• Home
  • Legal/Compliance

Final Ruling

LegalImpact

Centers for Medicare & Medicaid Services publishes final rule on emergency preparedness.

By Paul J. Welk, PT, JD

On September 16, 2016, the Centers for Medicare & Medicaid Services (CMS) issued a final rule (“Rule”) providing for emergency preparedness requirements for certain Medicare- and Medicaid-participating providers and suppliers.1 The Rule went into effect on November 16, 2016; however, those health care providers and suppliers affected by the Rule2 are not required to be in compliance with the regulations until November 16, 2017, one year after the effective date.

New Evaluation Codes for Physical Therapists

january1_calendar
By Rick Gawenda, PT

When the clock struck midnight on January 1, 2017, “out with the old and in with the new” applied to suppliers and providers of physical therapy services. That’s because effective January 1, 2017, Current Procedural Terminology (CPT) codes 97001 (Physical therapy evaluation) and 97002 (Physical therapy reevaluation) were deleted and replaced with 3 new CPT codes for physical therapy evaluation and 1 new CPT code for physical therapy reevaluation.

According to the American Medical Association CPT 2017 Professional Edition, the new CPT codes are as follows:

97161 – Physical therapy evaluation: low complexity, requiring these components:

  • A history with no personal factors and/or comorbidities that impact the plan of care;
  • An examination of body system(s) using standardized tests and measures addressing 1-2 elements from any of the following: body structures and functions, activity limitations, and/or participation restrictions;
  • A clinical presentation with stable and/or uncomplicated characteristics; and
  • Clinical decision making of low complexity using standardized patient assessment instrument and/or measurable assessment of functional outcome.
  • Typically, 20 minutes are spent face-to-face with the patient and/or family.

97162 – Physical therapy evaluation: moderate complexity, requiring these components:

  • A history of present problem with 1-2 personal factors and/or comorbidities that impact the plan of care;
  • An examination of body systems using standardized tests and measures in addressing a total of 3 or more elements from any of the following: body structures and functions, activity limitations, and/or participation restrictions;
  • An evolving clinical presentation with changing characteristics; and
  • Clinical decision making of moderate complexity using standardized patient assessment instrument and/or measurable assessment of functional outcome.
  • Typically, 30 minutes are spent face-to-face with the patient and/or family.

97163 – Physical therapy evaluation: high complexity, requiring these components:

  • A history of present problem with 3 or more personal factors and/or comorbidities that impact the plan of care;
  • An examination of body systems using standardized tests and measures addressing a total of 4 or more elements from any of the following: body structures and functions, activity limitations, and/or participation restrictions;
  • A clinical presentation with unstable and unpredictable characteristics; and
  • Clinical decision making of high complexity using standardized patient assessment instrument and/or measurable assessment of functional outcome.
  • Typically, 45 minutes are spent face-to-face with the patient and/or family.

97164 – Reevaluation of physical therapy established plan of care, requiring these components:

  • An examination including a review of history and use of standardized tests and measures is required; and
  • Revised plan of care using a standardized patient assessment instrument and/or measurable assessment of functional outcome.
  • Typically, 20 minutes are spent face-to-face with the patient and/or family.1
  • Time Component

    You may notice that each CPT code has a typical amount of time that the physical therapist spent face-to-face with the patient and/or family performing the initial evaluation or reevaluation; however, it is important to understand that all 4 of the new CPT codes are untimed and the physical therapist would only bill 1 unit of the appropriate CPT code. In addition, the specified amount of time is only a guide and does not play a factor in deciding which evaluation code to report.

    So what does determine the level of evaluation reported by the physical therapist? At a minimum, the following components must be documented in the medical record in order to report the selected level of physical therapy evaluation:

    • History
    • Examination
    • Clinical presentation and decision making
    • Development of plan of care1

    History

    History would include patient personal factors such as age, gender, education level, lifestyle, social background, past and current experience, coping styles, character, and attitudes. History may also include patient comorbidities. Examples could be obesity, diabetes, hearing loss, vision loss, and cognitive deficits. Personal factors and comorbidities that exist but do not impact the plan of care are not to be considered when selecting the level of a physical therapy evaluation.1

    Examination

    To understand the impact the examination has on the level of evaluation code reported, we must first understand some definitions.

    Body regions: head, neck, back, lower extremities, upper extremities, and trunk

    Body systems: musculoskeletal, neuromuscular, cardiovascular pulmonary, and integumentary

    1. Musculoskeletal system would include the assessment of gross symmetry, gross range of motion, gross strength, height, and weight.
    2. Neuromuscular system would include the general assessment of gross coordinated movement such as balance, gait, transfers, and motor function (motor control and motor learning).
    3. Cardiovascular pulmonary includes the assessment of heart rate, respiratory rate, blood pressure, and edema.
    4. Integumentary system includes the assessment of pliability, presence of scar formation, skin color, and skin integrity.

    Body structures: The structural or anatomical parts of the body, such as organs, limbs, and their components, classified according to body systems.

    Activity limitations: A difficulty encountered by an individual in executing a task or action (e.g., mobility, self-care, domestic life).

    Participation restrictions: A problem experienced by an individual in involvement in life situations (e.g., social interactions, family relationships, engaging in religious or spiritual activities).1

    As you can see, the therapist documentation of deficits of body structures and functions as well as how those deficits cause activity limitations and participation restrictions are crucial to the selection of the correct level of evaluation.

    Clinical Presentation of the Patient

    Clinical presentation is also an important piece of documentation completed by the evaluating therapist and contained in the initial evaluation documentation. CPT code 97161 states “A clinical presentation with stable and/or uncomplicated characteristics.” An example could be a patient who has centralized low back pain with no radicular symptoms and can be expected to progress in a certain manner during the episode of care.

    CPT code 97162 states “An evolving clinical presentation with changing characteristics.” An example could be a patient who has had low back pain for the past 2 weeks, but 2 or 3 days ago, began experiencing tingling and burning sensations on the top and sole of his right foot.

    CPT code 97163 states, “A clinical presentation with unstable and unpredictable characteristics.” An example could be a patient who has a sudden drop in blood pressure, becomes diaphoretic, or experiences difficulty breathing during the initial evaluation.

    Clinical Decision Making

    The therapist must use a standardized patient assessment instrument and/or measurable assessment of functional outcome during the initial evaluation. Examples include, but are not limited to, Disabilities of the Arm, Shoulder, and Hand (DASH), Quick DASH, Neck Disability Index, Oswestry, Lower Extremity Functional Scale, Berg Balance, Tinetti, Upper Extremity Functional Index, etc.

    Deciding Which Evaluation Code to Report

    You have completed the initial examination, documented the subjective reports of the patient and/or caregiver as well as the objective findings and patient assessment instrument, documented your assessment of the patient, and developed the plan of care. How do you determine what level of evaluation to report?

    You must go back and look at the 3 categories: patient history, examination, and clinical presentation of the patient. The patient must meet the criteria in all 3 categories to bill that particular level of evaluation CPT code.

    For example, in order to bill the moderate complexity evaluation code, the patient must have 1-2 personal factors and/or comorbidities that impact the plan of care, a total of 3 or more elements from any of the following: body structures and functions, activity limitations, and/or participation restrictions, and an evolving clinical presentation with changing characteristics.

    If the patient only had a total of 3 or more elements from any of the following body structures and functions, activity limitations, and/or participation restrictions, and an evolving clinical presentation with changing characteristics, but had no personal factors and/or comorbidities that impact the plan of care, the therapist would have to select code 97161, Physical therapy evaluation: low complexity.

    Let’s look at CPT code 97163, Physical therapy evaluation: high complexity. In order for the physical therapist to report this evaluation code, the patient must have 3 or more personal factors and/or comorbidities that impact the plan of care, a total of 4 or more elements from any of the following: body structures and functions, activity limitations, and/or participation restrictions, and a clinical presentation with unstable and unpredictable characteristics.

    If the patient only had a total of 4 or more elements from any of the following: body structures and functions, activity limitations, and/or participation restrictions, and a clinical presentation with unstable and unpredictable characteristics, but had no personal factors and/or comorbidities that impact the plan of care, the therapist would have to select code 97161, Physical therapy evaluation: low complexity.

    What insurance carriers will use the new evaluation and reevaluation codes?

    Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), all HIPAA-covered entities must use the current year’s CPT codes. Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which the U.S. Department of Health and Human Services (HHS) has adopted standards. Generally, these transactions concern billing and payment for services or insurance coverage. For example, hospitals, academic medical centers, physicians, and other health care providers who electronically transmit claims transaction information directly or through an intermediary to a health plan are covered entities. Covered entities can be institutions, organizations, or persons.

    This means that hospital outpatient departments, skilled nursing facilities, rehabilitation agencies, comprehensive outpatient rehabilitation facilities, home health agencies, and private practices are an HIPAA-covered entity and are required to use the current year’s CPT codes. In addition, insurance carriers such as Medicare, Medicaid, Aetna, Cigna, Blue Cross Blue Shield (BCBS), United Healthcare, Humana, TriCare, etc., are also HIPAA-covered entities and are required to use the current year’s CPT codes.2

    Who would not be mandated to use the new evaluation and reevaluation codes?

