According to a September 11, 2023 news release from the U.S. Department of Health and Human Services (HHS), “L.A. Care, the largest publicly operated health plan in the country paid $1,300,000 to settle” potential HIPAA Security Rule violations. The settlement comes at the end of two Office for Civil Rights (OCR) investigations into L.A. Care Health Plan (“LACHP”). One of the investigations was due to a large data breach resulting from a mailing error which caused member identification cards to be mailed to the wrong members. The other investigation stemmed from a processing error which allowed L.A. Care covered members to log into the LACHP payment portal where they could potentially view the name, address, and member identification number of another LACHP member.
In addition to the $1.3 million dollar settlement, LACHP has agreed to a comprehensive corrective action plan and three years of monitoring from OCR. They must develop and distribute HIPAA compliance policies and procedures for performing a risk analysis and risk management plan. Additionally, they must implement and adhere to their new policies and procedures.
As quoted in the HHS release, OCR Director Melanie Fontes Rainer aptly stated, “Breaches of protected health information by a HIPAA-regulated entity often reveal systemic, noncompliance with the HIPAA Rules.” She goes on to advise, “HIPAA-regulated entities need to be proactive in ensuring their compliance with the HIPAA Rules, and not wait for OCR to reveal long-standing HIPAA deficiencies.”
Follow the advice of our PAAS analyst team (and the advice of the OCR Director!), and proactively review your HIPAA program to ensure you are compliant with all the Rules before you potentially find yourself at the very expensive end of an OCR investigation.
Those of you with the PAAS National® Fraud, Waste and Abuse (FWA) & HIPAA Compliance Membership have a wealth of knowledge available at your fingertips in your Policy & Procedure (P&P) Manual. This manual is automatically generated after the Risk Analysis and P&P Questionnaire have been completed. Account administrators or officers can download a full copy of the P&P Manual for further review. Highly trained PAAS analysts are also here to answer HIPAA questions, discuss HIPAA concerns, guide you through the intricacies of breach notifications (if a breach occurs), and so much more.
If your pharmacy does not currently have the PAAS FWA & HIPAA Compliance Membership, we suggest scheduling a services overview to obtain additional information about this one-of-a-kind, customizable FWA & HIPAA program! PAAS National® – helping community pharmacies gain confidence and peace of mind. Be Proactive. Be Prepared. Be Protected.®
Auditors Become Increasingly Stringent on Quantity and Unit of Measure Appeals
You may recall the article Quantity Changes Cause Audit Appeal Trouble from the May 2023 Newsline. The article discusses how PAAS National® saw an increase in the number of discrepancies for “unauthorized” refills. Consider the excerpt,
“Unauthorized refills” are instances where a pharmacy dispenses a quantity of medication that exceeds the total written quantity of the prescription, whether that be in a single fill or over the lifetime of the prescription.
PAAS Tips:
Avoiding MedImpact Recoupments for Bypassing Plan Limits
Pharmacies receive many rejections while billing claims throughout the day. Paying attention to these rejection messages is key to avoiding audit recoupments, which may occur years later. One such rejection occurs when a pharmacy bills a claim that exceeds a plan limit. This can be due to:
Actions to consider including …
MedImpact has a history of recouping claims which have been rebilled incorrectly to bypass plan limits. PAAS National® has seen numerous audits on blood glucose test strips where a pharmacy attempted to bill the correct days’ supply, received a rejection stating they will only cover a certain number of test strips per month, then rebilled for that quantity and with a different days’ supply even though it is not mathematically correct. This makes it very easy for MedImpact to come back and audit the claim because they already saw the pharmacy put in one days’ supply, then rebilled for a new days’ supply after receiving a rejection (especially when it occurs within seconds of the first rejection). Audit results will often state, “Incorrect billing of the day supply in order to bypass system edits (or the PA process) is not acceptable. MedImpact will reverse this claim.”
These recoupments can be difficult to appeal. It is better to ensure you are entering the correct days’ supply based on the mathematical calculation of the directions and following plan rejections appropriately at the start of the claim than to try to appeal later.
PAAS Tips:
Documentation Deep Dive: Meeting Auditors’ Standards in DUR and SCC
PAAS National® frequently sees claims audited that contain a clinical drug utilization review (DUR) or submission clarification code (SCC), particularly from Express Scripts and Prime Therapeutics. Auditors are looking for proper documentation when these codes are used, but pharmacies are often unaware of what this should include.
When a claim is being processed, a DUR conflict message may appear as a warning to prevent potential patient harm. The pharmacist must be made aware of it so that they can use their professional judgement before dispensing the medication. These should not be automatically overridden without pharmacist input.
Once the pharmacist has reviewed the DUR conflict, they will determine the appropriate “professional service” and “result of service” codes. A full clinical note documenting the situation must then be recorded to prevent audit recoupment. Simply documenting the override codes used does not meet this criterion or provide the auditor with the explanation for why the override used was appropriate.
