According to a September 11, 2023 news release from the U.S. Department of Health and Human Services (HHS), “L.A. Care, the largest publicly operated health plan in the country paid $1,300,000 to settle” potential HIPAA Security Rule violations. The settlement comes at the end of two Office for Civil Rights (OCR) investigations into L.A. Care Health Plan (“LACHP”). One of the investigations was due to a large data breach resulting from a mailing error which caused member identification cards to be mailed to the wrong members. The other investigation stemmed from a processing error which allowed L.A. Care covered members to log into the LACHP payment portal where they could potentially view the name, address, and member identification number of another LACHP member.
In addition to the $1.3 million dollar settlement, LACHP has agreed to a comprehensive corrective action plan and three years of monitoring from OCR. They must develop and distribute HIPAA compliance policies and procedures for performing a risk analysis and risk management plan. Additionally, they must implement and adhere to their new policies and procedures.
As quoted in the HHS release, OCR Director Melanie Fontes Rainer aptly stated, “Breaches of protected health information by a HIPAA-regulated entity often reveal systemic, noncompliance with the HIPAA Rules.” She goes on to advise, “HIPAA-regulated entities need to be proactive in ensuring their compliance with the HIPAA Rules, and not wait for OCR to reveal long-standing HIPAA deficiencies.”
Follow the advice of our PAAS analyst team (and the advice of the OCR Director!), and proactively review your HIPAA program to ensure you are compliant with all the Rules before you potentially find yourself at the very expensive end of an OCR investigation.
Those of you with the PAAS National® Fraud, Waste and Abuse (FWA) & HIPAA Compliance Membership have a wealth of knowledge available at your fingertips in your Policy & Procedure (P&P) Manual. This manual is automatically generated after the Risk Analysis and P&P Questionnaire have been completed. Account administrators or officers can download a full copy of the P&P Manual for further review. Highly trained PAAS analysts are also here to answer HIPAA questions, discuss HIPAA concerns, guide you through the intricacies of breach notifications (if a breach occurs), and so much more.
If your pharmacy does not currently have the PAAS FWA & HIPAA Compliance Membership, we suggest scheduling a services overview to obtain additional information about this one-of-a-kind, customizable FWA & HIPAA program! PAAS National® – helping community pharmacies gain confidence and peace of mind. Be Proactive. Be Prepared. Be Protected.®
Best Practices for Financial Hardship Waivers
PAAS National® analysts have noticed an increase in PBM audits focusing on copay collection. These audits requested a copy of the pharmacies’ policies and procedures addressing copay collection and financial hardship.
In general, PBMs require that pharmacies collect copays at the point of sale and retain a “financial paper trail” to prove such collection took place. Pharmacies will be asked to provide check copies (front and back), credit card receipts with authorization numbers and bank deposit slips as evidence of receiving cash from patients. Pharmacies may also be required to provide Accounts Receivable balances and Coordination of Benefits billing information, where applicable.
If patients are unable to pay their copay and the pharmacy waives or discounts the copay due to financial hardship, then you must have a robust written policy explaining the details on how such a policy is operated.
In general, financial hardship policies should include the following:
Be aware that insufficient copay collection (or evidence thereof) is one of the leading causes of network pharmacy termination.
PAAS Tips:
PBM Audits: Letters to Patients for Prescription Verification
Pharmacies often see PBM audit letters requesting documentation to validate paid claims, but not very many see letters sent to their patients.
PBMs have increasingly conducted patient (and prescriber) verifications, in the form of letters sent, to validate claims billed by your pharmacy. These letters are often initiated as part of a PBM investigation where they are searching for fraud, waste, or abuse– if there are inconsistencies between the information provided by the pharmacy, patient, and prescriber this can be a sticky situation.
Letters to patients typically consistent of basic questions like:
Letters often include an itemized list of claims billed by the pharmacy where the questions may include:
Patients may fail to respond to these letters for a variety of reasons, including: not recognizing the PBM name (and afraid of a scam), not remembering the details (and are afraid to answer incorrectly) or not being able to respond (e.g., literacy issues or changes in address).
PAAS National® has received audits where PBMs will issue audit results to the pharmacy that include recoupments for patient denials of receipt or paying copay where the pharmacy has never been asked to provide signature logs or proof of copay collection – these unfair conclusions are drawn before the pharmacy has had a chance to provide objective evidence to defend themselves.