    The HIPAA Privacy Rule does not apply to entities that are either workers compensation insurers, workers compensation administrative agencies, or employers, except to the extent they may otherwise be covered entities. The HIPAA privacy rule also does not apply to automobile medical payment insurance, coverage for onsite medical clinics, liability insurance, and coverage issued as supplemental to liability insurance.2

    This means workers compensation and auto no-fault plans are not mandated by HIPAA to use the current year’s CPT codes and if they wanted to, could continue to use the old and deleted physical therapy evaluation and reevaluation and occupational therapy evaluation and reevaluation CPT codes. As a provider of outpatient therapy services, you will want to contact your various workers compensation and auto no-fault plans to see if they will switch to the new evaluation and reevaluation CPT codes effective with dates of service on and after January 1, 2017.

    Will Insurances Pay for the New Evaluation Codes?

    While insurance carriers must use the new CPT codes due to HIPAA, HIPAA does not mandate that the insurance carriers have to pay for the 3 new physical therapy evaluations or 3 new occupational therapy evaluations. Providers of physical therapy services will have to work with each of their insurance carriers to determine if they will recognize and pay for all 3 new evaluation codes.

    Medicare Payment for the New Evaluation Codes

    On November 2, 2016, the Centers for Medicare & Medicaid Services (CMS) issued the final rule for calendar year 2017 for services paid under the Medicare Physician Schedule. In the final rule, CMS finalized their proposed rule to pay the 3 new physical therapy evaluation codes the same dollar amount due to concerns of potential upcoding on the part of the physical therapist. CMS is concerned that if they paid each of the 3 new physical therapy evaluation codes a different rate that it would incentivize the physical therapist to report the higher complexity evaluation code in order to receive a bigger payment especially as physical therapists become familiar with the new requirements that must be satisfied to report each evaluation code.3

    References

    1. American Medical Association, Current Procedural Terminology; CPT 2017; Professional Addition.

    2. Centers for Medicare & Medicaid Services; Are You a Covered Entity, www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity.html. Accessed November 17, 2016.

    3. Centers for Medicare & Medicaid Services, Medicare Program; Revisions to Payment Policies under the Physician Fee Schedule and Other Revisions to Part B for CY 2017; Medicare Advantage Bid Pricing Data Release; Medicare Advantage and Part D Medical Loss Ratio Data Release; Medicare Advantage Provider Network Requirements; Expansion of Medicare Diabetes Prevention Program Model; Medicare Shared Savings Program Requirements; Final rule, s3.amazonaws.com/public-inspection.federalregister.gov/2016-26668.pdf. Accessed November 17, 2016.

    rick-gawenda

    Rick Gawenda, PT, is the president of Gawenda Seminars & Consulting and is a member of the PPS Payment Policy Committee. He can be reached at info@gawendaseminars.com.

    Compliance Q & A

    qanda

    How well do you know compliance requirements?

    By Mary R. Daulong, PT, CHC, CHP

    Therapists and practice owners are in a complicated and risky situation when it comes to finding accurate answers to compliance requirements. Each day there appears to be yet another regulation or another modification or escalation to an existing regulation. How and when are practitioners expected to find the time to monitor the ever-changing regulatory environment?

    While we all need to be accountable as professionals, we can accept a little help from a qualified source. As a compliance consultant I, along with my peers, spend hours validating resources so that a client, a colleague, or a student can feel confident that the answer provided is accurate and has been authenticated.

    I would like to share with you some questions I have fielded and cases I have encountered in the past month or so. (I have provided resources online). As you read this column, answer the questions posed by circling “yes” or “no.” If you selected the correct answer, then pat yourself on the back and just file the answer. If, however, you did not have the correct answer, please take the time to read the supporting information online.

    1. Is there a potential that I could lose my Medicare billing privileges if I do not report a change in enrollment information such as a change in practice location or final adverse action?

    Yes.   No.

    2. Could I be sanctioned for accepting in-network payment rates from a patient if I am out-of-network with that payer?

    Yes.   No.

    3. Are the new Medicare Supplemental Medical Review Contractor and the Office of Inspector General focusing on the number of units a therapist bills in a given day?

    Yes.   No.

    4. Will the new alternative payment system for interventions (treatments) go into effect January 1, 2017?

    Yes.   No.

    5. Is it true that the Physician Quality Reporting System (PQRS) is being retired, as it currently exists, on December 31, 2016?

    Yes.   No.

    6. Would I meet the Health Insurance Portability and Accountability Act (HIPAA) security requirement of conducting a Risk Assessment, if I only performed it once?

    Yes.   No.

    7. Do private practices have to comply with Occupational Safety & Health Administration’s (OSHA) Bloodborne Pathogens Standard?

    Yes.   No.

    8. Do I have to update my OSHA Safety Data Sheets (formerly Material Safety Data Sheets) to comply with the Globally Harmonized System effective June 1, 2016?

    Yes.   No.

    9. Does my workforce have to be educated on the new OSHA labeling system?

    Yes.   No.

    10. Does the “one to one” Current Procedural Terminology (CPT) coding definition apply to all patients regardless of payer classification?

    Yes.   No.

    11. Can a physical therapist assistant treat a Tricare patient under the supervision of a physical therapist?

    Yes.   No.

    12. Can I bill for a reevaluation on Medicare patients solely because my state’s practice act requires monthly reevaluations on all patients?

    Yes.   No.

    13. Is a physical therapist in private practice (PTPP) required to have a site visit because PTPPs are in Medicare’s Moderate Risk Classification as it relates to fraud and abuse?

    Yes.   No.

    14. Should I expect a basic site visit if I am a newly enrolled practice; if I add a physical therapist to the practice; if I change or add a practice location; or if I, my practice, or staff are due to revalidate enrollment with Medicare?

    Yes.   No.

    15. Can Medicare recoup payment if a timely appeal request is made at either and/or both the first level and second level of appeals before the contractor has determined that there was actually an overpayment?

    Yes.   No.

    Answers with supporting references:

    1. Yes
    Pub. 100-08 Transmittal: 304 Date: September 25, 2009 Change Request: 6642

    Revocation 11 (42 CFR §424.535(a)(9)): If the individual or organization reports a change in practice location more than 30 days after the effective date of the change, the contractor shall not revoke the supplier’s billing privileges on this basis. However, if the contractor independently determines—through an on-site inspection under 42 CFR 424.535(a)(5)(ii) or via another verification process—that the individual’s or organization’s address has changed and the supplier has not notified the contractor of this within the aforementioned 30-day timeframe, the contractor may revoke the supplier’s billing privileges.

    Click here for more information.

    2. Yes
    Providers have encouraged patients to continue receiving services despite the provider’s out-of-network status by waiving or reducing the increased portion of the copayment, coinsurance, or deductible amount attributable to the out-of-network services. Notably, this reduction or waiver is being given without regard to the patient’s financial ability to pay in an attempt to create parity for the member so that the cost to the plan member is the same as if he or she had gone to an in-network provider (the practice). But providers who engage in this practice risk being charged with violating state and federal laws and sued by managed care organizations (MCOs).

    Click here for more information.

    3. Yes
    CMS has tasked Strategic Health Solutions as the Supplemental Medical Review Contractor (SMRC) with performing this medical review on a postpayment basis. The SMRC will be selecting claims for review based on:

    • Providers with a high percentage of patients receiving therapy beyond the threshold as compared to their peers during the first year of the Medicare Access and CHIP Reauthorization Act (MACRA)
    • Therapy provided in skilled nursing facilities (SNFs), therapists in private practice, and outpatient physical therapy or speech-language pathology providers (OPTs) or other rehabilitation providers

    Of particular interest in this medical review process will be the evaluation of the number of units/hours of therapy provided in a day.

    Click here for more information.

    4. No
    The proposed physical therapy evaluation and reevaluation codes will be implemented January 1, 2017. At this time there is no set implementation date for the proposed intervention codes.

    Click here for more information.

    5. Yes
    The current quality reporting programs under Medicare part B will be replaced with a new quality reporting program, the Merit-based Incentive Payment System (MIPS), in 2017 as required by the Medicare Access and CHIP Reauthorization Act of 2015 legislation. MIPS will begin in 2017 for physicians and other practitioners, but will not include physical therapists.

    The Secretary has the discretion to add physical therapists to MIPS beginning in the 2019 reporting year (2021 payment adjustment year).

    Click here for more information.

    6. No
    The risk analysis process should be ongoing. In order for an entity to update and document its security measures “as needed,” which the Rule requires, it should conduct continuous risk analysis to identify when updates are needed (45 C.F.R. §§ 164.306(e) and 164.316(b)(2)(iii). The Security Rule does not specify how frequently to perform risk analysis as part of a comprehensive risk management process. The frequency of performance will vary among covered entities. Some covered entities may perform these processes annually or as needed (e.g., biannually or every 3 years) depending on circumstances of their environment.

    Click here for more information.

    7. Yes
    The standard’s requirements state what employers must do to protect workers who are occupationally exposed to blood or other potentially infectious materials (OPIM), as defined in the standard. That is, the standard protects workers who can reasonably be anticipated to come into contact with blood or OPIM as a result of doing their job duties.

    Click here for more information.

    8.Yes
    June 1, 2016 is the final deadline and date by which employers must be in full compliance with the Globally Harmonized System (GHS). That means making any necessary updates to their hazard communication programs, training employees on new hazards identified during the reclassification process, updating workplace labels, and anything else required by HazCom 2012.

    Click here for more information.

    9. Yes
    December 1, 2013 was the date by which employers were required to train employees on the new SDSs and labels in GHS format.

    Click here for more information.

    10. Yes
    Covered entities must adhere to the content and format requirements of each transaction. Under HIPAA, the Department of Health and Human Services (HHS) also adopted specific code sets for diagnoses and procedures to be used in all transactions, including the Current Procedural Terminology (CPT®) (outpatient services/procedures), the Health Care Procedure Coding System (HCPCS) (ancillary services/procedures), International Classification of Diseases, Ninth Revision (ICD-9) (diagnosis and hospital inpatient procedures), and ICD-10 (as of October 1, 2015).

    Click here for more information.

    11. No
    In contrast, when a physical therapist assistant (PTA) performs a physical therapy modality, he or she is performing a medical procedure and rendering treatment, not simply providing a service that is incidental to treatment. Therefore, the difference here is that unauthorized TRICARE providers working under the physician’s supervision do not “treat” patients, whereas a PTA (currently an unauthorized TRICARE provider) working under a physical therapist’s supervision does.

    Click here for more information.

    12. No
    Reevaluation provides additional objective information not included in other documentation. Reevaluation is separately payable and is periodically indicated during an episode of care when the professional assessment of a clinician indicates a significant improvement, or decline, or change in the patient’s condition or functional status that was not anticipated in the plan of care. Although some state regulations and state practice acts require reevaluation at specific times, for Medicare payment, reevaluations must also meet Medicare coverage guidelines, noted above. The decision to provide a reevaluation shall be made by a clinician.

    Click here for more information.

    13. Yes
    Consistent with 42 CFR § 424.518, newly enrolling and existing providers and suppliers will, beginning on March 25, 2011, be placed into one of three levels of categorical screening: limited, moderate, or high. Physical therapists enrolling as individuals or as group practices are in the “moderate” level of categorical screening, which requires a site visit by a National Site Visit Contractor (NVSC). Site visits are required for:

    • Initial application
    • Revalidation
    • Practice location addition and/or change
    • Change of ownership that results in a new taxpayer identification number/employer identification number (TIN/EIN)
    • Reactivation of privileges

    Click here for more information.

    14. Yes
    Specifically, a contractor’s report for an unannounced site visit will document the date and time of the visit and observations made at the facility, such as the facility was vacant and free of all furniture, a notice of eviction or similar documentation is posted at the facility, or the space is occupied by another company. The contractor also will photograph the provider or supplier for inclusion in the provider’s file. In terms of the extent of the visit, the contractor will determine whether the following criteria are met:

    • The facility is open.
    • Personnel are at the facility.
    • Customers are at the facility (if applicable to that provider or supplier type), and
    • The facility appears to be operational.

    This will require the site visitor(s) to enter the provider’s practice or the supplier’s site rather than simply conducting an external review. If any of the 4 elements listed above are not met, the provider’s enrollment application may be denied or Medicare billing privileges revoked.

    Click here for more information.

    15. No
    For overpayments subject to this limitation on recoupment, Medicare will not begin overpayment collection of debts (or will cease collections that have started) when it receives notice that the provider has requested a Medicare contractor redetermination (first level of appeal) or a reconsideration by a Qualified Independent Contractor (QIC).

    As appropriate, Medicare will resume overpayment recoveries with interest if the Medicare overpayment decision is upheld in the appeals process. If the dministrative Law Judge (ALJ)-level process reverses the Medicare overpayment determination, Medicare will refund both principal and interest collected, and also pay 93 percent interest on any recouped funds that Medicare took from ongoing Medicare payments.

    Click here for more information.

    PHOTO-Mary-Daulong-Keep-on-file

    Mary R. Daulong, PT, CHC, CHP, is a PPS member and the owner of Business & Clinical Management Services, Inc., a consulting firm specializing in outpatient therapy compliance, including documentation, coding and billing, enrollment and credentialing, and Health Insurance Portability and Accountability Act and Occupational Safety and Health Administration regulation education. She is also the author of both The Private Practice Compliance Manual and The Third-Party Biller Compliance Manual. She can be reached at daulongm@bcmscomp.com.

    The Basics

    padlock_people

    Performing a HIPAA risk assessment for a suspected breach.

    By Paul J. Welk, JD, PT

    Most private practice physical therapists, even those who devote only limited time and attention to current events surrounding the Health Insurance Portability and Accountability Act of 1996 (HIPAA), are aware of the risks associated with a breach of Protected Health Information (PHI) and the potential negative ramifications of the same. That being said, many of these individuals nonetheless believe they are “careful enough” that neither they nor their practice will ever need to assess a potential HIPAA breach. The purpose of this column is to illustrate that breaches do occur in private practice physical therapy offices with more frequency than practitioners might imagine and to review certain steps in the risk assessment process that are undertaken should an impermissible use or disclosure of PHI occur.

    As a starting point, the HIPAA Breach Notification Rule requires a covered entity to provide notice to affected individuals following a breach of unsecured PHI. A breach is generally defined as an impermissible use or disclosure under the privacy rule that compromises the security or privacy of PHI.1 However, it is important to note that not every impermissible use or disclosure of PHI is a breach. When an impermissible use or disclosure occurs, a practice must perform a multiple-step risk assessment to determine whether there is a “low probability” that PHI has been compromised. An impermissible use or disclosure is presumed to be a breach unless the practice can demonstrate such “low probability” based on the risk assessment.

    In completing the required risk assessment, the practice must assess various factors, including at least four that are specifically enumerated in the HIPAA Omnibus Final Rule.2 The first required factor to consider is the nature and extent of the PHI involved, including the types of identifiers and the likelihood of reidentification. For example, when assessing this factor relative to clinical information, a physical therapy private practice would need to consider the specific type of information involved (e.g., diagnosis, medical history, imaging study results). More specifically, if the practice inadvertently disclosed a list of patient diagnosis and discharge dates only, the practice may ultimately determine that this specific factor weighs in favor of a finding of “low probability” that the PHI has been compromised. This determination may rely on the fact that the individuals could not be identified based on factors such as the specificity of the diagnosis and given the large size of the community served by the practice.

    screen-shot-2016-09-28-at-4-35-01-pm

    The second required factor is giving consideration to the unauthorized person who used the PHI or to whom the disclosure was made. For example, if PHI is impermissibly disclosed by a physical therapy practice to another covered entity obligated to comply with HIPAA, there may be a lower probability that the PHI has been compromised. This determination is due to the fact that the recipient is obligated to protect the privacy of the information in a manner similar to that of the private practice responsible for the impermissible disclosure. On the contrary, if the same information is disclosed to an employer of the affected individuals, the employer may be able to determine to which employee the information relates based on information already known to the employer. As seen by these two contrasting examples, the determination as to whether a breach has occurred requires a detailed fact-specific analysis.

    The third required factor is whether the PHI was actually acquired or reviewed. For example, if a laptop computer containing PHI is stolen but it can be definitively shown through an analysis that the PHI was never accessed or otherwise compromised, the practice may determine that the information was not actually acquired. On the contrary, if an individual is inadvertently mailed the PHI of a second individual and notifies the practice of the receipt of the incorrect information, it is obvious that the information was in fact accessed and viewed.

    The fourth required factor is the extent to which the risk to the PHI has been mitigated. There are multiple ways in which mitigation can occur. For example, a physical therapy practice may be able to obtain satisfactory written assurances from an unauthorized recipient that the information will not be further used and disclosed and will be either returned immediately to the covered entity or otherwise destroyed.

    Although many readers assume they will never have to perform a risk assessment or be involved with an impermissible use or disclosure, that assumption may well not be the case. The author is aware of dozens of impermissible uses or disclosures by physical therapy private practices, some of which were determined to be a breach and others which were demonstrated to involve a “low probability” that the PHI was compromised. In these various incidents, factors that weighed in favor of a finding of low probability were, among others, a fax being sent to the incorrect health care provider (as contrasted with a fax to an unregulated individual or entity), the PHI disclosed consisting only of a patient name and telephone number (as contrasted with a complete medical record), a stolen laptop that was remotely wiped prior to access by a third party (as contrasted with a laptop that was unsecured), and the use of an affidavit signed by an unauthorized PHI recipient to demonstrate appropriate mitigation (as contrasted with a case in which the unauthorized recipient is never identified).

    In summary, practices should be cautious not to jump to the conclusion that a breach has occurred in all cases of impermissible PHI disclosure, but rather should complete a risk assessment to determine if there is a low probability that the PHI was compromised. Although performing a risk assessment following a suspected breach of unsecured PHI may be a time-consuming endeavor, it is not only a regulatory obligation but an important step in determining whether a breach has occurred and what actions must subsequently be taken under HIPAA.

    Please note that this article is not intended to, and does not, serve as legal advice to the reader but is for general information purposes only.

    REFERENCES

    1. See www.hhs.gov/hipaa/for-professionals/breach-notification/index.html. Accessed July 4, 2016.

    2. See www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf. Federal Register, Vol. 78, No. 17. Friday, January 25, 2013. Accessed July 4, 2016.

    Paul_Welk

    Paul J. Welk, PT, JD, is a Private Practice Section member and an attorney with Tucker Arensberg where he frequently advises physical therapy private practices in the areas of corporate and health care law. He can be reached at pwelk@tuckerlaw.com.

    Hiding in Plain Sight

    Camouflage_codes_2

    Therapy Coding Billing and Compliance Risk

    By Nancy J. Beckley, MS, MBA, CHC

    It all started out with a call from a health law attorney. He represented a small private practice that was under investigation. The therapy practice was in receipt of a civil investigative demand (CID); the U.S. Attorney’s office was involved as well as investigators representing federal health care programs. Is therapeutic exercise a one-on-one code? mused the attorney. If it is, how can a small practice stay in business if they have to treat patients individually? was the follow-up question.

    Unfortunately, I have received many similar calls in the past year. Whistleblower cases, audits under the Office of Inspector General (OIG) Work Plan (Physical Therapists in Private Practice), Medicare Administrative Contractor (MAC) widespread probes and provider-specific probes, and unannounced visits by Zone Program Integrity Contractors (ZPICs). Outpatient physical therapy has been on the review radar with the OIG for over six years.

    Reports under the OIG Work Plan are routinely published to the OIG’s website, and if nothing else they should serve as learning tools for all outpatient therapy providers, not just those in private practice. There have also been several settlement agreements and/or integrity agreements for small therapy providers in just the past several months. We have come a long way since the original OIG reports on Gem Physical Therapy and World Gym (both in South Florida) issued 16 years ago, and a long way from the “big news” corporate integrity agreements of 10 years ago with HealthSouth and Physio. All of these reports, Department of Justice (DOJ) press releases, corporate integrity agreements, and self-disclosures to the OIG all make for great case studies in compliance training and education. They make for even better case studies if you know both sides of the story.

    So what do you need to do to mitigate compliance risk at your practice, and how can you use the posted settlement agreements, integrity agreements, DOJ press releases, OIG audit reports and crafting training programs, lunch and learns to mitigate compliance risk? A caveat: Just because your practice has been paid for submitted claims does not mean the claims would be considered payable if they were reviewed by a Centers for Medicare & Medicaid (CMS) contractor.

    Group Code (CPT©97150)
    Let’s start with the obvious. This is a current code that is valued and listed in the Medicare Physician Fee Schedule. CMS even provides alternative scenarios in using the group versus individual treatment codes. Do you use the group code at your practice? Should you use the group code at your practice? Do your groups have more than one patient? Do you bill the Medicare beneficiary for group, but other patients being treated at the same time for a 1:1 code? Would it surprise you to know that it doesn’t matter if the “other” patient is covered by commercial insurance?

    The code descriptor for group is “therapeutic procedures(s), group (two or more individuals).” Group therapy procedures involve constant attendance, but by definition do not require one-on-one patient contact. So the definition of group includes more than two individuals. How is that to be documented in order to demonstrate that you complied with coding? A good example of documentation requirement for those providers with National Government Services (NGS) as their Medicare Administrative Contractor (MAC) is:

    “The purpose of the group and the number of participants in the group. Description of the skilled activity provided in the group setting, such as instruction in proper form, or upgrading the difficulty of the activity for an individual.”

    If you are using the group code, do you have more than one person in your group? Are you meeting the documentation requirements to support the use of the code?

    Aquatic Therapy Code (CPT©97113)
    Medicare coverage of aquatic therapy, as noted in the local coverage determinations (LCDs) of many CMS MACs, is contingent on demonstrating the need for aquatic-based exercises, including a transition to land-based exercises and therapy. Over the years there have been a number of cases involving aquatic therapy. In one case the therapy provider billed the state’s Medicare program for therapeutic exercise because aquatic therapy was not a covered service. In another case the practice owner instructed staff to conduct “group” aquatic therapy classes and bill as if individual aquatic therapy was provided.

    First Coast Services (FCSO), the Florida MAC, indicates that aquatic therapy may be considered medically necessary if at least one of the following conditions is present and documented if the patient:

    “has rheumatoid arthritis; has had a cast removed and requiring mobilization of limbs; has paraparesis or hemiparesis; has had a recent amputation; recovering from a paralytic condition; requires limb mobilization after a head trauma; or is unable to tolerate exercise for rehabilitation under gravity based weight bearing.” So if the patient is unable to tolerate exercise under gravity, is this documented in your evaluation and/or ongoing assessment?

    Do you provide aquatic therapy at your clinic? Is the pool on site in the clinic? If the pool is not on site at your clinic, and you provide aquatic therapy at a community pool, do your policies conform to CMS requirements for the use of a community pool? (CMS policy differs for private practice and rehab agencies on the use of community pools.) Does your documentation include the medical necessity of aquatic-based exercises?

    Self-Care Home Management Training Code (CPT©97535)
    When you are developing a home exercise program (HEP) for a patient, how are you documenting the time, and ultimately coding and billing for the time spent in developing and progressing the HEP? If you are using the self-care management training code to instruct your patient and progress your patient in their HEP, you should review the code description to ensure meeting the code’s descriptor. Looking again to guidance from the NGS’s LCD:

    “This code should not be used globally for all home instructions. When instructing the patient in a self-management program, use the code that best describes the focus of the self-management activity. For example, if the instruction given is for exercises to be done at home to improve ROM or strength, use 97110; if instructing the patient in balance or coordination activities at home, use 97112; if instructing the patient on using a sock aide for dressing, use 97535; if teaching the patient aquatic exercises to use as an independent program in the community pool, use 97113.”

    Vasopneumatic Devices (CPT©97016)
    If you are treating patients with lymphedema, you are most likely familiar with the vasopneumatic code.

    There seems to be a trend with therapists using this code to describe (and bill for) the use of ice and compression. Some commercial payers have reportedly approved the use of this code to reduce swelling. With respect to Medicare, are you documenting the area of the body being treated, the location of edema along with objective edema measurements (1+, 2+ pitting, girth, etc.) and doing a comparison with the uninvolved side? Does your evaluation document the effects of edema on function? Do you describe the type of device used? This is what is expected in lymphedema treatment. In the absence of a lymphedema diagnosis, the use of this code for compression and ice may be considered upcoming.

    If you are billing Medicare for this code, your documentation should include all the aforementioned details.

    Next Steps
    A few high-risk codes have been identified from recent audits and reviews. But any code can turn out to be a high-risk code depending on the circumstances and your MAC. For example, NGS continues to conduct a widespread probe review in Illinois on the use of whirlpool (97022) for all provider types including physician therapists. Hand therapists using this code to report and bill for fluidotherapy are finding that their claims are subject to review and often not paid, even if documented in accordance with the LCD.

    Providers are reporting that Wisconsin Physicians Service (WPS) is requesting Additional Documentation Request ADRs on the use of group therapy code. The providers report little success in getting paid, even upon appeal.

    To keep you on track and help mitigate compliance risk, two items move to the top of the list and should be considered a minimum starting point for your practice:

    1. Exclusions Monitoring and Sanctions Check. There is an expectation that your practice does not employ individuals who have been excluded from participation in federal health care programs. The OIG maintains a list of excluded individuals and entities that is updated monthly. Although not a requirement, it is an essential underlying element of compliance commitment.

      In addition to querying all your employees (https://exclusions.oig.hhs.gov/), you should check Medicare exclusions lists, keeping in mind that 37 states maintain their own exclusions list and at this time do not report to the OIG. The most frequent reason for exclusion? According to the folks at Provider Trust (http://providertrust.com), it is license infractions.

    2. Compliance Plan & Program. Compliance plans are required under the Affordable Care Act, but they are only applicable to skilled nursing facilities until CMS publishes further guidance. In light of that the OIG has suggested that providers use the OIG compliance guidances that are provided at their website (http://oig.hhs.gov/compliance/compliance-guidance/). The OIG guidance for individual and small-group physician practices specifically mentions the applicability to physical therapists in private practice and indicates that compliance plans can be scalable to the practice.

    Please join me at the Private Practice Section’s annual conference in Las Vegas for my session on “Audits and Investigations: The True Hollywood Story.”

    Nancy-Beckley

    Nancy J. Beckley, MS, MBA, CHC, is certified in health care compliance by the Compliance Certification Board and is a frequent speaker and author on outpatient therapy compliance topics. She advises practices on compliance plan development and audit response. Questions and comments can be directed to nancy@nancybeckley.com.

    Copyright © 2017, Private Practice Section of the American Physical Therapy Association. All Rights Reserved.