Inappropriate Documentation: HD/M0/1B
Appropriate Documentation: 01-01-2020/Verified with Dr. Jones they are aware this is a high dose/Told to fill prescription as is/Pharmacist’s initials
Claims billed with an SCC code require similar documentation. These are typically overrides done for situations like a vacation supply, lost or stolen prescription, or therapy change. The code used, the date, and the reason should be documented in these cases.
PAAS Tips:
All Pharmacies Face Medicare Part A vs Part D Billing Risks, Especially Combo Shops
Pharmacies that service long-term care (LTC) and assisted living facilities (ALF) as well as retail patients, known as “Combo Shops”, may not be aware of the potential recoupment risks from Medicare. PAAS National® wants to inform our members of these risks and how to best avoid them.
Many times, patients residing in long-term care or assisted living facilities have a temporary stay under Medicare Part A. A change in Medicare coverage status is typically linked to the patient’s admission and discharge dates from a hospital or skilled nursing facility (SNF) stay.
When a patient is covered under Part A, the facility providing the stay is paid for the medications, supplies, and services during the coverage period. This means Medicare Part D will not be responsible for claims billed during that time (Medicare won’t pay under Part A and Part D at the same time). CMS provides Part D sponsors a Long-Term Institutionalized (LTI) report on a quarterly basis. This information is utilized by the plan to identify any misbilled claims due to overlapping Part A coverage. Unfortunately, PBMs do not have the information at the point-of-sale to stop these claims from being billed inappropriately.
It is vital that pharmacies stay in constant contact with facilities prior to billing and delivering prescriptions to ensure there has not been any changes in patients’ Medicare coverage due to an admission. Medications that are delivered to facilities when a patient is “in-patient” (under a Part A stay) should be returned to the pharmacy until the Part A stay has ended. Claims can be billed once again to Part D the day after the last covered day of the Part A stay. Any sooner and the claim would face full recoupment – even if there’s only one day of overlap!
LTC and ALF claims are not the only ones at risk. Prescriptions billed for patients that are on a Part A stay (for use at home) would also fall under this risk. Families and facilities frequently request pharmacies to fill prescriptions in anticipation of discharge. This in theory is a great idea; however, if Part A has already paid for that patient on that day(s), Part D will not pay for duplicate coverage. While difficult to catch, imagine the scenario of a husband being in the hospital (under Part A) and the wife presenting to the pharmacy for prescriptions. Even if the prescriptions are routine refills, they are subject to full recoupment! If the spouse (or an authorized representative) mentions that the patient is in the hospital right now, and they’re on Medicare, you will want to ask more questions before dispensing.
PAAS Tips:
Best Practices for Financial Hardship Waivers
PAAS National® analysts have noticed an increase in PBM audits focusing on copay collection. These audits requested a copy of the pharmacies’ policies and procedures addressing copay collection and financial hardship.
In general, PBMs require that pharmacies collect copays at the point of sale and retain a “financial paper trail” to prove such collection took place. Pharmacies will be asked to provide check copies (front and back), credit card receipts with authorization numbers and bank deposit slips as evidence of receiving cash from patients. Pharmacies may also be required to provide Accounts Receivable balances and Coordination of Benefits billing information, where applicable.
If patients are unable to pay their copay and the pharmacy waives or discounts the copay due to financial hardship, then you must have a robust written policy explaining the details on how such a policy is operated.
In general, financial hardship policies should include the following:
Be aware that insufficient copay collection (or evidence thereof) is one of the leading causes of network pharmacy termination.
PAAS Tips:
PBM Audits: Letters to Patients for Prescription Verification
Pharmacies often see PBM audit letters requesting documentation to validate paid claims, but not very many see letters sent to their patients.
PBMs have increasingly conducted patient (and prescriber) verifications, in the form of letters sent, to validate claims billed by your pharmacy. These letters are often initiated as part of a PBM investigation where they are searching for fraud, waste, or abuse– if there are inconsistencies between the information provided by the pharmacy, patient, and prescriber this can be a sticky situation.
Letters to patients typically consistent of basic questions like:
Letters often include an itemized list of claims billed by the pharmacy where the questions may include:
Patients may fail to respond to these letters for a variety of reasons, including: not recognizing the PBM name (and afraid of a scam), not remembering the details (and are afraid to answer incorrectly) or not being able to respond (e.g., literacy issues or changes in address).
PAAS National® has received audits where PBMs will issue audit results to the pharmacy that include recoupments for patient denials of receipt or paying copay where the pharmacy has never been asked to provide signature logs or proof of copay collection – these unfair conclusions are drawn before the pharmacy has had a chance to provide objective evidence to defend themselves.
