Physicians who transition to direct primary care aren’t abandoning their patients

I want to thank Rob Lamberts, MD, for his March 25, 2019, article addressing the issues of potential “dangers” and “negatives” as they relate to the DPC model of healthcare delivery.  I am thankful to comment.  Dr. Lamberts addresses three topics: abandonment, consistency in the model, and leadership.

After reviewing the definition of “patient abandonment,” a physician making the transition from an established practice to DPC would be hard-pressed to be in the position of abandoning patients. It behooves the physician to follow proper procedure when leaving an established practice for DPC or he/she would risk malpractice. How does this situation differ from a physician leaving a practice if moving away, taking a new job (consider physician administrators leaving their patients), retiring, or quitting medicine altogether? Would that be called “patient abandonment” too?

Let’s talk about “care abandonment” which are words appropriate to a system that gives patients 7-10 minutes with their doctor (at no fault of the physician) surrounded by mounds of useless red tape, gives limited access, and causes patients to forgo personal medical care due hurdles in cost, attention, access. The discussion should be about “care abandonment.”

Careful consideration is necessary when using the moniker “patient abandonment” before assigning it to anything or anyone; perhaps paying attention to “care” rather than “abandonment” is more appropriate since doctors who embrace DPC do so to be able to provide improved medical care to patients.

When and by whom was it determined that a patient panel of 2,500 to 3,000 is the standard for primary care?  Clearly it is not working for patients or physicians. A higher absolute number of patients does not translate into more or better “care” for numerous reasons that do not need to be summarized. 

Direct Primary Care is the most
	patient-centric, consumer-driven form of healthcare delivery this country has seen in decades. Patients are driving this model too. Maybe 800 patients, or any number the physician feels is adequate for their practice, should be the new standard. And maybe panels of 800 is why there is growing interest in Direct Primary Care from medical students and residents. 

Consistency in the model is an interesting topic and has been discussed among DPC leadership. There are criteria for DPC practices incorporated into office workflows. These criteria are for public consumption in 25 state DPC bills and on 

Specialists are starting direct care models, too. Trying to exclude imposters and those who practice non-traditional medicine is, in my opinion, not our job. State boards of medicine and medical malpractice companies will enforce standards and consistency within scope of training. Patients will choose. Individual DPC physicians will practice medicine while being held appropriately accountable by these entities and by their patients.

Thankfully the criteria are not restrictive but outline necessary legalities. The proposition of a Direct Primary Care certifying board/society would provide an added layer of bureaucracy which would inhibit innovation.  Innovation must continue for real working solutions to our healthcare crisis. DPC, with its “risks,” is providing just that. 

As with any grassroots movement, flexibility is necessary to promote change. DPC physicians are responding to our patients’ needs and the DPC movement is responding to the American healthcare system’s deficiencies.  That is our leadership. 

Corba serves on the board of directors for DPC Action, is a founding member of the DPC Alliance, and owns a direct primary care practice. 

Articles

Your voice: Physicians who transition to direct primary care aren’t abandoning their patients

Q: Are there any updates on the Evaluation and Management (E/M) code requirements?

A: The American Medical Association (AMA) has now weighed in with their E/M requirement modifications, which means that all payers will be affected in 2021. If you remember, Medicare announced plans to revamp the E/M coding structure in 2018 and was met with a quick response from the medical community. As a result, the Medicare changes implemented in 2019 were mostly documentation-related changes that generally benefited providers but were not necessarily accepted and implemented by all payers.

In March, the AMA posted the CPT Editorial Summary of Panel Actions for February 2019, which lists specific changes that they intend to make to the E/M codes, effective January 1, 2021. Although the AMA plans to make significant changes to E/M, they in no way are as extreme as the original proposed Medicare E/M changes. Additionally, as the CPT Editorial Committee  met earlier this month and will also meet in September, we may see even more E/M changes following the summary from those meetings (May 9-11 and September 26-28).

What does this mean for those documenting E/M services, assigning the code levels, and auditing them?

The AMA has joined Medicare and has published the 2021 E/M changes that they intend to make.  We’ve all seen that when Medicare and Current Procedural Terminology (CPT) do not agree on how to report a specific service, or group of services, Medicare may produce Healthcare Common Procedure Coding System (HCPCS) code(s) with specific guidance for Medicare-contracted providers to follow.

As coders know, when a provider contracts with a payer, they must follow the guidelines and policies specific to the contract they have signed, whether or not it matches the CPT guidelines.

Now that the AMA has published these changes, we will need to wait and see how Medicare responds to them. Will we end up with significant differences in E/M code assignation among multiple payers or will they all adopt the same changes? And what are the new AMA E/M changes? 

The new AMA CPT E/M changes are specific only to Office or Other Outpatient Services (99201-99205 and 99211-99215) codes. To date, we don’t have any changes to the inpatient or observation codes.  

Unless the AMA makes further modifications, these changes will be included in the 2021 CPT codebook, so payers, including Medicare, will need to decide whether or not they will adopt them.  They include:

Changes in component scoring for both new and established patient codes (99202-99215)

Changes to the medical decision-making table

Changes to the typical times associated with each E/M code (99202-99215)

The AMA is planning to delete 99201 from the E/M code set. That is an official code deletion, meaning it will no longer appear in the codebook after 2020. There are some situations in which you may still need to report 99201, such as those entities that will not immediately adopt the 2021 CPT code changes (e.g., workers compensation payers).

Although documentation of history and physical examination will still need to be medically appropriate,  the amount of history or number of elements examined and documented will not factor into the scoring used to determine the overall E/M level of service. 

Instead, the basis for code selection will be the level of MDM performed or the total time spent performing the service on the day of the encounter.

To this end, the AMA will be changing the definition of the time element associated with codes 99202-99215 from typical face-to-face time to total time spent on the day of the encounter, and changing the amount of time associated with each code.  What hasn’t changed is that medical necessity for the level of service must be identifiable within the documentation. 

The changes to the titles of the subcategories and time are in the MDM table below. 

Again, these are the CPT changes; however, any payer contracts (e.g., Medicare or payers that follow Medicare guidelines) may require another way to calculate the E/M code levels, so confirm how your payers are implementing E/M changes in 2021. 

Q: Can an ICD-10-CM body mass index (BMI) code be used as a stand-alone code? If not, what does the documentation need to include to justify the use of a BMI code? 

AMA announces Evaluation and Management coding changes

Right now, medical practices are being attacked by cybercriminals

Emails are being sent in the hope a practice employee will click on a link that will install ransomware, hackers are exploiting security flaws in medical equipment with internet connections, and information is being gathered from social media to trick staffers into revealing patient or financial records.

The sophistication and volume of attacks is increasing, according to cybersecurity experts, and practices have to be more vigilant than ever to protect themselves, even if at times it seems fruitless. “A doctor running a small practice might say, ‘If Blue Cross of Tennessee can’t protect itself, how can I?’” says Rob Tennant, director, health information technology policy for the Medical Group Management Association. “But you can’t just throw your arms up and say there’s nothing that can be done. If at the minimum you take some low-impact security steps, that should be sufficient, but always have a contingency plan so that if you run into a hack, a fire, or flood, you have a way out that ensures your practice continues.”

Cybercriminals have many resources and are highly knowledgeable about how technology works and its vulnerabilities, experts say. But they also tend to take the path of least resistance, meaning the harder they have to work to hack a practice, the more likely they are to move on to an easier target. As the bad guys refine their tactics, practices must continue to be vigilant, especially against the most common threats. 

“Malware is still big and they are learning to be more effective with the messaging they use to get people to click on ransomware links,” says Kevin Johnson, CEO of Secure Ideas, a Jacksonville, Fla.-based security consulting firm. “The threats compared to last year are very much the same, but that’s good, because organizations that took the time to enhance their security are still running down the right path. However, people that said they weren’t worried about it are just as far behind as they were last year.”

One of the biggest mistakes a practice can make is to assume it won’t be a target because it is too small or has nothing of value. “Hackers are not going after you specifically, they are going after everybody,” says Johnson. “They target large numbers of victims, because it doesn’t take much more effort to send out millions of attacks versus a hundred, because it is all automated.”

The idea that a hacker is someone living in their mom’s basement is almost always wrong. In fact, most cyberattacks are coming from complex organizations.

“A lot of these groups would be considered mid-sized businesses,” says Elliott Frantz, CEO of Virtue Security, a New York City-based firm that identifies vulnerabilities in applications and networks. “They have full-time staff, their own R&D teams, and in some ways are on par with many tech companies.”

Broad attacks are the most common, but practices can still be singled out by hackers. Elliott says that there are huge markets for stolen information, including specific markets with established prices for healthcare records. Because cybercriminals know the potential return, they can calculate whether targeting a specific practice is a good investment, either through the number of health records they might obtain or through ransomware.

“They may see a smaller organization as a more tempting target,” says Bruce Snell, director, emerging threats and disruptive technologies, for Tokyo-based NTT Security. “The thought process is that a smaller practice may not have good backups or a security plan or tools in place, so it might be worth their time to spend eight hours putting together a phishing attack that might get them $15,000-$30,000 out of them through ransomware.” 

Practices need to defend against several threat types as part of a comprehensive cybersecurity plan, but ransomware is still the leading one. “Ransomware in particular works from a cybercrime perspective because its straightforward and uses malware to infect the system,” says Snell, who adds that medical organizations are particularly vulnerable because of their immediate need for access to patient information. 

Because some healthcare organizations pay the ransoms, it leads to more ransomware attacks across the industry, because cybercriminals see they can profit from it. But paying a ransom doesn’t always work, says Snell. The ransomware code is sometimes poorly written, so even when the victim pays the ransom, they still are not able to recover their data using the key. 

Phishing attacks, where a cybercriminal uses an email pretending to come from someone the recipient knows, are also common, says Elliott. The sophistication of attacks has evolved well beyond the old ruse of the Nigerian prince who requires a little money upfront to secure a much bigger payout later. 

“Attackers are realizing they need to put in more effort to create a realistic scenario,” he says. “It’s much more common now for malicious emails to look legit and be relevant to the victim.” Emails targeting medical practices are now more likely to contain names of doctors or accounts payable staffers, with requests for modest money transfers or patient records.

When cybercriminals want to attack a specific organization, they’ll do the research required to get as many details as possible. “They are looking up identities on social media like LinkedIn and Facebook,” says Elliott. “They are using these sources to target people not traditionally targeted five or 10 years ago.” 

A rising threat to practice cybersecurity is through devices connected to the internet, collectively known as the “internet of things” (IoT). This can include everything from medical equipment to thermostats. As medical technology advanced, many of these devices began collecting and storing patient data like a computer, but without the same level of built-in security, says David Finn, MA, executive vice president, strategic innovation for  CynergisTek, an Austin, Texas-based cybersecurity consulting firm. These devices are often connected to a practice’s network and offer a gateway for hackers to get in.

While computers might get changed out every three to four years, medical
	devices are typically kept for a decade or longer, meaning many older devices weren’t designed with security features to deal with today’s hacking threats, says Finn.

“There are literally millions of devices deployed across the country in hospitals and practices, and nothing can be done in terms of protecting the device,” he adds.

More troubling is that some hackers have attacked devices not to steal or ransom data,  but simply to be malicious and shut them down-including one example from Russia last year where hackers shut down all of the operating-room equipment during a 13-year-old’s brain surgery.

 “In some cases, it’s just evil people testing their product in a real market,” says Finn. “The new threat is really for lack of a better term from ‘hacktivists.’ They like to read in the paper how they shut down a hospital or disrupted a surgery, similar to how an arsonist likes to see the response to their crimes.”

With the rising number of threats and the growing sophistication of attackers, trying to defend a practice may seem impossible. However, experts agree that a careful review of cyber vulnerabilities can greatly reduce the odds of a breach.

“Before ever looking for a specific technology or solution, I think generally speaking, small practices should understand what their exposure is and where the risk really lies,” says Elliott. Too often, people look for one “silver bullet” product that will protect their data. Elliott adds that the most important thing is to understand what the potential problems are before trying to solve them. 

For example, a practice sending lots of emails or receiving files from outside sources needs to invest in making sure those systems are secure and that it is taking extra precautions when accepting files or getting requests for information, such as some sort of secure email delivery service, says Elliott.

Basic security hygiene is also important. “Make sure your passwords are different for your work email and personal email,” says Elliott. “Make sure your desktops and laptops are secured at the system level, and ensure you have anti-virus or endpoint detection of threats.”

Snell says that every log-in for every computer and device should have a different password and should not be common words. If it’s too complicated to manage, he suggests using a password tool such as LastPass or 1Password.

Johnson recommends working with the practice’s IT expert or vendor to reduce the number of ways an attacker can potentially gain access to the network or its data. “Too many organizations buy computers that are way more powerful than they need that run lots of applications,” says Johnson. “Evaluate using something like a Chromebook.”

Because of the device’s simplicity, there are fewer ways for hackers to exploit them. He compares using Chromebooks, which are stripped down computers, to removing half the windows and the back door to the garage on a house-fewer points for an intruder to get in.

Similarly, using as many cloud-based services as possible can help a small practice with security because the application provider-with its superior resources-will be responsible for securing its platform, says Snell. 

An often overlooked security measure is training staff members to recognize potential risky links and to not click on them. “Users have to understand they are the first line of defense,” says Johnson. “They have to think through what they are doing and ask themselves if it makes any sense.”

Snell says education can be one of the most effective defensive tactics a practice can use. “Make sure everyone in the organization is part of the overall security program,” he says. “Make sure everyone is aware of the risks they may see on a daily basis.”

For example, Johnson says, an office manager received what looked like a request from a supervisor for all the employee W-2 forms. The office manager was a little suspicious and so encrypted the data and sent it with a message that the encryption key was texted to his phone.

The attacker, still posing as the supervisor, emailed back that he lost his phone and requested the key by email-and the office manager complied, thus giving the attacker the data and the key because of a compromised email account.

“People think computers are different,” says Johnson. “If you got a letter in the mail asking for everyone’s sensitive data, would you comply? They need to think about what they are doing.”

When purchasing new medical devices with internet connections, always ask about the security standards on the device, says Finn. “Ask if it can be upgraded if a vulnerability is found and if it can run some sort of anti-virus program on its system,” he says. 

One other caution with connected medical devices is to know whether they store patient data, and if so, to make sure the data is purged on a regular basis, says Finn. “When you scan a document, some of what you are putting in is stored and retained by the device and most people don’t even think about that,” he says. 

If cost is an issue to securing a practice’s data, Tennant says to look at free resources first, then bringing in outside help to deal with the unresolved vulnerabilities. He recommends starting with the Office of the National Coordinator for Health IT website (www.healthit.gov), which has guidance on how to do a security analysis and other tools. Another option is to team up with other practices and share the cost of a security consultant.

Attacks, with the exception of ransomware, are rarely obvious. Experts say a practice most likely wouldn’t even know if it’s systems are compromised, because there are few tell-tale signs from today’s hackers. Only a security expert examining a practice’s systems will be able to tell if a breach has occurred, and if it has, can take steps to remove the intruder. The best approach is to be proactive and assume an attack is coming, if it hasn’t already happened. 

“Security 101 is making sure you have all your data backed up,” says Snell. “Cloud-based backup is inexpensive, and it will give you secure and remote backups so you can recover quickly.”

