Hacking remains a constant threat, but with each security lapse, we learn something important about the shortcomings of our current data protection methods. In October 2017, for example, hackers exposed the personally identifiable information (PII) of 

 at the Henry Ford Health System in Detroit after stealing employees’ emails. With only a single layer of authentication protecting the data, the thieves could easily break into the system. 

 found that 81 percent of all breaches are caused by stolen or weak credentials. And 

 is particularly vulnerable: In 2017, the number of data breaches totaled 328 worldwide, costing an estimated $1.2 billion. To put that into perspective, consider that the second-most vulnerable industry-technology-experienced only 48 breaches in the same year.

To protect patients’ health records, many organizations have turned to two-factor authentication to maintain data security. The goal is to go beyond passwords and add something unique to the user-making it harder for thieves to spoof.

, each factor must be one of the following: a password or security question, a signature or biometric (e.g., fingerprint, voice print, or iris pattern), or a mobile number to receive SMS codes. If a hacker can obtain a password but access also requires an SMS text code, the thinking goes, the organization’s data should remain secure.

However, two-factor authentication isn’t a silver bullet against all security breaches, and even though two methods are better than one, neither is truly foolproof. When implementing two-factor authentication, be wary of these shortcomings:

1. Text codes are convenient but susceptible. 

SMS text codes are one of the most popular authentication methods because of their convenience. Our phones have become an extension of ourselves, and it wouldn’t take long to realize it was missing. But if it 

get stolen, cybercriminals are instantly closer to infiltrating your healthcare organization. In some cases, thieves don’t even need the physical phone. There have been reports of hackers 

 into rerouting calls and texts to another number, after which they change passwords on accounts that use the number as a security backup. 

The mobile market doesn’t have much incentive to increase security, either. Two major networks dominate the market, and the industry has remained one of the 

 to two-factor authentication standards. This means that even if an employee receives the code, hackers could still exploit the network’s vulnerability. 

One solution is to use a time-sensitive code that expires after being sent, shortening the window of time thieves have to hijack the SMS service. You can also add an additional layer of security with 

-square bar codes that read both horizontally and vertically-that hospital employees scan with an app, such as 

Two-factor authentication promises an additional layer of security, but compliance can be burdensome. Perhaps that’s why Google recently revealed that 

 users have enabled the free two-factor authentication measures it offers. 

Hospital staff members are constantly pressed for time, and the idea of taking extra steps, even if they’re for a good reason, won’t sound appealing. As a result, they’ll be keen on finding ways to get around their own two-factor authentication to save time-making mistakes or ignoring some of the processes altogether. This can cause technical errors and bog down the tech help desk, giving hackers a weak link to exploit. 

To reduce fatigue, personalize two-factor authentication with adaptive risk assessments that analyze each user’s IP address, location, device, and credential behavior every time he or she signs in. The second authentication will only be triggered if an anomaly indicates a potential risk rather than every time an employee signs in. 

When you label devices as “trusted” within your network, they only require two-factor authentication periodically. If access to the trusted device is compromised, two-factor authentication loses its value. The device doesn’t need to be stolen to be comprised, either. Organizations often forget to update their trusted devices list when employees leave or when devices are lost. As long as those devices remain trusted, they’re a huge liability. 

In addition to routinely updating your list of trusted devices, you can encrypt and password-protect them for added security. You might even consider putting a time limit on how long devices are considered trusted. Limiting who can view sensitive information by implementing role-based access to patient records and protected health information is another way to protect data. 

Once you see improvement in user engagement and lower security risks, it’s easy to become overconfident in your security measures. Remember that two-factor authentication is not people-proof and security threats are constantly evolving. 

An excess of confidence leaves your employees more likely to take the bait of a crafty scheme, especially now that phishing attacks are sneakier than ever. For example, a hacker recently 

compromised LinkedIn’s two-factor authentication

 measures by sending seemingly authentic emails to users. Those who opened the link were sent to a fake login screen, where they completed the two-factor authentication process. Hackers could observe and record the session’s cookies and then use them to act as authenticated users.

The trick worked because the only difference between LinkedIn and the email’s origin was an L in place of an I in the URL. Details like this are easy to miss, so make sure every employee carefully examines the origin of any unsolicited or unexpected email-even if it seems authentic.

Two-factor authentication is a significant step toward protecting your organization, but it doesn’t change the fact that healthcare remains one of the most vulnerable industries. Follow the strictest precautions possible, even after implementing two-factor authentication, and utilize additional features to help build up the security it already provides.

, the leading provider of HIPAA-compliant email services. A serial entrepreneur, Greevy also founded Pau Spam, an email filtering software service.

Articles

Two methods are better than one, but nothing is foolproof to stop eager hackers.

