Practice Administrator Meeting January 16, 2014

I. Questions Out to the Group 9:30–9:35

II. Cyber Risk Management 9:35-10:45 Susan Marr, TDC

III. Malpractice Program 10:45-10:55

IV. Wellness Program 10:55-11:05

V. Mid-Level Provider Data 11:05-11:15

VI. Benchmarking 11:15–11:25

VII. KHF Weekly Roundup 11:25-11:35

Next PA Meeting will be held on Thursday February 20, 2014 at 9:30 in the Scottish Rite Auditorium

Cyber Risk Management Presentation to Kids Health First Practice Administrators

1-16-14

Susan Marr, MSA, CPHRM, LHRM Patient Safety Risk Manager II

Southeast Region

Cyber Risk / 2

Objectives

• Understand cyber risks • Explain requirements • Discuss ten best practices for physician offices

What is “Cyber” Security

The protection of data and systems in networks that connect to the internet.

This definition applies to any computer or other

device that can transmit electronic health information to another device over a network connection, whether is uses the internet or some other network.

Cyber Risk / 3

CyberGuard

Recognizing the growing risks/penalties for breaches of patient health information and financial data, The Doctors Company created this coverage

• Protects from regulatory and liability claims arising from the theft, loss or accidental transmission of protected information

Cyber Risk/4

Why is it Important?

• Cyber attacks on the rise – especially small and mid size organizations

• Attack could result in: • Loss of patient trust • Violation of HIPAA laws • Damage to practice – reputation and financial

• Truth is – we are often own worst enemy in failing to follow simple cyber safety rules

Cyber Risk / 5

Techniques Deployed - Theft

Av Med, Jacksonville, Florida Scope: 1,220,000 lives Date: 12/09/2009 Source: Theft of a laptop.

Our Lady of Peace Hospital, Kentucky Scope - 24,600 lives Date: 3/31/2010 Source: Theft of a smart phone.

Department of Health, Wyoming Scope: 9,023 Date: 12/02/2009 Source: Unauthorized access to a network server.

A Few More Examples…

• Seventeen hospital workers tried to access records of former President Bill Clinton when he had heart surgery at NY Columbia Presbyterian

• A hospital clerk at Jackson Memorial in Miami stole SSN’s and personal data of 16 patients and gave to friend who opened 200 bank and credit card accounts, bought 6 new cars….

• A Palm Beach county Health Dept worker mistakenly attached a list containing names and information on 6000 AIDS patients to an email to 900 county employees

Cyber Risk / 7

Information Security Tools

Firewalls

Locked Cabinets

Shred Bins

Monitor Shades

Strong Passwords

Annual Training

Internal Perimeter

Access (Limited)

Alarm

controlled building access

3rd Party Audits

Policies and Procedures

#1 – Strong Passwords

• Not easily guessed • Not include words in dictionary • Not include dob, SSN, names of pets/children • Should be at least 8 characters, combination

small and capital plus at least one number plus at least one special character

• Change regularly • For some activities - Multi factor authentication

such as smart card, key fob, iris scan, fingerprint

Cyber Risk / 9

#2 – Install/Maintain Anti Virus Software

• Computers can be infected by CD’s, flash drives, emails, web downloads

• Symptoms include blue screen of death, repeated crashes, browser goes to unwanted web sites, user cannot control mouse

• Anti virus software is effective and affordable but MUST be kept up to date

Cyber Risk / 10

#3 –Use a Firewall

• Anti virus is infection control • Firewall is disease prevention • Inspects everything coming in • Can be hardware or software • Need specialist to advise based upon your

particular situation

Cyber Risk / 11

#4 – Control Access to PHI

• PHI is individually identifiable health information • Grant access to PHI only to people with need to

know • Set access permissions • Additional controls might include role based • This is a complex process in the small practice • Note – if PHI is accessed without permission or

need to know – may be breach • Need knowledge of who is accessing PHI and

what they are accessing

Cyber Risk / 12

#5 – Control Physical Access

Where to locate Server? Physical: • Prevent unauthorized access – i.e. in a locked

room accessible only by appropriate staff Environmental: • Protected from fire, water, elements • Away from water and windows • Up off floor • In temperature controlled area

Cyber Risk / 13

#5 – Control Access continued

• Most common loss of PHI is loss of device itself • Missing devices include:

• CD’s, flash drives, hand held devices, laptops • Desktops, hard drives ripped out, servers

• Manage access to servers for example by placing in locked room where limited access, manage the keys

Cyber Risk / 14

#6 – Limit Network Access

• When a wireless router is used, must be set to operate ONLY in encrypted mode

• Devices brought into the network by visitors should not be allowed access to the network – to allow this safely is time consuming and expensive

• Peer to peer sharing such as IM and file sharing may be unwarranted exposure

• Do not allow staff to install anything without IT approval

Cyber Risk / 15

#7 – Plan for the Unexpected

• Two essentials - Creating back ups and having a recovery plan

• Data must be backed up regularly and reliably from day one

• Back up must be tested regularly • Must be stored safely so it will not be wiped out by

the same disaster • Must meet HIPAA if Cloud storage • Storage precautions have to include precautions

mentioned in #4 and #5

Cyber Risk / 16

#7 – Plan for the Unexpected continued

• Recovery planning must include ability to restore function quickly

• Assign responsibility of who is to access • OK to store at home?

• Permanently installed home safe for which limited access

• Portable boxes where non staff have access not appropriate

Cyber Risk / 17

#8 – Maintain Good Computer Habits

• Configuration Management • Uninstall anything not essential • Do not just accept “standard” – know what it is and what

it does • Find out if your EHR vendor maintains an open

connection – if yes this needs to be managed well • Disable remote file sharing and remote printing

Cyber Risk / 18

#8 – Maintain Good Computer Habits continued

• Software Maintenance • Manage updates timely

• Operating Maintenance • User accounts for former employees disabled timely • Any device that had PHI is sanitized before disposal

(Federal guidelines) • Software no longer needed is fully uninstalled

Cyber Risk / 19

#9 – Protect Mobile Devices

Laptops, handhelds, smart phones, portable storage media = easy to lose, vulnerable to theft

• Must be protected from electro-magnetic interference

• PHI should not live on the device, rather access remotely through a secure environment

• If PHI is on the device, must be encrypted • PHI should not be transmitted wirelessly over

public networks without encryption unless requested by patient who is aware of risks

Cyber Risk / 20

#9 – Protect Mobile Devices continued

• If a device does not support encryption, it should not be used

• Remember the own worse enemy thing - Install and enable remote wiping/disabling

• When flash drives are used, they should be encrypted flash drives

Cyber Risk / 21

#10 – Establish a Security Culture

• Share information about risks • Set a good example • Have expectations of everyone – no exceptions • “Build it in” don’t “bolt it on” • Make protecting patient information a core value

Cyber Risk / 22

Mission Statement

Our Mission Is to Advance, Protect, and Reward the

Practice of Good Medicine

For further Patient Safety information, please visit our Web site at:

www.thedoctors.com

smarr@thedoctors.com (800) 421-2368 x 6726

2014 Benchmarking Schedule

Benchmarking Item

Date Requested

Due Date Return to Practices

Top Codes 1/7/2014 1/28/2014 3/20/2014

(March PA meeting, pending Contract

Committee approval)

Salary Survey 2/3/2014 2/24/2014 Via email on or before

3/20/2014 (March PA Meeting)

Practice Benchmarking

Report

3/3/2014 3/31/2014 Via email on or before

5/15/2014 (May PA Meeting)

WELLNESS PROGRAM UPDATE As of 1-14-14

• Program Launched on 11-14-13

• 37% of Employee Participants have sent in confirmation of preventive

service

• 75% of Practices in Health Insurance Program have Employee confirmations sent in

• 6 Practices have had NO confirmations sent in by Employee Participants

• 1-14-14, Dee Ann Pierce sent emails to all Practices showing what employees still need to have confirmation of preventive visits

• Deadline to get in confirmation of preventive visit is February 28, 2014

Health Care Exchanges Humana As of today Humana is the only confirmed AND active contracted KHF Payor that will be participating in the marketplace in Georgia. Any member who purchases the Humana NPOS product on the exchange will be able to keep their current provider. Humana Atlanta HMOx or Humana Connect HMO plans We are not in network for this particular product offered by Humana. This is a narrow network product where providers took very deep discounts to participate in. Alliant Alliant is offering products on the Marketplace Exchange and KHF is not contracted with these plans. We are contracted with Alliant through PHCS and if the PHCS logo is not present on the members card, do not accept. Also Marketplace member’s identification cards will start with numbers vs alpha numeric characters which will be present on the PHCS plans. *Note: Some of the marketplace plans offered by Alliant offer out of network coverage, it will be up to you to decide to accept or not. Peach State Peach State has been given permission to participate in the Marketplace Exchanges. No final word has been given regarding when their plans will be active and available for enrollment. United Healthcare, Aetna and Coventry are not participating in the marketplace exchange in the state of Georgia in 2014. Amerigroup The contract with Amerigroup for the Foster Care population will not take effect until March 1, 2014. The members will remain with fee for service. In the meantime we have started the contracting process with Amerigroup. Aetna Aetna AWP Fee Schedule effective 10/15/13 The Aetna HMO & PPO AWP fee schedule effective 10/1/13 has been updated and was sent out to Practice Administrators on November 4, 2013.

Payor Update January 16, 2013

Cigna CIGNA HMO & PPO Full Fee Schedule effective 11/15/13 The CIGNA AWP 11-15-13 has been received. Once verified, it will be emailed to Practice Administrators and posted on the KHF intranet.

Coventry Coventry HMO and National Full and AWP Fee Schedules effective 10/1/13 The HMO & PPO AWP fee schedule effective 10/1/13 has been requested. There were issues with the fee schedule sent and we are working with Coventry to get this resolved. Once resolved and verified it will be emailed to Practice Administrators and posted on the KHF intranet. Pharmacy October 1, 2013, Aetna Specialty Pharmacy will become a participating specialty pharmacy provider for all Coventry Commercial Health Plans. January 1, 2014, Aetna Specialty Pharmacy will become the preferred provider for all Coventry Commercial Health Plans. Humana Humana AWP Fee Schedule effective 10/1/13 The AWP fee schedule effective 10/1/13 has been updated and was sent out to Practice Administrators on November 4, 2013. It is now available on the KHF intranet. New E-mail for Reconsideration of Claims When you contact Humana customer service for claim reconsideration, the representative should give you a reference number. If resolution is not achieved, Humana is requesting that you contact them again via email to further work the claim. You can email humanaproviderservices@humana.com, using the reference number given to you, to submit the claim for additional review. New Contract While we thought we thought we would have the new contract finalized and in effect by January 1, 2014 that date is no longer realistic. We will be receiving a full update in January 2014 that will possibly contain the newly contracted fee schedule.

United Healthcare United AWP Fee Schedule effective 10/1/13

The UHC HMO & PPO AWP fee schedule effective 10/1/13 has been updated and was sent out to Practice Administrators on November 4, 2013. It is now available on the KHF intranet. **Revision to Re-bundling Policy** Effective third quarter 2013 United Health Care will deny Evaluation and Management (E/M) services (CPT99201-99380, 99401-99499) when reported on the same date of service as an immunization administration service (CPT codes 90460-90461 and 90471-90474). At this time, this policy change will not apply to preventive medicine services (CPT codes 99381-99397, HCPCS code G0402). If the E/M code is reported with Modifier-25 indicating it is a significant and separately identifiable service provided on the same day, both codes would be reimbursed. Please reference, page 17 of the the UHC May Policy bulletin. Peach State Practices are receiving EOBs that indicate Peach State is now charging $2 co-pays for children that are covered on Medicaid. This is an internal issue and Peach State is working to correct the problem. A system fix is in place and once completed a claims project will be initiated. If you have more than ten claims that have been affected please send an excel spreadsheet that includes patient name, ID# and DOS to acwilliams@khfirst.com. WellCare Denials There were a number of coding denials that occurred during the months of October and November, below are the codes errors and latest corrective information received: CE050 - Payable Medicaid CPT codes denied as not covered in error. The CE050 policy was implemented on October 30, 2013 and was corrected on November 25, 2013. Any claims received by Wellcare between these dates could be effected by an incorrect denial. Please note, not all denials may be incorrect. A claims project has already been initiated to capture and reprocess claims for correct reimbursement. No action is needed from providers. Claims project completed 12/11/13. If you had impacted claims, you will see payment soon. CE051 - Claims denied CE051 are denying incorrectly on payable Medicaid services billed with the appropriate CPT. Not all CE051 denials are incorrect. The CE051 policy was implemented on October 30, 2013 and was removed Monday, November 18, 2013. This means any claim received by Wellcare between 10/30/13 – 11/18/13 may be impacted. An adjustment project will be completed to capture the impacted claims for proper reimbursement therefore no action will be needed from the providers. The reprocessing project will take 30-60 days to complete. Claims project completed 12/13/13. If you had impacted claims, you will see payment soon. CE006 - Providers have experienced CE006 denials for procedures not performed on the same day, because they are denying against previously billed claims found in member history. The NCCI policies would deny certain code pairs when the provider split bills for the same DOS or performs the code pair together on the same DOS if it is an identified NCCI code pair. Please note, not all CE006 denials are

incorrect. Only claims where the procedure was NOT performed on the same date of service and isn’t part of a global care package are erroneously denied. Only claims received (not DOS) in mid-October may have been impacted. Claims received after October 19th do not appear to be impacted. An adjustment project will be completed to capture claims for proper reimbursement. No action will be needed from the providers. Claims project completed 12/2/13. If you had impacted claims, you will see payment soon. CE016 – The issue with CE006 denials may have created denials for CE016 denials for add-on denied due to primary unpaid which is a component of the CE006 issue. Our claims payment policy team is currently working on resolution and will reprocess incorrect denials. CE062 – Claim denials were submitted as a project to be reviewed and reprocessed. No provider action required. Part 1 - Claims project completed 11/12/13. If you had impacted claims, you will see payment soon. Part 2 – We were notified of this on 12/9/13. This CE062 denial is similar to Part 1 (I just named it “Part 1” and “Part 2” to differentiate the issues), but was caused by the corrected claims in Part 1 reprocessing. Awaiting additional information. CE064 -Only Claims for members over 21 years of age are incorrect. If you have denials for this scenario, please let me know. Referral Authorization Information distributed through the AAP on December 17, 2013 delaying the PCP portion of the referral process indefinitely. Wellcare denied some claims submitted by specialist on the basis that no prior authorization was submitted by the primary care physician. Wellcare notes that these denials were due to an erroneous benefit rule being applied to these claims. In addition, the plan is implementing a claims reprocessing project and adjustments will follow. Specialty Capitation Payments Claim payments were sent on an incorrect Capitation listing template in error. Providers received a blank EOP labeled “Specialty Capitation” with no claim information listed on payments received 12/20/13. Please note, the check numbers and amounts are valid. This issue has been fixed and the corrected EOPs are reflected in the PaySpan portal. Providers can download the corrected EOP now available in the PaySpan Portal.

Wellstar/Piedmont Contract Negotiations We are effective as January 1, 2014 and we do not have a current fee schedule. We are are working diligently with PWHP to get this to you as soon as possible. As of December 12, 2013 all providers have been added to the Piedmont Wellstar Health plan website and as of December 17, 2013 their Provider OnLine services went live. All information regarding the PW health plan to include an online version of the Provider manual can be found here: www.pwplans.org

Medicaid ACA Payments Effective November 1, 2013, the Affordable Care Act (ACA) Provider Rate Increase will be distributed to eligible providers on their Remittance Advice (RA) for new day claims. The ACA Provider Rate Increases will be reflected on their RA with the Explanation of Benefit (EOB) message: EOB 9980, "Pricing Adjustment - Special Rate Increase". EOB 9980 will be the only message to indicate the ACA Provider Rate Increases has been applied to the claim. If you have not been paid at Medicare rates for current FFS claims, please contact the Chapter office. Retroactive FFS Claims: DCH does not have a timetable for paying retroactive FFS claims back to January 1st, but is working through the procedures necessary for this to occur. CMO Claims: DCH does not have a timetable for the CMOs to begin paying current claims or retroactive claims. DCH reports to us that they are working through additional procedures (separate from the procedures for FFS Medicaid) necessary for this to occur. Payment will be distributed through the CMO’s (WellCare and Peach State) and they are awaiting word from DCH. Providers who attested and are eligible for the additional PCP rate increase through the ACA will receive the additional payment for the admin through the quarterly reconciliation. 2010 – 2012 Mass Adjusted Claims Medicaid FFS will allow claims where payment was recouped to be resubmitted within 90 days of the mass adjustment. Each claim must be corrected individually and when the claim denies for timely filing, it must be listed in a specific spread sheet format and submitted to your HP Provider Representative. Flu Vaccines-90672,90686,90660 As of September 19, 2013 changes were submitted to the MMIS team with an effective date of August 1, 2013 for reimbursement for the 2 new quad vaccines (90672 and 90686). The administration fee for all VFC vaccines is $10. Physicians must use private stock for vaccines administered to 19 and 20 year olds. There were only 2 new quadrivalent influenza vaccines added – 90672 (FluMist) and 90686. A completion date of October 1, 2013 was given that the two codes would be live in the system but providers will haveto resubmit the denied claims when the system has updated. The 2 additional quadrivalent influenza codes (90672 & 90686) are in addition to the vaccine codes (including the trivalent codes) that are listed in the EPSDT (Health Check) Manual - Appendix C. (Please refer to the EPSDT Manual. ) Only those 2 codes are being updated, the other vaccine codes have already been in the system. The other update/revision related to the influenza vaccines is that 90660 (FluMist-trivalent) is not available under the VFC program. NP & PA expirations updates

Must bill under NP or PA Medicaid # & suspend Medicaid # if no claims after 12 mo. and expire after 18 mos.

Credentialing News Cigna Credentialing Reminder As you know, Kids Health First has delegated credentialing for all contracts except for Cigna. Kids Health First sends the initial credentialing application in for your practice, but maintaining credentialing with Cigna is the responsibility of your practice. If you receive credentialing requests from Cigna, please respond to them. **Hiring New Physicians – The Credentialing Process** Below are a few reminders when hiring new physicians. - If your practice participates in the KHF Malpractice Program, new physicians must go through an initial approval process prior to an offer of employment. - If a new physician will be seeing Medicaid patients, please provide the Medicaid number to KHF as soon as it is available. Preferably, the Medicaid number should be provided with the initial credentialing application. It can take a while to acquire a Medicaid number, so you should begin this process as soon as possible. - Once a physician is malpractice approved (only those in the program), and a complete application is received, the physician will be presented at the next Credentialing Committee meeting. This meeting is held on the first Tuesday of each month (the second Tuesday in January and July). - Once approved by the Credentialing Committee, the physician is presented at the next Board meeting. The Board meetings are held the second Monday of each month. NOTE – Occasionally due to a scheduling change, the Board meeting will be held before the Credentialing Committee meeting. Therefore, physicians approved by the Credentialing Committee one month will not be approved by the Board until the following month. KHF will alert practices if this is the case. - Physician information is not sent to Payors until the physician is approved by the Board. Information is sent to the Payors within the week following the Board meeting. - It can take up to 45 days for physicians to be entered into the Payor systems once they have been fully credentialed with Kids Health First. 60 days for CMOs if the Medicaid number is provided before the new physician is approved by the Board. - For commercial products, charts can be reviewed and signed off by another physician, and you can bill under the reviewing physician until the new physician is effective with the Payor. - For CMOs and Medicaid, new physicians CANNOT bill under another physician. New physicians should not see Medicaid patients until they are in the systems at the CMOs.

- Practices may submit applications for new physicians early, prior to start date, to speed up the credentialing/effective process. Practice Reminders Please remember that as the contract holder, Kids Health First must send any demographic or other changes to the payors. Changes sent directly from the practices may be ignored by payors or will have to be confirmed by Kids Health First to become effective.

www.khfroundup.com

password for access is: roundup

Kids Health First Weekly Roundup Kids Health First Bi-Weekly Roundup

January 16, 2014

UHC January Network Bulletin

There were a number of items of note this month and I've attempted to pick those that may be of more importance. I do recommend taking a look at the entire document at your earliest convenience. List of Important Pages Network Bulletin

ICD-10 Webinar: ICD-10 FAQ Review

DCH held a ICD-10 Webinar on December 17, 2014. The power point presentation is available for viewing here. There was also a list of FAQ complied asked and answered during after the event. That can be found here.

Piedmont Wellstar & Piedmont Hospitals

PWHP We have received many questions regarding the Piedmont Wellstar Fee schedule and as of today we do not have it. We have requested it repeatedly and will continue to do so. Piedmont Hospitals: Coventry of Georgia states they are currently in contract negotiations with Piedmont. Within the terms of the pending negotiations Piedmont asked for a term date of 1/31/14. We will keep everyone up to date regarding the negotiations.

Save The Date!

January 17 Early Hearing Detection & Intervention Webinar The Early Hearing Detection & Intervention: AAP Tools for Medical Home Providers to Address Loss to Follow-Up/Documentation (LTF/D) webinar on January 17th (times listed below) will

introduce these new tools and how to use them in practice. Register today at https://www3.gotomeeting.com/register/293858862 to reserve your seat!

Benchmarking - Top Codes Request

Please submit your utilization no later than Tuesday, January 28, 2014. I have attached the 2014 Benchmarking schedule.The next request will be for the Salary Survey and will be sent out on 2/3/2014. 2014 Benchmarking Schedule

Practice Reminder

Please remember that as the contract holder, Kids Health First must send any demographic or other changes to the payors. Changes sent directly from the practices may be ignored by payors or will have to be confirmed by Kids Health First to become effective.

2010-2012 Mass Adjusted Claims

Medicaid FFS will allow claims where payment was recouped to be resubmitted within 90 days of the mass adjustment. For instructions on how to correct: More Information

Wellcare PCPCC Delay Notice

Please see the attached documentation regarding the postponement of the Care Coordination (authorization) model. Many providers have requested written documentation and this should cover your needs. More Information

Forward this email

This email was sent to acwilliams@khfirst.com by acwilliams@khfirst.com | Update Profile/Email Address | Instant removal with SafeUnsubscribe™ | Privacy Policy. Kids Health First | 2814 Spring Rd Se Ste 104 | Atlanta | GA | 30339