Do you allow your staff members to use smart devices in the office (i.e., smart phones, smart watches, smart speakers)?  Do you have a policy in place to safeguard patient information from access by those smart devices?
 
In an era where technology continues to advance at an exponential rate, the healthcare industry (along with most industries) is constantly “playing catch up.”  Chances are that most, if not all, of your staff members use a smart phone while at work.  In addition, some staff members may use smart watches, and others (likely fewer) may use, or have inquired about using, smart speakers to listen to music in the office.  Given the voice-assistant capabilities of those devices, there are safeguards that must be put in place to prevent potential HIPAA violations and/or breaches.  Below are the three (3) most common smart devices and the patient privacy issues that should be addressed in an internal office policy if you are going to permit staff members to use those smart devices in the office:

1. Smart phones:  Given the ubiquitous nature of smart phones in our society, prohibiting the use of the devices in the office is not realistic.  That said, usage policies should be implemented which limit, or negate, the ability of such devices to access patient information.  While prohibiting the use of phones during work hours is one step, it is likely not enough to sufficiently protect patient information.  For staff that use the voice-assistant capabilities of their devices (i.e. Siri, Cortana, Google), their devices are always “listening” to communications occurring when the capability is activated. However, there are methods by which this capability can be deactivated, at least when the phone is “locked”.  By requiring such deactivation, combined with the prohibition of phone use during work hours, you can more effectively prevent staff members from inadvertently giving their devices’ access to patient data. 
   
2. Smart watches:  Smart watches are less prevalent than smart phones, but their usage rate continues to grow.  Smart watches generally have the same capabilities as their complementary smart phone (i.e., phone calls, texting, voice-assistant).  Additionally, these devices also have the ability to deactivate the voice-assistant capability.  Accordingly, if smart watches are permitted in the office, your internal office policy should contain the same limitation on the use of the smart watch’s voice-assistant during work hours.
   
3. Smart speakers:  Smart speakers are most often used in the privacy of individuals’ homes.  However, some staff members may desire to use the speaker in the office to play music, set reminders and perform other tasks.  Although the speakers have the capability of working without using the voice-assistant technology, it is rare for individuals to use the speaker without such technology.  Accordingly, we generally recommend that smart speakers be prohibited from use in the physician office.  Unlike smart phones and (potentially) smart watches, smart speakers are not necessary for staff members’ daily living.  Further, given the intended use of the speakers (i.e. to play music, research miscellaneous facts, set reminders), it does not make practical sense to use the devices without the voice-assistant capability.  As a result, any policy that prohibits use of the voice-assistant during work hours would be futile and negate the convenience of the device itself. 
   

 
As advancements in technology continue and new smart devices are developed, you will need to revisit whether the use of those devices post a threat to your patients’ privacy rights and your office’s HIPAA compliance.  Your internal policies should be reviewed periodically to ensure that they address any new risks that are created by use of such devices.
 
If your office is interested in developing and implementing a device policy, please contact our firm. 

Pursuant to the new Merit-based Incentive Program System (“MIPS”), payment adjustments are applied to Medicare fee-for-service claims for practices’ performance on certain quality, improvement, information technology and cost measures.  We are now seeing the first payment adjustments being applied to 2019 claims based on 2017 performance.  Prior to the payment adjustments occurring, practices probably did not consider how such adjustments would impact their relationships with vendors, specifically those that they may rely on to achieve the performance requirements and that are compensated based on a percentage of the collections impacted by the adjustments – i.e., billing companies.
 
Except in those few states that prohibit percentage-based arrangements for billing companies, the majority of healthcare billing contracts provide for services in exchange for a percentage of collections.  Before MIPS, this made sense.  The more claims submitted by the billing company, the more services the billing company had to provide, and the more money the practice collected.  However, now that reimbursement for claims (at least Medicare claims) is being adjusted based on performance metrics of the practice, practices may begin to wonder whether it still makes sense to pay the billing company a percentage of all collections.  Below are three (3) key issues to take into consideration when negotiating compensation rates for billing companies given the new MIPS payment scheme:

1. Reporting method.  Practices have a number of options available for purposes of reporting their MIPS data.  One of these options is through their Medicare Part B claims submissions, thereby requiring assistance from their billing company.  The other four (4) options do not involve the submission of claims and therefore do not require the assistance of the billing company.  Further, only small practices (i.e., with 15 or less providers) can use the claims reporting mechanism, and that mechanism can only be used for certain quality measures (and not for improvement, information technology or cost measures).  Accordingly, it does not make sense for the billing company to get a percentage of any positive payment adjustment that a practice receives.  Even if the practice chooses to submit data via Part B claims, such submissions have a limited impact on the practice’s achievement of the positive adjustments.  It may make more sense to carve out any payment adjustment reimbursement before calculating the percentage-based fee due to the billing company.  To the extent that the billing company is legitimately performing additional services, the practice can pay the billing company an additional, reasonable flat fee for those services.
   
