Behavioral Health Advisor: The Guide to Navigating Compliance - - PowerPoint PPT Presentation

Behavioral Health Advisor: The Guide to Navigating Compliance Quarterly Webinar

February 13, 2018

Today’s Presenters

Shannon Mace, Senior Advisor, National Council for Behavioral Health Dianne Pledgie, Compliance Counsel, Feldesman Tucker Leifer Fidell LLP

Navigating the Control Panel

Your Participation

The GoToWebinar Control Panel allows attendees to interact with their session. Submit questions and comments via the Questions panel. Note: Today’s presentation is being recorded and will be made available within 48 hours.

Agenda

• Sign of the Times:

– Addiction & Recovery Treatment: State of the field

• In the Field:

– Peer Support Staff: Compliance considerations – Updates

• The Upshot:

– Recent enforcement actions involving addiction and recovery providers

• Due Process:

– Update and discussion on 42 CFR Part 2

• Resources
• Questions and answers

Sign of the Times

Sign of the Times

In the Field

Peer Support Staff: Compliance Considerations

• Compliance issues and nonissues related to hiring

peer supports and recovery specialists

• Hiring individuals with lived experience

– Bona fide occupation qualification (BFOQ) – Open-ended questions that do not trigger EEOC or ADA issues

• Creating a healthy work environment for peers

– Training – Supervision – Reasonable accommodations – Clearly defined roles and responsibilities

In the Field: Updates

• CMS authorized work requirements in Medicaid

program

– CMS approved Indiana and Kentucky’s waivers with work requirements

• The Department of Health and Human Services

provided updated guidance on HIPAA and behavioral health

– Includes resources for professionals, patients and family members – Includes information related to opioid abuse and mental health

The Upshot

Recent Enforcement Actions Involving Addiction and Recovery Providers

Anti-Kickback Triggered by Test Cups

• Two organizations, Addiction Medical Care of

Norwalk (AMC) and Parallax Center, Inc. entered into settlements with the OIG due to Anti-Kickback and Stark violations for receiving point of care test cups from Millennium Laboratories

– AMC entered into a nearly $80,000 settlement – Parallax entered into a $64,000 settlement

• Cautionary tale about the risk of “gifts”

Drug Testing Overbilling

• APT Foundation, Inc. in Connecticut entered into

an $883,859 settlement due to overbilling for urine drug testing.

• Drug testing was already included in the weekly

bundled rate, but APT was also billing for testing as a separate service through a third-party lab.

• Several provider bulletins were published about

billing prior to APT’s actions.

Due Process

42 CFR Part 2: Compliance Fundamentals

This training has been prepared by the attorneys

• f Feldesman Tucker Leifer Fidell LLP. The

materials are being issued with the understanding that in conducting this training program the authors are not engaged in rendering legal services. If legal assistance is required, the services of a competent attorney should be sought.

DISCLAIMER

42 CFR Part 2

• Overview
• Applicability
• Compliance Requirements

AGENDA

• Statute: 42 U.S.C. § 290dd-2
• Regulations: 42 CFR Part 2 (“Confidentiality of Alcohol

and Drug Abuse Patient Records”)

• Federal Agency: Substance Abuse and Mental Health

Services Administration (“SAMHSA”), of the U.S. Department of Health & Human Services (“HHS”)

• Generally: Imposes restrictions on the disclosure and

use of substance use disorder (SUD) patient records which are maintained in connection with the performance

• f any Part 2 program, unless certain circumstances

exist.

• Purpose: Ensure that patients receiving treatment for a

SUD in a Part 2 program are not made more vulnerable than others. Enacted to encourage people to get treatment when needed without stigma.

OVERVIEW

Relationship to state laws and HIPAA

• “Part 2” is a floor; not a ceiling
• State law may not authorize or compel any

disclosure prohibited by Part 2

• State laws may, however, be more restrictive than

those set forth in Part 2

• Some alignment between Part 2 and HIPAA, but in

some instances, Part 2 provides more stringent federal protections than those of HIPAA

OVERVIEW

SAMHSA’s 2017 Final Rule

• First substantive revision to Part 2 regulations since 1987
• Issue Date: January 18, 2017
• Effective Date: March 21, 2017
• Available at:
• 82 FR 6052
• https://www.gpo.gov/fdsys/pkg/FR-2017-01-18/pdf/2017-

00719.pdf

• Purpose: To modernize Part 2 “by facilitating electronic

exchange of [SUD] information for treatment and other legitimate health care purposes while ensuring appropriate confidentiality protections for records that might identify an individual, directly or indirectly, as having or having had a substance use disorder.” 82 FR 6056.

