Related Posts

With the Appropriate Use Criteria program slated to go into effect in 2023, healthcare providers shoud implement new alerts for prior authorizations.

The No Surprises Act, effective Jan. 1, 2022, requires that healthcare providers include a “Good Faith Estimate” that covers all relevant codes and charges. This was established to increase price transparency for patients. For a summary of the No Surprises Act, read our previous blog. In our recent webinar, hosted on December 15, 2021, industry expert Stanley Nachimson, principal of Nachimson Advisors*, answered our audience’s most pressing questions about “Good Faith Estimates.”** To read the FAQs from our first webinar, click here. Experian Health can help your healthcare organization navigate the regulatory landscape  and implement solutions ranging from transparent, patient-friendly estimates to our all-new FREE No Surprises Act (NSA) Payer Alerts Portal.  Here’s what Nachimson had to say: Q1: What are the top things to do now to prepare for the No Surprises Act by Jan. 1? SN: Set up processes to avoid out-of-network billing for emergency and in-network facility services Out-of-network providers need to make sure they have the right processes set up to avoid surprise billing patients. Evaluate in-and-out of network status for all providers Implement Good Faith Estimate for Uninsured/Self Pay from a single provider Make sure to have a process in place for self-pay or uninsured patients Prepare patient notice documents Train staff and ensure they’re aware of new rules and changes Q2: What must be included in the Good Faith Estimate starting 1/1/22? SN: Starting Jan 1, 2022, the only Good Faith Estimates required are for “self-pay” or uninsured patients. These are the only ones that will be enforced/mandated on January 1st. CMS has created forms that show what GFEs should include. This includes individual services that will be provided in an encounter, line-item descriptions of services, procedure codes, diagnosis codes, and more. Estimates should be within $400 of the final bill for any provider or facility that was included, assuming there are no extenuating circumstances. Q3: How should providers deliver the Good Faith Estimate to the patient? Payers? SN: For patients, Good Faith Estimates should be delivered in a written document. This can be done through email, USPS, or delivered in person. Currently, providers do not need to worry about sending anything to payers. Regulators put this requirement on indefinite hold until they have more clarity on the technical delivery/transition of this data. CMS expects to provide a ruling clarification on this in 2022. Experian Health is now offering a FREE comprehensive, updated list of No Surprises Act (NSA) payer policy alerts for United States hospitals, medical groups, and specialty healthcare service organizations. Q4: What are the differences between Insured & Self-Pay Good Faith Estimates that providers should consider starting Jan. 1? SN: There will probably be no significant difference in the GFEs for self-pay vs insured individuals. However, the GFEs will be sent to health plans for the insured individuals. At this point, there is no standard electronic delivery method. Individual providers/organizations may come up with their own paper or electronic form, assuming it contains all the required information. At some point in the future, the GFEs will be sent to health plans for insured patients, and that will most likely be a standard transaction. CMS is currently waiting on guidelines for what this transaction will look like. Q5: How does an estimate get calculated when there are multiple providers involved? Who is the “convening provider?” SN: A convening provider is the provider that (1) is responsible for scheduling the primary item or service(defined as “the initial reason for the visit”), or (2) receives a request from an individual shopping for an item or service)—must determine at the time an item or service is scheduled or when a patient is shopping for care whether the patient is a self-pay patient, as defined above. This will not be enforced on Jan. 1, 2022. In 2022, each provider will be expected to provide the GFE for their own services. Because there aren’t any processes in place, the healthcare industry will have at least 1 year to develop a standard guideline for gathering this information. The requirement that the convening provider combines all provider GFEs into one GFE will not be enforced until 2023.This means that over the course of 2022, the convening provider will not be required to include estimates from other providers.  The industry will need to create a standard guideline and establish communication processes first. Until then, patients will need to ask every provider involved for a Good Faith Estimate.  Providers may wish to consider how they will accomplish this during 2022. Q6: Does the Good Faith Estimate apply to all services – even office visits? Labs? Urgent care? Drop-ins? SN: It applies to all types of services. However, depending on when the service is scheduled, the timeframe will vary on when the Good Faith Estimate can be sent out. Q7: If the actual charges are more than $400 greater than the Good Faith Estimate, what consequences will be there for providers starting Jan. 1? SN: The latest rule established an independent dispute resolution process.  The patient must initiate the process within 120 days of receiving the bill, file the required documentation and pay a $25 administrative fee. Webinar Series: Unpacking The No Surprises Act and Q&A with an expert Industry expert Stanley Nachimson, Health IT Implementation Expert, recently hosted a series of webinars to help providers get up to speed on what they need to do to comply with the No Surprises Act. Learn about the Good Faith Estimate, how NSA will apply in different care settings, and more. *Stanley Nachimson is not an employee or representative of Experian Health. **The scope and details of the No Surprises Act are evolving. The information provided here is up to date as of December 23, 2021. This content is intended for information and education purposes only.  Experian Health cannot and does not provide legal and compliance guidance.  It is recommended that all organizations review the regulation thoroughly and seek appropriate legal and compliance guidance to determine an appropriate strategy for compliance. Experian Health offers solutions across the healthcare journey – including patient engagement, revenue cycle management, identity management, care management and analytics – that may contribute to meeting compliance requirements.  

Healthcare data breaches are nothing new, but their size and frequency are increasing: CVS Health lost over a billion search records when a third party accidentally made an online database publicly accessible in March 2021. A ransomware data breach at prescription management vendor CaptureRx affected over a million patients at 17 healthcare providers in February 2021. More than 3.47 million individuals and at least 10 healthcare organizations were affected by a massive data breach at file transfer company Accellion, which spanned multiple global industries in December 2020.   Further illustrating the risks to healthcare organizations, Scripps Health in San Diego was hit with two class-action lawsuits that assert that the organization should have done more to protect patient data. If upheld, it will set a precedent for healthcare organizations to be held legally responsible for failing to protect data – to the tune of $1000 per patient. The direct monetary cost of fines and lawsuits, however, may ultimately be a secondary concern as damaged reputation is often a more difficult setback to overcome. Patients increasingly approach healthcare as “consumers” and a breach – or a poorly managed breach situation – might prompt them to look elsewhere for care. “Incidents happen every day. However, the real threat lies in how quickly and efficiently an organization can respond. This is what customers will remember. You need to be able to make prompt updates to your website, scale up call center capacity, and have answers ready when consumers need them.” The growing frequency and scale of health information breaches means it’s no longer sufficient to say, “we’re careful with our health data – this won’t happen to us.” Medical identities are extremely valuable, which makes them an attractive target to cybercriminals. In addition, the sudden increase in virtual care and remote working during the pandemic has created new vulnerabilities in data security.   A recent FBI alert that a major ransomware group is targeting the healthcare sector with phishing attacks is a cl reminder that healthcare organizations can’t relax when it comes to cybersecurity. It’s a case of “when, not if” a healthcare organization will have to deal with a breach. Prevention is the goal, but preparation is the smart strategy.   Shifting from data breach prevention to preparedness   During the pandemic, the volume of data being shared within and between healthcare organizations sky-rocketed, as providers offered more virtual care services and workforces became more distributed. While these innovations meant access to healthcare and work could continue safely, the shift to cloud-based data sharing and storage, means the data perimeter is much broader and tougher to secure – if there remains a perimeter at all. Data must be secured at the device- and employee-level now.   While prevention is better than cure, the hard truth for healthcare cybersecurity teams is that they’re increasingly likely to have to deal with a breach. Unfortunately, many organizations don’t have the technology, resources, or time to prevent breaches all the time, at every access point.   Chris Wild, vice president at Experian Health, says:   “We’re seeing an increased frequency of cyber threats across the whole industry. Hardly a week goes by that we don’t hear of a health system under attack from hackers or ransomware. The statistics show us there’s a health data breach nearly every single day, so it’s just a matter of time before it impacts any one provider, pharmacy, payer or physician group.”   Instead of focusing solely on prevention, healthcare organizations need a strategy to prepare for what happens when a breach occurs. If they don’t, they risk a long, public struggle to contain the breach, resulting in brand damage, patient loss, and financial consequences in the form of fines and lost revenue.   Building a data breach response plan   Recovering from a data breach requires a speedy and thorough response. With a plan in place, action can be taken as soon as the dreaded call comes in. Knowing exactly what needs to be done to meet HIPAA notification requirements, helps reassure consumers and regulators alike that every effort is being made to contain the breach. Not only will this help minimize fines, but it will also mitigate against the reputational damage caused by the security breach.   A breach is bad enough but compounding the negative impact of exposed data by failing to provide sufficient support to worried consumers is even worse. Wild says: “Incidents happen every day. However, the real threat lies in how quickly and efficiently an organization can respond. This is what customers will remember. You need to be able to make prompt updates to your website, scale up call center capacity, and have answers ready when consumers need them.”   A robust response plan calls for C-suite engagement, clear success metrics, and regular pressure-testing. Above all, it must be flexible to adapt to whatever size and type of breach occurs.   The best support for the worst-case scenario A data breach response plan isn’t going to prevent the breach itself, but it can help a healthcare organization take the right steps in the aftermath. Having serviced thousands of data breaches over the last 17 years, Experian Health’s Reserved Response™ program is based on real world experience and has evolved as the threats and consequences have increased. In a recent survey, clients using Reserved Response reported 15% fewer data security incidents than those who did not. Furthermore, any incidents that did occur tended to be smaller in scale.   Because the risk and impact of data breaches is trending upwards, this year Experian Health has introduced a new Reserved Response Hub. This digital, self-service tool helps to prepare and test a data breach plan, including: the new and improved 2021 Data Breach Response Guide downloadable readiness reading materials tried and tested notification templates a pre-breach incident checklist access to Experian’s full Reserved Response service, which provides support before or after a breach to ensure regulatory compliance and support for those impacted.   Reserved Response can help healthcare organizations put together a data breach preparedness plan in as little as three days.