Safeguarding patient’s electronic PHI (ePHI) is a top priority for all who work in healthcare. Unfortunately, tactics hackers use to access ePHI have become more sophisticated and occur with an increasing frequency. The OCR Summer Update references a report that states in the healthcare sector, 61% of data breaches have been committed by external threats, leaving the other 39% by internal employees. This article serves to reflect upon how your pharmacy safeguards patient ePHI and potential considerations to strengthen those efforts.
Two HIPAA Security Rule standards, Information Access Management and Access Control, dictate how access to ePHI is handled. Each standard is then further divided into what is called “implementation specifications”. Each implementation specification is either required (entities must implement to be in accordance with the Security Rule) or addressable (entities must assess if that implementation specification is reasonable and appropriate). If the entity decides to forego an addressable specification, documentation of why, and if appropriate, what equivalent measures were implemented in its place, is necessary.
First, Information Access Management, made up of “Access Authorization” and “Access Establishment and Modification” implementation specifications, define how access to ePHI is authorized. It requires pharmacies to:
- Have policies and procedures for granting ePHI access to personnel
- Define to what degree of access is needed for an employee to adequately do their job
- Explore how access is altered depending on a change in job description or employment
Example #1: The pharmacy clerk who handles prescription sales may not require access to patient profiles.
Example #2: Changing system access to allow for remote access – something frequently done due to the pandemic.
Other points to consider include what policies and procedures does the pharmacy have in place to establish, document, review, and modify employees’ degree of access and who oversees ensuring such policies and procedures are followed. PAAS FWA/HIPAA compliance members should review Section 11.5 Information Access Management of their Policy and Procedure manual and the Employee Request for Access in Appendix B.
Second, the Access Control standard, which addresses the technical controls to ePHI access, requires access restrictions be in place to allow for ePHI only to be accessible in accordance with the Information Access Management processes discussed above. There are four implementation specifications included within the Access Control standard:
- “Unique User Identification” (required) – Utilizing unique credentialing for each employee is an important aspect to preserve the security of ePHI. This identification can be implemented several ways, one being user-based access. Examples may include each employee having their own credentials to utilize when pulling up patient profiles or selling pseudoephedrine products. Another example would be role-based access, or only a pharmacist’s credentials will allow for additional access to ePHI that pharmacy technicians do not require.
- “Emergency Access Procedure” (required) – When power or internet failures occur, interruption of workflow may happen. What degree of ePHI can a pharmacy get by utilizing while in such situations? This also includes the question of how employees working remotely have peace of mind that they are securely accessing ePHI without risking a breach.
- “Automatic Logoff” (addressable) – Implementing a user being automatically logged off after a specified amount of time could decrease the risk of unauthorized access or misuse of PHI.
- “Encryption and Decryption” (addressable) – Encrypting data can be used to reduce risks of unauthorized access to ePHI. If ePHI is encrypted following the NIST Special Publication 800-111 (Guide to Storage Encryption Technologies for End User Devices), it is considered secured per OCR’s guidance for securing PHI and therefore not subject to the Breach Notification Rule if a data breach or loss of a device containing ePHI would occur.
Covered entities, such as pharmacies, must keep PHI protected by ensuring their computer systems are secured. Section 11.5 Information Access Management of the PAAS FWA/HIPAA compliance program Policy and Procedure manual is designed to meet this standard.
PAAS Analysts are always happy to discuss how our Fraud, Waste, & Abuse and HIPAA compliance program is built to help you address federal regulations. Call (608) 873-1342 or visit paasnational.com to see how you can become an FWA/HIPAA Compliance Member today.