PAAS Tips:
Avoid the Creon® Chargeback Catastrophe by Following THIS Billing Rule
Creon® is indicated for the treatment of exocrine pancreatic insufficiency due to cystic fibrosis, chronic pancreatitis, pancreatectomy, or other conditions. Claims for these pancreatic enzymes find themselves on audits year after year, and the audit risk has just increased as …
With this change to the package labeling, pharmacies MUST be sure to bill and dispense all strengths of Creon® in quantities that correspond with a full bottle, or multiples of a full bottle. Claims billed for quantities not evenly divisible by the quantity in a full bottle are easy for a PBM’s algorithm to flag for audit. If audited, these claims will likely face a partial or full recoupment with very little chance of a successful appeal. One example of language explaining this discrepancy can be found in the Fourth Edition (Version 4.1) of the 2023 OptumRx® Provider Manual, which reads “OptumRx reserves the right to recover payment for claims dispensed outside the manufacturer’s FDA-approved storage and dispensing recommendations. Claims for products where the manufacturer’s original package is designed and intended to be dispensed to patients without repackaging due to stability and patient safety concerns, may be subject to review and recovery. Pharmacies are advised to follow FDA requirements.”
Claims billed for LTC patients or patients enrolled in a medication synchronization or medication packaging program are NOT EXEMPT from the FDA rules to store and dispense medications in their original containers. In other words, these medications should NOT be put in bubble packs, blister cards, BINGO cards, strip packaging, medication boxes, or other compliance packaging and must only be dispensed by the pharmacy in their original containers.
PAAS Tips:
The Power of Clearly Communicated Sanction Policies in HIPAA Compliance
Sanctions were the focus of the October 2023 Office for Civil Rights Cybersecurity Newsletter. The article states, “An organization’s sanction policies can be an important tool for supporting accountability and improving cybersecurity and data protection. Sanction policies can be used to address the intentional actions of malicious insiders, such as the stealing of data by identity-theft rings, as well as workforce member failure to comply with policies and procedures, such as failing to secure data on a network server or investigate a potential security incident.”
Adequate and thorough training is an essential component to all employee on-boarding and continued employment. One critical topic to discuss is sanctions, because the HIPAA Privacy and Security Rules both require sanction policies. Talking to employees about sanctions, or penalties for not following state, federal, or local laws or pharmacy-specific rules, helps to reinforce an employee’s understanding of the importance of taking their training seriously and understanding the consequences of non-adherence.
PAAS Tips:
Potential HIPAA Violations Lead to $1.3 Million Settlement
According to a September 11, 2023 news release from the U.S. Department of Health and Human Services (HHS), “L.A. Care, the largest publicly operated health plan in the country paid $1,300,000 to settle” potential HIPAA Security Rule violations. The settlement comes at the end of two Office for Civil Rights (OCR) investigations into L.A. Care Health Plan (“LACHP”). One of the investigations was due to a large data breach resulting from a mailing error which caused member identification cards to be mailed to the wrong members. The other investigation stemmed from a processing error which allowed L.A. Care covered members to log into the LACHP payment portal where they could potentially view the name, address, and member identification number of another LACHP member.
In addition to the $1.3 million dollar settlement, LACHP has agreed to a comprehensive corrective action plan and three years of monitoring from OCR. They must develop and distribute HIPAA compliance policies and procedures for performing a risk analysis and risk management plan. Additionally, they must implement and adhere to their new policies and procedures.
As quoted in the HHS release, OCR Director Melanie Fontes Rainer aptly stated, “Breaches of protected health information by a HIPAA-regulated entity often reveal systemic, noncompliance with the HIPAA Rules.” She goes on to advise, “HIPAA-regulated entities need to be proactive in ensuring their compliance with the HIPAA Rules, and not wait for OCR to reveal long-standing HIPAA deficiencies.”
Follow the advice of our PAAS analyst team (and the advice of the OCR Director!), and proactively review your HIPAA program to ensure you are compliant with all the Rules before you potentially find yourself at the very expensive end of an OCR investigation.
Those of you with the PAAS National® Fraud, Waste and Abuse (FWA) & HIPAA Compliance Membership have a wealth of knowledge available at your fingertips in your Policy & Procedure (P&P) Manual. This manual is automatically generated after the Risk Analysis and P&P Questionnaire have been completed. Account administrators or officers can download a full copy of the P&P Manual for further review. Highly trained PAAS analysts are also here to answer HIPAA questions, discuss HIPAA concerns, guide you through the intricacies of breach notifications (if a breach occurs), and so much more.
If your pharmacy does not currently have the PAAS FWA & HIPAA Compliance Membership, we suggest scheduling a services overview to obtain additional information about this one-of-a-kind, customizable FWA & HIPAA program! PAAS National® – helping community pharmacies gain confidence and peace of mind. Be Proactive. Be Prepared. Be Protected.®
Calculating Days’ Supply – Pancreatic Enzymes
Auditors target pancreatic enzyme prescriptions like Creon® and Zenpep® due to high cost and ambiguous directions.
The solution to this problem is contacting the prescriber at the time of fill to clarify the number of snacks or the maximum daily dose and make a clinical note on the prescription. This information must also be added to the patient label to avoid possible recoupment for a “misfill” on audit.
PAAS Tips: