HIPAA Compliance or Security – Which is your lodestar?

By: Susan (Zeisler) Pretnar President at KeySys Health LLC

When the focus of HIPAA Risk Management efforts by healthcare entities is simply to comply with documentation requirements to assuage a judgment of ‘willful neglect’ or ‘non-compliance’ in an audit, the spirit of HIPAA is completely lost. In the absence of HIPAA police or the experience of a breach, many fail to see the distinction between compliance and security, or the value of either one.


In truth, almost no routine HIPAA compliance audits have been completed. A few audits were instigated because of major breaches and a small number of covered entities were audited as a pilot several years ago. Those audits only exposed the lack of commitment to both HIPAA compliance and security. Sadly, the only bellwether we have is the thousands of Meaningful Use desk audits that reinforce the notion that you should be guided by compliance, not security, when it comes to managing protected health information. MU audits demand only the evidence of a risk assessment, and sometimes a plan, based on the findings. Never mind actually implementing anything in the plan.


Security, specifically cyber security, is all the rage, yet there is minimal commitment to investing resources to secure electronic protected health information, including using encryption or something so simple as training. ePHI that is not securely created, stored and transmitted in the vast healthcare ecosystem exposes practices to the risk of breach for lax management of digital information. Hackers are having as much success with phishing emails and phone calls to employees who have not been trained to recognize bogus requests for information and dangerous links.

 A thorough risk assessment should indicate how vulnerable the practice will be if HIPAA required or addressable safeguards are not in place. Every practice is different. Recommended controls are irrelevant for some (we don’t’ have a wireless network) and a game changer for others (we allow everyone to use their personal mobile devices). No practice is without risk and no technology is stagnant. Unless you conduct a baseline risk analysis, and reassess routinely, it will be difficult to determine which risks you can accept and which risks should be mitigated quickly, ie. those that will improve your security posture.


Glaring lapses in clinical risk management can result in physical harm to the patient. Foregoing or ignoring administrative, technical and physical controls that are basic safeguards for patient data can expose the patient to financial harm or mental distress. Patients, not HIPAA, should be motivating practices to concentrate on security not just compliance.


There are myriad solutions to technical weaknesses in IT infrastructure that can thwart the casual hacker and make it difficult for the professionals. Neglecting staff training that reinforces security policies and procedures and arms employees with knowledge to stop social engineering phishing schemes only compounds vulnerability from technical weaknesses. That’s not rocket science: it’s basic business sense.

Weekend Warriors – Common Knee Injuries

By: Samuel R. Goldstein, M.D. with Andrews Sports Medicine and Orthopaedic Center

With spring upon on us, many of us are becoming more active, spending considerable time outside enjoying the warmer weather.

Unfortunately, when it comes to physical activity, many of us “Weekend Warriors” jump right into “too much, too fast, too far” mode.

We feel committed to a sport or activity, but, based on life, work and family demands, find ourselves with limited time to participate. We try to squeeze in rigorous physical activity on our off days – usually the weekend – and all too often this results in aches, pains and even more serious injuries.

As an orthopaedic surgeon, I see a lot of serious Weekend Warrior injuries to the knee. The knee is at high risk for injury because of its complexity and the enormous amount of force it absorbs and stress it takes. Knee injuries often result from a blow to the knee, twisting or turning or an improper landing.

COMMON KNEE INJURIES

The most common knee injuries I treat are intra-articular (inside the knee), including meniscal tears and ligament tears.

Meniscal Tears

The meniscus is a “C” shaped cartilage cushion, which is like a wedge within the knee. There are two in each knee which cushion, support, and aid movement. Injury to the meniscus is very common and is one of the most frequently occurring cartilage injuries of the knee. Menicus tears can occur from wear and tear over time or from a sudden twist, turn, or even slowing down when running. As we age, our meniscus gets worn. This can make it tear more easily. Like a lot of knee injuries, a meniscus tear can be painful and debilitating.

Common Symptoms

• Pain in knee

• Swelling and stiffness

• Fluid build-up inside on top of knee

• Sensation that knee is getting stuck or locking


Ligament Tears

The majority of stabilization in the knee comes from the ligaments. The cruciate ligaments are made up of the anterior cruciate ligament (ACL) and posterior cruciate ligament (PCL), which cross to form an “x” shape inside the knee. The collateral ligaments provide additional stability on the inside of the knee through the medial collateral ligament (MCL) and outside the knee through the lateral collateral ligament (LCL).

Ligament injuries in the knee - such as an anterior cruciate ligament (ACL) -- are dreaded by pro and amateur athletes alike. They can be painful and debilitating. They can even permanently change our lifestyles. But there's good news. While an ACL injury or other ligament damage once ended the career of many an athlete, treatment has become much more successful for all of us.

Common Symptoms

• Pain, often sudden and severe

• A loud pop or snap during the injury

• Swelling

• A feeling of looseness in the joint

• Inability to put weight on the point without pain


TREATMENT

The form of treatment used for both meniscal & ligament tears will be dependent on the severity of the injury.

Conservative Treatment

1. Physical Therapy – We work closely with physical therapists to create an individualized program to maximize healing and restore function, strength and mobility.

2. Supports - A variety of supports such as a brace, crutches or other advanced support can help restrict movement and allow the cartilage to begin the healing process.


Surgery

Meniscus - When conservative treatment fails, and the knee continues to be painful and locks in place, arthroscopic surgery may be recommended to repair, trim or remove the damaged meniscal cartilage.

Ligament - Depending on the severity and type of ligament injury, surgery may be recommended.

• For ACL injuries, arthroscopic or open surgery is done using a graft to replace the damaged ligament.

• For certain PCL cases where the ligament is no longer attached properly to the shinbone, surgery is considered.

• For MCL injuries when the ligament is completely torn, surgery can help to repair it.


STAYING HEALTHY

The risk of injury does not mean we shouldn’t be active, but avoiding these injuries requires some common-sense prevention.

• Exercise

1. If we don’t exercise on a regular basis and are not conditioned for a particular sport or activity, we put yourselves at greater risk for injury.

2. Regular exercise helps maintain our muscle strength to help prevent arthritis and keep our joints flexible and better protect them from damage.

• Warm-up and stretch.

• Gradually increase our activity level – and intensity level – on a week-to-week basis.

• Use proper technique.

• Use proper gear and safety equipment.

• Listen to our bodies. The “no pain, no gain” theory is not a good mantra.


Samuel R. Goldstein, M.D. is an orthopaedic surgeon and sports medicine specialist at Andrews Sports Medicine and Orthopaedic Center. Dr. Goldstein specializes in sports medicine, arthroscopy of the knee and shoulder, knee joint replacement and general orthopedic surgery. He has been practicing medicine in Birmingham since 1989 and provides sports medicine coverage to various high school athletic programs in the Greater Birmingham area.

For more information, contact Andrews Sports Medicine and Orthopaedic Center at 205.939.3699 or visit www.AndrewsSportsMedicine.com 

HIPAA…. Oh, we’re covered!

By: Chad Sizemore, Managing Partner, ICS Medtech

“Our attorneys have validated our policies, our accounting firm produced our procedures, and our IT vendor installed our network and systems integration to be HIPAA compliant. So we are covered and have nothing to worry about…….”

This is a small subset of the discussions we have with practice managers, security administrators, IT staff, CFO’s, and even doctors with various size practices in regard to HIPAA compliance.

Are you sure? And can you prove it?


By definition, HIPAA is a U.S. law designed to provide privacy standards to protect patients’ medical records and other health information provided to health plans, doctors, hospitals, and other health care providers. It was developed by the Department of Health and Human services as a standard to provide patients with access to their medical records and more control over how their personal health information is used and disclosed.

We have all read the rule/law, but what does it really mean?


HIPAA is the basis for privacy standards, but it is cumbersome and hard to understand. And it is very important to remember, it is the baseline for protecting patient data, and we should all treat it as an evolving means to protect all data as if it were our own. We continue to see news reports of large organizations being exposed to data breaches. If large organizations are affected by a breach, it could happen to organizations of all sizes. These large organizations spend millions each year to secure data in their infrastructure, yet we are still seeing examples of exposure. To be HIPAA compliant, you must have third party verification of your policies and procedures, the technology they were designed to administer, and you must be able to show that all internal standards are met. All policies must be followed, and demonstrated to have sufficient documentation to meet the guidelines set forth by the HIPAA/HITECH acts.

Recently the U.S. Department of Health and Human Services’ (“HHS”), Office for Civil Rights (“OCR”), and the Federal Trade Commission (“FTC”) levied fines over $500,000 for HIPAA violations and misrepresentation of encryption levels of services offered by a software provider. OCR has the authority to levy fines from $50,000 to 1.5 million depending on the severity of the case, as well as seek criminal charges against the violators. Vendors and system integrators continue to sell their products as secure. We are living in a time where cyber-attacks are increasing and many organizations believe they have been sold a compliant solution.

There is an increasing gap between IT professionals and executives when it comes to HIPAA compliance. A majority of executives believe they are HIPAA compliant, while few understand what that means or what it provides them. If your organization received government funding for Meaningful Use, you stand a 1 in 20 risk of being audited. To be compliant you must address process and procedure requirements, technology standards, and show that they are consistently monitored and improved if needed. Beyond the potential for fines and legal fees, we must make sure we as a society are diligent in our ability to safeguard all data and maintain compliance in policy, procedure, and technology.


So this means we must spend a ton of money to maintain compliance right?


Compliance should be standardized process and should be priced at a standard cost based on the size of the practice. The total cost should be stated up front for the annual assessment and for ongoing documentation management. The cost should reflect the full effort to address all of the OCR published audit protocol points and to manage the process for continuous audit readiness. No one wants to be audited, but if you apply the principals and proof that a legitimate compliance vendor can provide, the audit process becomes much easier. That vendor should supply the customer with a standardized, automated, and complete process to guide the organization through the compliance process that requires minimal input from the organizations staff. The service should include all the required analysis, evidence, documents, training certifications, and network verifications in a HIPAA compliant offsite storage facility. All organizations should have the option to purchase a monitoring service that alerts them to potential attack at a reasonable cost.

Our process makes it easy on the practice manager, helps you gain or maintain compliance, provides a needed service at an affordable upfront cost, documents checks and balances to keep you audit ready all the time, and allows you to get something for your money. With this process, you can truly answer “Oh, we’re covered” when asked about HIPAA.



About the Author: Chad Sizemore is the Managing Partner of ICS Medtech, LLC. A subsidiary of ICS Inc. a technology systems integrator since 2006 in Birmingham, Alabama. ICS Medtech combines the technology expertise as well as federal and state regulatory audit experience to provide healthcare clients reliable professional services. Contact ICS Medtech at 205-423-6958 or email Chad at chadsizemore@icsmedtech.com for additional information.

Challenges in Patient Collections

By: Tammie Lunceford, CPC with Warren Averett

The implementation of the Affordable Care Act has enabled many Americans to acquire health coverage for the first time in their lives. Even those who have enjoyed long term coverage have seen changes in deductibles and co-pays over the last few years. It has always been difficult for the patient to understand their coverage but now it is even more difficult due to the vast number of plans.

Any medical entity providing service to commercially covered patients or physicians who serve the uninsured are challenged when trying to effectively collect from the patient. When working with practice managers, I often find outdated practice management systems still in place with no electronic eligibility or limited eligibility. The front office is trying to answer the phone, greet the patient, and perform various other tasks unrelated to collecting balances and co-pays. The front office staff are the most important people in the office related to efficient account set up and collection of the co-pay and balance. The ability to interpret the eligibility file and confidently educate the patient on their responsibility is very important. Physicians should realize the importance of providing the best practice management systems with best practice workflows in collection activity.

Many patients want to pay but they need options to make reasonable payments. Credit card on file or CCOF is a great option to collect efficiently, reduce statements and staff time by reducing collection calls and the generation of collection letters. Patients like credit card on file because it is paperless and it is no different than paying a bill using online banking. The practice must assure the patient the data is stored securely and their policies are effective in processing the recurring payment.

Tips to Improve Patient Collections:

▪ Prepare efficient registration process and financial policies

▪ Update and verify patient information at every encounter

▪ Perform batch and real-time electronic eligibility

▪ Track staff performance for 95% co-pay collection rate, % of balances collected

▪ Obtain benefits prior to procedure/surgery scheduling…set arrangement using CCOF

▪ Send statements twice monthly

▪ Use two collection agencies, a soft collection agency beginning at 65 days

▪ Use a financing option to transfer patient debt prior to surgery or procedures

▪ Be consistent and educate the patient regarding your policies

Medical entities can improve patient collections by assuring every step of the process is working well. It is important for the billing staff to communicate reasons for a shift to patient responsibility by reviewing the remittances and communicating with front office staff. The use of alerts or flags in the account can prepare a workflow aimed at improving patient collections.

So lets talk about Reflux Management

By: John G. Touliatos, MD with Advanced Surgeons, P.C.

There is a medical device for patients 21 years and older who have been diagnosed with GERD called LINX. When patients continue to have heartburn or regurgitation despite taking medication to treat GERD, LINX can be used.

What exactly is GERD? It occurs when the sphincter (valve) between the stomach and the esophagus is weak or opens improperly and allows stomach acid (juices) to reflux into the esophagus and may cause injury to the esophagus and result in heartburn or regurgitation

The LINX system is designed to help the sphincter stay closed to stop the reflux. It uses a small, flexible band of beads. Each bead has a magnet inside. When placed around the outside of the esophagus, the magnet attraction between the beads helps the sphincter stay closed to prevent reflux. Swallowing food will overcome the magnetic attraction and allow the beds to separate, allowing food and liquid to pass normally into the stomach.

Why doctors choose to use this method? This is another option to surgery for GERD, for those whom the Nissen fundoplication seems too invasive. The LINX system does not involve significant alterations to the anatomy that may limit future treatment options. With the Nissen fundoplication, the top part of the stomach is wrapped around the lower esophagus to improve the reflux barrier.

If needed, the LINX system can be removed laparoscopically similar to the way the implant procedure is performed (<1%). Removal of the device generally leaves the esophagus the same as before the implant. After surgery, patients usually go home the same day or the next day. Patients are able to eat a normal soft diet after surgery, and it is well-tolerated by patients. If you have the Nissen fundoplication, patients are restricted to a liquid diet for 3- 4 days that is slowly advanced over weeks to normal food.

Contraindications for the provider are patients who are allergic to titanium, stainless steel, nickel, or ferrous materials. Another consideration is people who need or expect to need an MRI.  The newer devices are safe, but it is still may affect the durability or effectiveness of the device.  There is no risk of injury to the patient if the MRI is done.   It is recommended that anyone implanted with the LINX system register the device with the MedicAlert Foundation.

Join Children’s in Celebrating Heart Month

By: Dr. Robert J. Dabal, chief of pediatric cardiac surgery and an associate professor of surgery in the Division of Cardiothoracic Surgery at the University of Alabama at Birmingham (UAB).

Every year surgeons at the Pediatric and Congenital Heart Center of Alabama at Children’s of Alabama perform hundreds of cardiopulmonary surgeries. If a child in Alabama needs one of these life-saving procedures, they will likely get it at Children’s.

Our expertise in treating congenital heart disease (CHD) in children can be traced back to Dr. John W. Kirklin, a legendary heart surgery pioneer, clinician and scientist who came to UAB from the Mayo Clinic in 1966 and died in 2004. In recent years, we have moved into state-of-the-art facilities at Children’s where we perform most of our procedures.

These days, we take a team approach to treating patients. In the past, doctors would work more or less independently, for instance, with patients moving from cardiologists, to surgeons, to ICU. Now, everybody is involved in every aspect of care. When patients enter the hospital, a team of doctors and nurses provide a continuum of care from admission to discharge and beyond. For example, a child coming in for open heart surgery will have a minimum of three doctors taking care of him or her at all times.

We spend much time and effort sharing data with a nationwide collaborative, run by the Society of Thoracic Surgeons, of congenital heart surgery programs. Every time we perform an operation, we enter all the information in a database that allows us to compare time in hospital, time in ICU, time on ventilators and other variables. We are proud of our outcomes. Last year, our surgical mortality rate was 2.6 percent, which is lower than the national average of 3.2 percent. That’s great for us and great for the children here.

A third of our patients are under 30 days old, and those tend to need the most complicated operations. Therefore, they spend the most time in the hospital. Another third of our children are between about 30 days old and 2 years old. And the final third of patients are toddlers through adults. Our program also has a component for adults who have congenital heart disease, and most of those operations are performed at UAB by Dr. James K. Kirklin. Because of the outstanding success of the current surgeries, we expect that portion of our program to expand as generations of pediatric patients grow older and require follow up care.

A significant percentage of surgical patients need to be followed for a lifetime. Recently, Dr. Kirklin saw a 39-year-old patient who had surgery as a baby. The patient had been followed by a pediatric cardiologist until she was 13 and then released from care. It turns out that her pulmonary valve had been removed, and needed to be replaced. It shows that many if not most patients need lifelong follow up. The more complicated an operation is early in life, the more likely that follow up is needed late in life.