2. Liability for failure to meet benchmarks.  This issue is two-fold.  First, the billing company may, in some instances, be directly responsible for the practice’s failure to receive a positive adjustment (or for the receipt of a negative adjustment) if the billing company performed the claims submissions and erred in doing so.  In such instance, should the sole remedy to the practice be that the billing company receives a lesser reimbursement for those claims due to the negative or neutral adjustment?  Or, should the billing company be penalized further for those errors?  For instance, should the billing company be required to provide a performance guarantee related to the MIPS submissions, and if so, what is the penalty for failing to fulfill those guarantees?  Second, in the event that the practice does not use the billing company to submit data, and the practice’s performance results in a negative payment adjustment due to its own failures, should the billing company be entitled to some remedy for the lower reimbursement that they will receive as a result of such adjustment?
   
3. Addressing retrospective re-adjustments.  As practices may have already seen, there may be instances in which CMS makes incorrect adjustments to a practice’s claims and is required to retrospectively re-adjust the claims to account for such error.  In those instances, chances are that the billing company has already received their compensation based on the incorrect adjustment amount.  The practice is now forced to “chase” after the billing company for a refund of any overpaid fees.  Had the practice carved out the adjustments before calculating the billing company’s fees, this could have been avoided.
   

 
These three (3) issues only touch on the impact that MIPS has on billing company arrangements.  Further, similar considerations may apply to other vendor arrangements (e.g., EHR vendors responsible for tracking performance data).  Accordingly, practices must not only dedicate resources to achieving MIPS incentives, but also to reviewing and possibly renegotiating agreements that are impacted by their MIPS performance.
 
If you are concerned about the impact that MIPS has on your practice’s vendor agreements, contact our firm for assistance.

As private equity firms and health systems continue to purchase practices, independent physician practices look for ways to affiliate with one another and expand the services that they provide to patients.  For example, general ophthalmologists may lease space to or contract with retina specialists; dermatologists may lease space or contract with a physician to perform Mohs procedures; and multi-specialty groups may lease space to or contract with additional specialists.  In those instances, the general ophthalmologist, dermatologist and multi-specialty group want patients to view the contracted and lessee physicians as being a part of their practices.  However, if the practice is successful in this goal, they may be opening themselves up to liability for the physicians’ actions.
 
Across the country, courts have imposed liability on hospitals for the malpractice of non-employed physicians performing services within the hospital.  In such instances, the courts looked at whether the physician had “apparent authority” to act on behalf of the hospital.  If the hospital was found to have acted in a manner that would cause a reasonable patient to believe that the physician was acting on behalf of the hospital, and the patient relied on that belief when obtaining the physician’s services, the court held the hospital liable for the actions of the physician.  In making this determination, the courts looked at factors such as: (1) whether the hospital advertised the physician as being affiliated with the hospital; (2) whether patient registration and consent forms were on the hospital’s letterhead; (3) who was responsible for scheduling the physician’s visits/work hours; (4) whether the patient had a prior, ongoing relationship with the physician; and (5) whether the patient was provided notice of the independent contractor relationship through signage, verbal communications, and/or a written consent form. 
 
Given the increased possibility of injury from hospital procedures, malpractice actions are more often brought against hospitals than independent physician practices.  However, in the event that a patient is injured by a physician that is an independent contractor of, or leasing space from, your practice, he/she will likely sue both the physician individually, as well as the practice.  In such case, the courts would likely apply the same “apparent authority” test to the relationship between your practice and the physician.  Accordingly, it is important to ensure that your practice implements safeguards to avoid responsibility for the non-employed physicians’ actions.  Safeguards that you may consider include:

• Limit advertising of the physician's services. - Be cautious when including the contracted or lessee physicians on your practice’s website.  While it is safest to avoid listing the physicians on the site altogether, we understand that the entire purpose of contracting with and leasing to these physicians is to offer your patients their services.  Accordingly, when advertising those physicians’ services, avoid using phrases such as “our team of specialists” or “we offer [specialty] services”.  Also, include an express, conspicuous statement that the physicians are not employed by the practice and the practice is not responsible for their actions or omissions.
  
• Avoid using practice letterhead. - Patient consent and registration forms for the non-employed physicians’ services should be on the letterhead of the individual physician or the practice that employs him/her.  To the extent necessary (e.g., the patient is a patient of the practice but may require the services of a contracted specialist), include a disclaimer similar to that included on the website.  Make sure the disclaimer is conspicuously placed, is not in small or hard-to-read print, and is easily understandable by the patient.
  
• Post signage. - Place conspicuous signage in the office stating that the physicians are not employed by the practice.  For example, the front door may include those physicians under a separate practice name which employs them. 
  
• Distinguish their appearance. - Consider distinguishing the appearance of your employed physicians from independent contractors and lessee physicians.  This may include different scrubs, lab coats or name badges.
  

 
In the event that you are found liable for a contracted or lessee physician’s actions (either because these safeguards were not implemented or the court nevertheless found that the physician was acting on the practice’s behalf), it is important that you have in place protections to avoid suffering a negative financial impact.  Accordingly, it remains important that you have a written contract with your contracted and lessee physicians which:  (1) requires the physician to maintain sufficient malpractice insurance; (2) requires the physician to indemnify the practice for the physician’s actions and omissions; and (3) clearly states that the relationship between the practice and physician is one of independent contractors or lessor and lessee.  By doing so, your practice will have the contractual protection to avoid significant losses.
 
If you are concerned about the way  in which your practice advertises your contracted or lessee physicians’ services, contact our firm at (610) 296-1800.  We would be happy to assist in implementing the necessary safeguards to protect your practice.