4 reasons two-factor authentication isn’t a silver bullet

Welcome to Medical Economics' blog section

 which features contributions from members of the medical community. These blogs are an opportunity for bloggers to engage with readers about a topic that is top of mind, whether it is practice management, experiences with patients, the industry, medicine in general, or healthcare reform. The opinions expressed here are that of the authors and not UBM / Medical Economics.

Imagine that you and your family love going to a local chef-owned restaurant. The service is good. The price is reasonable. The staff is friendly and knows your order. You know the chef-owner personally, and have heard that he often donates surplus food to the local food bank.

Then a large restaurant chain buys up the restaurant. The menu looks exactly the same, but it doesn’t have prices. You go ahead and order the Caesar salad and hamburger that you always get for $12. After you’ve eaten, you get your bill. The meal is now $48. When you ask why, you don’t get a straight answer. 

Finally, after some persistence, you discover that the chain-owned restaurant has layered in a facility fee: a charge that adds no value to your dining experience whatsoever, but that allegedly helps the corporate entity maintain its overhead and give an occasional free meal to the poor-so the owners claim.

Facility fee? The facility looks the same. You find the former owner, who looks a little sheepish, and demoralized. He tells you he wishes he never sold out, but the corporation pressured him and paid him a lot of money. And now the corporate honchos are making him prepare twice as many meals a day as an employed chef. He’s burning out. Quality has suffered. He can’t buy the fresh market ingredients he wants, but must make do with what the company supplies. What’s more, he is contractually forbidden from opening another restaurant within 100 miles. He’s stuck.

You start trying out other nearby restaurants to find a new favorite and learn they’ve all been bought by the same company.

Every day, hospitals and health systems are buying independent doctors and turning them into employed physicians. When they do, hospitals tack a facility fee onto the doctor’s fee every time he or she performs a procedure. These fees add zero value, yet the law allows hospitals to charge them to “cover overhead.” These money-for-nothing fees are one reason hospitals can afford to pay doctors more than doctors can earn on their own, and lure them out of independent practice-a trend that is unhealthy for doctors and for Americans.

Because of these fatuous fees, the same treatment that cost $500 in an independent practice, now costs $1,500 or $3,000 after a hospital buyout. A hospital that employs a cardiologist should not get $4,000 for a heart catheterization when an independent doctor performing the same procedure across the street gets $1,100. A procedure should cost the same regardless of where it’s performed. But our law doesn’t work that way.

Under current federal law, Medicare payments flow differently depending on whether payments go to a hospital outpatient setting (via the Outpatient Prospective Payment System) or to a private physician (through the Physician Fee Schedule). Hospitals get paid more, often several times more, because the system lets them add facility fees.

For example, clinic visits are the most commonly billed service under Medicare. Currently Medicare pays $116 for a visit to a doctor in an outpatient hospital clinic, and only $46 for the same level visit to an independent doctor. That difference adds up.

CMS has long advocated for equal payments, or what the agency calls “site-neutrality,” to no avail. The Medicare Payment Advisory Commission has advised year over year that if Medicare stopped paying facility fees our nation could save 

. This could be a lot more if private insurers followed suit.

Where the facility fees really add up is when they compound. See, hospitals require employed physicians to refer only to other employed doctors, and to order tests only through hospital-owned facilities, regardless of whether those doctors or facilities are the best or most cost effective. Doing otherwise is called “leakage,” an offense that sparks an administrative rebuke, and often a pink slip. 

So, when a patient with a knee injury unwittingly goes to an employed primary care doctor, he will be referred to a hospital-owned orthopedist, who will order an MRI from a hospital-owned imaging center, then schedule surgery in hospital-owned outpatient center. Facility fees pile on at every step, so a knee surgery that would have cost the patient $5,000 through various independent practices now costs $35,000. When you figure that 

only one third of practicing physicians today are independent

, leaving the majority employed, you see how facility fees cost us all billions of dollars a year. For nothing. 

Even if you never go to the doctor, you pay for this through higher premiums, higher deductibles, higher taxes, and higher costs of goods and services. 

If CMS knows this, why doesn’t the agency follow MedPAC’s recommendations and get rid of facility fees? Because MedPAC advises Congress. CMS can’t change the law. Getting rid of facility fees would literally require an act of Congress.

And, because the American Hospital Association alone 

 lobbying lawmakers on behalf of their bottom lines, and because it’s tough for lawmakers to put patients over their own pockets, lawmakers aren’t motivated to get rid of these facility fees. (See how much your lawmaker gets from healthcare special interests on 

 to move toward a site-neutral payment system in in 2019. If the move goes through, Americans would save $760 million in 2019 alone. 