PAAS Tips:
Avoid the Creon® Chargeback Catastrophe by Following THIS Billing Rule
Creon® is indicated for the treatment of exocrine pancreatic insufficiency due to cystic fibrosis, chronic pancreatitis, pancreatectomy, or other conditions. Claims for these pancreatic enzymes find themselves on audits year after year, and the audit risk has just increased as …
With this change to the package labeling, pharmacies MUST be sure to bill and dispense all strengths of Creon® in quantities that correspond with a full bottle, or multiples of a full bottle. Claims billed for quantities not evenly divisible by the quantity in a full bottle are easy for a PBM’s algorithm to flag for audit. If audited, these claims will likely face a partial or full recoupment with very little chance of a successful appeal. One example of language explaining this discrepancy can be found in the Fourth Edition (Version 4.1) of the 2023 OptumRx® Provider Manual, which reads “OptumRx reserves the right to recover payment for claims dispensed outside the manufacturer’s FDA-approved storage and dispensing recommendations. Claims for products where the manufacturer’s original package is designed and intended to be dispensed to patients without repackaging due to stability and patient safety concerns, may be subject to review and recovery. Pharmacies are advised to follow FDA requirements.”
Claims billed for LTC patients or patients enrolled in a medication synchronization or medication packaging program are NOT EXEMPT from the FDA rules to store and dispense medications in their original containers. In other words, these medications should NOT be put in bubble packs, blister cards, BINGO cards, strip packaging, medication boxes, or other compliance packaging and must only be dispensed by the pharmacy in their original containers.
PAAS Tips:
The Power of Clearly Communicated Sanction Policies in HIPAA Compliance
Sanctions were the focus of the October 2023 Office for Civil Rights Cybersecurity Newsletter. The article states, “An organization’s sanction policies can be an important tool for supporting accountability and improving cybersecurity and data protection. Sanction policies can be used to address the intentional actions of malicious insiders, such as the stealing of data by identity-theft rings, as well as workforce member failure to comply with policies and procedures, such as failing to secure data on a network server or investigate a potential security incident.”
Adequate and thorough training is an essential component to all employee on-boarding and continued employment. One critical topic to discuss is sanctions, because the HIPAA Privacy and Security Rules both require sanction policies. Talking to employees about sanctions, or penalties for not following state, federal, or local laws or pharmacy-specific rules, helps to reinforce an employee’s understanding of the importance of taking their training seriously and understanding the consequences of non-adherence.
PAAS Tips:
Potential HIPAA Violations Lead to $1.3 Million Settlement
According to a September 11, 2023 news release from the U.S. Department of Health and Human Services (HHS), “L.A. Care, the largest publicly operated health plan in the country paid $1,300,000 to settle” potential HIPAA Security Rule violations. The settlement comes at the end of two Office for Civil Rights (OCR) investigations into L.A. Care Health Plan (“LACHP”). One of the investigations was due to a large data breach resulting from a mailing error which caused member identification cards to be mailed to the wrong members. The other investigation stemmed from a processing error which allowed L.A. Care covered members to log into the LACHP payment portal where they could potentially view the name, address, and member identification number of another LACHP member.
In addition to the $1.3 million dollar settlement, LACHP has agreed to a comprehensive corrective action plan and three years of monitoring from OCR. They must develop and distribute HIPAA compliance policies and procedures for performing a risk analysis and risk management plan. Additionally, they must implement and adhere to their new policies and procedures.
As quoted in the HHS release, OCR Director Melanie Fontes Rainer aptly stated, “Breaches of protected health information by a HIPAA-regulated entity often reveal systemic, noncompliance with the HIPAA Rules.” She goes on to advise, “HIPAA-regulated entities need to be proactive in ensuring their compliance with the HIPAA Rules, and not wait for OCR to reveal long-standing HIPAA deficiencies.”
Follow the advice of our PAAS analyst team (and the advice of the OCR Director!), and proactively review your HIPAA program to ensure you are compliant with all the Rules before you potentially find yourself at the very expensive end of an OCR investigation.
Those of you with the PAAS National® Fraud, Waste and Abuse (FWA) & HIPAA Compliance Membership have a wealth of knowledge available at your fingertips in your Policy & Procedure (P&P) Manual. This manual is automatically generated after the Risk Analysis and P&P Questionnaire have been completed. Account administrators or officers can download a full copy of the P&P Manual for further review. Highly trained PAAS analysts are also here to answer HIPAA questions, discuss HIPAA concerns, guide you through the intricacies of breach notifications (if a breach occurs), and so much more.
If your pharmacy does not currently have the PAAS FWA & HIPAA Compliance Membership, we suggest scheduling a services overview to obtain additional information about this one-of-a-kind, customizable FWA & HIPAA program! PAAS National® – helping community pharmacies gain confidence and peace of mind. Be Proactive. Be Prepared. Be Protected.®
Calculating Days’ Supply – Pancreatic Enzymes
Auditors target pancreatic enzyme prescriptions like Creon® and Zenpep® due to high cost and ambiguous directions.
The solution to this problem is contacting the prescriber at the time of fill to clarify the number of snacks or the maximum daily dose and make a clinical note on the prescription. This information must also be added to the patient label to avoid possible recoupment for a “misfill” on audit.
