that’s required under MIPS,” Nash said.

	He noted that it’s not farfetched to think that practices will, for example, hire a care coordinator in 2017, employ a diabetes nurse educator in 2018 and in 2019 hire a nutritionist.

	“Practices will have to add professional staff if they want to meet performance measures and that will be expensive and will create a decrease in revenue,” Nash said.

	What is also expected to change is the control that physicians had on predicting revenues. 

	Nash noted that in a fee-for-service system the calculation was easy: The number of patients times the number of visits times the amount of time spent with the patient.

	“You can implement a pretty good revenue cycle management system if you know how many patients you’re going to see in what period of time and what their average co-payment is. That's easy,” Nash said. “It's much harder when the physician is forced to hit these performance measures which sometimes are a year away. It becomes a much bigger challenge and setting an annual target income for the practice is near impossible.”

	One good thing about value-based initiatives, Nash said, is that many share the same goals of reducing costs, enhancing the quality of care and improving patient outcomes. With this in mind, Nash said physician practices can leverage their systems and participate in multiple value-based initiatives to drive a practice’s overall performance and raise revenues.

	There are several key areas that practices should focus on as they meet MIPS and population health measures while improving revenue cycle management systems, Nash said.

	For example, small physician practices have to improve office efficiency in many areas such as improving data capture, patient registration and pre-registration, as well as engaging patients with patient portals, mobile apps and other technology.

	He added that claim submissions, remittance processing, coding, patient collections and other tasks related to medical billing and payment require well trained office staff with the proper skills to handle these activities.

	Nash also said physician offices must create a patient registry function to track how well or poorly they are taking care of populations of patients that have, for example, diabetes. He added that a registry function can also help physician offices address MIPS measures on advancing care information about patients.

Small practices that enroll in value-based initiatives will see revenue cycle disruptions and loss of income, one expert says.

Medicare pay reform, population health will disrupt RCM

	With the government conducting a new round of HIPAA privacy and security audits in 2017, small medical practices need to be prepared.

	In an assessment of its first round (Phase 1) of audits, the U.S. Department of Health and Human Services’ Office of Civil Rights (OCR), which is responsible for enforcing patient privacy rules, found that many healthcare entities, including smaller practices, are having difficulty not only with implementing security technology to protect patient data, but with implementing plans and selecting personnel to manage HIPAA compliance at their practice.

	In fact, 66% of entities lack complete and accurate risk assessments in a review of Phase 1 audits, according to Zinethia Clemmons, OCR’s HIPAA compliance audit program director.  

	Research from SecurityMetrics, a data security company in Orem, Utah, suggests that protecting digitized patient health information continues to be a low priority for small practices. 

	A poll of 150 healthcare professionals responsible for HIPAA compliance at organizations with fewer than 500 employees found that: 

	51% don’t test employees on HIPAA-related training;

	50% of respondents don’t know if their organizations use multi-factor authentication;

	41% don’t know how often their firewall rules are reviewed;

	27% don’t encrypt emails containing patient data; and 

	There are a variety of reasons why small practices find it difficult to make their systems HIPAA-compliant. One is finding information on how to prepare. OCR and the Office of the National Coordinator for Health Information Technology (ONC) have a HIPAA Security Risk Assessment tool available online to assist small and medium-sized practices. (bit.ly/HIPAA-SRA).

	Many small practices also haven’t implemented measures to prepare for a potential HIPAA audit. In a recent study by cloud-based practice management software provider NueMD, 30% of healthcare professional said they didn’t have a compliance plan. Fifty-four percent said they did not have a security or privacy officer, and 60% were unaware of the planned increase in audits under OCR’s Phase 2 HIPAA Audit program, which began last year and is ongoing.

	Clemmons says that small practices preparing for the new round of audits should use the federal government’s HIPAA audit protocol, which provides specific guidance on what is required. It is available on the Health and Human Service department’s website. 

	Inadequate resources may be another reason many small practices rely on their software vendors to manage HIPAA compliance issues. Some small practices may believe mistakenly that software or billing vendors are taking care of HIPAA security issues, Clemmons says. 

	Against this background, physicians such as  Rodney Hood, MD, are keeping up with HIPAA audit requirements by strengthening their defenses against patient data theft.

	Hood, an internist who runs a two-physician practice in San Diego, California, has taken several steps to prepare for an audit. For example, he recently bought a new cloud-based EHR system for his patient data management operations, and assessed its HIPAA-compliant features as part of the selection process.

	He has also contracted with a local IT company to check for software vulnerabilities. The company is addressing any that it finds by providing patch management services, updating legacy applications and assisting staff with log management software. 

	Additionally, Hood belongs to an independent physician association (IPA), which provides his practice with services such as identifying consultants that offer a HIPAA security risk assessment at a reduced rate. Through his IPA, Hood performs an annual mock HIPAA risk assessment of his IT systems, policies and procedures. 

	He has assigned the practice’s office manager responsibility for training staff on many aspects of security such as changing passwords, alerting staff to the dangers of opening unusual emails and making sure that computer screens cannot be seen by patients or visitors.

	Hood says that as small practices redesign their business operations around managing larger quantities of data, they are increasingly forced to engage the services of IT service providers such as cloud services and IT consulting companies to help manage and secure patient data.    

	“In a small practice like this, we rely on our partners-the EHR vendor, the local IT company we’ve hired and the IPA we belong to, along with our office manager, to take care of securing patient data,” Hood says. “We assume and accept what we are being told by the vendors about how secure the software is or isn’t.”

	HIPAA conducts two types of audits, on-site and desk. The Phase 1 HIPAA Audit Program, which occurred in 2012, included on-site audits by auditors who interviewed key personnel and observed processes and operations to determine compliance with the HIPAA Privacy and Security Rules.

	The Phase 2 HIPAA audit program, now underway, consists of desk audits. During a desk audit, practices are asked to provide documentation of their privacy, breach notification and security practices electronically via a secure web portal.

	Mark Swearingen, JD, a lawyer with the Indianapolis, Indiana, law firm Hall, Render, Killian, Heath & Layman, PC, has several recommendations for small practices as they prepare for a potential HIPAA audit:

Develop and implement policies and procedures that address HIPAA requirements. 

	For example, practices need to develop HIPAA-compliant protocols for responding to outsider requests for patient medical records. Among the questions to be answered are: 

		Who handles the request-the doctor or the office manager? 

		How will the office authenticate that the requester is authorized to receive the records? 

		What documents from the requester should be presented, photocopied and kept on file? 

		What paperwork is required to process that request? 

		How much can be charged for the records?

Implement practices that adhere to HIPAA privacy requirements for physical safeguards. 

	For example, make sure that conversations during patient registration can be held in private. Also, ensure computer screens can’t be seen by patients and visitors to the practice.

Designate an individual to oversee privacy and security activities. 

	There is no prohibition on the privacy or security officer performing other activities or functions, which means small practices don’t necessarily have to hire a person solely dedicated to doing this job, but HIPAA requires that they identify someone within the practice to manage HIPAA compliance activities. 

	The individual in charge of privacy and security activities must demonstrate that the practice has made good-faith efforts to meet HIPAA requirements, including obtaining and regularly reviewing HIPAA policies, ensuring that employees are trained on the policies, making sure that an IT risk analysis is performed and problems are addressed and ensuring that business associate agreements are in place as necessary. 

	Where a third party performs a service or function on behalf of the practice that involves access to patient information, that third party is a business associate under HIPAA and the practice should not disclose such information to the business associate until a business associate agreement has been signed. 

	Practices utilizing cloud computing technology to host their patient data should ensure a business associate agreement is in place with the cloud service provider. 

