Pharmacies, big and small, may find themselves on the probing end of a hacker’s criminal scheme designed to access and steal protected health information (PHI). Recently, CVS Pharmacy, Inc., Ravkoo (affecting Amazon Web Services), and Florida-based BioPlus Specialty Pharmacy Services LLC have all been targets of malicious actors after PHI. It comes as no surprise that the U.S. Department of Health and Human Service’s Office for Civil Rights (OCR) 2022 first quarter Cybersecurity Newsletter reported an increase in cyberattacks from 2020 to 2021. According to the OCR’s report, cyberattacks and “IT incidents” accounted for 66% of breaches affecting 500 individuals or more, and according to the 2020 Data Breach Investigations Report by Verizon, over 80% of data breaches due to hacking were from weak authentication requirements.
Having safeguards in place to detect, and prevent, unauthorized users from accessing PHI and electronic PHI (ePHI) is a requirement for all covered entities as outlined in the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and clarified by the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009. Although ePHI is usually the target of cyberattacks, it is important to be aware of the potential for internal breaches as well, some of which may be the result of inadequate policies and procedures, not necessarily malicious actors. Rite Aid pharmacy chain found out the hard way that tossing medication vials with patient information into their regular trash bins was not the correct way to dispose of PHI. Rite Aid’s $1 million settlement for having insufficient internal policies and procedures for handling PHI can serve as a reminder of the importance of evaluating your own HIPAA policies and procedures. In fact, periodically reviewing your security protocols and correcting your security shortcomings is a HIPAA Security Rule requirement.
PAAS National® has a customizable Fraud, Waste & Abuse (FWA) and HIPAA Compliance Program with tools and resources to help pharmacies meet HIPAA and HITECH compliance requirements. The PAAS FWA/HIPAA Compliance Program walks members through setting up a robust compliance program which includes:
- appointing HIPAA Privacy and Security Officers,
- performing a Risk Analysis to identify and document threats and vulnerabilities that may impact ePHI,
- developing administrative, technical and physical safeguards to protect ePHI,
- developing customized HIPAA Policies and Procedures (including proper PHI disposal, security reminders, access controls, prevention of malicious software, etc.),
- online HIPAA training and much, much more!
Having a robust HIPAA Compliance Program and an educated workforce that is fully engaged in protecting PHI can greatly reduce the risk of unauthorized access to PHI and ePHI. Don’t be the weak link and have no plan in place – it’s the law!
PAAS Tips: Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!
- Review your HIPAA policies and procedures to check for appropriate administrative, technical, and physical safeguards
- Administrative safeguards should include risk analysis, risk management, sanction policy, and information system activity review
- Technical safeguards include access control (i.e., user identification, emergency access procedure, automatic logoff, encryption, and decryption), audit controls, ePHI integrity, person/entity authentication, and transmission security
- Physical safeguards include facility access controls (i.e., contingency operations, facility security plan, access control and validation procedures, maintenance records), workstation use and security, and device and media controls
- PAAS National® is here to assist you with your FWA and HIPAA Compliance needs and questions, call (608) 873-1342 today to start customizing a program for your pharmacy!
Small Differences Between Prescription Directions and Patient Label Can Lead to BIG Recoupments
PAAS National® recommends attention to detail when it comes to typing directions for patient labels. Many PBMs require the patient label directions match the prescription directions exactly, or a pharmacy may face recoupment for a “misfilled” prescription.
Errors on the patient label can range from simple typos to dosing errors. Even seemingly innocuous additions to the patient label (e.g., a diagnosis code or time of administration) can lead to potential audit discrepancies when added without prescriber approval (or documentation). If the prescription directions are clarified with the prescriber’s office, make sure to add a clinical note and update the patient label. See our November 2020 article Are Your Pancreatic Enzyme Prescriptions Audit Ready? for a common issue between the prescription directions and patient label.
Another problematic patient label issue PAAS frequently sees is regarding units. Consider Victoza®, which typically has directions in mg, but has often been mistyped as mL. See our January 2021 article Victoza – One Letter Can Cost You! for more detail.
PAAS Tips:
Billing the Correct Insulin for Use in a Pump
Insulin is a very popular audited drug category due to its complexity, frequency of use, and high cost. When used in conjunction with an insulin pump, it adds another layer of complexity.
One of the reasons insulin claims for Medicare Part D patients are commonly audited is because the PBMs can’t identify if the patient is self-administering (and Part D is responsible) or using in a pump (where Part B may be responsible) at adjudication. PBMs may isolate insulin claims if a member does not have any syringes being billed to Part D along with their insulin. The pharmacy should always verify with the patient or prescriber if insulin is being used in a pump.
Billing the wrong type of insulin for a pump can also result in large audit recoupments. See the tips below for which insulin types should, and should not, be used in an insulin pump.
PAAS Tips:Join today!
- Do NOT bill the following long acting, pre-mixed and concentrated insulins for use in a pump
- Insulin pens should never be used with pumps
- Intermediate or long-acting insulins like NPH, glargine (Basaglar®, Lantus®, Levemir®, Rezvoglar™, Semglee®, Toujeo®), Levemir®, and Tresiba®, as well as pre-mixed insulins like 70/30, 50/50, etc. should never be used with pumps
- U-500 is not FDA approved for use in a pump
- Appropriate Insulins for use in a pump are rapid-acting
- Aspart – NovoLog®, Fiasp®
- Lispro – Admelog®, Humalog®, Lyumjev®,
- Glulisine – Apidra®
- See September 2020 Newsline Billing Insulin for a Pump is Tricky, especially for Medicare Patients
- See April 2022 Newsline Insulin for a Pump – Medicare B or Medicare D?
Hackers Don’t Sleep, Your PHI is At Risk! What Are Your Safeguards?
Pharmacies, big and small, may find themselves on the probing end of a hacker’s criminal scheme designed to access and steal protected health information (PHI). Recently, CVS Pharmacy, Inc., Ravkoo (affecting Amazon Web Services), and Florida-based BioPlus Specialty Pharmacy Services LLC have all been targets of malicious actors after PHI. It comes as no surprise that the U.S. Department of Health and Human Service’s Office for Civil Rights (OCR) 2022 first quarter Cybersecurity Newsletter reported an increase in cyberattacks from 2020 to 2021. According to the OCR’s report, cyberattacks and “IT incidents” accounted for 66% of breaches affecting 500 individuals or more, and according to the 2020 Data Breach Investigations Report by Verizon, over 80% of data breaches due to hacking were from weak authentication requirements.
Having safeguards in place to detect, and prevent, unauthorized users from accessing PHI and electronic PHI (ePHI) is a requirement for all covered entities as outlined in the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and clarified by the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009. Although ePHI is usually the target of cyberattacks, it is important to be aware of the potential for internal breaches as well, some of which may be the result of inadequate policies and procedures, not necessarily malicious actors. Rite Aid pharmacy chain found out the hard way that tossing medication vials with patient information into their regular trash bins was not the correct way to dispose of PHI. Rite Aid’s $1 million settlement for having insufficient internal policies and procedures for handling PHI can serve as a reminder of the importance of evaluating your own HIPAA policies and procedures. In fact, periodically reviewing your security protocols and correcting your security shortcomings is a HIPAA Security Rule requirement.
PAAS National® has a customizable Fraud, Waste & Abuse (FWA) and HIPAA Compliance Program with tools and resources to help pharmacies meet HIPAA and HITECH compliance requirements. The PAAS FWA/HIPAA Compliance Program walks members through setting up a robust compliance program which includes:
Having a robust HIPAA Compliance Program and an educated workforce that is fully engaged in protecting PHI can greatly reduce the risk of unauthorized access to PHI and ePHI. Don’t be the weak link and have no plan in place – it’s the law!
PAAS Tips:Join today!
- Review your HIPAA policies and procedures to check for appropriate administrative, technical, and physical safeguards
- Administrative safeguards should include risk analysis, risk management, sanction policy, and information system activity review
- Technical safeguards include access control (i.e., user identification, emergency access procedure, automatic logoff, encryption, and decryption), audit controls, ePHI integrity, person/entity authentication, and transmission security
- Physical safeguards include facility access controls (i.e., contingency operations, facility security plan, access control and validation procedures, maintenance records), workstation use and security, and device and media controls
- PAAS National® is here to assist you with your FWA and HIPAA Compliance needs and questions, call (608) 873-1342 today to start customizing a program for your pharmacy!