PAAS Tips:
Albuterol HFA Inhaler Substitution Refresh
There have been many new albuterol HFA NDCs released since the June 2020 article, First AB-Rated Generic for Proventil® HFA Approved, and since albuterol inhaler substitutions require an extra level of consideration due to not all NDCs being equivalent, a refreshed chart was in order.
The chart below shows albuterol products grouped into their respective Therapeutic Equivalence (TE) Code category – AB1, AB2, or BX. As a reminder, substitution can occur at the pharmacy level if the substitution involves two therapeutically equivalent products and is allowed per state law.
Example: AB1 inhaler 6.7 gm Proventil® would be able to be substituted for AB1 inhaler 6.7 gm Sandoz albuterol HFA.
If a substitution to a non-equivalent is required, it would be necessary to contact the prescriber and make a corresponding clinical note documenting the conversation.
Example: Prescription written for AB1 inhaler 6.7 gm Proventil® but PBM rejects claim stating an AB2 inhaler such as 8.5 gm Lupin Pharmaceuticals albuterol HFA is required.
Refer to the article linked above for examples of how to handle substitutions based on how a prescription is written.
USP 800 – The Struggle is Real…
Are you compliant with USP 800? While USP 800 became official on December 1, 2019, it was informational only and not compendially applicable. With the recent updates to USP 795, Nonsterile Compounding and USP 797, Sterile Compounding in November 2022, USP 800 was effective as of November 1, 2023.
USP 800 is not just for compounding pharmacies as it defines the quality standards for the safe handling of hazardous drugs in all healthcare settings, with the goal to minimize exposure to healthcare personnel, the patients in your pharmacy, and to the environment.
You might still be asking, does my pharmacy need a USP 800 program?
The answer is yes! All healthcare settings, including community pharmacies, should now have a “handling of hazardous drugs” program in place and while, USP itself is not an auditing entity, there are other agencies that may audit including OSHA, EPA and most likely State Boards of Pharmacy, many of which have already committed to doing so. The safe handling of hazardous drugs is now considered a “standard of practice” so implementation is essential to protect the health and safety of your employees.
Are you struggling with the multitude of requirements?
This isn’t one of those “throw it together in an afternoon” type of programs. PAAS can help! PAAS’ customized USP 800 Compliance Program provides:
Call (608) 873-1342 to sign up for PAAS’ USP 800 Compliance Program and you can immediately get started on setting up your program in hours, not days!
Specialty Pharmacy Paying the Price: $20 Million Settlement for Kickbacks and Copay Waivers
A September 30, 2023, Department of Justice press release outlined a recent settlement between the U.S. government and a specialty pharmacy based in Delaware. The pharmacy agreed to pay a settlement of $20 million to resolve allegations that they violated the False Claims Act and the Anti-Kickback Statute by paying kickbacks to patients in the form of routinely waived copayments and to physicians in exchange for providing patient referrals.
The government alleged that from August 2015 through May 2020, the pharmacy routinely waived copays for Medicare and TRICARE patients, regardless of any financial hardship need, to induce them to fill prescriptions at the pharmacy. Additional allegations include kickbacks to prescribers such as gifts, dinners, and free administrative and clinical support services to induce patient referrals to the pharmacy. The prescribers involved knowingly solicited and accepted the remuneration and have settled separately.
Two former employees, who acted as whistleblowers under a qui tam lawsuit to report these abuses to the government, will receive over $4 million as part of the settlement.
Make sure your pharmacy staff has implemented a robust set of FWA policies and procedures, including discussion of Anti-Kickback Statute, and are completing annual training on healthcare fraud, waste, and abuse. Protect your pharmacy by enrolling in the PAAS National® FWA/HIPAA Compliance Program today. Call us at (608) 873-1342 to get started.
You’ve Got Mail! Post-COVID-19 Mailing & Delivery Considerations
After three years of a Public Health Emergency (PHE) due to COVID-19, the Department of Health and Human Services (HHS) allowed the PHE to expire May 11, 2023. With the end of the PHE came the end of most PBM concessions, including those made in relation to mailing and delivery of medications. Therefore, re-training staff on the importance of adhering to PBMs’ signature, mailing, and delivery requirements will help curtail audit risk.
The remainder of this article will focus on adherent mailing and delivery practices.
PBMs are more restrictive with allowing prescriptions to be mailed. Caremark will allow mailing for up to 20% of the monthly claims submitted under their “Retail Pharmacy” definition. Anecdotally, Express Scripts has some degree of tolerance for mailing; however, it varies by situation (e.g., distance, drugs being dispensed and frequency). Humana, who usually completely restricts mailing prescriptions, is allowing their PHE concession on mailing prescriptions to continue until January 1, 2024. Consider this during open enrollment or put a plan in place to set patient expectations come 2024, if necessary.
PAAS Tips: