It was with the best of intentions that Congress passed the Federal Confidentiality of Alcohol and Drug Abuse Patient Records Law over forty years ago. The patient privacy regulations (“Part 2”) spawned by this law reflected a sensitivity to the stigma that can accompany substance abuse, preventing highly vulnerable patients in need from seeking appropriate treatment.[1] In the interim, however, the field of behavioral health care has experienced seismic shifts in coordinated patient care while the regulations concerning these patient records have failed to adapt to changing standards such as electronic health records or health information exchanges. Due to this inflexibility, providers and patients are now facing a host of impediments in the provision of behavioral healthcare.

Although supervising physicians are required to follow regulatory guidelines, it is also important that physician assistants (“PAs”) understand their role in the authority delegated to them and the specifics of regulatory compliance for supervision.

My last post focused on the discovery and investigation of a data security breach to determine if breach notification is needed. Today’s post now turns to the requirements of breach notification triggered by a data security breach.

As discussed in my prior post, recent massive data breaches at major retailers and health insurance providers paint a bleak picture of modern data and emphasize the importance of strong security safeguards and plans for handling suspected security breaches for electronic protected health information (“ePHI”). In the healthcare context, a security breach of a covered entity or a Business Associate’s (BA) data security system triggers the Security Rule and can trigger certain breach notification requirements under Health Insurance Portability and Accountability Act (“HIPAA”) and Health Information Technology for Economic and Clinical Health Act (“HITECH”). This post will discuss the investigation needed to determine whether a breach has taken place, while the next post will discuss the necessary notifications in the event of a breach.

Tuesday’s post discussed the basics of Transitional Care Management (“TCM”), but today’s post will focus on five things that providers should know about TCM.

Similar to rules providing billing opportunities for chronic care management (as discussed in this McBrayer blog post), relatively new Medicare funds for Transitional Care Management (“TCM”) provide a new path for providers to supplement their Medicare practice with payment for services they may already provide. Beginning in 2013, Medicare, for the first time, allowed providers to bill for thirty days of TCM, incentivizing post-discharge care with an aim to prevent hospital readmission. The Center for Medicare and Medicaid Services (“CMS”) requires five specific elements of TCM to be met before provider reimbursement. Those elements merit review and brief discussion today, while Thursday’s post will discuss five important points of consideration with regard to TCM.

The rapidly-evolving field of health care has been moving lately towards a single-minded goal – coordination of patient care in the name of efficiency and efficacy. Hospital systems are more and more often merging with other medical practices to better achieve the standards and goals of the Patient Protection and Affordable Care Act (“ACA”). The Ninth Circuit Court of Appeals, however, recently provided a stark reminder that the ACA isn’t the only law hospitals need to consider compliance with in these mergers.

Rural communities in Kentucky are still largely underserved by health care providers. With the expanded range of Medicaid and Medicare services now available as a result of the Patient Protection and Affordable Care Act (“ACA”), rural health care infrastructure needs a shot in the arm to meet the demand. Fortunately, several programs exist to incentivize the provision of rural health care, and Kentucky providers in underserved areas should begin taking advantage of them.

As more and more providers adopt electronic health records (“EHRs”) systems (and with new regulations concerning their required use for purposes of Medicare billing for chronic care management, their popularity can only continue to grow), a myriad of compliance issues continue to surround them. To that end, the federal government has stepped up auditing programs to ensure compliance with HIPAA/HITECH as well as making sure taxpayer money has been invested wisely through the Meaningful Use program. The bent of these audit programs is clearly along the lines that applicable covered entities and business associates should be preparing with a “when” mindset, rather than “if,” as these audits are going to happen.

In the last days of 2014, the IRS released regulations that finalized the compliance requirements for charitable hospitals. These new 2014 IRS regulations relate to the Community Health Needs Assessment (CHNA or needs assessment) requirements for nonprofit hospitals or nonprofit organizations operating a hospital contained in Section 501(r) of the tax code, which was created by the Patient Portability and Affordable Care Act (“ACA”). Section 501(r) requires that thorough CHNAs be conducted every three years in order to maintain their 501(c)(3) nonprofit status. These needs assessments must define the community served by the hospital, the needs of the community, and a strategy addressing the identified community needs. Since each facility that fails to meet CHNA requirements loses its nonprofit status and has to pay a $50,000 excise tax, nonprofit hospitals and networks need to pay special attention to the changes and incorporate these new requirements into their needs assessments.