OVERVIEW

SAMHSA’s 2018 Final Rule

• Additional revisions proposed in NPRM in the 2017 Final Rule
• Issue Date: January 3, 2018
• Effective Date: February 2, 2018 (except for certain contracts)
• Available at:
• 83 FR 239
• https://www.gpo.gov/fdsys/pkg/FR-2018-01-03/pdf/2017-

28400.pdf

• Purpose: Allows for an abbreviated notice on redisclosure and

addresses the circumstances under which “lawful holders” and their legal representatives, contractors, and subcontractors may use and disclose patient identifying information for purposes of payment, health care operations, and audits and evaluations.

OVERVIEW

General Rule

Part 2 restricts disclosure and use of substance use disorder records which are maintained in connection with the performance of a federally- assisted Part 2 program.

APPLICABILITY

Substance Use Disorder Records (§2.11- 2.12)

Any information, whether recorded or not, created by, received, or acquired by a Part 2 program relating to a patient.

• E.g., diagnosis, treatment and referral for treatment

information, billing information, emails, voicemails, and texts.

• For Part 2, records include both paper and electronic

records.

APPLICABILITY

Federally-Assisted (§2.12(b))

• Conducted (in whole or in part) by federal government
• Supported by federal funding

– Includes federal block grants or other funds channeled through state or local governments (e.g., Medicaid) – Funding does not need to be for SUD services

• Carried out under federal license, certification, registration
• r authorization

–Certification of provider status under the Medicare program –Authorization to conduct methadone maintenance treatment –Registration to dispense a substance under the Controlled Substances Act to the extent the controlled substance is used in the treatment of substance use disorders

• Receives tax exempt status from the IRS

APPLICABILITY

Part 2 Program (§2.11)

1.An individual or entity (other than a general medical care facility) who holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment 2.An identified unit within a general medical facility which holds itself out as providing and provides, substance use disorder diagnosis, treatment, or referral for treatment 3.Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment or referral for treatment and who are identified as such providers

APPLICABILITY

Lawful holder

• 2017 Final Rule expanded applicability to

lawful holders of patient identifying information.

– Lawful holder: An individual or entity who has received patient identifying information as the result of a patient consent or as a result of one of Part 2’s limited exceptions to the consent requirements – Patient identifying information: Name, address, social security number, fingerprints, photograph, or similar information by which the identity of a patient can be determined with reasonable accuracy either directly or by reference to other information

APPLICABILITY

Notable Exceptions (§2.12(c))

• Communication within a Part 2 program or

between a Part 2 program and an entity having direct administrative control over that Part 2 program

• Qualified service organizations
• Crimes on Part 2 program premises or against

Part 2 program personnel

• Reports of suspected child abuse and neglect

APPLICABILITY

Key Compliance Concerns

• 1. Disclosure requirements
• 2. Notice to patients
• 3. Security of records

COMPLIANCE

Disclosure – General Rule

Information that identifies an individual as a patient

• f a program is confidential and may not be

disclosed without patient consent, unless an exception applies.

• Disclosure is permitted under exceptions, but is not

required

• Unlike HIPAA, patient consent is required even

for disclosures for the purposes of treatment, payment or health care operations

COMPLIANCE

Minimum Necessary Rule (§ 2.13(a))

Any disclosure made under Part 2 must be limited to that information which is necessary to carry out the purpose of the disclosure.