Tennant says not investing in a backup system to protect the integrity of patient data is irresponsible, and puts the viability of the practice at risk. “It is not a question of if a practice will be attacked, it’s a matter of when,” he says. “You have to assume you are going to be hit with something eventually. If it happens, what is your solution to that?”

Malware: Malicious software designed to disrupt computer ­operations or steal information.

Ransomware: A type of malware that locks users out of their data and encrypts it until a ransom is paid.

Virus: A type of malware that can corrupt or erase information on a computer before spreading to other computers.

Worm: Malware than can replicate itself to spread to other ­computers.

Phishing/spear phishing: A scheme using an email to trick someone into divulging personal information or passwords. A spear phishing attack uses more detailed personal information to make an email appear to be coming from a known employee, business associate or family member. 

Practices are increasingly coming under attack by cyber criminals, so physicians must take steps to improve their security efforts.

The growing cyber threat to physician practices

The clock is ticking, and you’re trying to select the right E/M level from a drop-down menu in the EHR. Choose a level that’s too high, and you run the risk of post-payment audits and recoupments. Choose one that’s too low, and you may lose revenue to which you’re entitled. You decide just to trust your instincts and go with a code that feels right so you can move on to the next patient. 

Choosing an E/M code based on a gut feeling is one of the biggest mistakes a physician can make, says Sonal Patel, CPMA, CPC, a healthcare coder and compliance consultant with Nexsen Pruet LLC, a business law firm in Charleston, S.C. Payers and auditors use a quantitative scoring process that requires specific elements (i.e., history, exam, and medical decision-making [MDM]-or time spent counseling and coordinating care) for each E/M level. 

If physicians don’t document these elements adequately-or the elements they document don’t make sense given the patient’s presenting problem (e.g., performing a comprehensive exam for a patient with a sinus infection)-payers and auditors may down-code the service or even conduct a more in-depth audit that could expose additional documentation vulnerabilities, she adds.

It’s equally risky to report the same E/M level for all patients with the same diagnoses (e.g., diabetes or congestive heart failure) without first considering medical necessity-a trap into which many physicians fall because they assume all patients with the same diagnoses generally require the same work, says Toni Elhoms, CCS, CPC, director of coding and compliance at RT Welter & Associates Inc., a healthcare consulting company in Arvada, Colo. “In reality, every single visit could be a different level based on the documentation and circumstances of the encounter,” she says.

Focus on quality E/M documentation-and the dollars will follow

Knowing what documentation is required for each E/M level is paramount. For example, the history, exam, and MDM must meet or exceed certain requirements for all new patients. The only exception is when the physician selects the E/M level using time as the controlling factor. In this case, documentation must indicate that the physician spent more than 50 percent of the encounter face-to-face with the patient and/or family providing counseling and/or coordination of care. The physician must also explain the specific services rendered and the reasons for them. 

Only two of three key components must meet or exceed certain requirements for established patients unless the physician bills based on time. Elhoms provides an E/M scoring guide that includes a visual depiction of documentation requirements for each specific E/M level based on whether the patient is new or established. 

Sound confusing? Experts agree that even the most experienced medical coders have difficulty translating physician documentation into an accurate E/M code. They cite several reasons why E/M coding is so difficult for physicians-lack of formal training on E/M guidelines, complex documentation requirements that don’t align with clinical practices, and the subjective nature of the MDM component. 

We’ve asked our experts to share their best documentation tips to ensure accurate E/M reporting. Here’s what they said. 

When billing a level 4 or 5 new patient E/M code (i.e., 99204 or 99205), 

remember to document one specific item from the past medical history (i.e., illness, operations, injuries, treatments, medications, or allergies), one specific item from the family history (i.e., medical events or hereditary diseases that place the patient at risk), and one item from the social history (e.g., use of tobacco, drugs, or alcohol). 

Also document a review of systems that relates directly to the problem identified in the history of the present illness (HPI) in addition to a review of all additional body systems, says Elhoms. Physicians frequently forget to include all of these elements, often leading payers to down-code these services to a level 2 or 3 on post-payment review, she adds. That means physicians could lose as much as $133 per encounter.

Similarly, when billing a level 3 new patient E/M code (i.e., 99203), 

don’t forget to document one specific item from either the past, family, and/or social history that’s directly related to the problem in the HPI. Omitting one or more of these details usually prompts payers and auditors to down-code the service to a level 1 or 2 on post-payment review, says Patel. Revenue loss in this case could be as much as $64 per encounter. 

Be as descriptive as possible when documenting the HPI. 

Specify the location, quality, severity, timing, context, modifying factors, and associated signs and symptoms that are significantly related to the presenting problem, says Patel. These descriptors help physicians gain points when choosing an E/M level, she adds.

Don’t repeat the same HPI for every visit. 

This is true even for follow-up appointments related to chronic conditions. Payers want to see what’s new with the patient-for example, new pain, new flare-ups, new concerns, or new lab results-or some acknowledgement that the patient has been stable and symptoms are controlled, says Patel. The same repetitive HPI could be a red flag that a physician is cloning their documentation, she adds.

Only review body areas or organ systems that affect MDM for the current encounter, 

says Michael Miscoe, JD, CPC, founding partner of Miscoe Health Law LLC in Central City, Pa. Most subsequent visits, for example, don’t require a multi-system exam even though it’s very easy in an EHR to pull this information forward from the initial visit. Doing so inflates the E/M level and could expose a physician to audit risk, says Miscoe. “More isn’t necessarily better,” he adds. “Because many docs either don’t understand this or let their EHR system flood the record with irrelevant content, we see skewed E/M profiles that lead to post-payment liability.”

