In Canada (where privacy laws are similar to HIPAA), a man requested his surgery records, and soon received a package in the mail from the hospital. When he opened the package, however, he did not find his surgery records—he found another man’s autopsy.
Four nurse aides commit abuse with Facebook Live
The family of an Illinois nursing home resident who appeared in a caregiver’s Facebook Live video is suing the home. Four nursing aids allegedly participated in a video of the resident, who is a stroke survivor with dementia. The lawsuit asserts that the video shows the resident in bed, holding a diaper, surrounding by employees who are harassing him. One of the caretakers is heard yelling “Take off your pants, [resident name].”
This example poses HIPAA concerns and abuse concerns. Without a patient authorization, it is a potential HIPAA violation to record the resident and share that recording with third parties. In addition, CMS made it clear in its Survey & Certification Memo 16-33 that humiliating or demeaning photos or recordings of nursing home residents are mental abuse.
Snapchat use leads to criminal charges
The Department of Justice Criminal Division recently issued a Guidance Document for prosecutors: Evaluation of Corporate Compliance Programs.
In this document, the DOJ outlines three questions prosecutors should ask when making an "individualized determination of a corporate compliance program's effectiveness:
- "Is the corporation's compliance program well designed?"
- "Is the program being applied earnestly and in good faith?" In other words, is the program being implemented effectively?
- "Does the corporation's compliance program work" in practice?
We have an opioid problem
In the United States, 134 opioid-related deaths occur daily. In 2016, more than 60,000 Americans died from drug overdoses, and two-thirds of those deaths were opioid related. Fentanyl is now responsible for more overdose deaths (28.8%) than heroin. And, three out of four new heroin users first misuse prescription opioids.
In 2017, almost one-third of Medicare Part D beneficiaries received opioids. About 460,000 beneficiaries received high amounts of opioids; 71,000 beneficiaries were at serious risk of misuse or overdose; and almost 300 prescribers had questionable prescribing. Everyone agrees our country has an opioid problem.
In late 2018, the OCR entered an $111,400 settlement with Pagosa Springs Medical Center (PSMC), a Colorado critical access hospital. The OCR alleged that the hospital failed to terminate a former employee’s remote access to the hospital’s scheduling calendar, which includes patient PHI. The OCR also alleged that the hospital failed to enter a Business Associate Agreement with the scheduling calendar vendor.
Note: This topic is of special interest to our SNF readers. General healthcare compliance and HIPAA topics will return next week!
The Affordable Care Act mandated compliance and ethics programs for all nursing facilities. Medicare and Medicaid will require implementation by November 28, 2019.
Are you ready?
Fortunately, the ACA requirements closely – but not entirely – track the ACA OIG compliance program guidance and the Federal Sentencing Guidelines principles for compliance programs, so providers who have built compliance programs on these documents should be in pretty good shape. Here is what the ACA requires nursing facilities to have by November 28, 2019:
- Written compliance and ethics policies and procedures that are communicated to staff, contractors and volunteers and:
- Reduce the risk of criminal, civil and administrative violations
- Promote quality of care
- Designate a compliance contact to receive reports
- Include an anonymous way to report non-compliance without retribution
- Include disciplinary standards
- Apply to contractors and volunteers
- Assigned high-level personnel oversight for the compliance program, and sufficient resources and authority for such high-level personnel
- Due care not to delegate substantial discretionary authority to individuals the SNF knew or should have known had a propensity to commit a crime
- Auditing and monitoring
- A reporting system
- Consistent enforcement via discipline
- Annual review.*
*It can take weeks or even months to review a compliance program, so if this is your first experience with annual review, it is a good idea to start early.
Organizations with five or more facilities must also have:
An Arizona patient received a free sample for an erectile dysfunction (“ED”) medication from his doctor. Later, his pharmacy, Costco, called the patient to tell him that his full prescription was ready. The patient told Costco that he did not want the prescription and would not be picking it up.
One month later, the patient called Costco about another prescription. Costco again told the patient that his ED prescription was ready, and the patient again told Costco he did not want that prescription. The next day, the patient called Costco to give his ex-wife permission to pick up is prescription. The patient and his ex-wife were considering reconciling. A Costco employee gave the ex-wife the patient’s prescription – and the ED prescription, and joked with the ex-wife about the patient taking so long to pick it up. The ex-wife ended reconciliation attempts with the patient.
The patient sued Costco for negligence and other claims.
All skilled nursing facilities will be required to have conducted an annual review of their compliance programs by November 28, 2019 (and it’s essential for other providers, too). SNFs who have not conducted an annual review by November 28, 2019 will be in violation of the law.
After ransomware took over Brookside ENT & Hearing Services’ EMR system, it decided to close its practice for good. The virus deleted and overwrote the medical practice’s medical records, bills and appointments—and the backups. The virus left behind duplicates, which the hacker promised to unlock in exchange for a $6,500 ransom. The two doctors who own the practice wisely refused to pay the ransom. Instead, they called the FBI.