We also work cooperatively with interventional cardiology on hybrid procedures. Our new facility at Children’s includes a large cardiac catheterization lab that can double as an operating room, a hybrid room.. It has equipment for both specialties. While the cost of building and equipping this one room in the hospital was extremely high, it allows complicated operations to be performed in a more stream-lined fashion. Recently, I opened a child’s chest, performed a surgical repair and then put a catheter into an artery so a cardiologist could put a stent in a blood vessel. Then I removed the IV. The hybrid room made it easier on me, easier on the cardiologist and easier on the staff. But most importantly, the hybrid room made the operation easier on the patient.

As the field has evolved, results have improved, and now, there’s more emphasis on outcomes other than mortality. In the next decade we will be looking more closely to what happens to patients after the immediate post-op period. We want to see problems that arise in 6 months, 12 months or 5 years. That will help ensure that we are doing everything possible to protect the brain and other critical organs. Our goal is to provide patients a lifetime of good health, with hopes to restore a normal life expectancy.

Dr. Robert J. Dabal is the chief of pediatric cardiac surgery and an associate professor of surgery in the Division of Cardiothoracic Surgery at the University of Alabama at Birmingham (UAB). His areas of expertise include neonatal and pediatric cardiac surgery. Dr. Dabal graduated from Duke University School of Medicine and completed his cardiac training at the University of Washington Medical Center. He completed fellowships in congenital heart surgery at Denver Children’s Hospital and Children’s Hospital Boston.

A Fantastic Endoscopic Voyage

By: Christopher P. Shaver, MD, Birmingham Gastroenterology


The Fantastic Voyage was a 1966 science fiction film about a team of scientists miniaturized and injected into the body of a world-renowned scientist dying of a brain aneurysm. Their mission was to pilot their mini-submarine to the depths of his brain to perform life-saving neurosurgery.

At Birmingham Gastroenterology Associates, we have the endoscopic technology to perform our own fantastic voyages. This voyage involves the endoscopic surveillance of the entire length of the small intestine. The human small intestine spans an average length of twenty-two feet. Due to its lengthy anatomy and relative inaccessibility, the direct inspection of this very important segment of the digestive tract was difficult. Consequently, a good look at the interior of the small intestinal tract was reserved for risky, low yield, and last resort operations.

The advent of the wireless video capsule changed all of that. The pill camera is an ingestible, wireless video camera that puts your Go Pro to shame. During its eight-hour battery life, its takes no less than 50,000 images. The images are uploaded into a sophisticated workstation producing a high definition video of the entire small intestine. The procedure is painless and the pill camera is disposable. A physician makes expert recommendations regarding future diagnostics and therapy based on the findings.

We utilize video capsule endoscopy primarily for the evaluation of two common conditions: undetectable gastrointestinal bleeding and unexplained, chronic diarrhea.

GI bleeding, often associated with chronic anemia, is frequently encountered in our patients. Though its source is usually easily identified, five percent of gastrointestinal bleeding events occur beyond the reach of conventional endoscopy. In this era of powerful blood thinning medications used to treat various cardiovascular and hematologic diseases, both overt and obscure GI bleeding events are quite common. Fortunately, we have a powerful diagnostic tool to shine a light on the depths of the gut previously beyond our reach.

Diarrhea is common symptom that significantly restricts the quality of life of many of our patients. Though routinely diagnosed and treated in a routine and uncomplicated fashion, its cause is occasionally elusive and the symptoms sometimes refractory. In situations where small intestinal inflammation is suspected, video capsule imaging is very helpful in inspecting the small intestinal lining for signs of damage.

Indications for wireless capsule endoscopy are expanding into the realms of celiac disease, hereditary polyposis syndromes, and malabsorption. Though not widely available, other novel uses for wireless capsule technology include Barrett esophagus screening and non-invasive colonic inspection. The wireless Smartpill is also available which assesses intestinal motility based on pressure, ph and temperature readings.

Well, the Fantastic Voyage ended well. Despite many close calls and the attempted sabotage of the mission, the brave medical pioneers successfully completed their mission by saving the scientist and returning home safely. The good news for our patients is that fantastic voyages in gastroenterology are no longer science fiction.