Miscoe says documentation should reflect the following: For example, what did the physician specifically ask the patient about each body system, and how did they respond? How did this contribute to the physician’s overall assessment and evaluation? In the examination, what element of the organ system did the physician evaluate, and why? 

Physicians who don’t explain their analysis in the context of the patient’s complaints often end up with what Miscoe terms “healthy sick people records” (i.e., level 4s and 5s with mostly negative findings and no explanation of why the physician performed certain services) that tend to raise a red flag with payers and auditors.

Know whether your Medicare Administrative Contractor uses the 1995 or 97 E/M guidelines. 

These guidelines differ in their options for the exam component of the E/M level, says Patel. More specifically, the 97 guidelines provide additional options for single organ system exams, allowing providers to report higher-level services for intensive, problem-specific examinations. Once you know which of the guidelines your MAC uses, ensure your EHR vendor incorporates them into any templates you use, she adds. 

“MDM is all about the cognitive labor a physician puts into the encounter,” says Elhoms. This includes the number of diagnoses and management options considered, the amount and/or complexity of data reviewed (e.g., urinalysis, EKG, lab results, or additional workup planned), and the risk of complications, morbidity, or mortality. Therefore, documenting each of these elements is critical because it can help justify a higher-level E/M code, she adds.

Know how your Medicare Administrative Contractor interprets MDM. 

Contractors publish frequently-asked questions and other guidance describing what they look for in terms of all E/M documentation, including MDM. For example, some MACs define ‘additional workup’ as any service that’s performed outside of the current encounter while others state it’s any work that goes beyond the E/M service-even when the physician performs it during the current encounter, says Shannon O. Deconda, CPC, CPMA, founder and president of the National Alliance of Medical Auditing Specialists in Knoxville, Tenn. 

spent face-to-face with the patient and/or family during the visit, and specify how much time (in minutes) was spent counseling the patient and/or family or coordinating care, says Miscoe.

Summarize specific details of the conversation 

with the patient and/or family (i.e., what was discussed with patient and/or family and why), says Elhoms.

Experts agree that with all the buzz about upcoding, it’s easy to forget that under-coding is also a problem because it results in lost revenue. Though less common, under-coding happens when physicians report a lower-than-necessary E/M level out of fear they will be targeted by a payer for an audit. It can also happen when physicians don’t document all of the services they render or the complexity of their MDM. 

Most physicians become aware of a trend of underpayments after hiring a consultant to perform an internal audit, says Elhoms. The good news is that physicians can submit corrected claims to try and recoup some of the revenue to which they’re entitled.

Medicare allows providers to submit corrected claims up to a year from the date of service, while many other payers require resubmissions within 120 days or sooner. 

Is it worth the time and effort of resubmitting a claim? Elhoms provides this hypothetical example: A provider sees 100 patients per month, 50 of whom receive level 4 E/M services based on the documentation. However, the provider bills a level 3 for these 50 patients out of fear of being audited or because they don’t understand documentation requirements for each E/M code. The difference in payment between a level 3 and level 4 established patient is $35, equating to a $21,000 revenue loss over the course of a year. 

 This includes annual E/M refresher training for all physicians and staff.

 Ask this individual to audit E/M documentation and ensure it supports the level of codes assigned.

Be mindful of time-saving functionality.

 The Office of Inspector General (OIG) monitors copy-paste functionality (often referred to as cloned documentation) as well as auto-populated fields within E/M templates. Experts suggest turning off this functionality to avoid inappropriately upcoding E/M services. They also suggest turning off the automatic E/M calculator. This calculator is often based on a vendor-proprietary algorithm that may not accurately correlate with E/M scoring guidelines. The calculator also isn’t able to consider the medical decision-making or complexity of care that’s provided.

 Is it medically necessary to bill a higher-level E/M code when a lower level of service is warranted? For example, even though CPT guidelines permit physicians to report a level 5 E/M code when performing a comprehensive history and comprehensive exam, it may be appropriate to report a level 3 if the medical decision-making is straightforward (i.e., minimal risk of complications, morbidity, or mortality; minimal or no data reviewed; and minimal number of diagnoses or management options considered). Per the Medicare Claims Processing Manual, CMS considers medical necessity the overarching criterion in selecting an E/M code.

Partner with a certified coder to validate codes prior to claim submission.

 Certified coders are well-versed in E/M guidelines and documentation requirements and can help increase compliance and minimize post-payment audit risk.

Tips and warnings from experts for E/M coding

Level of care coding tips to boost revenue, mitigate risk

Carmela Mancini, DO, worked long days as a hospitalist for almost three years after residency. She became frustrated early on, feeling that the doctor and patient were not the most important factors to the hospital and healthcare system. 

“I became disheartened,” she says. “I did not go to medical school to do billing and write notes the majority of the day.”

Mancini thought she was going to have to quit practicing medicine, but began talking with one of her hospital’s admitting physicians, Jeffery Gold, MD, who ran a direct primary care (DPC) practice in Marblehead, Mass. His practice accepts no insurance plans; instead, his patients pay a monthly fee for their primary care needs. They get an annual physical, wellness and sick visits, same or next-day appointments. Other minor in-office procedures are included, like wart removals, skin biopsies and osteopathic manipulative treatments. 

Mancini rented space in Gold’s office in 2015, and hasn’t looked back. With insurance billing and insurance documentation requirements considered some one of the most frustrating parts of practicing medicine, physicians like Mancini are finding ways to practice off of the insurance treadmill. Besides DPC, a number of alternative payment models exist, including concierge medicine and fee-for-service self-payment. But transforming to an alternate model can be a challenging endeavor. 

While practices like Mancini’s started with no patients, it’s easier to make the leap if the physician already has a full practice of patients to draw from. Physicians can run a hybrid practice, accepting insurance and DPC payments from different patients, during the transition. 

This model can increase the practice complexity. The physician may want to consult legal with counsel to ensure that the business structure is appropriate to accept both kinds of payments, and that the billing staff is clear on what patients can be billed. The scheduler also needs to track which patients are in which model, to schedule the right amount of time for each visit, and to leave time in the schedule for same day or next day appointments for the DPC patients. 

Patient panels in traditional insurance settings generally include about 2,500 patients, according to the American Academy of Family Physicians (AAFP); DPC panels are smaller, often with 600-800 patients, according to the AAFP. 

It’s also easier for independently employed physicians to start a DPC practice. If employed, the physician would have to break away and start a separate practice, or the whole group needs to move to the model. The physician also must ensure there is no non-compete or non-solicitation agreement.

There are financial risks with alternative payment models. “There’s no guarantee that you’ll hang up your shingle and people will come,” says Jennifer Pollard, MD, an internist in Austin, TX. “People are spending money out of pocket.”

Pollard runs an integrative medicine practice, using a fee-for-service model, but paid directly by patients. In lieu of rolling labs and imaging into the services package for patients, as some all-inclusive DPC providers offer, Pollard says she provides more face-to-face time and direct attention at visits. 

Monthly membership prices are often based on what the local market will bear. A study in the 

Journal of the American Board of Family Medicine

, notes a $77 average monthly DPC membership payment. Mancini’s practice charges $40-$135 a month, depending on patient age. Some practices have a family rate. 

Physicians in DPC models find that their overhead decreases, compared to the insurance reimbursement-based model, and the study found a 40 percent overhead reduction for DPC practices. The main reason is they need fewer staff members because they don’t bill insurance. But they also use fewer to no mid-level professionals, as the physician takes on the entire clinical role. 

Mancini shares a receptionist with Gold, and handles her own billing. She has no nurse, does her own triaging and calls patients directly with lab or imaging results. She spends 20-25 percent of her time on administrative work, including writing notes, billing patients, and getting prior authorizations for imaging tests, which in most practices is handled by a staff member. She says that in an insurance-based practice, about 50 percent of the physician’s time is spent documenting what she says is extraneous information on the history and physical, so that insurance would pay for the visit. 

Pollard has lower overhead than when she was in a traditional practice, but also finds that the insurance-free model simplifies the office infrastructure. She takes the patient’s vital signs and asks about their medications, allergies, and complaints, which elsewhere is done by a nurse or medical assistant. Not all physicians want to do that, Pollard says. 

When starting any practice from scratch, there may be additional costs to rent, buy or outfit the office. Pollard says she doesn’t have a lot of equipment, which decreased her start-up cost.

It can take time for physicians in DPC practices to earn a salary equivalent to their traditional practice days, though. Pollard says she broke even her first year. 

Much depends on how many patients the practice can recruit, and the amount charged per month. Before starting a practice, it’s a good idea to think about the eventual patient panel size, how much time to allocate per visit, how many days and hours providers will spend seeing patients in the office, and then anticipate overhead expenses including office space, insurance, office supplies, and programs such as EHRs. 

Running some cost scenarios on a spreadsheet should give an idea of the anticipated salary with a full patient panel, and the amounts brought in for various numbers of patients. 

“As a hospitalist, I made much more money,” says Mancini, who has recruited about 250 patients to her practice. She doesn’t want to go above 300, as she has chosen to keep her panel small in order to enjoy more family time and decrease her stress level. “Most direct primary care physicians make at least as much money as in their prior practice. My wellbeing was more important to me than how much I was making.”

Some doctors launch a DPC program while continuing to see patients with insurance, a hybrid model. A 2018 survey of AAFP physicians using a DPC model showed that those who achieved their ideal practice size did so in an average of 20 months. However only 17 percent of those practices had reached their target panel numbers. That concurrent period allows revenue from the new model to kick in, while the traditional practice winds down. Physicians should be prepared financially if coming from a salaried position, as salary is not guaranteed with this model. Physicians often supplement their income by working at other practices or hospitals as they continue to market and build their practice.

“When you have zero patients, it’s risky and scary,” Mancini says, and it can take a few years to reach the enrollment goal.

Ashley Maltz, MD, is still ramping up her self-pay practice, with more than three years in business. The internist and preventive medicine physician shares space with Pollard, and works part time for another clinic. She is considering converting to the DPC model, as it offers a continual stream of revenue, versus fee-for-service patient payments. To transition, she’ll need to rework her forms, website and payment system. 

“Patients have to know what they’re signing up for,” she says. 

Before talking with patients, the physician must set up the infrastructure and work out all logistics, with a business plan and timeline in place. The physician should have all the legal and financial paperwork drawn up, including brochures and patient contracts. The physician needs a website and other electronic programs, including electronic health records, membership management software, a secure patient communication portal, and possibly telehealth access if offered. Some physicians broker discount agreements with labs and imaging centers, and dispense discounted medication from their office as well.

It can be time consuming to tell patients about the new model, and physicians who are transitioning their practice will want to spend several months before it begins, explaining it to each patient at the beginning of the visit. 

Whether starting from scratch or with a full patient base in a traditional practice, the physician and office staff must have a clear elevator speech about the new model, including the benefits to the patients, says Pollard. In a DPC practice, the office staff may just include a receptionist, which may be shared with other physicians in the office. If transitioning a practice, all office staff members should understand the new model well enough to explain its benefits clearly.

“You have to really train whoever is answering the phone to explain what the practice is about and the benefits you may get,” she says. 

Physicians need to network and market, and that may put them outside their comfort zone, says Mancini. Since transitioning her practice, she has attended chamber of commerce meetings, held open houses, gave healthcare speeches at senior centers, and joined a networking organization. Once she had 100 patients, word of mouth referrals increased, and she did not need to network as vigorously. 

“You have to be willing to be a business person,” Mancini says. 

Maltz also started with in-person networking, and now concentrates more on social media. She formed a group called the Austin Wellness Collaborative, which she says has been a great source of patient referrals. The Collaborative includes a variety of wellness professionals who network with each other.

Physicians can also network with employee benefits companies, insurance brokers, local banks, and financial planners, to incorporate DPC into a financial or benefits plans. Patients may find it worthwhile financially to change to a less expensive high deductible plan, and join a DPC practice. Some DPC physicians work with employers to enroll employees as well.

With growing interest in DPC, many physicians are willing to help other physicians for free. “I wouldn’t recommend someone paying a company to help them get started. There’s so much free advice out there,” says Mancini. “Doctors who do this type of practice want to help this movement grow and are happy to talk to doctors thinking about going this route.”

Those who want high-touch professional help can consult with companies like Paragon, though these companies focus mostly on concierge practices. The AAFP publishes information on its website, and sells a toolkit to get started with DCP, as well.

“I’ve never been happier in a job,” says Mancini. “I’ll never go back to working for a hospital-based system.”

How to transform into a direct or concierge model

Practicing medicine without payers

As more physicians become employed, learning how to successfully negotiate an employment contract becomes a crucial skill to learn. 

A common issue is that many physicians simply don’t negotiate, and just sign what’s put in front of them, says Michael S. Sinha, MD, JD, a Regulatory Science Fellow at the Harvard-MIT Center for Regulatory Science.

Sinha, who is presenting a session on negotiation basics at the American College of Physicians annual conference in Philadelphia, talked with Medical Economics via email to discuss some of the key aspects of negotiation vital for physicians to learn.

 What is a common mistake physicians make when negotiating contracts?

: Often, physicians will eagerly sign a binding letter of intent or agree to terms of a contract with little or no negotiation-in some cases, they aren’t even aware of what can be negotiated!

The key is to consult a healthcare lawyer early in the process. Find someone who specializes in physician employment contracts in that state. They will have a lot more insight as to what can, and should, be negotiated.

Ultimately, if you don’t negotiate, you’re only cheating yourself.

 What areas in an employment contract are most important to focus on?

 The first thing to do, before any financial compensation is discussed, is to clearly define the duties and responsibilities in the contract. Get any promises that are important to you in writing. Only when those details have been hammered out can you get an estimate of your true market value.

It will also affect the salary structure that works best for you. Perhaps you have a lot of administrative responsibilities that would cut into meeting pre-defined relative value unit (RVU) thresholds-this may mean you’ll miss out on bonuses under an incentive-based contract, and a fixed salary would make more sense.

Flexibility and vacation time may also be up for negotiation, but at the expense of your base pay. Here, an incentive-based contract may mean that, as long as you’ve hit appropriate metrics, you’ll have more time off with no salary repercussions.

That said, be sure that you have access to the performance reviews or quality metrics that are being used to determine bonuses. Get it in writing!

 One area we regularly hear about from physicians is restrictive covenants/non-compete clauses. What do physicians need to know before signing a contract containing one of these? Is there anything they can do to protect their post-employment career opportunities if they sign a contract containing a restrictive covenant?

 State-level legal expertise is particularly important here. Some states, like Massachusetts, ban restrictive covenants in physician contracts. Others have limits on what these clauses can entail. The lawyer you hire should know the standard for a particular area and can push for compromises in duration and geographic distance.

That distance can be very important. For instance, a 20-mile restrictive covenant may be reasonable in rural Tennessee but would be unreasonable in New York City. Negotiate favorable terms for a restrictive covenant prior to signing the contract; if you don’t, disputes over restrictive covenants could take a few years and several thousand dollars in litigation fees to resolve. Don’t ignore the clauses just because you think you’ve found your “dream job.” And don’t be afraid to ask around. Other physicians in your practice group may have a covenant of shorter duration or distance-or may not have one in their contract at all.

 What are some items physicians can/should negotiate for that many physicians tend to overlook?

 I would start with student loan repayment. Some newly-minted physicians are coming out of residency with $200,000 to $300,000 in student loan debt. There are usually ways to get the hospital to pay some of it off. They may be reluctant to pay a lump sum directly to you, but may be happy to write a check straight to the lender. They’re also less likely to pay any of it up front, but may agree to annual installments, payable after each year of service.

As more physicians become employed, learning how to successfully negotiate an employment contract becomes a crucial skill to learn.

ACP 2019: Contract negotiation: What physicians need to know

Loneliness: It is a growing societal challenge that can dramatically influence patient and physician health.

In a keynote presentation April 11 at the American College of Physicians (ACP) Internal Medicine Meeting 2019, former Surgeon General Vivek H. Murthy, MD, MBA, told about 4,000 attendees that the country’s state of emotional health remains an important driver of health.

“If you told me five years ago that I would be talking to physicians about the subject of loneliness, I would have been surprised,” Murthy said. As he travelled the country as the 19th Surgeon General of the United States, he began to hear more patient stories related to addiction, violence, mental illness and other behavioral-based health conditions. There was an undercurrent, Murthy says, that connected many of these prevalent social issues to loneliness. “Many patients are struggling with it,” he adds.

Healthcare professionals are starting to recognize its impact on adherence to physician treatments and recommendations, lack of exercise, smoking, and other unhealthy lifestyle behaviors and other social determinants.

It is estimated that as much as 20 percent of the population struggles with loneliness, and additional research in this area is starting to offer stronger linkages to health consequences associated with loneliness including depression, dementia, cardiovascular disease, and anxiety.

“It affects physicians too. We talk about burnout in our profession,” Murthy says, but healthcare is not a profession that often promotes self-care.

Physicians work long hours, which can definitely contribute to feelings of isolation and a kind of physical and emotional barrier to making stronger connections with friends and family.

When your professional lives take over, Murtha says, you need to adopt strategies that can help you stay connected with your love of medicine and maintain a healthy balance outside of busy schedules.

During long shifts, try to add a micro-dose of self-appreciation, Murthy says. For example: Take five extra seconds when you are washing your hands to reflect on the ways you have helped patients that day. Do that three times a day.

“We are not designed to work alone,” he says. “We need each other, and we need to support each other.”

Murthy called on attendees to imagine a time in healthcare where physicians have built a culture that supports each other. “The lives of the people in this room matters.”

“Our country is in this struggle between love and fear,” he says. “People are worried about the kind of environment their children are growing up in. They see the polarization of politics. They look at the meanness on social media. People are worried. How are we going to create a better world for ourselves? Where will that leadership come from? Our profession has to lead.”

Loneliness is a quiet epidemic causing loud health impacts on patients and physicians. 

ACP 2019: How loneliness affects patients-and their physicians 

As the prevalence of physician burnout rises, so too might the occurrence of medical errors. A recent 

 by researchers at Stanford University School of Medicine found that physicians with burnout were more than twice as likely to commit medical errors, even after adjusting for specialty, work hours, fatigue, and workplace safety. 

But the relationship between physician burnout and medical errors may be more cyclical than linear. “We value our relationships [with patients], so when someone dies or an error occurs … not only does it hurt the patient and the family, but we are upset as well,” says Tracey L. Henry, MD, MPH, FACP, assistant professor of medicine at Emory University in Atlanta. When left unaddressed, this emotional or psychological stress can further contribute to burnout.

Despite this issue, Henry says most institutions do not have a system in place to support physicians and other healthcare professionals in the event of a medical error or adverse patient outcome. As a result, many physicians avoid disclosing errors and end up internalizing their emotions because “there’s this machismo culture in medicine, and so a lot of times we are ashamed to ask for help,” she explains, noting that early career physicians tend to struggle the most with error-related stress because their clinical self-confidence is still developing.

At this year’s ACP Internal Medicine Meeting in Philadelphia, Henry will moderate an interactive panel discussion focused on helping physicians recover and grow from medical errors. The panelists will use programs currently in place, such as 

, to provide physicians with resources and best practices for coping with medical errors that they can take back to their organization or practice. 

Specifically, leaders should create awareness that medical errors happen and can happen to any physician, and then ensure that physicians are able to process their emotions in a healthy way. Henry recommends developing a protocol that includes nonpunitive teams debriefs following an error or adverse event and a peer-to-peer support network. She notes that it’s important for the individuals leading the debriefs and peer support groups to receive training in order to ensure they understand how to discuss the error without pointing blame or re-traumatizing the physician.  

When medical errors occur, patients suffer-but so do physicians.

May 25, 2019 edition

Your voice: Physicians who transition to direct primary care aren’t abandoning their patients

AMA announces Evaluation and Management coding changes

The growing cyber threat to physician practices

Level of care coding tips to boost revenue, mitigate risk

Practicing medicine without payers

ACP 2019: Contract negotiation: What physicians need to know

ACP 2019: How loneliness affects patients-and their physicians

ACP 2019: Caring for the caregiver after a medical error

8 ways to transform your practice to a concierge model

Beyond burnout: The real problem facing doctors is moral injury

Healthcare security is improving, but don’t stop now