Vaccinating Outside of Approved COVID-19 Emergency Use Authorization Has Legal Ramifications
As reported in a September 27, 2021 article by the US Attorney’s Office, the owner of a pharmacy in Juana Díaz, Puerto Rico, “knowingly and willfully” administered vaccine outside of the Emergency Use Authorization (EUA) and subsequently billed Medicaid for the claims. Twenty-four children between 7-11 years of age were vaccinated with the Pfizer-BioNTech COVID-19 vaccine. The current EUA is solely for the age group of 12-15 years of age, with patients 16 years or older FDA-approved. Pharmacies are required to follow the requirements pertaining to COVID-19 vaccine administration set forth by the FDA, which includes any EUAs in place. Due to the violations, the owner was charged with “participating in a felony conspiracy to convert government property and to commit health care fraud”, to which they plead guilty. For the guilty plea, they voluntarily forfeited their right as a provider for all federal health care programs for five years and returned the reimbursement paid to the pharmacy by the illegitimate Medicaid claims to the United States. In addition, they face up to five years in prison, a fine of up to $250,000, and three years of supervised release.
Due to the seriousness of administering COVID-19 vaccine outside of FDA guidance, this case reiterates the importance of confirming patient eligibility. Due diligence must be performed to substantiate the patient receiving a vaccine dose, including an additional “third” or booster dose. Short of obtaining the patient’s medical record, utilizing PAAS’ COVID-19 Vaccine Self Attestation document, located on the PAAS Portal under Tools & Aids for PAAS Audit Assistance members, will help support a vaccine dose was appropriately given. For more information PAAS Audit Assistance members can refer to the October 2021 Newsline article, COVID-19 Vaccine Administration Audit Risk.
MedImpact is Turning Up the Heat on FWA Investigations
PAAS National® has recently received several FWA audit results requiring the pharmacy to submit additional, and arduous, supporting documentation. Pharmacies need to be aware of the audit risks for medications with high Average Wholesale Prices (AWP) and narrow FDA approved indications (e.g., Pennsaid®). Significant time and effort must be put forth by the pharmacy, prescriber and potentially the patient, to support these claims.
MedImpact FWA audit results are requesting numerous items to support the claims submitted by the pharmacy. Important to note, these results have included many claims that were never paid by the plan. Any claim submitted to a PBM can be requested for audit, even if rejected at point of sale. Clearly these FWA audits are not focusing solely on financial recoupment, but also suspicious conduct by the pharmacy (i.e., test claims). Keep the following in mind:
With the current public health emergency, pharmacies must be diligent in verifying the legitimacy of telemedicine prescriptions, especially for high AWP medications. See the June 2019 PAAS Newsline article, Telemedicine: Questions to Consider from an Audit Perspective for more information.
Are You Violating PBM Return to Stock Policies? (including New PAAS Chart)
PAAS National® continues to see pharmacies losing money due to violating PBM Return to Stock policies. Each PBM sets a timeframe that unclaimed prescriptions must be reversed and returned to stock. Full recoupment of the claim can occur when a PBM discovers prescriptions are dispensed to patients outside this timeframe. Staying up to date on Return to Stock requirements is imperative. PAAS has a chart available on the PAAS Member Portal (portal.paasnational.com) in our Tools & Aids section so you can stay up-to-date on these policies.
The strictest Return to Stock Policy is 10 calendar days. Pharmacies that currently have a policy for 14 days are running the risk of full claim recoupment from these specific PBMs.
Recoupments are preventable if pharmacies follow through on this very important task. PAAS Fraud, Waste & Abuse and HIPAA Compliance Program members have a customized policy in their manual.
PAAS Tips:
Not a PAAS Fraud, Waste & Abuse and HIPAA Compliance Program member? Contact PAAS today at (608) 873-1342 or info@paasnational.com and save $120 by combining services.
Billing Insulin & Related Supplies – Medicare Part B vs Part D
PAAS National® analysts frequently field questions about billing insulin and related supplies – this can be particularly confusing when the patient has Medicare coverage. Coverage of insulin and related supplies may depend on both the type of Medicare benefit and how the item is being used. Specifically, insulin vials and alcohol swabs could be covered under either Medicare Part B or Part D!
Remember that Medicare patients could have prescription and medical benefits that are separate or combined.
Here is a chart to help you identify the correct payer depending on the type of Medicare benefit and the item in question.
(Part B/DMEPOS)
(MAPD)
A few nuances to keep in mind:
PAAS Tips:
COVID-19 Vaccine Administration Audit Risk (including New PAAS Resource)
With additional doses of the COVID-19 vaccine being approved comes additional opportunities for COVID-19 audits, particularly in the realm of vaccine administration to Medicare beneficiaries at their homes and to the immunocompromised patient population.
At the beginning of June, Medicare began their initiative of paying approximately $75 per vaccine dose administered to patients who have difficulties leaving their homes or are considered “hard-to-reach”. Effective August 24, 2021, Medicare broadened the locations in which patients can receive vaccine administration to include “communal space of a multi-unit or communal living arrangement.” Additionally, Medicare allowed for increased payment, allowing for the $75 payment amount up to a maximum of five vaccine administration services within a single group living location as long as less than 10 Medicare patients receive the COVID-19 vaccination dose on the same day at the same location. Take the following example of two Medicare beneficiaries in the same household which was laid out in CMS’ Medicare Payment for COVID-19 Vaccination Administration in the Home document, and serves as a great reference document to have on hand if providing at home COVID-19 vaccinations:
The audit risk lies in the need to document.
Secondarily, there could be audit risk tied to administering an additional dose of vaccine, again due to the need for proper documentation. Note that a third dose of the vaccine is separate and distinct from administering a booster dose of the vaccine. Refer to the table below for the specific details of each:
Approved 9/2/2021
Approved 9/24/21
1 CDC COVID-19 Vaccines for Moderately to Severely Immunocompromised People
2 CDC Statement on ACIP Booster Recommendations
PAAS recommends having the patient attest to qualifying for an additional (third) dose, or booster dose, of the mRNA COVID-19 vaccine, although we do not believe knowing the patient’s exact diagnosis or condition is necessary. In a meeting between the CDC and NCPDP, it was stated that, “Providers should be responsible to receive attestation from patients regarding appropriate timelines”. Included in October’s Newsline is a new resource: COVID-19 Vaccine Additional (Third) Dose and Booster Dose Self-Attestation of Eligibility. You can find this resource under our Tools & Aids section of the PAAS Member Portal (portal.paasnational.com). Pharmacies can use this attestation for patients to fill out at the time of vaccine administration. Consider filing it with your placeholder prescription for easy retrieval.
Getting Help with an Audit
Oh no! You just received an audit, now what? First step is to get your audit notice to PAAS National® as soon as you receive them.
Pre-audit assistance steps:
Post-audit/appeal assistance:
PAAS Tip:
Humana Audit Program Updates
On July 1, 2021 Humana updated three audit program documents and published them on their public pharmacy resources page under the “Manuals and forms: Audit guide, claim form and other materials” tab section. Below is a list of the three documents and important updates for each.
Humana Pharmacy Solutions Audit Uniform Prescriber Statement Form
Humana Pharmacy Solutions Audit Discrepancy Code List
Humana Pharmacy Solutions Audit and Claim Review Guide
Self-Audit Series #6: Transfer Prescriptions
Transferred prescriptions are at high risk for audit recoupment. The PBMs are hitting pharmacies on incomplete transferred prescriptions based on missing required elements. In many cases, these discrepancies are flagged as “law violations” and are difficult to appeal. Your state has specific elements that must be documented on the transferred prescription. Don’t let a simple mistake cost you big money!
PAAS Tips:
LifeScan Hires Law Firm to Pursue Pharmacies Purchasing from Unauthorized Distributors
Test strip manufacturers sit in a unique position when it comes to monitoring nonprescription diabetic supply purchasing and dispensing. Manufacturers acquire purchase histories from authorized distributors regarding the volume of test strip products ordered by a pharmacy. Additionally, manufacturers can obtain information regarding the amount of test strip-associated rebates paid to PBMs by NCPDP number. With simple math, the manufacturer can identify when a pharmacy has not ordered diabetic test strips from a source they authorize.
In fact, legal action pertaining to test strip manufacturers alleging pharmacies and/or distributors malpractices have a long-standing history. In 2015, Abbott filed a complaint that U.S. pharmacies, wholesalers, and other distributors were selling Freestyle® test strips intended for sale internationally. This prompted both Caremark and Express Scripts to change their policies regarding authorized distributor use due to manufacturers withholding millions in rebates owed to PBMs. In 2019, Roche Diagnostics filed multiple lawsuits claiming, “nationwide fraud for improper sourcing or billing of diabetic test strips that caused the manufacturer to pay millions of dollars in unwarranted rebates.” This was previously written about in May 2019’s Newsline article, Fraud Risk with Diabetic Test Strip “Authorized Distributors” and Manufacturer Lawsuits.
It is of the utmost importance that the test strip distributor(s) pharmacies choose are properly vetted. PAAS National® has assisted on numerous cases pertaining to test strip manufacturers and PBMs trying to recoup funds on the premise of pharmacies utilizing unauthorized distributors. Pharmacies may think they are saving money, but the repercussions can be exorbitant, including recoupments, contract termination, and legal actions.
Manufacturers have compiled a list of authorized distributors which is posted on their websites. Refer to each manufacturer’s online authorized distributor list prior to purchasing test strips. Note that Drug Distributor Accreditation (DDA), formerly Verified-Accredited Wholesale Distributors (VAWD) is not the same as being an authorized distributor.
Abbott® (Freestyle): https://www.diabetescare.abbott/ click on “Distributors” at the bottom of the page
Ascensia® (Contour® Next): https://www.contournext.com/ click on “Distributors” at the bottom of the page
LifeScan® (OneTouch®): https://www.lifescan.com/transparency
Roche® (Accu-Chek®): https://rxvp.accu-chek.com/welcome/adr_list
Safeguarding ePHI – Office for Civil Rights (OCR) Summer Update
Safeguarding patient’s electronic PHI (ePHI) is a top priority for all who work in healthcare. Unfortunately, tactics hackers use to access ePHI have become more sophisticated and occur with an increasing frequency. The OCR Summer Update references a report that states in the healthcare sector, 61% of data breaches have been committed by external threats, leaving the other 39% by internal employees. This article serves to reflect upon how your pharmacy safeguards patient ePHI and potential considerations to strengthen those efforts.
Two HIPAA Security Rule standards, Information Access Management and Access Control, dictate how access to ePHI is handled. Each standard is then further divided into what is called “implementation specifications”. Each implementation specification is either required (entities must implement to be in accordance with the Security Rule) or addressable (entities must assess if that implementation specification is reasonable and appropriate). If the entity decides to forego an addressable specification, documentation of why, and if appropriate, what equivalent measures were implemented in its place, is necessary.
First, Information Access Management, made up of “Access Authorization” and “Access Establishment and Modification” implementation specifications, define how access to ePHI is authorized. It requires pharmacies to:
Example #1: The pharmacy clerk who handles prescription sales may not require access to patient profiles.
Example #2: Changing system access to allow for remote access – something frequently done due to the pandemic.
Other points to consider include what policies and procedures does the pharmacy have in place to establish, document, review, and modify employees’ degree of access and who oversees ensuring such policies and procedures are followed. PAAS FWA/HIPAA compliance members should review Section 11.5 Information Access Management of their Policy and Procedure manual and the Employee Request for Access in Appendix B.
Second, the Access Control standard, which addresses the technical controls to ePHI access, requires access restrictions be in place to allow for ePHI only to be accessible in accordance with the Information Access Management processes discussed above. There are four implementation specifications included within the Access Control standard:
Covered entities, such as pharmacies, must keep PHI protected by ensuring their computer systems are secured. Section 11.5 Information Access Management of the PAAS FWA/HIPAA compliance program Policy and Procedure manual is designed to meet this standard.
PAAS Analysts are always happy to discuss how our Fraud, Waste, & Abuse and HIPAA compliance program is built to help you address federal regulations. Call (608) 873-1342 or visit paasnational.com to see how you can become an FWA/HIPAA Compliance Member today.