Healthcare Compliance for Surgeons
Amy Anderson, MBA
For surgeons running their own practices, navigating the complex world of healthcare compliance can feel overwhelming. And let’s be honest – does anyone understand all this stuff?
Understanding and implementing proper compliance measures is crucial for protecting your practice legally and financially. In a recent interview with healthcare attorney Michael Sacopulos, founder of Medical Risk Institute, he elaborated on key compliance areas every surgeon needs to be aware of.
Billing Compliance
Practices doing any third-party billing, even if it is a very small percentage of your revenue, are required by law to have a billing compliance plan. Billing compliance aims to prevent fraud and abuse in the healthcare system by ensuring that all billing practices are transparent, accurate, and in accordance with legal and regulatory requirements.
Key elements of billing compliance include:
Accurate Coding and Billing: Ensuring that all services provided are accurately coded and billed according to current coding standards and payer requirements.
Third-Party Billing Compliance: Practices that bill third parties must have a compliance plan in place, as mandated by law. This includes training staff, conducting audits, and implementing corrective actions for any identified issues.
False Claims Act: Compliance with the False Claims Act, which prohibits submitting false or fraudulent claims for payment to the government.
Training and Education: Regular training for staff on proper billing practices and updates to coding standards.
Auditing and Monitoring: Conducting regular audits to ensure billing accuracy and compliance with payer requirements.
Disciplinary Guidelines: Establishing and enforcing disciplinary guidelines for staff who violate billing policies.
While the specifics can be complex, working with a healthcare compliance expert, like Medical Risk Institute, can help ensure your billing compliance plan meets all legal requirements without overburdening your practice.
Patient Privacy and HIPAA Compliance
Patient privacy remains a major compliance focus, with risks coming from both cyber threats and human error. Common violations include:
Staff improperly sharing patient information
Responding to online reviews with protected health information
Improper disposal of patient records
HIPAA compliance involves adhering to a set of standards designed to safeguard Protected Health Information (PHI) and ensure patient privacy. The key elements of HIPAA compliance include:
Privacy Rule: This rule establishes national standards for the protection of PHI. It dictates how PHI can be used and disclosed by covered entities and business associates.
Security Rule: This rule sets standards for the protection of electronic PHI (ePHI). It requires the implementation of administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI.
Breach Notification Rule: This rule mandates that covered entities notify affected individuals, the Secretary of Health and Human Services (HHS), and, in some cases, the media of a breach of unsecured PHI.
Administrative Safeguards: Policies and procedures designed to manage the selection, development, and implementation of security measures to protect ePHI.
Physical Safeguards: Measures to protect electronic systems, equipment, and data from threats, environmental hazards, and unauthorized intrusion.
Technical Safeguards: Technology and policies to protect ePHI and control access to it.
HIPAA compliance requires ongoing efforts, including regular training for staff, risk assessments, and updates to policies and procedures to address new threats and vulnerabilities.
Cyber Insurance
Cyber insurance is now considered essential for surgery practices. A breach can cost $340-$368 per patient record, potentially bankrupting a practice without proper coverage.
When evaluating policies, look for:
Both first-party (your practice) and third-party (patients) coverage
Identity theft protection for affected patients
No exclusions for social engineering attacks
Sacopulos recommends a minimum of $1 million in coverage for new practices, potentially increasing to $3-5 million as the practice grows.
Compliance Priorities for New Practices
By prioritizing compliance from the start, you can protect your new practice and focus on providing excellent patient care. Remember, working with experienced healthcare compliance and legal experts can help you navigate these complex issues efficiently and effectively.
To learn more about the compliance programs offered through Medical Risk Institute, visit www.medriskinstitute.com.