States push ahead on public health insurance to lower costs, improve access, told its network hospitals in 34 states that it will assess emergency room claims. Failure to code correctly could directly impact a patients treatment. Here's how to avoid it. Several hospitals and health systems accidentally violated HIPAA as a result, including Novant Health, WakeMed Health and Hospitals, and Advocate Aurora Health. Tags: Claims Denials, coding, CPT Codes, healthcare fraud prevention, medical coding. Consequences of Coding Errors - MEREM Health Regardless of how they train themselves to do it, physicians should try to dictate in a way that supports current coding, not the old-fashioned subjective, objective, assessment, plan (SOAP) protocol. What is Upcoding? FAQ Kohn, Kohn & Colapinto LLP There are three cake layers: the history, the exam, and the medical decision making. They should use the documentation regs as a safe harbor. They are not enforcing it.". Everything else is excessive. The difference between an accidental disclosure and an incidental disclosure is that an accidental disclosure of PHI is an unintended disclosure such as sending an email containing PHI to the wrong patient. Ultimately, what happens if you accidentally break HIPAA rules depends on the content of your employers sanctions policy. Its a game, but legitimately so. Although few care to admit personally to improper coding, the trends are clear. 4 II. If you accidentally break HIPAA rules, the consequences depend on how the rules were broken, what the outcome was, and your previous compliance history. Term used when the insurance carrier bases reimbursement on a code level lower than the submitted by the provider. The data provided can be used to improve the website, services, and user experience. Then look for aberrant data. Coders and providers (rightly) worry about upcoding, or coding at a "higher level" than supported by documentation or medical necessity; however, "downcoding," or coding at a level lower than the level or service supported by documentation or medical necessity, is equally damaging, from a compliance perspective. This is often due to oversight, but some practices intentionally undercode to avoid an audit. According to an end-of-year report from the DOJ, federal prosecutors filed 371 criminal indictments in healthcare scam cases in 1999 - a 16 percent increase over the previous year; 396 defendants were convicted that year of criminal activity (that is, activity usually resulting in jail time, not just fines). Downcoding is a defensive approach used by certain providers to prevent refused claims, audits, and other problems. If circumstances similar to the examples above have occurred in your practice, it may be time to consider outsourced medical coding in order to improve the accuracy of codes and prevent these serious mistakes from affecting your patients. Delayed reimbursements are also costly, as they are unexpected. Downcoding is when dental plans use a procedure code different from the one submitted to determine a benefit in an amount less than that which would be allowed for the submitted code. Correct any errors in your coding and billing practices identified during this review to prevent future denials. Downcoding, on the other hand, disadvantages healthcare providers as patients pay less than they should for services offered. The code snippet is used for tracking visitor activity on websites and provides insights into how the website users are accessing the sites. If you didnt write it down, it didnt happen, at least as far as HCFA is concerned. When a practice downcodes, they code at a level lower than the medical service supported by medical necessity. However, the defined fee per group . Facing mounting criticism from hospitals and doctors groups, health insurance giant UnitedHealthcare said it will delay a policy that would scrutinize payments for non-urgent emergency . Medical Billing and Coding Review Flashcards | Quizlet And it provides another example: According to testimony by the Central Billing Office (CBO), hospitalized patients with respiratory infections are generally assigned to one of two diagnosis-related groups: respiratory infection or simple pneumonia. Unscrupulous health officials defraud patients by overbilling them. How Should You Respond to an Accidental HIPAA Violation? Appeal all code changes by the FI or PRO you believe to be inappropriate. Copyright 2014-2023 HIPAA Journal. When claims are denied, hospitals can submit evidence an emergency room visit met the definition of an emergency that is consistent with the prudent layperson standard, according to the insurer notice. LeGrand thinks the data already is skewed, and she thus encourages clients to use benchmarks only as a launching pad for a more intensive review. You should explain that a mistake was made and what has happened. Checks and balances in the billing process are another important pieces in the complex puzzle of avoiding upcoding and downcoding. Remember, too, that 1999 national data, or even 1998 data, will reflect existing patterns of downcoding. One of the best places to find examples of accidental HIPAA violations is HHS Breach Portal. If the HIPAA violation is ongoing or institutionalized, and the Privacy Officer fails to resolve the violation, members of a Covered Entitys workforce can make a complaint to HHS Office for Civil Rights. Your report could help your employer fill a gap in their compliance efforts which if left unfilled may lead to further accidental violations with more serious consequences. If audited, they may not have the documentation they need to support their coding patterns. HIPAA Advice, Email Never Shared Whether or not an accidental breach of confidentiality is the same as an accidental HIPAA violation depends on the nature of the confidential information disclosed, who the disclosure was made by, and who to. Example: A fax or email is sent to a member of staff in error. But where to start? If the documentation supports the code used, fine. Upcoding is a fraud that involves billing payers for more expensive procedures and treatments than those provided. Back to the basics: Post-pandemic enforcement of coding compliance issues. Coding patterns have shifted dramatically - from higher-level codes to lower-level ones. If the accidental violation is indeed a violation of HIPAA, the Privacy Office will need to determine whether or not the violation constitutes an impermissible use or disclosure which qualifies as a breach of unsecured PHI. It may be possible they were unaware they had accidentally violated HIPAA or they may have some other reasons for not reporting the violation. Thats only a $26 difference. Professional coder or not, if they are not keeping up with the nuances for your specialty, there is no use to either one of them, she says. 3)If the covered entity or business associate has a good faith belief that the unauthorized person to whom the impermissible disclosure was made, would not have been able to retain the information. 8 medical coding mistakes that could cost you For example, one of the exam elements for eyes is inspection of lids. Fear & Loathing In Coding - Physicians Practice Downcoding - Definition, Impact and Prevention Tips This kind of data analysis has an uncanny ability to motivate physicians to do better with coding. Or, step up and compare each physician, or the practice as a whole, to national or state data in your specialty, LeGrand suggests. Returning patients do not need to fill out a new history every time they visit the office - though plenty of physicians chew up time, money, and patient patience by asking for a new form each visit anyway. If someone unknowingly violates the Privacy Rule, how will they know they have violated the Privacy Rule unless a colleague or a supervisor tells them? If your Privacy Officer fails to investigate your suspicions, you should file a complaint with HHS Office for Civil Rights providing the agency with as much information as possible about how you suspect PHI is being used or disclosed in violation of the Privacy Rule. Upcoding is a severe compliance risk that may result in payer audits, payment reversals, and claims of abusive or fraudulent invoicing, whether deliberate or not. Downcoding is the total opposite of upcoding in medical billing. All rights reserved. This back up of denials due to coding errors requires focused efforts to catch up on claim denial and improve your revenue cycle. The first thing a Privacy Officer should determine is whether the accidental HIPAA violation is indeed a HIPAA violation or a violation of the organizations policies. This can ensure your login credentials are changed quickly to prevent a hacker gaining unauthorized access to a computer network. While were dismayed by Uniteds decision, we are not, unfortunately, surprised to see an insurance company once again try to cut its costs at the expense of necessary patient care, Dr. Mark Rosenberg, president of the emergency physicians group, said in a statement. The first, downcoding, reverse-engineers the transformations performed on the data, such as the zip code example mentioned earlier. If a healthcare employee accidentally views the records of a patient, if a fax is sent to an incorrect recipient, if an email containing PHI is sent to the wrong person, or if any other accidental disclosure of PHIhas occurred, it is essential that the incident is reported to your Privacy Officer. How quickly are your claims being followed up on upon initial denial? The appropriate sanction for an accidental disclosure of PHI depends on the circumstances of the accidental disclosure, the consequences of the accidental disclosure, and the previous compliance history of the individual. One of the largest causes of medical coding errors is due to inadequate medical documentation. "Based on feedback from our provider partners and discussions with medical societies, we have decided to delay the implementation of our emergency department policy until at least the end of the national public health emergency period," Tracey Lempner, spokeswoman for theMinnesota-based insurer, said in a statement. In circumstances where an accidental HIPAA violation has the potential to create further harm for example, if you have disclosed login credentials to a phishing site you should also inform your supervisor or manager immediately. Documentation for this can be as easy as writing something like, Health history from December 7, 1999, reviewed; agree with findings, LeGrand confirms. In the medical billing process, downcoding is the practice of submitting a diagnosis code that describes a less severe condition than what was actually treated. In November 2020,OCR fined the practice $25,000. Any accidental HIPAA violation that may qualify as a data breach must be treated seriously and warrants a risk assessment to determine the probability of PHI having been compromised, the level of risk to individuals whose PHI has potentially been compromised, and the risk of further disclosures of PHI. If one of our members does receive care in an emergency room for a non-emergent issue, like pink eye, we will reimburse the emergency facility according to the members benefit plan.". In a Thursday statement, the Minnesota-based insurer said the policy will be halted until the end of the pandemic. Incidental disclosures that are accidental are permitted by the Privacy Rule if they occur as a by-product of another permissible disclosure provided the Covered Entity has applied reasonable safeguards and implemented the minimum necessary standard where applicable with respect to the primary disclosure. According to the survey, physicians upcoded 19 percent of the time and downcoded 21 percent of the time. This article originally appeared in the March/April 2001 issue of Physicians Practice. If this were to happen, it would most likely be the case you have a history of accidental HIPAA violations and have received prior warnings about what might happen when you next violate HIPAA.