This would be a huge positive step toward fixing a badly broken system riddled with perverse incentives. 

But brace yourself for a fierce fight from hospitals, who aren’t going to give up this gravy train easily. 

Meanwhile, facility fees are a farce we all pay for. They need to go away, or at least be made very clear in every state. If Medicare doesn’t fix this, and lawmakers won’t, that leaves it up to doctors and patients. Doctors must first say no when hospitals bribe or bully them to sell out. Second, they need to educate consumers about choosing independent doctors. 

If we expose-or even better-eliminate facility fees, hospitals will stop buying doctors. Independent doctors could practice on a level playing field. Patients could get reasonably priced care. Americans would save tens of billions of dollars a year in healthcare costs. And a burger and salad would be $12 again, with better service.

Marni Jameson Carey is the executive director of the Association of Independent Doctors. 

Because CMS can’t and Congress won’t get rid of hospital-based facility fees, doctors and patients must take action.

Facility fees: the farce everyone pays for

In today’s age of advanced connectivity, technology is shaping the delivery of healthcare services. By engaging in telehealth, providers can utilize technologies such as mobile devices, video conferencing, and real-time data sharing to provide healthcare services remotely. 

Despite the vast opportunities for healthcare delivery available through technology, legal policy poses a great barrier to telehealth. In the United States, 49 states have some form of legislation relating to telehealth, the Medicaid programs in 48 states and the District of Columbia provide coverage for some form of telehealth, and the Medicare program has its own set of telehealth coverage rules. These state and Medicare telehealth policies vary widely, although there have been attempts to establish more uniform rules. 

While many different aspects of telehealth are regulated, telehealth policies tend to revolve around where the services take place, who provides the services, and the technology utilized. Typically, a telehealth encounter is considered to occur at the “originating site,” which is where the patient is physically located when receiving telehealth treatment. Medicare typically limits telehealth services to rural or underserved areas, and requires a patient to be at certain specified origination sites, such as a practitioner’s office, a hospital, a rural health clinic or a skilled nursing facility. Like Medicare, a few states also restrict telehealth services to rural and underserved areas. While certain states, such as New York, also restrict telehealth services to certain originating sites, more than half of the states, including New Jersey and California, allow patients to receive telehealth services at any location.

Who provides the services is another issue that must be carefully considered. Medicare and most states, including New Jersey, New York, and California, require a provider to be licensed in the state where the telehealth patient is located, thus requiring the practitioner to follow that state’s professional practice rules and recordkeeping requirements. Over 20 states have adopted the Interstate Licensure Compact that makes it easier for member-state physicians to obtain a license in another member state, and almost 30 states have adopted the Nurses Licensing Compact that allows member-state licensed nurses licensed to practice in another member state. Several states, including Ohio and Texas, even offer special telehealth certifications to out-of-state practitioners.

The technology used to provide the services also matters. Most states and Medicare require the use of live or interactive technology, such as video conferencing, that permits two-way communication, and limits the use of real-time data sharing to certain specified services. A few states, however, are more relaxed regarding the types of technologies that may be used, and an increasing number of states are permitting physicians to remotely monitor patients with chronic conditions through real-time data sharing technology.

Other aspects of telemedicine that are typically regulated under state laws include the types of services that may be provided through telehealth, whether private payers must cover telehealth services, and remote prescribing. For example, New Jersey and California allow physicians to prescribe medications to telehealth patients, except that certain classes of controlled substances may only be prescribed after an initial in-person physician-patient encounter. Contrast that with New York, which does not have any specific telehealth prescription rules.

Telehealth and other technology can be useful tools in providing broader access to healthcare services. Telehealth also creates opportunities for providers to expand their patient base and grow their medical businesses by reaching across borders that have historically been barriers. Despite the benefits of telehealth to consumers, laws designed to protect state healthcare providers and patients often stand in the way. As with any other business, the business of telehealth requires providers to understand the rules where they intend to conduct business. Therefore, before a telehealth provider expands into a new state, it is imperative that the provider seeks the right information, asks the right questions, and engages the right advisers in order to ensure compliance with the law. 

John D. Fanburg is chair of the Health Law Practice and the managing member at Brach Eichler LLC, a law firm based in Roseland, NJ. He can be reached at (973) 403-3107 or 

. Jonathan J. Walzman is an associate in Brach Eichler’s Health Law Practice. He can be reached at (973) 403-3120 or 

Despite the benefits of telehealth to consumers, laws designed to protect state healthcare providers and patients often stand in the way.

Telehealth and the law: how policy shapes the marketplace

There’s a great deal of misunderstanding and even misinformation about direct primary care (DPC). It is often confused with higher cost “concierge” or “boutique” practices, and hence is seen as elitist, unaffordable, and consequently something that has only a future as a niche version of care. 

So let me clarify things by once again stating what DPC is:

Primary care that excludes third-party payments. No money is accepted from insurance companies or other third-party payers. Payment comes either from the patient or by an employer who offers the care to its employees.

Payments are made on a monthly, quarterly, or yearly basis, with that charge usually being under $100 per patient per month (generally in the $50 per month range). Some offices charge a small copay for office visits, but most do not.

In my office, we charge between $35 and $70 per month, depending on age. There are no charges for office visits.

Both of these differences are a huge departure from the status quo of medicine, and both have a huge effect on the quality and cost of the care given. All of those effects would be too much to explain in depth in a single article, so this month I will focus on the implications of direct patient payment, and next month will discuss the monthly payment.

Before moving on, let me address a common misconception: DPC is 

meant to replace insurance, nor does the model in any way encourage patients to drop their insurance. People need a way to pay for the high-cost areas of care, such as surgery and hospitalizations. DPC doesn’t try to address paying those costs, but instead focuses on decreasing their need by focusing on health and prevention. While that may sound like typical preventive medicine jargon, it 

is in the best interest of the DPC practice to keep patients healthy and reduce the need for catastrophic care.

Using automobile insurance as a parallel, health insurance has done the equivalent of paying for oil changes, tires, and other car repairs in addition to covering collision and liability. But the consumer is already motivated to do those things and will pay out of pocket to maintain their car so as to avoid needing to use their auto insurance at all. Additionally, paying for tires, oil changes, etc., allows these things to have artificially set prices which are unreasonably high (since it’s covered by insurance) and so the cost of routine maintenance goes up.

So, what are the implications of rejecting insurance payment?

There is an increased focus on reducing the cost of care.

My patients are paying me, so I am very conscious of trying to give them their money’s worth. If I can give them 

(a concept that has become foreign to healthcare), patients are happy with my care and will continue to stay in my practice. It’s in my business’ best interest to do this, so we do a number of things to save patients’ money:

We offer very low-cost lab testing (using “client billing”), saving people 75 percent or more on labs.

We dispense medications in the office (legal in most states), also saving people 75 percent or more, and offering a huge convenience to the patient.

We find the lowest cost for procedures, X-rays, and specialist services. While many of these are covered by insurance, most people have higher deductibles, so the lower cash prices are very valuable to them (not to mention the value to the uninsured). 

None of these give significant direct income to the practice, but they all make patients much more reluctant to leave. In truth, these things end up being our biggest marketing tool, as patients frequently brag to friends and family about their doctor “who saves me money.”

The result of this work has had three key benefits:

There is an increased focus on customer service.

It is fairly easy to exceed expectations in the area of customer service, as people have an increasingly low expectation for the service they get at the doctor’s office. It’s normal to have to wait an hour or more to be seen, and then get only a few minutes of the doctor’s time (if a doctor is seen at all). This results in, at best, frustration. At worst, people avoid care they should be getting.

In our practice, the patient has a much different experience:

Patients seldom have to wait more than 10 minutes to be seen.

Appointments are, on average, 30 minutes per patient.

Most days begin with multiple slots open for same-day urgent visits.

Care is often done via text message or phone, reducing the need for coming to the office at all.

Much of these changes hinge on the use of monthly payment for care (eliminating the economic motivation for unnecessary care). But a premium is placed on patient experience in the office, and again this is done because it’s in the best interest of the business. 

Patient records are freed from the coding nightmare.

I remember asking myself: “What would medical records look like if their only purpose was patient care?” This was a radical question at the time, as records have long become the domain of a ridiculously complex payment system that requires submission of data and over-documentation to justify billing codes. It was hard to imagine not having to think about evaluation and management codes, Meaningful Use or the Medicare Quality Payment Program, or other “pay-for-performance” factors when charting. But that is what happens when insurance is eliminated. I now document for care, leaving out parts of the note (what I refer to as “computer vomit”) that get in the way of patient care.

I am daily reminded of the depth of this change, as I get records from specialists, previous primary care physicians, and hospitalizations. Most heath records hide important clinical information in an avalanche of insurance documentation compliance.

This may be a subjective one, but it is very important. Patients are increasingly suspicious of the motivations of their physicians, wondering if the care they get is focused on them or if it is done for increasing revenue or following insurance company rules. They question the doctor’s motivation when that doctor is financially rewarded for increasing the cost of care. The dichotomy between the needs of the patient and the business interests of the practice sows mistrust and undermines the doctor-patient relationship. 

My patients don’t have to question this. I am rewarded for minimizing the cost of care, for getting them healthy, and for helping avoid unnecessary cost. So, I am not questioned nearly as much when I don’t prescribe an antibiotic or when I recommend physical therapy instead of pain medication. People know I am on their side because they pay me to do so. 

Overall, this has resulted in a much better relationship with my patients, has increased my satisfaction in practicing medicine, and has improved the quality of care I can give.

Rob Lamberts, MD, is a board-certified internist and pediatrician who runs Dr. Rob Lamberts, LLC, a direct primary care practice in Augusta, Ga. He also recently gave a 

 on the DPC model. Have questions about DPC? Email medec@ubm.com

Running a DPC practice means excluding third-party payments, which in turn means better patient satisfaction for our services.

Direct primary care: three key consequences of dropping payers

I am an outpatient primary care internal medicine and HIV care specialist physician in Seattle, Wash. 

I love being a doctor and having the privilege of working in this profession for the past 28 years. I feel fortunate to work in a healthcare system that listens to my perspective and continues to improve the system.

This is my first of a series of columns on physician well-being, a topic that is dear to my heart and one I speak about at conferences and to various organizations.

One of my goals is to inspire others to get engaged in improving the healthcare bureaucracy, which in turn will benefit physician wellbeing. I am not going to tell you that the way to prevent burnout is to practice yoga, mindfulness, or laughter therapy-even though these are excellent stress reduction and resiliency techniques. Some of the contributors to physician/clinician burnout is having to deal layers of bureaucracy and regulations that interfere with our ability to take good care of our patients. 

Positive change must be made in all these areas. What must we do to bring about positive changes? One answer is simple: 

Physicians know how these factors impact our patients’ lives. When policies may harm patients-such as time-consuming prior authorizations-we need to speak out and get involved; we need to advocate for change.

Early in my career, I did not realize the importance of advocacy and knew nothing about how to engage in system change. I was busy taking care of my patients, continuing my medical knowledge, and teaching learners. As the systems in which we practice medicine have changed, getting engaged in advocacy has reduced my stress and distress. I find it energizing that I am speaking out for the betterment of my profession, my patients, and work environment. It is not effective to sit back and let those who have not walked (or practiced) in our shoes tell us these regulations or policies are necessary. My voice and the voices of my patients and colleagues need to reach the ears of those in a position to make better laws, policies, regulations, and work environment. That is what advocacy can do. I am confident that each of us can make change happen in our own organizations, and at the local, state, and national level. 

Since advocacy takes time, how is this possible? We all have too little time in our workplace these days. 

First, “many hands make light work”-the more of us who are involved, the less time it takes to impact change. Second, if we want better systems, regulations, and policies, we must be at the table and part of the conversation and decision making. Third, it can make a difference to reducing burnout and disengagement.

So here are five tips for effective advocacy

Join a medical professional society advocacy group; get educated on the issues.

Get on a committee at your organization that can work on system improvements.

Write a resolution for your state medical society to advocate on an issue that matters to you.

Invite your elected representatives to visit your workplace.

Use the “take 5” approach. Take 5 minutes to call, email, or write a letter to your elected officials on a specific topic. Remember: Keep it simple and specific.

Access to physicians and healthcare should not be a partisan issue-it is a human issue. Each person is unique and our responsibility is to care for that individual. Our advocacy will continue to change or build systems that allow us to practice with fulfillment, joy and professional satisfaction.

Carrie Horwitch MD, MPH, is an internal medicine physician practicing in Seattle, Wash. Her column represents her own opinions and not her employer. 

Advocacy takes time-a rarity for physicians. But there are five simple ways to advocate for needed healthcare changes.

Reducing physician burnout starts with increasing advocacy

You don’t care if she lives or dies, do you?”

Her grandmother’s words surprised me, not because we were having a disagreement over the next steps of needed care, but because her granddaughter’s death wasn’t even on my radar. 

Her grandaughter was an older teenager, admitted with what I was sure were non-epileptic seizures and functional neurologic symptoms. In doing our due diligence, the team was moving forward with a lumbar puncture, which the family was demanding be done under full sedation. We were at an impasse, one in which I was unwilling to increase the risk of what I deemed a questionably needed procedure while her family was unwilling to subject her to any more pain than what they already perceived her to be in. I regretted even discussing the lumbar puncture. 

My offers of anxiolytics and child life distraction were rejected, and now we stood in the hallway after her grandmother had asked me to leave the room. As a relatively new attending, this level of disagreement was new to me. In that moment, I was beyond frustrated with the patient and her family. 

I have the insight to know I struggle to compassionately communicate and empathize with patients with this disease process, perhaps in large part due to my inability to fully comprehend and effectively treat it. This makes me more diligent and intentional with my interactions with these patients and their families, so to be at such a broken place with this particular family felt even more like a failure. 

I remember very intentionally focusing on my body language, posture, and tone in an attempt to fake what I did not feel. I did care about this patient; I cared that she understood her diagnosis, partnered with me to seek treatment, and participated in discussions about risks and benefits of further testing and interventions. 

But I did not care if she lived or died because that wasn’t part of the playing field we were on together.

And so when her grandmother asked me that question, I stopped explaining, stopped justifying, stopped talking.
I stood (probably with my arms crossed, because I might not be that good at hiding my feelings when I’m caught off guard). 

In the silent stare that followed, I saw her grandmother’s worry. She really did think her granddaughter was dying and that I had no compassion for what they were going through. And that, despite all my frustration, was enough to cause a paradigm shift so that I could really see her granddaughter for the first time. 

She became more than just the story my residents had presented that morning. She became the cheerleader who was always at the top of the pyramid, until she wasn’t good enough one day. The straight-A student who felt enormous pressure to be the first in her family to have enough scholarships to go to college. The typical teenager who was peer-pressured by a boyfriend to do something she didn’t feel ready for. The mature but still-so-young woman who felt responsible for everyone in her family since her own mother chose drugs over her children.

In medical school, we are taught to see diseases; we review signs and symptoms, pair them with a few key social history points, and assimilate it all into a named disease process. We’re taught those diseases have people and lives associated with them, and some of us probably do a pretty good job at integrating it all together. For the rest of us, it takes work and effort to see the patients, lives, and people behind the illnesses we’re treating. Because, let’s face it-it’s easier to focus on the disease and treatment. 

It’s much harder to delve deep into the muddy waters that are our patients’ lives. But only with that vulnerability do we form the bonds that really make us great physicians. 

As for my patient, when I stopped talking, I started creating the opportunity for a different conversation. And that conversation led to an unsedated lumbar puncture with child life distraction. And it ultimately led to my original suspected diagnosis, which the family much more readily accepted. 

Whether that occurred because we had all the necessary testing or because I opened a different conversation, I’ll never know. I still pride myself on being able to develop great working relationships with patients and their families, and I think communication is one of my strengths. 

But now, when I’m faced with a challenging situation, instead of focusing so much on my body language and tone, I focus on really seeing my patient. And seeing my patients has never led me wrong.

Stephanie DeLeon, MD, has practiced pediatric medicine for nine years in Oklahoma City, Okla. She knew that she wanted to be a pediatrician from a young age. “I have always been drawn to science and pathophysiology, and I want to make a difference in the lives of others. I didn’t have any physician role models growing up, so I would say this was a calling I’ve always had,” DeLeon says. 

Her advice to young physicians is simple: “Choose a path that you love, that makes you want to go to work every day. Because the days are long and the work is difficult, but if you truly love what you do, the satisfaction runs deep.” This advice rings true for DeLeon every time she witnesses her young patients transition from feeling ill to running out the door to go home.

When not practicing medicine, DeLeon enjoys crafting, photography, and reading (she highly recommends her latest read, All the Light We Cannot See by Anthony Doerr). She also enjoys spending time on the beach with her family in Destin, Fla.

A runner-up of the 2018 Physician Writing Contest shares why it's important to really see patients.

As physicians, we often see what we want to see

Medical malpractice insurance is one of the greatest expenses physicians face during their careers. A primary care doctor can expect to pay hundreds of thousands of dollars in premiums over the decades.

But knowing what to look for in a policy is a mystery for many physicians, as well as a time-consuming chore that rarely gets the attention it deserves. And buying the wrong type or incorrect amount of insurance-or buying it from the wrong carrier-can be extremely costly. 

Physicians who take the time to understand how to buy malpractice insurance will not only save money, but ensure that they’ve got the right type and amount of liability coverage.

Policies typically cover expenses incurred while defending and settling malpractice suits. These can include attorney fees, medical damages, arbitration and settlement costs, court costs, and punitive and compensatory damages. Liabilities incurred from criminal acts or sexual misconduct usually are not covered. 

There are two basic types of malpractice insurance: claims-made and occurrence. A claims-made policy provides coverage only if the policy is in effect both when the incident took place and when a lawsuit is filed. Occurrence policies cover any claim for an event that took place during the period the policy was in effect, even if the claim is filed after the policy lapses.

Because a claim can be filed years after an event and after a claims-made policy expires, these policies often include a “tail” that extends coverage for a set number of years beyond the expiration date. If it’s not part of the original policy, tail coverage can be bought separately. 

Tail coverage offers protection when a physician is changing jobs or carriers or retiring. Sometimes, the cost of tail coverage will be covered by a previous employer to protect itself or can be negotiated with a new employer. Occurrence policies generally don’t require tail coverage, but are not available in all states.     

If buying a claims-made policy, be sure that the beginning date for coverage is accurate and matches the date on the prior policy to ensure there are no coverage gaps between policies, says Jennifer Richard, ARM, RPLU, vice president of sales and marketing, Professional Risk Associates., a Virginia-based malpractice insurance broker.

“Physicians should ensure all services they are providing have been fully disclosed and reviewed by their agent and underwriter to ensure there are no gaps in coverage in their practice,” she says. 

“Additionally, it’s important they review all other professional liability exposures within cyber, regulatory, directors and officers, and employment practices liability. There are situations where these coverages could overlap, or come into play, based on the risk exposure of the practice.”

The appropriate amount of coverage can vary by state, specialty, and contractual arrangements with hospitals and other healthcare organizations, says Richard. Some states require providers have minimum levels of coverage, but a physician can still need more. 

In general, carriers’ standard coverage limits are $1 million per claim and $3 million aggregate, which is the most the policy will pay in a year for all claims. However, certain states require different limits based on medical malpractice caps on damages. States with more litigious climates might require more.

Richard cites the example of Virginia, which does not have a statutory requirement for medical liability insurance. However, the state has a medical malpractice cap of $2.35 million (which eventually will increase to $3 million). For that reason, hospitals require physicians to carry at least that amount with an aggregate that is three times higher ($2.35 million per claim/$7.05 million aggregate).

Some states have patient compensation or catastrophe loss funds, which provide an additional layer of coverage over the primary policy limits, says Eric Anderson, vice president of marketing and communications for Medical Professional Liability Associates, an industry group. 

Providers pay into these state-run funds through a surcharge on medical malpractice insurance premiums. If a lawsuit is filed and found to be legitimate, malpractice insurance will cover the injured patient’s costs to a limit set by the state. The rest is paid by the fund.

Carriers must be licensed in each state in which they operate and follow that state’s rules and regulations. While many carriers operate in multiple states, not all do. Patrick Lawn, owner of Physicians Insurance Consultants in Pennsylvania, estimates that there is an average of five to six carriers in each state.

Price is an important factor, but it shouldn’t be the only one, says Lawn, adding that shopping on price alone can lead to hiring an unreliable or financially precarious carrier.

“You can’t just jump (carriers) for a penny; you’ve got to be able to rely on the carrier,” Lawn says.

Make sure the policy has a consent to settle clause, which prevents the insurer from settling a claim without permission of the insured doctor, Lawn advises.

The best carriers will act as resources for their clients, offering advice on how to avoid claims and other matters, says Kenneth Hertz, FACMPE, principal consultant at Medical Group Management Association (MGMA). “Partner with them as a resource. They’re the experts. They’re only too happy to help and they can help you stay out of trouble. It’s to their benefit as well,” he says.

He recommends screening potential carriers on a variety of criteria, in addition to price:

Ask medical colleagues and people in the insurance industry about the carrier’s reputation. How responsive is it? What’s its history on settling claims?

Check the carrier’s financial security on A.M. Best, which reports on the financial stability of insurers and rates individual companies. Look for a carrier with an “A, Excellent” rating or better and a “Stable” outlook.

How long has the carrier been in business? Does it specialize in certain fields, such as obstetrics?

Does the carrier have a local office or counsel? Is it willing to visit the practice and become familiar with the caregivers?

Virginia Kladder, MD, considers herself fortunate that she’s never had to shop for malpractice insurance. “If I had to go out on my own there is no way, as a physician, I could figure it out,” she says.

The Richmond, Va., internist works for PartnerMD, a concierge practice. Buying insurance for Kladder and 23 other physicians across eight offices in five states is the responsibility of PartnerMD’s Chief Operating Officer Jack Bretcher, who, in turn, relies on insurance broker Professional Risk Associates.

A broker has the depth of knowledge and the experience to know the coverage a practice needs and the best insurers to provide it, Bretcher says. 

“They help us keep abreast of what’s out there and what our needs are,” he says, adding that he’s bought extra layers of coverage, including cyber insurance, at the recommendation of his broker.

Even small practices are better off using independent brokers rather than spending the time to research policies and carriers, says MGMA’s Hertz, a former practice manager. 

“If you can find a broker who is knowledgeable, it’s a lot easier to hire them to do the legwork, get the quotes, and educate you as a manager,” he says.

An alternative to traditional malpractice insurance is a risk retention group (RRG). These are liability insurance companies that require all company owners to be policyholders and vice versa. 

