Safeguarding ePHI – Office for Civil Rights (OCR) Summer Update

Safeguarding patient’s electronic PHI (ePHI) is a top priority for all who work in healthcare. Unfortunately, tactics hackers use to access ePHI have become more sophisticated and occur with an increasing frequency. The OCR Summer Update references a report that states in the healthcare sector, 61% of data breaches have been committed by external threats, leaving the other 39% by internal employees. This article serves to reflect upon how your pharmacy safeguards patient ePHI and potential considerations to strengthen those efforts.

Two HIPAA Security Rule standards, Information Access Management and Access Control, dictate how access to ePHI is handled. Each standard is then further divided into what is called “implementation specifications”. Each implementation specification is either required (entities must implement to be in accordance with the Security Rule) or addressable (entities must assess if that implementation specification is reasonable and appropriate). If the entity decides to forego an addressable specification, documentation of why, and if appropriate, what equivalent measures were implemented in its place, is necessary.

First, Information Access Management, made up of “Access Authorization” and “Access Establishment and Modification” implementation specifications, define how access to ePHI is authorized. It requires pharmacies to:

  • Have policies and procedures for granting ePHI access to personnel
  • Define to what degree of access is needed for an employee to adequately do their job
  • Explore how access is altered depending on a change in job description or employment

Example #1:  The pharmacy clerk who handles prescription sales may not require access to patient profiles.

Example #2: Changing system access to allow for remote access – something frequently done due to the pandemic.

Other points to consider include what policies and procedures does the pharmacy have in place to establish, document, review, and modify employees’ degree of access and who oversees ensuring such policies and procedures are followed. PAAS FWA/HIPAA compliance members should review Section 11.5 Information Access Management of their Policy and Procedure manual and the Employee Request for Access in Appendix B.

Second, the Access Control standard, which addresses the technical controls to ePHI access, requires access restrictions be in place to allow for ePHI only to be accessible in accordance with the Information Access Management processes discussed above. There are four implementation specifications included within the Access Control standard:

  • “Unique User Identification” (required) – Utilizing unique credentialing for each employee is an important aspect to preserve the security of ePHI. This identification can be implemented several ways, one being user-based access. Examples may include each employee having their own credentials to utilize when pulling up patient profiles or selling pseudoephedrine products. Another example would be role-based access, or only a pharmacist’s credentials will allow for additional access to ePHI that pharmacy technicians do not require.
  • “Emergency Access Procedure” (required) – When power or internet failures occur, interruption of workflow may happen. What degree of ePHI can a pharmacy get by utilizing while in such situations? This also includes the question of how employees working remotely have peace of mind that they are securely accessing ePHI without risking a breach.
  • “Automatic Logoff” (addressable) – Implementing a user being automatically logged off after a specified amount of time could decrease the risk of unauthorized access or misuse of PHI.
  • “Encryption and Decryption” (addressable) – Encrypting data can be used to reduce risks of unauthorized access to ePHI. If ePHI is encrypted following the NIST Special Publication 800-111 (Guide to Storage Encryption Technologies for End User Devices), it is considered secured per OCR’s guidance for securing PHI and therefore not subject to the Breach Notification Rule if a data breach or loss of a device containing ePHI would occur.

Covered entities, such as pharmacies, must keep PHI protected by ensuring their computer systems are secured. Section 11.5 Information Access Management of the PAAS FWA/HIPAA compliance program Policy and Procedure manual is designed to meet this standard.

PAAS Analysts are always happy to discuss how our Fraud, Waste, & Abuse and HIPAA compliance program is built to help you address federal regulations. Call (608) 873-1342 or visit paasnational.com to see how you can become an FWA/HIPAA Compliance Member today.

Hope to See You This Fall at the NCPA Annual Convention!

PAAS National® is hopeful to be at our first in-person event in almost two years. This fall, visit the PAAS team at the NCPA 2021 Annual Convention in Charlotte, NC on October 9-12, 2021. Trent Thiede will be at the premier event for community pharmacy owners. We hope to see you there! Stop by booth #1304 in the convention exhibit hall to connect with us.

We love to hear from our members on how we are helping you fight for fair audit treatment, and toward compliance with rules and regulations regarding HIPAA and Fraud, Waste and Abuse. For other community pharmacy friends/non-members we welcome the opportunity to chat with you on how PAAS works hard to keep your hard-earned money in your pocket.

For more details on this event, visit: ncpa.org/annual-convention

OIG and GSA Exclusion Checking – Are You Compliant?

The United States Department of Justice recently released the outcome of an investigation of the False Claims Act. Two pharmacists and their management company in Pennsylvania agreed to pay $250,000 to resolve the potential liability.

Claims were brought forward under qui tam, known as the whistleblower provision of the False Claims Act statue. After an investigation by U.S. Department of Health and Human Services’ Office of Inspector General (OIG), the U.S. Office of Personnel Management’s Office of Inspector General, and the U.S. Attorney’s Office for the Eastern District of Pennsylvania, it was discovered the management group and pharmacies employed a pharmacist that had been excluded from participating in federal health care programs. This exclusion occurred due to a felony-controlled substance conviction.

The investigation also revealed that the pharmacist in question, although having a suspended pharmacist license due to his conviction, had been given administrative authority and was filling prescriptions when pharmacists-in-charge were not available.

Claims billed to Medicare, Medicaid or the Federal Employee Health Program by an excluded person are considered false or fraudulent. Penalties, claim recoveries and possible pharmacy exclusion can result from an excluded employee. Pharmacies must be diligent in monitoring the OIG and the General Services Administration (GSA) exclusion lists. Potential employees must be checked prior to hire.

PAAS National®’s Fraud, Waste and Abuse & HIPAA Compliance Program monitors the OIG and GSA lists for our members. The pharmacy is notified immediately if an excluded employee is found. The program also allows members to print monthly exclusion lists and stores them electronically. PBMs will often request proof of exclusion checks during an audit.

Contact PAAS National® at (608) 873-1342 or visit paasnational.com/fwac-hipaa for more information on our FWA/HIPAA Compliance Program. By becoming an Elite member of both programs you save $120; join today to avoid any gaps between checks and get daily OIG and GSA exclusion list checks!  

PAAS Tip:

Audit Risk: Ivermectin Used for Treating COVID-19 (September Update)

Ivermectin has been getting a lot of press as of late, from news outlets, national associations, and federal agencies, regarding the dangers of using it to treat or prevent COVID-19. While many of the reports discuss the concern about using veterinary products, there are also many reports of adverse effects when using high, and unauthorized or unapproved, doses of human products.

In March of 2021, the FDA published an article titled Why You Should Not Use Ivermectin to Treat or Prevent COVID-19 which lays out some of the reasons it is currently considered an ill-advised treatment, including not being an anti-viral drug, potential for serious patient harm when taken in large doses, and potential for patients to access via illegitimate sources and/or medications intended for animals. Subsequently, the CDC issued an official health advisory on August 26 to remind both clinicians and the public about the lack of evidence to support ivermectin use for COVID-19 and the potential dangers. Despite the FDA warning, the CDC advisory indicated a 24-fold increase in the number of outpatient prescriptions being prescribed, compared to the pre-pandemic baseline.

Consequently, PAAS is seeing more PBM audits on ivermectin prescriptions. Pharmacies should be prepared to

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

have claims looked at for potential recoupment on the basis of “clinical appropriateness”. Pharmacists should give extra scrutiny to telemedicine prescribers who may not have a valid patient-provider relationship, be prescribing outside their scope of practice, or not licensed in the state in which the patient resides.

Due to the exponential increase in prescribing and dispensing, the AMA, APhA and ASHP issued a joint press release on September 1, 2021 calling for an immediate end to the prescribing, dispensing, and use of ivermectin for COVID-19 outside of clinical trials.

PAAS Tips:

  • See our July 2021 Article, Audit Risk: Ivermectin Used for Treating COVID-19
  • Prescriptions successfully processed at point-of-sale do not guarantee payment. PBMs, and payers, use pay and chase methods to recoup claims to avoid inhibiting potentially needed access to medications.
  • Prescriptions dispensed for cash may still carry risk (outside the scope of PAAS audit services).
    • While off-label prescribing is commonplace, what is atypical with ivermectin treatment for COVID is the FDA, CDC, NIH, and National Medical and Pharmacy Organizations recommending against its utility. Consequently, this seems to open the door for potential malpractice lawsuits to occur.
    • At face value, would a prescription be considered reasonable in the face of the aforementioned opposition, or does the pandemic environment and a pharmacist’s experience and professional judgement supersede?

Medicare Part D Audits: Top 11 Areas for Scrutiny

By Karen Blum, Published August 26, 2021 by Specialty Pharmacy Continuum

Medicare Part D pharmacy audits are on the rise, and pharmacists would be wise to adapt their business practices and know how to respond, an audit expert said at the virtual MHA 2021 Business Summit.

“Prior to COVID-19, we’ve seen a nearly 80% increase in audits that pharmacies experience,” said Trenton Thiede, PharmD, MBA, the president of PAAS National®, a pharmacy audit assistance company. These have primarily been from pharmacy benefit managers (PBMs) but also by plan sponsors and the Centers for Medicare & Medicaid Services, Dr. Thiede noted. The increase has occurred partly as a result of escalating health care costs and the opioid epidemic, as well as instances of fraud, waste and abuse, he said. There’s been a shift from on-site to more quick turnaround desk audits that try to validate quick outliers, such as high-dollar items or incorrect days’ supply. Nearly one-fourth of desk audits seen by his company now are for these prescription validation requests, he said.

Over the past year, due to COVID-19, many PBMs have conducted virtual audits. These take elements from both on-site and desk audits, Dr. Thiede said, asking compliance questions, requiring photos of the pharmacy area and copies of licenses, as well as requesting copies of prescriptions and signature logs.

Pharmacy owners who don’t perform well on audits face risking their reputation, license, fines and even imprisonment, he said. Financial recoveries are common, but his firm is seeing more and more network terminations due to poor compliance or bad actors.

Overall, pharmacies need the following items to perform well on audits: prescriptions that are legal and valid per state and federal laws, proof of filling and billing accurately, proof of dispensing, proof of copay collection, and documents to prove enough inventory was purchased from an appropriate source.

Common audit discrepancies can occur over items such as missing, invalid or altered prescriptions; unauthorized refills; refilling medication too soon; incorrect dispense-as-written (DAW) codes; missing or invalid signature logs; and issues delivering medication greater than 10 days after the date of fill, Dr. Thiede said.

Dr. Thiede presented the top 11 audit discrepancy areas noted by his firm, and advised how to prepare for them. >>Learn more

Humana Notice of Erroneous Billing under Medicare’s Limited Income Newly Eligible Transition Program (LINET)

Brace yourself, a Humana LINET recoupment could be in your future. LINET is a program that started January 1, 2010 under CMS, designed to simplify Part D prescription drug coverage for Medicare beneficiaries who are eligible for Medicaid (dual eligible) or the Medicare Low-Income Subsidy (LIS).

PAAS National® has received an exorbitant number of audits from Humana, the administrator for the LINET program, in the past two weeks. Pharmacies should be concerned about these supposed “overpayments” going back 6+ years and the potential industry implications that lie ahead. PAAS has researched the issue and wants to help your pharmacy respond to these egregious attacks on your business.

SPECIAL: Join PAAS for 1 year, instead of 2 years today to get assistance with this recoupment.

Call us at (608) 873-1342 or go to ‘Buy Now’ to join today!

PAAS’ insight and proactive guidance will help you build an audit wall around your pharmacy. We want to save you vast amounts of TIME and MONEY. See why more than 5,000 pharmacies across the US agree. As a member, you receive an unlimited amount of one-on-one audit assistance—as much as you need!

PHI Access and Release for Deceased Patients

According to the Office for Civil Rights (OCR), the Privacy Rule allows for pharmacies to disclose PHI about a deceased patient to person(s) involved in the individual’s health care prior to their death, unless doing so is going against the patient’s documented requests. If under law an executor, administrator, or similar individual has the authority to act on behalf of the deceased patient, a pharmacy can treat that person as a personal representative with respect to disclosing PHI.

Become an audit assistance member today to continue reading this article. As a member, you’ll have access to hundreds of articles and receive our monthly proactive newsletter!

When assessing a deceased patient PHI request, can you ensure the relationship to the patient is understood to the extent you feel comfortable with disclosing a patient’s PHI? In such precarious situations, documentation is key. If there is a question about how to proceed, partner with your pharmacy’s Privacy Officer. For PAAS National® Fraud, Waste & Abuse and HIPAA Compliance members, reference Section 10.5 of your Policy and Procedure Manual and utilize Appendix B documents. The Manual, and PAAS staff, are here as a resource to make sure the pharmacy is aware of how to proceed appropriately.  Reach out to PAAS for additional guidance by calling (608) 873-1342 or emailing info@paasnational.com.

PAAS Tips:

  • Properly vet individuals who are requesting PHI on a patient’s behalf. Could you justify giving them the deceased patient’s PHI if asked? What supporting documentation would you have?
  • Document all PHI requests whether such requests have been granted or denied
  • Retain forms for a period of at least six years after date last in effect

As Seen in Fortune: Pharmacies Face Extra Audit Burdens …

PAAS National® provided data for the article “Pharmacies face extra audit burdens that threaten their existence” published August 6, 2021 on Fortune.com:

According to data from PAAS National, a pharmacy audit assistance service, while the number of pharmacy audits in 2020 declined nearly 14% from the year before, the overall number of prescriptions reviewed went up 40%. That meant pharmacies had to provide more documentation and stood to lose much more money if auditors could find any reason — even minor clerical errors — to deny payments.

The average audit in 2020 cost pharmacies $23,978, 35% more than the annual average over the previous five years, the PAAS data shows. And the number of prescriptions reviewed in September and October was fourfold over what PAAS members had seen in previous years.

And Trent Thiede, President at PAAS National® was quoted:

Trent Thiede, president of PAAS National®, said many of the more than 5,000 pharmacies he works with stepped up to offer covid testing and shots and to become an even bigger resource for customers during this health crisis. “With vaccinations in full swing, priorities should be focused on serving patients and our communities, not responding to audit requests,” Thiede said.

When auditors come in person, they primarily do the review themselves, occasionally asking pharmacists to pull additional documentation.

“In these virtual audits, you have to pull the prescription, put it through a copier of some kind, get everything aggregated, get all the signature logs. They want your license off the wall. They want all the employee licenses faxed,” Thiede said. “It’s a lot more laborious for these pharmacies.”

Read the complete article here from the beginning

Pharmacies Facing More Payment Denials During Pandemic’s Virtual Audits

By Katie Adams. Published August 6, 2021 in Becker’s Hospital Review

Already marred from COVID-19 burnout and years of financial threats, independent pharmacies’ latest woe is pharmacy benefits managers’ shift to virtual audits during the pandemic. Independent pharmacies say the new process allows for significantly more claims to be denied and allege the practice is predatory, Kaiser Health News reported Aug. 6.

The number of pharmacy audits conducted in 2020 actually decreased by nearly 14 percent from the previous year, but the overall number of prescriptions reviewed increased by 40 percent, according to data from pharmacy audit assistance service PAAS National®. The data showed the number of prescriptions reviewed in September and October increased fourfold from what PAAS reported in previous years.

When PBMs conducted these reviews in-person, they sent an auditor who would perform the process and occasionally seek additional documentation from a pharmacist. The virtual process means pharmacies face an increased administrative burden and stand to lose much more money, a change imposed when they were scrambling to take care of patients during the pandemic.

Continue reading the full article here

Pharmacies Face Extra Audit Burdens That Threaten Their Existence

By Markian Hawryluk, Published August 6, 2021 by Kaiser Health News

The clock was about to strike midnight, and Scott Newman was desperately feeding pages into a scanner, trying to prevent thousands of dollars in prescription payments from turning into a pumpkin.

As the owner of Newman Family Pharmacy, an independent drugstore in Chesapeake, Virginia, he was responding to an audit ordered by a pharmacy benefit manager, an intermediary company that handles pharmacy payments for health insurance companies. The audit notice had come in January as he was scrambling to become certified to provide covid-19 vaccines, and it had slipped his mind. Then, a month later, a final notice reminded him he needed to get 120 pages of documents supporting some 30 prescription claims scanned and uploaded by the end of the day.

“I was sure I’d be missing pages,” he recalled. “So I was rescanning stuff for the damn file.”

Every page mattered. Pharmacy benefit managers, or PBMs, suspended in-person audits because of covid last year, shifting to virtual audits, much as in-person doctor visits shifted to telehealth. Amid added pandemic pressure, that means pharmacists such as Newman are bearing significantly more workload for the audits. It also has allowed benefit managers to review — and potentially deny — more pharmacy claims than ever before.

According to data from PAAS National, a pharmacy audit assistance service, while the number of pharmacy audits in 2020 declined nearly 14% from the year before, the overall number of prescriptions reviewed went up 40%. That meant pharmacies had to provide more documentation and stood to lose much more money if auditors could find any reason — even minor clerical errors — to deny payments.

The average audit in 2020 cost pharmacies $23,978, 35% more than the annual average over the previous five years, the PAAS data shows. And the number of prescriptions reviewed in September and October was fourfold over what PAAS members had seen in previous years.

Continue reading the complete article here