I agree 100% with Ken Fisher’s assessment on the abject failure of the EHR mandate (“Is the EHR an ill-conceived obsession?” MedicalEconomics.com)
President Obama’s genius central planners are to blame for this mess; they proved once again that state socialism does not work, when they unleashed MACRA and EHR requirements on us, before they were pushed out the door. Healthcare is the only industry to suffer permanent losses of efficiency, profitability, and quality due to computerization.
Why did banking migrate to the web so smoothly and painlessly by comparison? Because it was not subject to a government mandate. When the government tells you how to micromanage your business, bankruptcy is right around the corner. The answer is as clear now as ever: Revoke MACRA and revoke the EHR mandate.
If you like your EHR, you can keep it. If you hate your EHR, feel free to blow it up.

‘Ludicrous’ to replace doctors with non-physician providers

I totally agree with your statements about physician earnings (Your Voice, “Foolish to presume doctors make too much, others deserve more,” March 10, 2018). What is so often not mentioned are the great cost of medications, drug company direct-to-consumer advertising, and the huge incomes of insurance company executives.
Furthermore, physicians must have an undergraduate college degree, four years of medical school, and at least three years of residency and additional years of training for a fellowship. As a result, most physicians are saddled with substantial debt before they can begin to earn a substantial income. We, furthermore, accept great responsibility and exposure to malpractice suits.
The idea that physicians can be replaced by physician assistants or nurse practitioner is ludicrous. While they may be able to manage very straightforward clinical situations they are not equipped to deal with the more complex problems or recognize when a patient is seriously ill. They do not possess the knowledge of the natural history of diseases which can only be obtained after the rigorous training a physician undergoes. In short, you get what you pay for.
Commercial airline pilots are well paid and deservedly so. You do not hear much complaint about this.

I’m writing to reply to Anish Koka’s “Grading the Trump administration’s healthcare initiatives” (MedicalEconomics.com).
As a full time pastor and retired physician, I feel that a response from a different set of trench workers is needed. People in my area are suffering from the recent healthcare policies. The hard-working people in rural Southeast Oklahoma are struggling to get quality healthcare vs. surviving. Many of these people are Trump supporters. It is unfortunate that the current administration’s policies will not support them.
As you continue to give grades, I will continue to work to find quality healthcare to for all people regardless of their political affiliation.

Charles A. Woodridge MD, M.Divinity
Talihina, Okla.

Articles

Your Voice: Computerization of medicine simply a failed experiment

Cybersecurity is now an omnipresent concern, with criminals finding ever-more-lucrative opportunities to breach organizations across a number of industries. Healthcare presents an especially pronounced risk-factor, and today, bad actors often target unsecured medical devices to gain access to an entire health system’s or hospital network’s data. Current 

 places the onus on manufacturers to secure their devices; however, many of these devices are constructed on legacy operating systems, which no longer receive software patches. Absent regular security patches and with a diversity of users-from doctors to nurses to PAs-devices are uniquely at risk to be compromised by a bad actor.

Dangerous and worrisome for any business, hacking attempts targeting medical devices can have dire consequences. A successful breach can put lives at risk while imperiling a provider’s entire data infrastructure. Ransomware schemes are particularly successful in hospitals because medical facilities need to recapture control as quickly as possible to save the lives of their patients.

Small practice owners in particular often face pronounced risk because cyber criminals may see them as easier, more penetrable targets. Indeed, it’s a misnomer that smaller practices are somehow unknown to potential bad actors. We’ve found that bad actors are often size-agnostic, targeting whomever they can hack. With that in mind, healthcare devices are at-risk regardless of whether they’re in big hospitals or in small practices – and sometimes it’s the smaller providers that are most vulnerable.

With that in mind, there are three precautions healthcare providers must take to more effectively protect their medical devices from potential cyberattacks.






Hospitals and healthcare providers utilize myriad devices to monitor, diagnose, and evaluate their patients. Devices are replaced when needed, upgraded when possible, and purchased when available. With such frequent changes, and due to the sheer number of devices providers utilize, they frequently lack a comprehensive register that includes all of them.

This is made more complicated by the fact that providers often maintain inventory in several physical locations, all of which utilize the same network.
If, because of these issues, a provider lacks a complete inventory, its devices are particularly vulnerable. In that case, a hacker need only access a single, unsecured device to gain control of the entire data infrastructure. And, without an inventory, a hospital may not even notice the breach.

It is therefore essential that hospitals take and maintain a complete and accurate inventory of all their devices. Doing so will help them better track and monitor their devices and thereby better secure them.






Healthcare providers, under the visage of efficiency, frequently aggregate their administrative and medical devices in one network. On the surface, doing so makes sense-both device archetypes require powerful networks, and using the same one for both is organizationally simpler. In smaller practices, it’s often more cost-efficient as well.

However, such a tactic may enable a simple phishing scam, targeted at a single employee working on the network, to bring the entire hospital to its knees.
For this reason, healthcare providers should utilize a hidden network exclusively for their medical devices. This accomplishes several goals. It:

• Makes the device network harder to find and access
• Insulates sensitive patient data
• Ensures that hacking efforts targeted at the administrative side do not interfere with device functionality

With a hidden network powering medical devices, and medical devices only, a network engineer can write specific rules to limit access to each of its composite segments, creating additional layers of security that protect the hospital and the patients it serves.






In the pre-ransomware era, hospitals were content with periodic cybersecurity audits during which they’d review their cyber risk, checking the all-important cybersecurity box. However, that orientation can no longer protect them from the lurking dangers.

Hospitals can now be hacked through devices as small as an 

. As their risk profile dramatically increases, they require constant, vigilant system monitoring, during which a provider surveys their systems, patches their vulnerabilities, and secures their data.

With effective monitoring and regular threat-profile updates, hospitals can preempt a looming cyberattack instead of suffering at the hands of one. 
Healthcare providers are, increasingly, cyber targets. The spate of recent ransomware demonstrates that they are facing heightened risk from hackers who grow more confident and powerful, and who see their disorganized and unprotected networks as an opportunity to score a significant payout.

Though it’s impossible to entirely eliminate cybersecurity risk, accurate inventory, hidden device networks, and regular monitoring are ways in which hospitals can meaningfully improve their protection, shield their devices, and, most importantly, secure their patients.

Ray Hillen is Managing Director of Cybersecurity at 

, a hybrid managed IT and cybersecurity services provider.

Three precautions to more effectively protect your practice from potential cyberattacks

Mitigate security risks for medical devices

Many internists don’t perform a thorough cognitive evaluation. Instead, they often refer patients with suspected cognitive impairments to a neurologist, or they order a CT scan that may not actually be medically necessary. However, it could be financially worthwhile to delve more deeply into patients’ cognitive problems.

That’s because starting in January Medicare began paying physicians an average of $242 to perform a cognitive assessment and develop a care plan to address functional limitations as well as neurocognitive and neuropsychiatric symptoms. Physicians can report this service using CPT code 99483.

“I’m excited about this payment, because it allows us to sit down with our patients and address their needs in a meaningful and comprehensive way,” says Melissa Lucarelli, MD, FAAFP, primary care physician in Randolph, Wisc. and Medical Economics editorial board member.

CPT code 99483 was created to reimburse physicians when they go above and beyond a cursory cognitive assessment that’s typically included in the social history portion of an E/M visit or Medicare annual wellness exam, says Alan Lazaroff, MD, a member of the RVS Update Committee (RUC) and retired geriatrician in Denver, Colo. The RUC is a multi-specialty committee that recommends new codes and Relative Value Units to CMS. The code also describes what a comprehensive cognitive evaluation should entail.

A comprehensive cognitive evaluation isn’t only good for patients, it also helps physicians with their medical decision-making, says Lazaroff. “Once you know that a patient has cognitive impairment, it will influence how you approach every other medical issue they have,” he says. For example, patients with cognitive impairment may have difficulty following instructions or remembering symptoms. Working with a caregiver to adapt a treatment plan then becomes critical.

Evaluating and addressing cognitive impairments may also reduce costs-and benefit physicians under Medicare payment reform-by preventing hospitalizations for patients who might otherwise accidentally injure themselves or forget to take their medications, he adds.
 

Identify patients who qualify for the service



Experts agree that physicians will likely identify patients in one of two ways: They’ll suspect a cognitive impairment during a wellness exam or E/M visit, or a family member will call the practice because they’re concerned that their loved one has a problem.

If the patient is already in the office, physicians can explain why it’s important for them to come back for a comprehensive cognitive assessment, says Lucarelli. Explain what patients can expect (i.e., they’ll be in the office for an hour while staff perform various assessments) and why a visit dedicated to their cognitive status is an important part of keeping them safe and ensuring their needs are met, she says.

Physicians should remind patients that they’ll need to bring a family member or caregiver with them when they return for the assessment, says Margaret A. Noel, MD, founder of MemoryCare in Asheville, N.C., an organization that offers community-based care for memory-impaired individuals. CPT code 99483 requires the presence of an independent historian to provide information and help implement the care plan.

“Every person with a progressive dementia will eventually need a partner to assist in managing their health and safety,” says Noel. “Engaging a chosen trusted care partner early in the course of a cognitive disorder is really critical, and the cognitive assessment process supports doing this.”

It may be helpful to create an educational pamphlet about the cognitive assessment and remind patients that although Medicare will cover the service, they will owe a copayment, says Deb Santos, CPC, auditor at DoctorsManagement, a healthcare consulting firm in Temple, Texas.

If a family member calls out of concern, staff members should perform a brief phone screening to see whether their loved one has symptoms that are consistent with cognitive impairment, says Lazaroff. “You want to make sure that this is the right kind of patient for this evaluation because this is a lot of work, and you don’t want to do it on people who don’t need it,” he says. “You need a good solid reason to believe that there’s something going on cognitively with this patient.”



CPT code 99483 requires an array of assessments and evaluations.

The good news is that physicians don’t need to perform all of the required elements, says Angela Jordan, CPC, senior managing consultant at Soerries Coding and Billing Institute, a practice management consulting company in Grain Valley, Mo.

For example, medical assistants, social workers, or non-physician providers can collect some of the data before the physician enters the exam room. Practices may also be able to send questionnaires and assessments to the caregiver through the EHR portal or mail these documents directly to the caregiver for completion prior to the appointment.

When the physician meets with the patient and caregiver, ideally they’ll have access to all of the assessments and evaluations and can focus on developing the care plan.

Lucarelli’s practice is developing a checklist to ensure that staff members perform certain tasks before she sees the patient (e.g., medication reconciliation, identify the caregiver, screen the patient for depression, and evaluate the safety of the patient’s home). The checklist, which is subsequently scanned into the EHR, requires Lucarelli and other physicians in the practice to circle a relevant diagnosis and provide a dated/timed signature.

“This won’t be our official chart note,” says Lucarelli. “It will be a supplemental sheet that’s basically our flow sheet. It will also help us with compliance if we ever get audited.”

Not only can other staff members help fulfill the required elements of the code, they can also do so over multiple visits that precede the actual care planning visit, says Noel, who began officially billing CPT code 99483 in early March. “It may be helpful to divide the components over routine E/M visits and then utilize those assessments to inform the more comprehensive care planning visit,” she says.






EHR templates can ease the documentation requirements associated with CPT code 99483 that includes 10 specific elements. “Not all providers will be able to remember everything that’s required,” says Santos. “This is what happened with the Medicare Annual Wellness Visits. Something was always missing. The templates will help with the workflow and make sure they covered everything.”

Lucarelli is also developing a template that imports various safety screening tools and other assessments that already exist within her EHR. Likewise, MemoryCare has developed an EHR template for the final written care plan that helps guide physicians to document the necessary components associated with CPT code 99483. If practices don’t have the ability to create a template in the EHR, they can simply laminate a card that lists each of the 10 required elements, says Santos.

Though this may not be a high-volume service, it can make a significant difference in the lives of patients and their families, says Noel. “Patients and families need not only a timely diagnosis, they need a road map to help them through a very challenging illness.”

Consider these three tips to avoid denials when reporting CPT code 99483.

 The cognitive assessment is intended to diagnose and evaluate chronic cognitive impairments. Don’t report CPT code 99483 for patients who are clinically unstable or acutely ill because the illness may transiently exacerbate the impairment, and physicians need to be able to identify a baseline cognitive capability for care planning purposes, says Alan Lazaroff, MD, retired geriatrician in Denver, Colo.
“The service is also not appropriate for individuals without cognitive disorders or for those who require briefer follow-up visits that are problem-focused,” says Margaret A. Noel, MD, founder of MemoryCare in Asheville, N.C.

Report the service only once every 180 days.

 However, remember to keep medical necessity in mind, says Deb Santos, CPC, auditor at DoctorsManagement in Temple, Texas. “If 180 days have passed, and nothing has changed-the care plan is the same, the caregiver is the same-then it may not be medically necessary,” she adds.

Angela Jordan, CPC, senior managing consultant at Soerries Coding and Billing Institute in Grain Valley, Mo., agrees, adding that payers will look for documentation indicating a new or substantial decline or an additional cognitive problem that requires a revised care plan.



Know what other CPT codes trigger a denial when billed with 99483.

 Per the 2018 CPT Manual, don’t report CPT code 99483 with any of the following services on the same date of service:

Advance care planning 99497-99498
Any outpatient E/M visits 99201-99205, 99211-99215, or 99241-99245
Brief emotional/behavioral assessment 96127
Complex chronic care management  99487 and 99489-99490
Domiciliary, rest home, or custodial care services  99324-99328 or 99334-99337
Home services 99341-99345 or 99347-99350
Interactive complex psychotherapy 90785
Medical team conferences 99366-99368
Medication therapy management 99605-99607
Neuropsychological testing 96120
Psychiatric diagnostic evaluation 90791-90792
Psychological testing 96103
Transitional care management 99495-99496

It could be financially worthwhile to delve more deeply into patients’ cognitive problems.

New cognitive assessment code promotes planning, generates revenue

Changes resulting from CMS’ Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) have created new opportunities for practices to evolve how they manage payment and reimbursement. One example is that solo practitioners and small practices will be eligible to join a virtual group to report their Quality Payment Program (QPP) measures for the first time.

While not limited on the number of participants, the virtual group is defined as a combination of two or more Taxpayer Identification Numbers (TINs) assigned to one or more solo practitioners, or to one or more groups consisting of 10 or fewer clinicians (including at least one Merit-based Incentive Payments System (MIPS) eligible clinician), or both, that elect to voluntarily form a virtual group for a performance period of a year. There are also no restrictions based on location or specialty.

While a virtual group is not for everyone, clinicians or TINs that join may find it easier to be successful in reporting their QPP metrics, thus earning a potential for greater reimbursement (ranging from 5 percent in 2018, up to 9 percent in 2020).

Practices must weigh several factors before making a decision that could have significant impact on its performance under MIPS.





A key benefit of virtual groups is the ability for clinicians and practices to aggregate data together to report on performance measures. This may help clinicians who are struggling to show significant results by combining data with partners who have stronger results on key performance measures.

However, virtual groups-just like regular groups-must report on all the same measures for the same period. When considering if a virtual group is a good fit, practices should factor in the measures that all participants have available and are applicable to them early in the process to maximize the strength of data available reported for the group: either through registry or EHR.



It is important that clinicians and practices join or form virtual groups with other reliable partners. Successful virtual groups have established traits and goals by which they measure potential members before confirming participation. Reliable partners should share similar focuses on providing quality care and accurate reporting.

Once formed, each participant is “locked in” for the entire reporting year, and every NPI or TIN in the virtual group will receive the same score. A provider not taking the steps to be sure he or she is constantly trying to improve may shift measurement scores lower. Virtual group members cannot ask poor performing clinicians and practices to leave the group mid-year. Similarly, individual clinicians or practices cannot exit early to report their own data, which is why it is critical to determine partners who will bolster performance results, rather than hinder them.



Forming or joining a virtual group may require additional administrative time to a clinician’s or practice’s already busy schedule.
Each virtual group should have a designated representative who can oversee it and handle communications with CMS. Groups may ask clinicians to review a mid-year Quality and Resource Use Report (QRUR) and/or conduct a monthly measurements check to track performance on a consistent basis across all participants.

Additionally, when the group (or specific clinician/practice) is not performing to the standards necessary to maximize reimbursement, if a lead practice has been assigned, they should take the responsibility to provide an action plan to improve. The role of group leader should be determined at the outset of forming the virtual group and clearly defined in written agreements delivered to CMS.





Through virtual groups, clinicians and practices can work with each other to help increase the overall level of care provided to patients. Virtual groups are a unique opportunity for small, rural area clinicians to share knowledge and best practices with larger practices offering their own perspective.

When making a decision to form or join a virtual group, members should evaluate the value of the knowledge they could gain from shared partnerships.



There are several resources and tools for clinicians and practices interested in joining or creating a virtual group. CMS’ Quality Payment Program Technical Assistance representatives can help figure out if clinicians and practices are eligible to join or form a virtual group before signing any formal written agreements or reallocating resources. CMS has also offered a toolkit, which outlines the process for joining or creating a virtual group, along with resources to get more information.

As clinicians and practices weigh these factors when deciding to join a virtual group, there are outside consulting professionals with expertise that can provide guidance on how to maximize their reimbursement based on updates to MACRA.

Jackie Rogers is the manager of the Quality Reporting Engagement Group at data analysis provider IntrinsiQ Specialty Solutions, a part of AmerisourceBergen.

Solo practitioner who is a MIPS eligible clinician, exceeds the low-volume threshold, and is NOT a newly Medicare-enrolled MIPS eligible clinician, a Qualifying APM Participant (QP), or a Partial QP choosing not to participate in MIPS.

Group that has 10  or fewer clinicians and exceeds the low-volume threshold at the group level.

A solo practitioner or group can only participate in 1 virtual group during a performance period.

Q: Are there limits on virtual group size?

There are no limitson the number of solo practitioners and groups able to form or join a virtual group.

Q: Must all physicians in a practice participate?

If a group chooses to join a virtual group, all of the clinicians in that group are part of the virtual group.

Before joining a virtual group to report quality metrics, make sure to pick the right partners

5 key factors in considering MACRA virtual groups

Jeff Kagan, MD, found out that hackers don’t discriminate when it comes to a practice’s size.

Kagan’s two-physician practice in  Newington, Conn., was alerted to something strange on one of his office computers and immediately shut down the system. The quick action stopped the malware from harming his computers and the data for his practice was safe, but the close call changed his attitude about cybersecurity.

“I thought all the talk about cybersecurity was all a joke and a waste of time and didn’t think I had to worry about it,” says Kagan, an internist, who is a member of the Medical Economics Editorial Advisory Board. “I got knocked into reality. It took me from, ‘It will never happen to me,’ to, ‘I’m a believer.’”

While large, high-profile health systems and hospitals have suffered well-publicized hacks of patient data in recent years, smaller practices had less to worry about until last year, when the threat shifted dramatically, says Mac McMillan, CEO of CynergisTek, a Mission Viejo, Calif.-based healthcare cybersecurity consulting firm. “What changed for the small practice was the ransomware threat,” he says. “Before, when a person was behind it directing the attack, they were typically going after bigger targets with bigger payouts. When these attacks shifted to more automated threats through botnets and malware, anyone connected to the internet became a potential target.”

Ransomware attacks-when a hacker takes control of a server and locks out the owner-are now targeting small practices with ransoms of $5,000 and $10,000, and several successful hacks against smaller offices yield the same amount of patient data as an attack on a larger health system, but takes less effort, experts say.

Smaller practices must take the cyber threat seriously, says Robert Tennant, MA, director, health information technology for the Medical Group Management Association. “Don’t think because you are a small practice you are immune to attack,” he says. “You have to run on the assumption that an attack is not an ‘if’ but a ‘when.’”

Kevin Johnson, CEO of SecureIdeas, a Jacksonville, Fla.-based cybersecurity consulting firm, says he knows of 20 smaller practices recently hit with ransomware attacks and that the threat is increasing. “Hackers know smaller offices have [their own] data and access to more data through a cloud-based EHR,” he says. “They may attack the physician’s office to try to get to the bigger source, and they know a smaller office will not have the same security controls a larger hospital will have.”



When it comes to protecting patient data, the only standards for practices are set forth in the HIPAA security rule and the security assessment it requires. Each practice must develop its own plan on how to comply with the law’s requirements and secure patient data, experts say.

To mitigate their cybersecurity risks, physicians need to understand why their practices are vulnerable. McMillan says there are four main areas where smaller practices lag behind:


“A lot of small organizations don’t back up their data as often as they should or as complete as they should,’ says McMillan. “They get hit, need to recover their system, and all of a sudden realize they don’t have everything backed up and now their information is lost.”

All kinds of devices-watches, tablets, readers, medical equipment-are now connected to the internet, and each one provides a possible gateway for hackers to gain access to a practice’s data. The same level of security must be applied to these devices as to a practice’s computers.

Keeping systems updated with the latest patches can go a long way toward thwarting any threats. “90 percent of the hacks we see involve some already existing vulnerability we know about,” says McMillan. “Hackers are not coming up with new ways to get in, but looking for organizations that aren’t configuring their systems’ security properly.”

Lack of an effective incident response plan 

When something does happen, the lack of a clearly detailed plan means wasted time searching for who should be called (and those records might now be inaccessible on the practice computers) and what the priorities should be in recovery efforts. “The lack of a plan tends to exacerbate the time and cost associated with a recovery,” McMillan says.



The stereotype of a hacker might be a young adult sitting in front of a bank of computer screens manipulating code to gain access to a practice’s system, but the reality is often much simpler: a doctor or member of the staff opens an email attachment that launched malware that gives the intruder electronic access.

Johnson says these phishing attacks are getting more sophisticated and believable-doctors probably won’t fall for the well-known prince from Nigeria that needs a cash advance, but they might fall for an official looking email regarding their EHR.

“One of the big ones is going after doctors with a story of urgency, that there is a problem with their EHR or it has a vulnerability and they need to click on the link to fix the problem,” says Johnson. “Staff members fall for the ruse, not because they are stupid, but because they are trying to do the right thing and fix something they need for their job.” Staff members are often targeted directly, because hackers know they will often not want to bother the physician and will try to solve the problem themselves.

Another type of attack that’s on the rise is social engineering, Johnson says. This type of attack uses specific information gathered about the practice from its website or from an insurance provider to try to trick the practice staff. For example, an attacker could obtain physician names from the website and find out they work with a particular payer from the insurance company’s online doctor finder.

Using this information, they can craft a more detailed ruse that might take the form of an email that appears to be from the head physician telling the office manager to transfer money for a legitimate-sounding insurance reason, or may appear to be from the insurance company to get someone to click on a link to download malware.

“This is cybercriminal activity that is paying well, and hackers are doing more of it and being more creative,” says McMillan. “If you break-and-enter houses to steal things, you have a good chance over time of getting caught. But you can break into houses all day long through a computer and have a much slimmer chance of being caught, and what you end up with is more people engaging in cybercrime than ever before.”
 



Tennant says a good place to start on a cybersecurity plan is by conducting the security risk assessment that’s required by HIPAA and the advancing care information portion of the Merit-based Incentive Payment ­System. “This will help you identify particular problems,” says Tennant, adding practices can then make a list of priorities to tackle as money allows.

“The two most important words in practice management are ‘What if?’” Tennant says. “What if the server is hacked and you could no longer access patient information? What if you had to tell your patients you lost all their records? You have to run on the assumption that something bad is going to happen and prepare for it.”

Stopping the majority of these attacks takes a combination of basic computer maintenance and a commitment to education and awareness, experts say.

Most smaller practices already work with an IT support company, and experts say the first step is making sure this vendor understands security and is keeping computers patched and updated against the latest threats. This includes making sure all data are backed up and that practice computers are protected by anti-virus software.

“Windows Defender for Microsoft computers is free,” says Johnson. “You don’t need to go spend thousands of dollars on anti-virus software.”

John Kulin, DO, an emergency medicine physician who oversees four urgent care centers in the Philadelphia area, and had a close call similar to Kagan’s, spends about $56,000 on hardware and software security across his four sites last year. And while security has become a major line item, he says it can’t be ignored. “The cost of a breach is too much,” Kulin says. “Could any of us stand up against a major data breach and the loss of trust that goes with it? The cost of rebuilding that might sink the practice.”

To reduce his risks, Kulin keeps all his computers isolated from the internet so there is no remote access allowed into the system. “It’s inconvenient, but it helps prevent intrusions from coming through,” he says.

Kulin and others agree that education and training are among the most effective tools in the fight against hackers. “We have a lot of internal communication ranging from emails we send out about awareness of threats to annual training sessions,” he says. “No one thing gets through to every employee, but you have to maintain a constant vigilance.”

Johnson says staff members need to understand that the office is a target and that there are risks to clicking on links. Training can reduce that risk, and it doesn’t have to be expensive. “There are plenty of services out there that provide what you need,” he says. Video training sessions from security consultants cost as little as $5 per user per year, and the FBI offers some videos for free. “You’ll always find someone can make a mistake, but by educating everyone, the likelihood of a successful attack goes way down,” he adds.

And while cybersecurity has costs, it’s essential. McMillan points out that a small practice might get hit with ransomware demanding $10,000 to release its data, and that a physician might think that paying the money is cheaper than trying to rebuild the practices database. While 70 percent of organizations that get hit with ransomware pay it, only 50 percent of those that pay actually get their data back.

“The moral of the story is, don’t count on paying the ransom and getting your information back,” says McMillan. “Make sure you back your data up and put it in a safe place so that if you get hit with a ransom attack, you can restore your data.”



No matter how vigilant a practice is with cybersecurity, there is always the chance that a hacker gets through and compromises its computer system. Mac McMillan, CEO of CynergisTek, a healthcare security consulting firm, says that it’s important for practices to have a response plan to minimize the damage. “A response plan should be kept simple so that anyone can execute it, and it is simply a list of steps to take when something goes wrong,” says McMillan.

A practice should start by finding out who at its IT vendor should be contacted in the event of a breach and what support can be expected. Numbers for local law enforcement and the FBI should also be included in the plan for quick reference.

“The checklist should include critical equipment and applications and who the vendor contact is that can provide support,” says McMillan. “It should also identify where the data backups are.”

Someone should be designated as a point person for all communications about the breach, and it should be clear which systems or equipment should be brought back online first.
 

What a business partner’s breach could mean to your practice  



When a security breach occurs, reporting it is essential. But what happens when that breach occurs within your business partner’s system rather than your own?

In March 2016, Allscripts Healthcare Solutions and the 2,700 hospitals that use its products were shut down by SamSam ransomware, according to media reports. In January 2018, the company’s partners proposed a class-action lawsuit against Allscripts for failing to monitor and audit its systems. The company’s failure exposed all of its partners’ patients’ data to the ransomware, according to the suit.
To be clear, not every attempted attack against a system needs to be reported. According to the Cisco “2017 Annual Cybersecurity Report,” such attacks will continue growing by approximately 350 percent each year. Given the sheer volume of attacks on healthcare systems, reporting every single attempt would be unmanageable.

However, every successful breach constitutes a HIPAA violation, which covered entities must document and report every time. Therefore, keeping an eye on business partners that might be compromised is also vital. It’s the only way to avoid being blindsided by an attack that threatens your organization through one of your partners’ systems.



Before, During, and After a Partner’s Breach



Knowing about a business partner’s data breach early is vital to responding to it. If a business partner’s breach affects your practice or makes the Department of Health and Human Services’  “Wall of Shame,” you should be notified automatically.

To be absolutely sure, you should also review the HHS breach portal (bit.ly/OCR_breach_portal) at least once a month as a precaution. To receive notifications about attacks that are trending or particularly dangerous, you can join email lists for the National Institute of Standards and Technology, HHS, and the FBI. You can cast your net further by setting up Google Alerts for keywords such as “breach + [your city].”

Knowing is only half the battle, though. To protect yourself against a business partner’s breach (or the potential for one), follow these steps before, during, and after a cyberattack:

Prioritize business agreements right away



Emphasizing business associate agreements (BAAs) as integral to your partnership isn’t just about breaches; it’s about adhering to HIPAA standards in general. For Illinois’ Center for Children’s Digestive Health (CCDH), not having one turned out to be a $31,000 mistake. After a review by the HHS Office for Civil Rights in 2015, CCDH was fined that amount for potentially violating HIPAA rules when it couldn’t produce a BAA for its 12-year partnership with FileFax.

To avoid the same mistake, begin every partnership with every vendor with an official BAA. The agreement will lay out your and the vendor’s reporting rules and obligations in case of a breach on either side. If you don’t have a BAA with a vendor that handles protected health information (PHI), have one signed immediately or find another vendor that’s willing to sign one.

Join forces with vendors during the attack



If more proactive, collaborative policies were in place in 2017, the infamous WannaCry attack might not have been able to sweep across more than 150 countries. The exploit that WannaCry used, called EternalBlue, allowed one remote computer to shut down an entire company and spread the attack through files shared with that organization’s business partners. But that exploit was patched before the attack even occurred.

The problem was that countless organizations were using older systems that couldn’t be automatically updated. However, by closely collaborating with vendors and affected entities, many organizations were able to recover and implement better security measures quickly. For instance, Windows rolled out a free patch for older systems, and IT vendors helped clients revamp their data systems to address the new (and evolving) threat as soon as possible.

Immediately report breaches that affect you



Whether a partner’s breach affects your organization or vice versa, you must report the breach as soon as possible. Even if you aren’t sure whether you’re in breach of HIPAA, your organization must report any PHI that was involved and the extent of the breach. If more than 500 people were affected, you only have 10 days to provide thorough details to HHS.

If you’ve been compromised, consult with your compliance officer or HHS for detailed instructions on what to report and how. Your existing BAAs will guide your organization in reporting to all associates, and collaborating with vendors will help everyone involved resolve the security breach as soon as possible.

Cyberattacks are too successful for hackers to give up any time soon, and healthcare will always be a prime target for information thieves. Comprehensive security standards and close collaboration with business partners can be a formidable barrier, but the most essential protective measures against ransomware and other data breaches are immediate notification and action.



Hoala Greevy is the founder and CEO of Paubox, a provider of HIPAA-compliant email services.

Fend off hackers with a thorough cyberdefense plan

Protect the practice

Many physicians hire family members as employees in both clinical and non-clinical roles at their practice. After all, why hire a stranger rather than a family member who presumably is more personally committed and likely to go the extra mile?

Some also want to help their family members by giving them a job. Perhaps a high school student needs summer work, or a newly licensed dietician is ready to step into his first employment setting.

This is especially the case in rural areas, says Robert Wergin, MD, a primary care physician in Milford, Neb.

“Sometimes, if you’re surrounded by cornfields rather than cities or suburbs, it can be hard to find people with the skillsets you need,” he says.

So, “if you’re looking for a dependable person for a particular position, it’s not uncommon for rural practices to have family members work as receptionists or office managers, for a father to take his son into the practice, or for a doctor to hire a spouse as a nutritionist or nurse,” says Wergin.

But there are also some serious downsides.






Nitin Damle, MD, immediate past president of the American College of Physicians, says it generally is not a good idea to hire family members at a practice. 

“It creates a fair amount of potential for conflict with other employees, who may be on the lookout for potential nepotism in hiring or promotions,” says Damle, senior/managing partner at South County Internal Medicine, Inc., an eight-physician practice in Wakefield, R.I.

Other employees might also feel that poor performance in the family member will be brushed aside because of the family relationship. “You can get into issues if the employed family member isn’t performing adequately but the physician employer overlooks it,” he says.

To address these concerns, Wergin advises physicians to be vigilant about favoritism and treat all practice employees the same professionally. A practice operates as a team, he says, with each person playing a key part in operations.

“If they feel that you are professional, clear, and transparent about roles, and that you accord all team players equal respect, they are less likely to feel resentful and more likely to feel genuinely valued,” says Wergin.



Family members do not always get along, and family squabbles can potentially find their way into the workplace.

“It can be tricky when family members feel they are being overworked, and this can lead to resentment,” Damle says.

“Part of being professional is leaving relationship issues and emotions outside the front door,” Wergin stresses.

But if that is too difficult, and if the personal dynamic is causing problems with other employees or with patients, “you might have to sit down with your employee and have an honest, straightforward talk to say that this scenario isn’t working out,” he says.



Damle advises physicians “separate out clinical positions from non-clinical positions, such as office management, front desk work, or other positions that do not involve direct patient care.

His internal medicine practice has a policy not to employ family members for non-clinical positions.“However, if a partner’s son or daughter is a physician or nurse practitioner, for example, and we had a position available, we would be open to it, but we would want to make sure we base our decision on the candidate’s merits,” he says.

The decision to hire a family member is complex and carries both benefits and drawbacks.

“All team members, whether family or non-family, need to be on the same page in making the work environment as inviting and patient-friendly as possible,” Wergin says.

Many physicians hire family members as employees in both clinical and non-clinical roles at their practice, but there are serious downsides.

The pros and cons of hiring family members as practice employees

Physician-owned hospitals have strengths that are especially relevant during an age of value-based care and comparison healthcare shopping. In particular, these facilities-essentially banned since 2010-tout superior patient experience and higher quality at a lower cost than competitors.

Unlike their nonprofit or academic counterparts, physician-owned hospitals are funded at least partially by physician owners (e.g., 50 percent physician-owned) who receive a bonus based on the facility’s profitability. Physician investors, especially primary care physicians, don’t necessarily see patients in the hospital at all, but may refer patients seen in their office. They are deeply involved in the administration of the hospitals in which they invest-a factor proponents say enhances physician owners’ commitment to promoting excellent patient care.

And these facilities may be making a comeback. In early 2018, within weeks of assuming his role, Health and Human Services Secretary Alex Azar publicly stated an interest in relaxing the moratorium put in place as part of the Affordable Care Act (ACA).

Such a decision could have vast implications for primary care physicians and their patients.





A key reason that physicians-owners and non-owners alike-refer patients to physician-owned hospitals is that they can often offer tests and procedures at lower prices than neighboring community hospitals, says Ron Rock, CRNA, who served as chief executive officer of Northwest Specialty Hospital, a 21-bed surgical hospital in Post Falls, Idaho, from 2007 to 2011, and has been a continuous investor.

For example, while a total hip replacement would cost roughly $22,000 at Northwest Specialty Hospital, the same procedure with the same surgeon and same implant in a competing nonprofit hospital would cost $57,000, says Rock. “We have much lower overhead, but I honestly don’t know how they get away with charging more than double. I plain don’t know where the money goes.”

In addition to lower prices and greater cost transparency, Northwest and similar facilities throughout the country demonstrate high CMS ratings and below-average infection rates. Part of the reason that small surgical hospitals are able to keep pathogens at bay is the elective nature of most of the procedures they perform, with clear pre-surgical criteria for patients, notes Rock. Very complex patients or those at high risk for complications are typically referred to general hospitals equipped to manage emergencies if they arise.
 



The foremost complaint about physician-owned hospitals is that physician owners’ ability to self-refer to these facilities results in cherry-picking of healthier and wealthier patients, opponents allege, leaving the majority of complex and indigent care to safety net hospitals.

The 2010 regulations prohibit new physician-owned hospitals from participating in Medicare or Medicaid, thereby cutting off a vital source of revenue to sustain the facilities. Physician-owned hospitals established before the ACA are grandfathered into receiving government reimbursement, but are permitted to expand only under limited circumstances. Hospitals that don’t qualify for exceptions may not add beds or new service lines or increase their percentage that is physician-owned.
 



The mission of Northwest Specialty Hospital has been based on philosophies aligned with value-based goals since it opened in 2003, says Rock.

“We started with the idea that we could be very competitive pricewise and offer a better-quality product in terms of infection rate, turnaround, patient satisfaction, and physician satisfaction,” he says. “Those were our foundational goals, which carried us through the first few years.” The restrictions included in the ACA, however ironically, have made them harder to achieve, he says, not only by blocking expansion of the hospital, but by making it nearly impossible to recruit new physicians unless current ones depart.

Christopher Billingslea, DO, a primary care physician and part-owner of Northwest Specialty, disputes much of the criticism physician-owned hospitals have faced. “There’s no pressure from the specialty hospital to refer to its providers,” he adds. “If physician-owned hospitals became worse facilities or more expensive, I’d just stop referring to them. I’m something of a firm believer in competition.”

Like many non-proceduralists, Billingslea works solely out of his private practice, while area hospitals, including Northwest, employ a hospitalist model. Of the 31 physician-owners of Northwest Specialty Hospital, 15 are primary care providers, says Rock. “Of the primary care doctors who are owners, they still refer outside of our hospital, depending on what relationship they have with which specialist and what the patient’s needs are,” he says.

Most of the referrals to the hospital come from physicians with no financial incentive to do so, Rock says. He estimates that about 60 percent of referrals come from community-practice physicians who are not investors in Northwest.
 



A healthcare environment that hinders growth and success of physician-owned hospitals is detrimental in that it limits patient choice, according to advocates.

“Hospital consolidation hurts patients through lower quality, increased costs, and reduced access-essentially the opposite of the Triple Aim,” says John Richardson, executive director of Physician Hospitals of America (PHA), the trade group for physician-owned hospitals.

According to the PHA, 37 physician-owned hospitals were not built because of the ban, 40 nearly finished construction projects were prevented, and 20 major expansion projects were canceled. 

Richardson also refutes the claim that physician-owned hospitals cherry-pick the most lucrative patients. “In fact, the only comprehensive peer-reviewed study [on the topic] concluded that physician-owned hospitals treat similar patient populations as our competitors.”



The research, central to the PHA’s position, was conducted by Massachusetts General Hospital and Harvard and published in BMJ in 2015. The observational study used data from 2,186 U.S. acute care hospitals (219 physician-owned hospitals and 1,967 non-physician owned hospitals) from across 95 hospital referral regions in pre-ACA 2010, and concluded that although physician-owned hospitals may treat slightly healthier patients, they do not systematically avoid low-income patients or those from ethnic and racial minority groups.

Lead author Daniel M. Blumenthal, MD, MBA, attributes the results, in part, to a study sample more representative of the current ratio of specialty hospitals to general medicine physician-owned hospitals. “One of the main findings, and why I think this study is important, is that all previous studies of physician-owned hospitals focused on a subset of them,” Blumenthal says.

When physician-owned hospitals began to emerge, the vast majority of them were specialty hospitals, which typically contain fewer than 100 beds, have no emergency department (ED), and often focus on one surgical specialty, he explains. “If you look at the hospitals in our [2010] study, the majority are generally larger acute care hospitals with several hundred beds. They have big EDs. They look just like community hospitals.”

Although grouped together in most previous studies, the two subcategories of physician-owned hospitals operate under vastly different business models, he says. Overall, 80 percent of the patients treated at physician-owned hospitals today are seen at the general-medicine subtype, Blumenthal says. “They may treat as many Medicaid patients as 10 smaller specialty hospitals. It’s like comparing apples and oranges.”

The research from Blumenthal and his team was not available in time to inform the restrictions included in ACA. “Policymakers might consider taking into account the fact that physician-owned general hospitals and physician-owned specialty hospitals may have very different impacts on spending patterns and on surrounding hospitals that they compete with,” he says. “The selection of patients may be very different between those hospitals because their operating models are very different.”

For instance, a large general hospital (physician-owned or not) needs to have an ED, both because it has a bigger community presence and in order to fill beds. “And once you create an ED and you open yourself up to the community, you completely lose control over who you take care of. And once you’re a general hospital, you need all of the other services that a specialty hospital doesn’t provide to everybody,” Blumenthal says.

Nonetheless, under current law, all physician-owned hospitals, regardless of size or scope, are subject to the same rules governing self-referral.



Self-referral to hospitals is currently permitted under the “whole hospital” exemption included in the Stark law. This exemption requires that the referring physician owner have a financial interest in the whole hospital, and not just a specific part, such as one service line or department. In addition, he or she must be authorized to perform services at the hospital and be expected to actually perform the services.
The 2010 restrictions were put in place to curb abuse of the exemption, says Jeff Cohen, executive vice president of public affairs for the Federation of American Hospitals (FAH). “What policymakers had to grapple with was that [physicians] were getting around the law,” he says.

They did this, he contends, by opening up five- to 15-bed facilities with no ED, obstetrics, trauma, mental health, or general-medicine services and calling them “whole hospitals.”

The ACA effectively closed this loophole, Cohen says, but not without challengers. H.R. 1156/S. 1133, the Patient Access to Higher Quality Health Care Act of 2017, for example, proposed repeal of the current law limiting self-referral to physician-owned hospitals.

In response, the FAH and American Hospital Association (AHA) co-authored a letter urging Congress to oppose the bill. “The law as it stands protects patients, businesses and taxpayers. It also helps ensure that community hospitals can continue to meet their mission to provide quality care to all the patients in their communities,” they wrote.

The FAH and AHA also dispute the findings of Blumenthal’s study, citing a whitepaper written by healthcare economics consulting firm Dobson DaVanzo. “The analysis compares the performance of non-physician owned full-service community hospitals with physician-owned hospitals,” they wrote. “The characteristics of these PHA hospitals virtually mirror the findings and data collected in the early-to-mid 2000s that drove Congress to enact the law prospectively banning self-referral to new facilities.”
 



Cohen emphasizes that neither he nor the FAH oppose exceptions to the ban that allow physician-owned hospitals to expand. For example, physician-owned hospitals that take as much Medicaid as other hospitals in the county or prove community need qualify for an exception.

“What has been found is that in several instances where you have hospitals that have adapted, the physicians are happy and the community is happy,” Cohen says. “There is a way folks who want to be able to grow or build on their footprint can do so. All they have to do is take all comers.”

On the other hand, Blumenthal notes that specialty hospitals with a limited array of services aren’t inherently problematic. He cites an example of two healthy patients who both need a knee replacement and are seeing a doctor who owns an orthopedic hospital-but one patient has commercial insurance and the other is covered by Medicaid.

“They should both get referred to the specialty hospital,” says Blumenthal. “However, if the Medicaid patient gets referred to a community hospital and the commercial patient gets referred to a specialty hospital, that’s a huge problem that should not be allowed to stand.”

Physician-owned hospitals have strengths that are especially relevant during an age of value-based care and comparison healthcare shopping

Is it time to lift the ban on physician-owned hospitals?

I am referring more of my patients to psychiatrists to monitor their behavioral health conditions. However, their mental health issues impact their other medical conditions, so I wanted to know if there is a way that I can stay involved in the care of these patients from a behavior health perspective. How would this be done from a coding perspective?

 There are three new codes for Collaborative Care Management (CoCM).  While these aren’t new services, there are new codes for 2018 with more detailed information on their use.

Psychiatric collaborative care management services describe care reported by a physician or other qualified health care professional (QHCP) overseeing a behavioral healthcare manager and psychiatric consultant who provide a behavioral health assessment, including establishing, starting, revising, or monitoring a plan of care as well as providing brief interventions to a patient diagnosed with a mental health disorder.

The psychiatric consultant contracts directly with the physician or other QHCP to render the consultation portion of the service. Patients are generally referred to a behavioral healthcare manager for assistance in receiving treatment for newly diagnosed conditions that have been unresponsive to traditional or standard care provided in a non-psychiatric environment or who need additional examination and evaluation before a referral to a psychiatric care setting.

Code 99492 replaces HCPCS Level II code G0502; 99493 replaces G0503; and 99494 replaces G0504.



Per the American Psychiatric Association, psychiatric CoCM services:
“….typically [are] provided by a primary care team consisting of a primary care physician and a care manager who work in collaboration with a psychiatric consultant, such as a psychiatrist. Care is directed by the primary care team and includes structured care management with regular assessments of clinical status using validated tools and modification of treatment as appropriate. The psychiatric consultant provides regular consultations to the primary care team to review the clinical status and care of patients and to make recommendations….”
These codes include the time spent by the entire team in collaboration to assess the patient’s mental health and the impact to his/her overall health.  Since these are time-based codes, the team’s total time spent each month needs to be documented in the progress note in order to support the code(s) billed.  Additionally, the tools utilized and the treatment modifications, when appropriate, should also be documented.  Keep in mind that 99494 is an “add-on” code and can be billed in addition to 99492 for the initial month’s service and 99493 for any subsequent month’s service.




Time spent providing smoking and tobacco use cessation counseling (99406-90407) or alcohol and/or substance abuse structured screening and brief intervention services (99408-99409) are not included in the time applied to psychiatric collaborative care management services (99492-99494) and should be separately reported using the appropriate code.

Psychiatric collaborative care services are provided under the direction of a treating physician during a calendar month.
These services are reported by the treating physician and include the services provided, the behavioral healthcare manager, and the psychiatric consultant, who has contracted directly with the treating physician to provide consultation.
 

Three new, time-based codes report CoCM services:


99492   Initial psychiatric collaborative care management, first 70 minutes in the first calendar month of behavioral healthcare manager activities, in consultation with a psychiatric consultant, and directed by the treating physician or other qualified healthcare professional
99493   Subsequent psychiatric collaborative care management, first 60 minutes in a subsequent month of behavioral healthcare manager activities, in consultation with a psychiatric consultant, and directed by the treating physician or other qualified healthcare professional
+99494   Initial or subsequent psychiatric collaborative care management, each additional 30 minutes in a calendar month of behavioral healthcare manager activities, in consultation with a psychiatric consultant, and directed by the treating physician or other qualified healthcare professional (List separately in addition to code for primary procedure)


In each instance, the patient’s primary care physician recommends that he/she be enrolled in the psychiatric CoCM services program.




Adult: A 55-year-old female, who is separated from her husband and has no children at home, has been feeling more fatigued, not sleeping well, and not taking her medicines for hypertension and diabetes. She also worries a lot about her future. The patient is diagnosed as having a behavioral health disorder.

Child/Adolescent: A 15-year-old child is brought in by a parent because of concerns about social withdrawal, anxiety, diminished school performance, and substance abuse. The patient is diagnosed as having a behavioral health disorder.



 – Once enrolled in the CoCM services program, if the patients above continue to have symptoms, 99493 would be appropriate to bill for subsequent month(s) of service.



While these aren’t new services, there are new codes for 2018 with more detailed information on their use.

May 25, 2018 edition