LIVE WEBINAR APRIL 7th: Compliance Issues, HIPAA Enforcement and Audit Risks with COVID-19
Join President of PAAS National®, Trenton Thiede, PharmD, MBA for a LIVE webinar “Compliance Issues, HIPAA Enforcement and Audit Risks with COVID-19” on April 7, 2022 from 2-2:45pm CT as he discusses:
We will allow for some Q&A at the end of the webinar.
SIGN UP TODAY!
PAAS Audit Assistance members will have access to a recording on the PAAS Member Portal if they are unable to attend the live event.
Beware and Be Ready! In-Person Onsite Audits Are Resuming
OptumRx and Express Scripts recently sent notices to pharmacies informing them in-person onsite audits will be starting back up in April. PAAS National® has also reviewed audit notices from Caremark and MedImpact with intentions of visiting the pharmacy in person to conduct the audit. We would expect other PBMs to follow this trend as well.
COVID-19 restrictions lead PBMs to conduct their audits virtually since early 2020. Pharmacies would respond to the audit request by submitting documents in for review and having a compliance phone interview with the auditor. With COVID-19 numbers decreasing, PBMs feel now is the time to resume audits onsite.
PAAS analysts have years of experience assisting pharmacies through onsite audits. Pharmacies can receive a pre-audit consultation with an analyst, in addition to specific PBM trends, state laws that are being targeted, and many other tips that can be provided to support you through your audit. We also offer our Onsite Credentialing Guidelines located on the PAAS Member Portal, to help our members prepare for potential questions that may be asked during the auditor’s visit.
PAAS Tips:
If you do not have a compliance program, contact PAAS today to explore the PAAS FWA/HIPAA Compliance program. Get complaint today and save $126!
Self-Audit Series #14: DMEPOS Items
Medicare Part B/DMEPOS billing and documentation rules are VERY different from most of your pharmacy claims – if you don’t have a strong grasp of these differences, or a process for handling the documentation, then you are sure to experience significant problems.
PAAS Tips:Join today!
- SWOs must include the following six elements:
- Beneficiary’s name or their Medicare Beneficiary Identifier (MBI)
- Date of the order must be present
- General description of the items – HCPCS code a HCPCS code narrative, or a brand name/model number
- Quantity to be dispensed
- Practitioner’s name or NPI
- Practitioner’s signature
- Other important items to know:
- Medicare accepts electronic, faxes and written orders. Telephone and transfer orders do NOT satisfy Medicare requirements
- Must have SWO in your possession prior to billing claims
- Not required to have a diagnosis code on the order; however, the correct diagnosis code is needed to appropriately bill the claim
- As of January 2020, pharmacies may obtain and make note of verbal clarifications
- See our January 2019 Newsline article Billing Medicare Part B – Nebulizer Drugs for requirements of a valid detailed writer order (DWO) if being audited on a claim with an order written prior to 2020
- Refill requests include the following four elements:
- Name of beneficiary (or representative) making the request
- Description of each item requested
- Date of refill request
- Quantity that beneficiary still has remaining
- NOT required for items picked up at your pharmacy
- PORR may not be obtained more than 14 days before exhaustion of current supply or delivered to the patient more than 10 days before exhaustion
- POD must include the following six elements:
- Beneficiary name
- Delivery address
- Detailed description of the item(s)
- Quantity delivered
- Date delivered
- Signature of beneficiary or representative
- Important notes:
- Date of delivery should match the date of service billed (there is no “return to stock” window)
- Applies to all DMEPOS dispensing – even when picked up at pharmacy
- Standard “signature logs” used for PBM audits generally do not satisfy requirements
- Most common items missing on audit = delivery address, detailed description, quantity
- Many pharmacies will add duplicate Prescription dispensing label to provide
- In general, medical records should conform to the following:
- Be created on or before the prescription order (SWO)
- Support the underlying diagnosis or condition
- Be signed by the treating practitioner
- To prove “continued medical need” of ongoing supplies or rental items, medical records must be “timely” which is defined as a record in the preceding 12 months unless otherwise specified (e.g., high utilization of diabetic test strips requires medical records within previous 6 months)
- Each DMEPOS product category requires different unique elements
- Best practice would be to obtain records before dispensing items to patients
- Medicare billing is based on HCPCS codes (not NDCs) and “units of service” (which varies by product)
- Many pharmacies utilize software vendors such as OmniSYS and Change Healthcare to convert NCPDP D.0 claim information into an “837 file” that CMS claim processors recognize
- Many DMEPOS items require “modifiers” to communicate various information
- Example for diabetic test strip claims (A4253): ‘KS’ indicates that the patient is NOT using insulin, while ‘KX’ indicates that the patient IS using insulin
- Example for claims billed during the public health emergency that do not meet all Medicare clinical indication requirements should be adding a ‘CR’ modifier to the claim if on or after 3/1/2020 and for the duration of the PHE – See March 2022 Newsline article Medicare not Enforcing Clinical Indications for Certain DMEPOS Categories during the PHE for more information on the ‘CR’ modifier
- Must ensure that the signature date matches the date of service billed on the claim
- Claim must be billed on the date picked up, or the date sent out for delivery
- If the dates do not match and you identify this error on your own, you can resolve it proactively via a Reopening without having to request a formal appeal
- If this error is discovered during an audit, pharmacies must appeal via a Redetermination. During the PHE, pharmacies are allowed to write a note to the medical reviewer asking them to adjust the date billed to match the date picked up
- Durable Medical Equipment Medicare Administrative Contractor (DME MAC) websites
- Noridian Healthcare Solutions
- CGS® Administrators, LLC
- Supplier Manual
- Local Coverage Determinations (LCDs) that outline billing and documentation requirements that are specific for various items
- Documentation Checklists – these are created by the DME MACs to aid suppliers in adhering to rules
- Dear Physician Letters – letters written by physicians of the DME MACs that suppliers can provide to local prescribers to education them about documentation requirements
- Educational, on-demand webinars on a variety of topics
Documentation for DMEPOS items
Standard Written Order (SWO)
Proof of Refill Request (PORR)
Proof of Delivery (POD)
Medical Records
Billing for DMEPOS items
Dispensing for DMEPOS items
Be sure to utilize all the tools and resources available on your local DME MAC website to ensure you are compliant with Medicare’s billing and documentation rules.
Options for DMEPOS Orders with Quantities Above Policy Limits
Medicare has strict coverage qualifications and limitations for items covered by Part B. This criteria and restrictions can be found within the Local Coverage Determinations (LCD) and Policy Articles set by the Durable Medical Equipment Medicare Administrative Contractor (DME MAC), Noridian or CGS®. The limits are dependent upon the DMEPOS item dispensed; therefore, being familiar with each LCD and Policy Article for the items dispensed by your pharmacy is critical for decreasing the risk of recoupment upon audit. Though the quantities may be limited by the policy, these limits may sometimes be exceeded if appropriate documentation exists to support the medical necessity of the excess supplies.
Rather than creating a workaround to circumvent the policy limits, below are the three recommended strategies for handling orders written for quantities above policy limits.
PAAS Tips:
Off-Label Use Not Covered Under Medicare Part D
PAAS National® has seen an increase in audit results from Elixir where the pharmacy was cited for “Claim not covered under Medicare Part D (NPD).” These claims were billed for Diclofenac 3% gel, which is only FDA approved for the treatment of actinic keratosis, a rough, scaly patch on the skin that can become cancerous. The prescriptions had directions indicating that the medication was being used for pain or discomfort, in other words, being used off-label.
PAAS has also seen the NPD discrepancy when pharmacies bill insulin used in a pump to Medicare Part D instead of Part B, or when intravenous (IV) injectable antibiotics are used in footbaths. While it may seem that PBMs selectively enforce these provisions, the reality is they’re pursuing easy targets with high rewards. Audits leverage sophisticated algorithms to identify these claim outliers. Expensive medications with narrow therapeutic indications only increase the likelihood of an audit. Prescriptions being used within FDA guidelines are much less likely to be identified as being used off-label. Consider a Medicare Part D claim for WegovyTM that gets rejected, only to have the prescriber send over a new prescription for Ozempic® 2.5 mg weekly. Not only does the PBM see the original rejection, but they also see an abnormally large quantity of Ozempic ® in correlation to its days’ supply. See our November 2021 article, Beware: Same Ingredients, Different FDA Indications. Every pharmacy wants to help the patient, but you must be mindful of the audit risk.
Section 1860D-2(e)(4) of the Social Security Act defines medically accepted indications for the Medicare Part D program by referencing Section 1927(k)(6). It states that a medically accepted indication is “any use for a covered outpatient drug which is approved under the Federal Food, Drug, and Cosmetic Act, or the use of which is supported by one or more citations include or approved for inclusion in any compendia described in subsection (g)(1)(B)(i)”.
Section 1927(g)(1)(B)(i) lists the three compendia including:
These NPD discrepancies can be difficult to appeal, so remember to send PAAS your audits as soon as you receive them to have the best chance for success.
PAAS Tips:
Medicare Not Enforcing Clinical Indications for Certain DMEPOS Categories During the COVID-19 PHE
On January 31, 2020, the Secretary of the Department of Health and Human Services (HHS) declared a public health emergency (PHE) throughout the United States due to the COVID-19 outbreak. On March 13, 2020, HHS authorized many waivers and modifications regarding Medicare Part B and DMEPOS claims to help prevent gaps in access to care for patients affected by the PHE. Please see below for some waivers and modifications to Medicare Part B and DMEPOS claims that may pertain to your pharmacy if you are a DMEPOS supplier.
PAAS Tips:Join today!
- The COVID-19 FAQs on Medicare Fee-for-Services Billing has a list of Local Coverage Determinations (LCDs) and National Coverage Determinations (NCDs) whose clinical indications are not being enforced during the PHE
- Two of the many LCDs listed are nebulizers and continuous glucose monitors
- If there is proof of medical necessity, these items can be billed to Medicare even if the beneficiary does NOT meet all clinical indications
- If all the coverage criteria are NOT met during the PHE, then those claims must be billed with the “Catastrophe/Disaster related” (CR) modifier attached to the HCPCS code and “COVID-19” narrative to avoid a denial as previously discussed in July 2020 Newsline article Medicare Part B Requires a Claim Modifier if You Are Not Collecting Patient Signatures!
- It is likely that CMS will come up with an audit plan for DME MACs and other contractors to audit claims billed with a CR modifier
- Pharmacies using CR modifiers on large volumes of claims could be targeted
- In addition to the LCD/NCD waivers, the following waivers are also in effect until the end of the PHE
- Waiver of face-to-face requirements
- Waiver of proof of delivery signature requirements
- Replacement of lost, damaged, or destroyed items that cannot be restored
- Flexibility with telehealth services
- Verbal orders
- Pharmacies should use waivers sparingly as the PHE declines
- Perform a self-audit on your DMEPOS claims (see Self-Audit Series #14: DMEPOS items) – if you find a claim billed due to a waiver and forgot to add the CR modifier, go online, and submit a reopening request to add the CR modifier to the HCPCS code and “COVID-19” narrative
- If a claim gets audited and is missing the CR modifier, the pharmacy can request a redetermination to add the CR modifier to the HCPCS code and “COVID-19” narrative
- Many contractors are refraining from auditing pandemic related claims due to waivers, so pharmacies are seeing increased audits on other DME categories that do not have waivers in place such as surgical dressings, urological supplies, ostomy supplies and more
- To submit a reopening or redetermination request, follow the guidance from your DME MAC
- Noridian homepage
- CGS® homepage
Best Practices for Vaccine Documentation
Without question, vaccine claims are on the rise! Consequently, PAAS National® analysts have recently seen an increased number of PBM audits for these claims. Consider a few best practices to reduce your risk of audit recoupments:
Billing
Quantity – Submit the correct NCPDP billing unit of each (EA) or milliliter (mL) based on vaccine product
Day Supply – NCPDP recommends that all vaccine claims be submitted as a 1-day supply
Origin Code
Prescriber ID
Documentation
Include at least the following:
PAAS Tips: