Source: https://complianceandauditingservices.com/category/compliance/
Timestamp: 2019-04-21 10:09:38+00:00

Document:
By now, most of you have heard bits and pieces about a Florida Court decision involving Allstate, and ultimately, your practice. I wanted to take a minute and summarize what has really happened.
Beginning in 2008, Allstate has been reimbursing PIP claims at 200% of Medicare B fee schedule. Allstate has been challenged about its “subject to” fee schedule language. The argument has been that the language used by Allstate was insufficient in explaining to providers and insureds about how it would pay 200% of the Medicare fee schedule.
The First District Court of Appeal decided several months ago that Allstate had provided sufficient notice in its policy language, thereby supporting Allstate.
This week however, the Fourth District Court of Appeal found differently – and this is important. Their opinion conflicts with the prior decision of the First Court of Appeal. This is encouraging because it provides greater grounds for the Florida Supreme Court to review the first decision.
So, for providers hoping to recoup additional money from Allstate, this is encouraging, but it’s not yet a done deal. The differing opinions of the two appellate courts provide reason for Supreme Court review; but this hasn’t happened yet. So, be alert and hopeful, but keep it in perspective (To read the recent court decision in its entirety below)!
As always, feel free to contact me about compliance issues and current events related to the well being of your practice. You can reach me via email: DrJohn@ComplianceandAuditingServices.com or the FCPA website.
Gary M. Farmer, Sr. of Farmer Jaffe Weissing Edwards Fistos & Lehrman P.L., Fort Lauderdale; David M. Caldevilla of De La Parte & Gilbert, P.A., Tampa; and Stephen Deitsch, William Foman and Lindsay Porak of Deitsch & Wright, P.A., Lake Worth, for appellants.
Suzanne Y. Labrit and Douglas G. Brehm of Shutts & Bowen LLP, Tampa; and Peter J. Valeta of Meckler Bulger Tilson Marick & Pearson LLP, Chicago, Illinois, for appellee.
Whether the Defendant’s PIP insurance policy language is legally sufficient to authorize [Allstate] to apply the [Medicare fee schedule] reimbursement limitations set forth in section 627.736(5)(a)2., Florida Statutes.
We answer that question in the negative, finding the policy language to be inherently unclear and reverse the summary judgment entered in favor of Allstate.
The only dispute between the parties concerns the meaning of a particular endorsement to the policy. The policy provision language chosen by Allstate resulted in the trial court’s decision to enter the underlying summary judgment for Allstate.
Eighty percent of all reasonable expenses for medically necessary medical, surgical, X-ray, dental, and rehabilitative services, including prosthetic devices, and medically necessary ambulance, hospital, and nursing services.
Any amounts payable under this coverage shall be subject to any and all limitations, authorized by section 627.736, [which would apply a Medicare fee schedule limitation] or any other provisions of the Florida Motor Vehicle No-Fault Law, as enacted, amended or otherwise continued in the law, including, but not limited to, all fee schedules.
The Providers argue that the “shall be subject to” provision in the endorsement is ambiguous, as it is unclear whether Allstate has actually and in fact elected to limit its reimbursements to the Providers under the Medicare fee schedules as provided for in section 627.736(5)(a)2.-5., Florida Statutes (2009), or is simply announcing that it is reserving its right to elect to do so. They analogize the policy at issue here to the ones found lacking in Geico General Insurance Co. v. Virtual Imaging Services, Inc., 141 So. 3d 147 (Fla. 2013) (“Virtual Imaging”), and Kingsway Amigo Insurance Co. v. Ocean Health, Inc., 63 So. 3d 63 (Fla. 4th DCA 2011) (“Kingsway”). In those cases, the courts found that the bare reference to the PIP statute was insufficient to put the insured and providers on notice that the insurer was, in fact, electing to employ the Medicare fee schedules. The Providers argue the language in the instant policy is similarly vague and only permissive in nature and merely incorporates the PIP statute. Our decision hinges on interpretation of contract of insurance language; thus our review is de novo. See Virtual Imaging, 141 So. 3d at 152 (citations omitted).
Provisions of the PIP statute, section 627.736, Florida Statutes, are at the center of the instant controversy. The statute lays out the benefits that a personal injury protection policy must provide and the methods of calculating reimbursements thereunder. Subsection 627.736(1)(a), Florida Statutes (2012), provides that “[e]very insurance policy . . . shall provide personal injury protection” to specified individuals as follows: “Medical benefits – Eighty  percent of all reasonable expenses for medically necessary medical . . . services.” As recognized by the Florida Supreme Court in Virtual Imaging, this provision requiring reimbursement of eighty percent of reasonable expenses for medically necessary services is “a basic coverage mandate” which is “the heart of the PIP statute’s coverage requirements.” 141 So. 3d at 155. Section 627.736(5)(a)1., Florida Statutes (2009), recites factors to consider in determining reasonableness.
[T]he 2008 amendments provided an alternative, permissive way for an insurer to calculate reimbursements to satisfy the PIP statute’s reasonable medical expenses coverage mandate, but did not set forth the only methodology for doing so.
The 2008 fee schedule amendments used the word “may” to describe an insurer’s ability to limit reimbursements based on the Medicare fee schedules. See § 627.736(5)(a)2., Fla. Stat. . . . [I]f an insurer is not required to use the Medicare fee schedules as a method of calculating reimbursements, the insurer must have “recourse to some alternative means for determining a reimbursement amount” if it chooses not to use the Medicare fee schedules. . . .
1 The statute was again amended in 2012 to add the following requirement: “Effective July 1, 2012, an insurer may limit payment as authorized by this paragraph only if the insurance policy includes a notice at the time of issuance or renewal that the insurer may limit payment pursuant to the schedule of charges specified in this paragraph.” Virtual Imaging, 141 So. 3d at 154 (emphasis in original) (quoting section 627.736(5)(a)5., Fla. Stat. (2012)).
the amount billed was reasonable. The permissive language of the 2008 amendments, therefore, plainly demonstrates that there are two different methodologies for calculating reimbursements to satisfy the PIP statute’s reasonable medical expenses coverage mandate.
Accordingly, we conclude that the 2008 amendments were clearly permissive and offered insurers a choice in dealing with their insureds as to whether to limit reimbursements based on the Medicare fee schedules or whether to continue to determine the reasonableness of provider charges for necessary medical services rendered to a PIP insured based on the factors enumerated in section 627.736(5)(a)1. In other words, we do not conclude that payment under section 627.736(5)(a)2. could never satisfy the PIP statute’s basic “reasonable expenses” coverage mandate, set forth in section 627.736(1). Instead, what we conclude is that the fee schedule payment calculation methodology in section 627.736(5)(a)2. was permissive.
Washington Nat’l Ins. Corp. v. Ruderman, 117 So. 3d 943, 948 (Fla. 2013) ((alteration in original) (internal citations omitted). “Further, in order for an exclusion or limitation in a policy to be enforceable, the insurer must clearly and unambiguously draft a policy provision to achieve that result.” Virtual Imaging, 141 So. 3d at 157.
‘“Whether a document is ambiguous depends upon whether it is reasonably susceptible to more than one interpretation. However, a true ambiguity does not exist merely because a document can possibly be interpreted in more than one manner.’” Smith v. Shelton, 970 So. 2d 450, 451 (Fla. 4th DCA 2007) (citation omitted). “In the event policy provisions are ambiguous . . . then well-established rules of construction must be applied. The most basic of these rules is that ambiguous policy provisions are to be construed in favor of the insured and against their drafter, the insurer.” Discover Prop. & Cas. Ins. Co. v. Beach Cars of W. Palm, Inc., 929 So. 2d 729, 732 (Fla. 4th DCA 2006) (citations omitted).
If the [insurer] wanted to take advantage of the permissive fee schedule, it should have clearly and unambiguously selected that payment methodology in a manner so that the insured patient and health care providers would be aware of it.
Kingsway, 63 So. 3d at 68 (alteration in original).
(a) 80% of medical expenses . . . .
Virtual Imaging, 141 So. 3d at 157. In finding that this language was not sufficient for the insurance company to utilize the fee schedule limits, the Florida Supreme Court pointed out that “[t]he . . . policy does not include any reference to the Medicare fee schedules . . . .” Id. at 158. The court agreed with the reasoning in Kingsway and held that in order to limit coverage to the Medicare fee schedules, “the insurer must clearly and unambiguously elect the permissive payment methodology . . . .” Id.
Here, providing that any amounts payable would be “subject to” “any and all limitations” authorized by the statute or any amendments thereto, Allstate did nothing more than state the obvious by indicating that there was a possibility (and the statutory authorization) for Allstate to apply a specific reimbursement limitation. The only reasonable way to read the language is as a general recital of Allstate’s reservation of its right to apply limitations authorized by law, with the accompanying and corresponding obligation to notify its policy holders of the election.
“subject to provision” fails to state anywhere in clear, plain text that it will not pay 80% of medically necessary services – which its primary coverage clause requires. Nor does Allstate express in any way that it pay no more than FS 627.736(5)(a)(2)(a-1) allow. Giving due effect to all relevant words, Allstate fails to state anywhere in explicit, plain, simple, apt words that Allstate will not pay 80% of reasonable charges and will actually limit payment to FS 627.736(5)(a)(2)(a-f).
By use of the phrase “subject to,” Allstate has not incorporated the optional provisions of the Medicare fee cap into the policy. See St. Augustine Pools, Inc. v. James M. Barker, Inc., 687 So. 2d 957, 958 (Fla. 5th DCA 1997) . . . (the words “subject to” in a contract are distinct from “incorporating” provisions of another document). Allstate has said nothing more than what is already true. All PIP policies are “subject to” these provisions; however, Allstate must clearly and unambiguously take the next step to incorporate these optional provisions into the policy if it desires to use the alternative methodology provided.
For Allstate to be allowed, after the fact, to pick and choose which ‘limitation’ amongst “any and all limitation” would render the Supreme Court’s ruling in [Virtual Imaging] meaningless.
Synergy Chiropractic & Wellness Ctr., Inc. v. Allstate Prop. & Cas. Ins. Co., 22 Fla. L. Weekly Supp. 750a (Broward County Court, Jan. 20, 2015) (footnote omitted).
Our sister court recently found the provision at issue here to be unambiguous and legally sufficient to give the required notice to policy holders. In Allstate Fire & Casualty Insurance v. Stand-Up MRI of Tallahassee, P.A., 40 Fla. L. Weekly D693 (Fla. 1st DCA Mar. 18, 2015), the First District reasoned that the plain language of the “subject to” provision “gives sufficient notice of [Allstate’s] election to limit reimbursements by use of the fee schedules.” Id. at 694. The court was persuaded by the use of the word “shall” in the provision. Id. The court also opined that Virtual Imaging provides for a “simple notice requirement,” and that the policy in Virtual Imaging was found deficient because it “failed to ‘indicate in any way . . . that it intended to limit its reimbursement to a predetermined amount of set reasonable medical expenses’ using the fee schedules.” Id. (quoting Virtual Imaging, 141 So. 3d at 158-59).
2 Allstate’s policy language simply incorporates the PIP statute (including but not limited to all fee schedules) into its insurance contract. Allstate reserves a plethora of options for itself but does not specify or enumerate anything.
that it will not pay the “basic” statutorily required coverage and will instead substitute the Medicare fee schedules as the exclusive form of reimbursement.
Virtual Imaging and Kingsway both make clear that insurance statutes require clarity and specificity in electing fee schedules with respect to PIP medical benefits coverage. Allstate’s post hoc explanation of its intent as to the policy language it chose does not now remake clarity or dispel ambiguities. Based on the foregoing, we find the language at issue is ambiguous and that it must therefore be construed in favor of the Providers. We reverse and remand for further proceedings and certify conflict with Allstate Fire & Casualty Insurance Co. v. Stand- Up MRI of Tallahassee, P.A., 40 Fla. L. Weekly D693 (Fla. 1st DCA Mar. 18, 2015).
Reversed and remanded for further proceedings. Conflict certified.
LEVINE, J., concurs specially with opinion. MAY, J., dissents with opinion.
I concur with the majority opinion and find that the language drafted by Allstate in its policy is ambiguous and thus compels a reversal.
In considering the specific provisions of this insurance contract, this case at its core rests on the following determination: if the provisions are unambiguous, then the insured has the sufficient notice required by the Florida Supreme Court in Virtual Imaging. However, if the provisions in question are ambiguous or can be susceptible to differing interpretations, then the insured does not have the sufficient notice mandated. “Policy language is considered to be ambiguous . . . if the language ‘is susceptible to more than one reasonable interpretation, one providing coverage and the other limiting coverage.’” Washington Nat’l Ins. Corp. v. Ruderman, 117 So. 3d 943, 948 (Fla. 2013) (quoting State Farm Mut. Auto. Ins. Co. v. Menendez, 70 So. 3d 566, 570 (Fla. 2011)).
Thus, our reading of the policy depends on what words or phrases would dominate the review. Is it “shall” as a mandatory command, is it “subject to” as a permissive instruction, or is it “shall be subject to” which is an amalgamation of both mandatory commands and permissive suggestions? The basic rules of contract interpretation instruct us to read the provisions in whole and not in isolated parts. Blackshear Mfg. Co. v. Fralick, 102 So. 753, 754 (Fla. 1925). “Courts should ‘avoid simply concentrating on certain limited provisions to the exclusion of the totality of others.’” Ruderman, 117 So. 3d at 948 (quoting Swire Pac. Holdings v. Zurich Ins. Co., 845 So. 2d 161, 165 (Fla. 2003)). Further, ambiguities are to be construed against the drafter. Hurt v. Leatherby Ins. Co., 380 So. 2d 432, 434 (Fla. 1980).
These principles of contract interpretation share a commonality with the principles of statutory interpretation. See OB/GYN Specialists of Palm Beaches, P.A. v. Mejia, 134 So. 3d 1084, 1093 (Fla. 4th DCA 2014) (stating that a statute is ambiguous “[w]here there is more than one reasonable interpretation”); Daneri v. BCRE Brickell, LLC, 79 So. 3d 91, 94 (Fla. 3d DCA 2012) (“When interpreting a statute, we interpret its language and the resulting operation of its terms by reading the statute as a whole to give it meaning in its entirety.”); Traci Commc’ns, Inc. v. Fla. Dep’t of Revenue, 737 So. 2d 1255, 1256 (Fla. 4th DCA 1999) (recognizing rule that ambiguities in tax law are to be construed against taxing authority and in favor of taxpayer); DeRoin v. State, Dep’t of Bus. & Prof’l Regulation, Bd. of Veterinary Med., 160 So. 3d 516 (Fla. 4th DCA 2015) (recognizing that statutes authorizing sanctions or penalties against a person’s professional license are to be interpreted in favor of the licensee). Because of these commonalities, it is useful to examine cases involving statutory as well as contractual interpretation in analyzing the case at bar.
Courts have through the years interpreted the phrase “shall be subject to” with obvious contradictory results. Some cases state that “shall be subject to” is a clear mandatory command. See Leslie Salt Co. v. United States, 55 F.3d 1388, 1397 (9th Cir. 1995) (majority finding “shall be subject to” imposes mandatory civil penalties); Beardsly v. Chicago & N. W. Transp. Co., 850 F.2d 1255, 1264 (8th Cir. 1988) (finding “shall be subject to” is mandatory); Jersey Cent. Power & Light Co. v. Melcar Util. Co., 59 A.3d 561, 568 (N.J. 2013) (reading phrase “shall be subject to” as mandatory to give effect to entire provision); Tilcon Conn., Inc. v. Town of N. Branford, 37 Conn. L. Rptr. 750 (Conn. Super. Ct. 2004) (listing cases finding “shall be subject to” is mandatory); TJX Cos., Inc. v. Superior Court, 77 Cal. Rptr. 3d 114, 118 (Cal. Ct. App. 2008) (stating “shall be subject to” imposes a mandatory obligation). See also Allstate Fire & Cas. Ins. v. Stand-Up MRI of Tallahassee, P.A., 40 Fla. L. Weekly D693 (Fla. 1st DCA Mar. 18, 2015) (finding, without analyzing phrase “shall be subject to,” that insurance policy gave sufficient notice as required by statute).
Alternatively, other cases declare that “shall be subject to” is permissive and thus discretionary in nature. Fallis v. City of N. Miami, 127 So. 2d 883, 884 (Fla. 1961) (finding that “shall be subject to referendum” permits a referendum); Leslie Salt, 55 F.3d at 1397-98 (dissent concluding that “shall be subject to” imposed a discretionary civil penalty); Pace Props., LLC v. Excelsior Constr., Inc., 3:08CV345/MCR/EMT, 2008 WL 4938412, at *3 (N.D. Fla. 2008) (listing cases finding “shall be subject to” is permissive); City of Rochester v.
Corpening, 907 A.2d 383, 387 (N.H. 2006) (majority finding that clause “shall be subject to” granted authority rather than imposed an obligation); Mena Films, Inc. v. Painted Zebra Prods., Inc., 831 N.Y.S.2d 348 (N.Y. Sup. Ct. 2006) (finding “shall be subject to” language in jurisdiction-conferring clause permissive).
Once again, by demonstrating there is more than one reasonable interpretation of this provision, the basic rules of contract interpretation, which we are bound by, instruct us to find against the drafter, and find for more expansive insurance coverage.
The case of Fallis v. City of North Miami is instructive. In Fallis, taxpayers attempted to contest a municipal bond by stating that the bond issuance required a referendum by the voters, where the provision stated that “[a]ll bonds or other evidence of indebtedness issued hereunder shall be subject to referendum . . . .” 127 So. 2d at 884.
A casual examination of the quoted provision might suggest merit in appellants’ position. However, upon closer scrutiny, it will be seen that all that this section provides is that the described evidences of indebtedness ‘shall be subject to referendum.’ The provision is not mandatory; it is obviously intended to permit a referendum on a bond ordinance when such is demanded in accordance with other provisions of the municipal charter.
Of course, Allstate could have written its policy to explicitly say that it “must” or “will” pay according to the limitations authorized by the statute. Then the policy would be clear and unambiguous. At oral argument, Allstate stated that in order to explicitly write in its policy that it will pay a certain rate as allowed by statute, such as 80% of 200% of the Medicare rates, Allstate would have to amend its policy each time the legislature changed the statute. Although that is an understandable concern, it does not make the language of that provision any less ambiguous or make the drafter of the policy any less required to write unambiguously if it wants to rely on such a provision as a binding interpretation.
The logic and reasoning of Judge O’Scannlain is also persuasive in Leslie Salt v. United States, where he, like Justice Scalia, recognized that even terms such as “shall” can lack precision and clarity. Salt concerned a statute with the same common phrase that confronts us here, “shall be subject to.” The Clean Water Act provided that “[a]ny person who violates [one of the enumerated sections of the Act] shall be subject to a civil penalty not to exceed $25,000 per day for each violation.” 55 F.3d at 1397.
3 “As Joseph Kimble, a noted drafting expert, puts it: ‘Drafters use it [shall] mindlessly. Courts read it any which way.’” Garner at 106 (citation omitted). Garner concludes that one should adopt the style of “transactional drafters [who] have adopted the shall-less style” with remarkable clarity. Id.
4 See Garner at 105-06 n.5-10 (citing Moore v. Illinois Cent. R. Co., 312 U.S. 630, 635 (1941); Railroad Co. v. Hecht, 95 U.S. 168, 170 (1877); W. Wis. Ry. V. Foley, 94 U.S. 100, 103 (1876); Scott v. United States, 436 U.S. 128, 146 (1978) (Brennan, J., dissenting); Gutierrez de Martinez v. Lamagno, 515 U.S. 417, 434 n.9 (1995); United States v. Montalvo-Murillo, 495 U.S. 711, 718 (1990)).
Id. at 1397-98 (citation omitted). He concludes that “[i]f Congress had meant civil penalties to be mandatory, it could have written [the section] to state that a violator ‘shall pay’ a civil penalty.” Id. at 1398.
In summary, I concur and would reverse the trial court and find the language in the policy ambiguous.
I respectfully dissent. For me, this issue was correctly decided in Allstate Fire & Casualty Insurance v. Stand-Up MRI of Tallahassee, 40 Fla. L. Weekly D693 (Fla. 1st DCA Mar. 18, 2015), and South Florida Wellness, Inc. v. Allstate Insurance Co., No. 13-61759-CIV, 2015 WL 897201 (S.D. Fla. Feb. 13, 2015). Both courts encountered the same insurer and the same policy language. Without struggling to create an ambiguity, the First District held “that Allstate’s policy language gave legally sufficient notice to its insureds of its election to use the Medicare fee schedules as required by Virtual Imaging.” Id. at D694. And as Judge Dimitrouleas found, “the relevant language unambiguously provides notice of Allstate’s election to use the Subsection 5(a)(2) fee schedule method.” S. Fla. Wellness, Inc., 2015 WL 897201, at *4. I agree with the conclusions reached by both courts and would affirm.
done here. It has placed the insured on notice that reimbursements are subject to the Medicare fee schedule-based limitation set forth in the PIP statute. There is nothing ambiguous in the policy’s language.
Unfortunately, the providers have led the majority down the yellow brick road. The issue is not whether the policy is ambiguous, but rather whether the policy adequately put the insured on notice of the insurer’s election to limit reimbursements according to the Medicare fee schedules set forth in section 627.736. See Geico Gen. Ins. Co. v. Virtual Imaging Servs., Inc. (Virtual Imaging), 141 So. 3d 147, 149–59 (Fla. 2013). Instead of simply reading the policy’s plain language for what it says, the majority spends fourteen pages trying to convince the reader that an ambiguity exists.
After all, let’s remember the purpose of PIP coverage. “[T]he purpose of the no-fault statutory scheme is to provide swift and virtually automatic payment so that the injured insured may get on with his [or her] life without undue financial interruption.” Id. at 153 (second alteration in original) (quoting Ivey v. Allstate Ins. Co., 774 So. 2d 679, 683–84 (Fla. 2000)) (internal quotation marks omitted). Providers, however, look to get paid as much as possible, but that does not inure to the insured’s benefit. The less costly the services provided, the more services the insured can receive. While some providers may choose to not treat an insured if their fee is limited to the Medicare fee schedules, that problem is one of the provider’s making, not that of the insurer.
Since its inception, the PIP statute has been the playing field where providers and insurers battle over the meaning of its language. The legislature continues to amend the PIP statute so that it serves the purpose for which it was intended. Indeed, the majority notes the numerous times the PIP statute has been amended. Each time that happens, insurers are required to review their policies and change language. That comes at a cost. And it is the insured that bears that cost.
what methodology will be used. As the First District articulated, “the language of [Allstate’s] policy makes reimbursements subordinate to the fee schedules in rather unmistakable terms.” Stand-Up MRI of Tallahassee, 40 Fla. L. Weekly at D694.
Here, Allstate specifically elected the limitations provided by the Medicare fee schedules and gave notice to the insured that it will pay according to their limitations. In short, the policy language is unambiguous.5 I would affirm.
5 In my view, it is unclear whether Virtual Imaging actually required an election of one of the two methodologies provided by the PIP statute as long as the insured is given notice that it would opt for one of the methodologies provided. That would still not make a policy ambiguous; it would simply allow the insurer discretion in choosing the methodology to be used.
With the increasing use of EHRs, practices are facing increased liability with regard to breaches of Protected Health Information (ePHI).
At the same time, increased HIPAA and HITECH security regulations and penalties for violations, also increase the healthcare provider’s liability for breaches of ePHI.
In part two of this series we are discussing simple steps to reduce most major threats to the safety of your ePHI.
Web 2.0 technologies like peer-to-peer file sharing and instant messaging are popular and make networking tools appealing. Wireless routing is a quick and easy way to set up broadband capability within an office.
However, because the sensitivity of healthcare information is protected by law, small practices that intend to rely on wireless networking must use special precautions.
Unless the wireless router is secured, its signal can be picked up from some distance away, including, for example, the building’s parking lot, other offices in the same building, or even nearby homes.
Therefore, it is crucial to secure the wireless signal so that only those who are permitted to access the information can pick up the signal.
Devices brought into the practice by visitors should not be permitted access to the network, since it is unlikely that such devices can be fully vetted for security.
Setting up a network to safely permit guest access is expensive and time-consuming, so the best defense is to prohibit casual access.
In configuring a wireless network, each legitimate device must be identified to the router and only those devices are permitted access.
Peer-to-peer applications, such as file sharing and instant messaging can expose the connected devices to security threats and vulnerabilities, including permitting unauthorized access to the devices on which they are installed.
Make sure these applications have been installed, reviewed and approved. It is not sufficient to just turn these programs off or uninstall them. A machine containing peer-to- peer applications may have exploitable bits of code that are not removed even when the programs are removed and should be encrypted.
Examples of mobile devices are laptop computers, handheld pads, smart phones, portable storage media (Disk, Thumb drives, external hard drives, etc.). They can make things easier, but they also present threats to information security and privacy. Some of these threats are similar to those of the desktop world, but others are unique to mobile devices.
Because of their very mobility, these devices are easy to lose and are very vulnerable to theft.
Mobile devices are more likely to be exposed to electro-magnetic interference (EMI), which can corrupt the stored information.
Not all mobile devices are equipped with strong authentication and access controls.
Mobile devices are frequently used to transmit and receive data wirelessly and must protect the information being intercepted.
Mobile devices that carry ePHI and that cannot support encryption should not be used. This includes thumb drives. Encrypted versions of these devices are available but are more expensive.
Staff members that that take ePHI home on mobile devices have responsibility for protecting patient data and must follow good security practices.
If it is necessary to remove a laptop containing ePHI from a secure area, the laptop’s hard drive should be encrypted.
Office Policies should specify all situations under which mobile devices can be removed from the facility, and care must be taken in developing and enforcing these policies.
In the next issue, we will go over a security risk analysis checklist to help you review your compliance activities.
If you would like to learn more about having an office that’s bullet proof, email me at drjohn@the complianceman.com to see if we can help you.
Again if you have any questions, don’t hesitate to contact me.
Reports of cyber attacks on large corporations such as Nationwide, JPMorgan Chase and even the Pentagon have been make big news. Yet, every day there are attacks aimed at small to mid-size organizations.
With the increasing use of EHRs, practices are facing increased liability with regard to breaches of protected Health information (ePHI). Hackers know that healthcare providers are less likely to fully protect themselves.
Many Doctors simply lack the knowledge and training needed to protect their offices against a cyber attack or meet HIPAA Security Rule requirements.
In this three part series we will discuss simple steps to reduce most major threats to the safety of ePHI. This should be considered basic computer security 101 and not a course on the HIPAA/HITECH rules.
First, unless your practice is totally disconnected from the Internet, it should have a Firewall to protect against threats from outside sources.
Basically, a Firewall is a system that prevents unauthorized access to a private network and works like a filter between your computer network and the Internet. Anything that goes into or out of the network must pass through the firewall.
The firewall examines each message and can be configured to prevent employees from sending certain types of emails or transmitting sensitive data outside of the network.
Additionally, firewalls can be programmed to prevent access to certain websites (like social networking sites) and can prevent outside computers from accessing computers inside your network.
Most computer operating systems come with a firewall installed and firewall software is also available at stores that sell computer products. Both types of firewall software normally provide technical support and guidance for users without the technical savvy.
In small offices, attackers compromise computers primarily through viruses, spyware and malware. Computers can become infected by outside sources such as CD- ROMs, e-mail, flash drives, and web downloads. Even a computer that has all the latest security updates to its operating system and applications can be at risk because of system flaws.
Anti-virus software is used to scan files to identify and eliminate computer viruses andmalicious software. It can also let you know when there has been an attempted threat to your system.
Anti-virus software analysis’s system files to look for known viruses, by means of a virus dictionary, and identifies suspicious behavior that might indicate an infection. Therefore, providing protection against brand-new viruses that do not yet exist in any virus dictionaries.
Without anti-virus software to identify infections, data may be stolen or destroyed. Reliable Anti-virus software is available at most stores that sell computer products, and are relatively inexpensive to buy.
Once you’ve down loaded anti-virus software to your computer, this includes hand held devices, make sure to keep it updated. Anti-virus products require regular updates in order to protect from new computer viruses.
Passwords are a first line defense in preventing unauthorized access to any computer and should be required to log into your system. In addition, passwords can be reviewed, using an audit trail log, to see who is accessing specific information and what changes where made to that information.
Passwords can also limit what information individual people have to certain information. This can include certain staff members, your IT contractor, your billing company or anyone who has remote access to your computer system.
You should also have policies in place to remove passwords on staff that leave or are terminated.
An administrator password is used only when you need to make changes or updates to your operating system. This means that anyone with this code can go anywhere and change anything in your system.
To decrease the chance that the administrator password gets stolen, the person in your office authorized to make changes to your system should have a separate user code that is used for daily system access.
It seems that surprise visits by special investigative units seem to be on the rise. Though providers are required to cooperate with the investigation, they do have certain rights when complying.
With this in mind, how should you respond to investigators?
First take the time to train your staff before an investigation occurs. You should ask for identification of anyone demanding protected information or access to your office. Your staff should make copies of the investigators identification and document the behavior of any investigator who makes demands or insinuates a threat.
This can help your defense with regard to improper behavior.
Secondly, it is important that you and your staff establish what authority they may have to inspect your office and for what purpose. This is so that you can verify their right to review protected information and see written proof of who they are representing.
This is your right and the office’s responsibility under HIPPA law. If and when you receive a surprise visit by an inspector, the following is a list of options to consider and to give your office some control of the situation.
1) Even with a subpoena, you have the right to defer an unannounced visit and schedule a more convenient time for their request.
2) Once they arrive, if they request additional information, you may ask to schedule another time to complete the inspection to allow adequate administrative staff to comply with the request.
3) You may request legal counsel at any time during the investigation. I would recommend this especially with federal or state agencies.
4) Get a list from the investigator of the information that they intend to inspect.
5) Provide the investigators with a private place to use for the inspection. This should be a place in your office away from your normal operating procedures and any other records, information or office marketing material that may draw their attention to other issues which are not a part of of the purpose of their visit.
6) Make available only the files and documents that they have requested. If they request additional information, you may ask to schedule another time to complete the inspection to allow adequate administrative staff to comply with the request.
7) Remember an investigator is not your friend. Think and remember to shut up. It is natural to attempt to defend your actions and to make sure that the investigators understand your side. However, it can jeopardize your opportunity for an effective defense.
8) If possible, have a compliance consultant available during the investigation. They should meet with you and your staff to review the investigation and to be present during the proceedings. If the consultant feels that there is a chance you could incriminate yourself, he will stop the interview and recommend that the interview be deferred until your attorney can be present.
9) If possible, always be present with the investigator for the duration of the visit. Even better, have a qualified compliance consultant who will stay with the investigator and obtain any information that may be needed to minimize you and your staffs member exposure to the investigator. The consultant may also review the records to give valuable information to determine what the worst case scenario might be.
10) Call or email me with concerns.Remember that the longer you’re in practice, the more likely you will to be investigated. By taking some careful steps when investigated, you can help ensure that your rights are safeguarded and it may result in a better outcome for your practice.
With investigations, CMS audits, OCR audits and MU audits on the rise the best advice that I can give you is to be prepared. So many doctors wait until an investigator walks into their office or until they receive a letter in the mail before doing anything about complying with the laws.
Have your compliance manual up-to-date, including your office policies and procedures as mandated by the OIG. Have copies of your most recent risk assessment and your risk assessment policies and procedures on file in your office as mandated by title II of HIPAA under the Security Rule.
Also, make sure that your office is using the new version of the Notice of Privacy Practices and that your privacy policies and procedures manual have been updated, as mandated by Title II of HIPAA The Privacy Rule.
Finally make sure that you understand the documentation requirements mandated by the CMS, private carriers and most States laws.

References: v. 
 v. 
 § 627
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.

 v. 
 v. 
 v. 
 v. 
 v. 
 V. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.