All owners/policyholders must be in the same type of business, such as physicians. RRGs can offer lower premiums than traditional carriers and, if they are profitable, the owners are paid dividends, but there are some drawbacks as well, says Hertz. They must be incorporated in at least one state but can operate nationwide, largely exempt from the oversight of other state insurance departments.

Because they were created by federal law, they are not subject to the same level of state regulation as private carriers. They may not have to disclose as much financial information and they are not backed by state guaranty funds in case of financial troubles. 

Practices should perform due diligence on RRGs before deciding to join one, Hertz says. Sources of information about them are Demotech and Risk Retention Reporter.  

Shopping for malpractice insurance can be a time-consuming task, so it’s not surprising that physicians tend to stick with a carrier and policy unless something changes, such as a large increase in premiums or a contentious claim. That complacency can be costly, says Lawn.

“I’ve seen doctors who are looking to save expenses, but they don’t bother [comparison] shopping one of their highest overhead expenses. It makes no sense to me,” Lawn says.

But that doesn’t mean shopping every year, says Richard, who adds that practices should review their policies and compare prices every two to three years. 

Ask carriers about ways to earn discounts, says Hertz, who adds that some insurers will offer discounts of up to 10 to 15 percent if doctors attend carrier-led risk management programs on how to avoid malpractice claims through such things as documentation and better patient communication.

Even if not shopping for a new carrier, physicians should periodically check if their coverage needs updating to account for developments since the policy was purchased. Richard says the following can result in a need for policy changes:

Any changes in practice parameters, such as new services or using new equipment  

“If you have any questions at all, you should reach out to your agent, as they can guide you through practice exposure changes,” she says.

Should you use your own attorney to defend you?

 Should a physician who’s being sued for medical malpractice use a personal defense attorney instead of, or in addition to, the one provided by the insurer? In most cases the answer is no, according to the experts.

As part of the policy, the insurer provides a defense team with expertise in medical malpractice, a highly specialized area of the law. Attorneys who don’t specialize in medical malpractice would be at a significant disadvantage in preparing a defense, says Patrick Lawn, owner of Physicians Insurance Consultants in Lafayette Hill, Pa.

“You want someone who’s an expert,” Lawn says. “A lot of the malpractice attorneys are well-versed in the law, so there’s really no need to spend your own money.”

Private attorneys are at another disadvantage because they do not have a prior relationship with the carrier, which can lead to miscommunication, mistrust, and a disorganized defense, says Jennifer Richard, ARM, RPLU, vice president at Professional Risk Associates, a healthcare insurance brokerage in Midlothian, Va.

Involving a private attorney can even lead to penalties. “Some policies will deny coverage if you have retained your own attorney to handle the case without the carrier’s written permission and the case is adjudicated and/or settled without the carrier’s knowledge,” Richard says. She advises physicians to familiarize themselves with the part of their policy that dictates the carrier’s and physician’s duties when a claim is filed.

The exception would be if the carrier informs the client that a claim is not covered. In that case, “it is good to enlist your own attorney, at your own expense, to protect your potential uninsured interests,” she says. In some cases, if the client insists and the insurer thinks it is to their advantage, the carrier will hire on the client’s attorney for the duration of the case, Lawn says.

Physicians worried that the insurer’s attorney will not adequately represent them should be sure to purchase polices with strong consent to settle clauses, which don’t allow insurers to settle a claim without the insured physician’s permission. However, many consent to settle policies also have a “hammer” clause which an insurer can invoke if a doctor refuses to settle. Typically, it states that if a doctor insists on going to court and is found liable then the doctor is responsible for any damages beyond the proposed settlement, as well as any further defense costs.   

Kenneth Hertz, FACMPE, principal consultant with Medical Group Management Association, says he has seen a practice’s private counsel brought in to help settle disputes between members of the practice as to whether to settle a claim. He adds that, even if they are not involved in the malpractice case, a practice’s attorney and the physician’s personal attorney should be kept informed of malpractice proceedings.

Here are six ways to better protect yourself and your practice. 

Malpractice guide 

New patient presents for follow up of radiculopathy, hypothyroidism. She’s had pain in her neck, upper back and shoulders for 10 years. She has long history of depression.

Check out the following scenario and see if you can choose the correct codes.

September 25, 2018 edition

4 reasons two-factor authentication isn’t a silver bullet

Facility fees: the farce everyone pays for

Telehealth and the law: how policy shapes the marketplace

Direct primary care: three key consequences of dropping payers

Reducing physician burnout starts with increasing advocacy

As physicians, we often see what we want to see

Malpractice guide

Coding case study: hypothyroidism and radiculopathy

What association health plans mean for physicians and their patients

How to sell your medical practice

The quest to find affordable insulin for patients

Cryptocurrency: good investment or financial disaster?

Your voice: Stop Medicare 'home invasions'