	These practices also should have an agreement with the provider addressing issues such as security responsibility and data backup and recovery in the event of an emergency such as a ransomware attack, apportionment of liability and how data will be returned to the customer after service use ends. 

Make sure mobile devices are encrypted. 

	Implement policies that address how these devices are managed. For example, policies should state whether or not laptop computers can leave the premises. Practices should make sure apps doctors use to manage patient care have sufficient safeguards to protect the confidentiality, integrity and availability of patient information.  

	Prepare and maintain documentation of HIPAA compliance activities so that information is readily available in the event of an audit. Not only will this improve the overall function of the practice’s compliance program, it will better position the practice to respond to a government request in a timely manner. (Practices selected for a HIPAA desk audit, have only 10 days to prepare and send the requested documentation to OCR.) 

With the government conducting a new round of HIPAA privacy and security audits in 2017, small medical practices need to be prepared

Get ready for the next round of federal HIPAA audits

	Revenue cycle management (RCM) systems will continuing to expand fairly rapidly in the small physician practice market, said Aaron Gleave, research director at health IT review firm KLAS Research.

	Gleave also predicts that integration of systems associated with patient payments will continue, and vendors will develop unified RCM platforms that incorporate new tools designed to improve patient engagement, analytics and population health management. 

	He noted that small medical practices are often ill-equipped to handle a variety of issues such as the rapid growth of patient payments, changes in the regulatory environment and inefficiencies in account management such as denials of claims.

	“The challenge for vendors who are offering RCM solutions is for them to be able to keep up with those changing needs in a way that satisfies small practices’ ability to maximize revenues,” Gleave told 

	KLAS estimates that while 66% of small practices of fewer than 10 physicians think it’s worth investing in RCM technology, 33% said ploughing money into an RCM system isn’t worth the money. Of the 33% that refuse to buy new RCM systems, Gleave said many practices seek help with their RCM operations by joining an 

) or decide to handle the claims and billing side of their business on their own.

	“For a small practice, especially if we are talking about one, two or three physicians, it's very much a leap of faith to put the business piece of your practice in the hands of someone else and outsource it,” Gleave said.

	However, while some practices are hesitant to purchase RCM software, Gleave said many small practice physicians are ready to embrace the technology especially since many younger doctors, who have recently graduated from medical school are familiar with electronic health records and other clinical and financial systems. Additionally, small practices must keep up with the changes that impact payment systems.

	“The needs of smaller practices have evolved. They are pressing across the entire spectrum, on the billing side, the practice management side, population health and patient outreach and engagement,” Gleave said.

Next: 3 reasons for a single vendor solution

	Gleave said that there are three key reasons why small practices would benefit from a single vendor solution.

The benefit of a fully integrated solution

. Small practices that use a unified system built from the ground up on the same platform and using the same coding has its advantages. Primarily, physicians have the ability to transfer data seamlessly between the electronic health record, billing and claims management systems which will help small practices improve functionality and provide greater usability of the technology.

 Going to one vendor with a practice’s problems helps solve that problem more efficiently than using multiple vendors. It eliminates confusion and finger pointing, and helps small practices build a better relationship with their vendor.

 By building RCM platforms with ancillary modules such as patient outreach, patient engagement and population health tools as well as analytics software, physicians can plan ahead and make better business decisions that strengthen their ability to collect revenues. These features are becoming increasingly important to revenue cycle management systems.

	As single RCM systems become more popular in the small practice market, Gleave said vendors will have to offer greater transparency to physicians by letting them know their technology roadmap. Additionally, small practice physicians will need greater vendor guidance on issues that help the practice through specific technological challenges, such as tracking claims denials and resubmissions.

New RCM systems will improve small practices’ ability to manage claim denials, improve reimbursements and boost their business operations.

Author | Nicole Lewis

Articles

Physicians need to be vigilant when choosing RCM solutions

Medicare pay reform, population health will disrupt RCM

Get ready for the next round of federal HIPAA audits

Analyst: Big changes ahead for revenue cycle management systems