COMPLIANCE

Disclosure – Written Consent (§ 2.31)

Required Elements:

1. Name of patient 2. Amount and kind of information to be disclosed

– Explicit description – Can include “all my SUD information” as long as more granular options are included

3. “From Whom”

– Specific name or general designation of the Part 2 program permitted to make disclosure

4. “To Whom” 5. Purpose of disclosure 6. Statement that the consent is subject to revocation at any time 7. The date, event, or condition of expiration 8. Signature of patient

– If the patient is a minor, incompetent, or deceased, signature of authorized individual when required. See 42 CFR §2.14 and 42 CFR §2.15

9. Date of signature

COMPLIANCE

Disclosure – Without Consent

1.Medical emergencies: To medical personnel to the extent necessary to meet a bona fide medical emergency in which patient’s informed consent cannot be obtained (See 42 CFR § 2.51) 2.Research: To recipients in compliance with research requirements under the HIPAA Privacy Rule and/or HHS regulations on protection of human subjects (See 42 CFR § 2.52) 3.Audit and evaluation: To auditors/evaluators that agree in writing to comply with Part 2 (See 42 CFR § 2.53) 4.Court authorization

• Unique order: only to authorize disclosure or use of patient

information otherwise prohibited by Part 2

• Subpoena or similar document must be issued (See 42 CFR §

2.61)

COMPLIANCE

Disclosure – Redisclosure

• Re-disclosure is prohibited
• Each disclosure made with the patient’s written consent must be

accompanied by one of the following written statements:

• This information has been disclosed to you from records protected by

federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see § 2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at § 2.12(c)(5) and 2.65.

• 42 CFR Part 2 prohibits unauthorized disclosure of these records.

COMPLIANCE

Notice to Patients (§ 2.22(a)-(b))

At time of admission to Part 2 program or as soon as the patient attains capacity to understand his/her medical status, the Part 2 program shall:

(1)Communicate that federal law and regulations protect the confidentiality of SUD patient records (2)Provide written summary of federal law and regulations, which must include:

• General description of the limited circumstances under which a Part 2 program may

acknowledge that an individual is present or disclose outside the Part 2 program information identifying a patient as having or having had a substance use disorder

• Statement that violation of the federal law and regulations by a Part 2 program is a crime

and that suspected violations may be reported to appropriate authorities, along with contact information

• Statement that information related to a patient’s commission of a crime on the premises
• f the Part 2 program or against personnel of the Part 2 program is not protected
• Statement that reports of suspected child abuse and neglect made under state law to

appropriate state or local authorities are not protected

• Citation to the federal law and regulations

COMPLIANCE

Security of Records

Part 2 programs must have formal policies and procedures

• To reasonably protect against unauthorized uses and

disclosures of patient identifying information (“PII”) and to protect against reasonable anticipated threats or hazards to the security of “PII” (See 42 CFR § 2.16) If using paper records, policies must address:

• Transfer and removal
• Destruction
• Maintenance in a secure location
• Using and accessing workstations and secure location
• De-identification
• If using electronic records, policies must address:
• Creation, receipt, maintenance, and transmission
• Destruction
• Use and access
• De-identification

COMPLIANCE

• Determine whether Part 2 applies to:
• Your organization’s current or planned substance use

disorder services (diagnosis, treatment or referral)

• Records received by your organization (lawful holder)
• Develop a compliance plan that addresses:
• Written compliance standards
• Review and revise patient consent forms
• Review and revise policies and procedures
• Training and education
• Develop a training plan that includes 42 CFR Part 2 for all

staff, as well as in-depth training for identified staff (medical records, front desk, providers)

• Internal monitoring and auditing
• Audit and revise business associate agreements to

include QSOA components, as necessary

• Audit release of records protected by Part 2

FINAL THOUGHTS

Dianne K. Pledgie, Esq. dpledgie@ftlf.com Feldesman Tucker Leifer Fidell, LLP 1129 20th St. NW, 4th Floor Washington, D.C. 20036 (202) 466-8960 www.FTLF.com

QUESTIONS

Resources

• HHS OIG Eye on Oversight 2017 Year in

Review

• Legal Action Center 42 CFR Part 2 decision

tree for SBIRT/integrated care

• HHS ONC 42 CFR Part 2 and Health IT

considerations

• Does Part 2 Apply to My Organizations?
• MAT Implementation Checklist

We want to hear from you!

Email us topic ideas, questions or suggestions for future editions at: compliance@thenationalcouncil.org

Questions

Next Behavioral Health Advisor Webinar:

April 12, 2018 at 12pm ET (only open to subscribers)

Thank you!

Please take a few moments to answer the brief survey that will pop up when the webinar is over