In The News

Implementing HIPAA Security Rule: A Cybersecurity Resource Guide

NAHC

The Department of Health & Human Services (HHS) Office for Civil Rights (OCR) and the National Institute of Standards and Technology (NIST) announced the publication of the final version of Special Publication (SP) 800-66 Revision 2, Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource GuideThis revised publication, a collaborative effort between NIST and OCR, includes resources for HIPAA covered entities (most health care providers, health plans and health care clearinghouses) and their business associates to help their understanding of the HIPAA Security Rule, drive compliance with the law and bolster security. This is the latest action in this work for HHS, who released a Department-wide Cybersecurity strategy for the health care sector in December of 2023, and voluntary performance goals to enhance cybersecurity across the health sector in January 2024.

The publication provides an overview of the HIPAA Security Rule, strategies for assessing and managing risks to electronic protected health information (ePHI), suggestions for cybersecurity measures and solutions that HIPAA covered entities and business associates might consider as part of an information security program, and resources for implementing the Security Rule. Specific topic areas include:

  • Explanations of the HIPAA Security Rule’s Risk Analysis and Risk Management requirements.
  • Key Activities to consider when implementing Security Rule requirements.
  • Actionable steps for implementing security measures.
  • Sample questions to determine adequacy of cybersecurity measures to protect ePHI.

In addition to the publication itself, NIST has also provided supplementary content on its website to further assist HIPAA covered entities and business associates with strategies to improve their cybersecurity in specific areas including:

  • Telehealth/Telemedicine
  • Mobile Device Security
  • Ransomware & Phishing
  • Medical Device Security
  • Cloud Services
  • Internet of Things Used in Healthcare
  • Application Security
  • Supply Chain

NIST also updated its Cybersecurity and Privacy Reference Tool (CPRT). The CPRT shows HIPAA Security Rule regulations with links to additional NIST tools

OCR also maintains information on its website to assist regulated entities with their obligations to protect ePHI including HIPAA Security Rule Guidance Material and Cybersecurity Guidance Material.

 

NHPCO and We Honor Veterans Welcome CMS Clarification Regarding Medicare Hospice Benefit for Dually Eligible Veterans

The Centers for Medicare & Medicaid Services (CMS) recently issued Change Request 13523, which updates the Medicare Benefit Manual to clarify that a Veteran beneficiary who elects hospice services under the Medicare benefit may still receive services that are not included in the hospice plan of care and are furnished and paid under the beneficiary’s VA benefits, in addition to hospice services. This is a much-needed clarification that NHPCO and WHV have advocated for to help ensure eligible Veterans get the best possible care with access to the full suite of benefits to which they are entitled. It is also an important demonstration of how concurrent care can optimize the patient experience.

 

NEW! Hospice Model Election Statement

NHPCO

A revised CMS Hospice Model Example Election Statement was recently posted for provider use. NAHC and NHPCO met with staff at CMS last week and asked to have the Right to Request “Patient Notification of Hospice Non-covered Items, Services, and Drugs” section updated to reflect the current timeframe for supplying the election statement addendum. CMS changed the timeframe in 2021 to allow hospices to supply the addendum within 5 days from the date of request if requested within the first five days of hospice care and within 3 days if requested later in the course of care but had not updated the model election statement.

We also shared that there is some confusion about the Representative signature.  CMS revised both sections in the new model form. CMS will also be making some updates to the Model Example of “Patient Notification of Hospice Non-Covered Items, Services, and Drugs”, referred to more commonly as the Election Statement Addendum. Stay tuned to NAHC Report for notification of its posting.

Hospices that use the CMS model election statement or use the language from the model statement in their own customized election statement can begin using the form/revised language immediately for newly enrolling patients. NAHC encourages providers to make these updates as soon as possible as we anticipate the Medicare Administrative Contractors (MACs) and other audit contractors will soon be looking for these updates for new admissions. We are reaching out to the MACs to see if there is a specific date after which they will expect to see the new form/language in use. 

There is not a need to have currently enrolled patients sign a new election statement, although hospices can provide existing patients with the new statement if they’d like to do so; however, it should not have any impact on the patient’s effective date/start of care date for the Medicare hospice benefit.

 

Hospice Regulatory & Compliance Updates (Week of 03/17/24)

NHPCO

Change Healthcare Updates Timeline for Cyberattack Recovery

In February, Change Healthcare experienced a cyberattack that disrupted several of its network and system operations. Change Healthcare recently updated its timeline for restoring operations in response to a cyberattack, stating that electronic payment functionality will be available beginning March 15 and connectivity to the claims network and software would be reestablished on March 18. In response to this attack and its adverse impact on our nation’s healthcare system, on March 5, the U.S. Department of Health and Human Services released a statement providing instructions to providers impacted by this incident.

Hospice Medical Director and Administrator Reporting Instructions

Last month, the CMS MLN Connects newsletter clarified “that hospice and skilled nursing facility medical directors and administrators are always considered managing employees for Medicare provider enrollment purposes. You must report all current managing employees. If you haven’t reported a medical director or administrator, report them now.” This newsletter suggests that hospices should report any missing hospice medical director or administrator as soon as possible and should not wait for Medicare revalidation. Hospices can obtain information about the Change of Information process for reporting their medical director and administrator on the CMS enrollment website

 

Non-Discretionary/Incentive Bonuses Under the FLSA

SESCO Management Consultants

Includable In Earnings

Incentive, production, and attendance bonuses are part of a non-exempt employee’s earnings which must be included in their regular rates when figuring the overtime pay due under the Fair Labor Standards Act (“FLSA”). To be excluded from the overtime pay calculations, bonuses must not be paid pursuant to a “contract, agreement, or promise causing the employee to expect such payments regularly,” a limitation found in Section 7(e)(3)(a). For this reason, bonuses fail to qualify for exclusion when they are promised to newly hired employees, when they are embodied in union contracts, and when they are announced to employees to induce them to work more steadily, rapidly, or efficiently or to remain with the employer.

Types of Bonuses

The types of incentive and production bonuses which must be taken into consideration when figuring overtime pay, because of a contract, agreement, or promise, are those based on:

-Attendance
-Production by individual employees
-Production by a group of employees
-Quality of work
-Accuracy of work
-Length-of-service
-Cooperation
-Courtesy
-Efficiency
-Number of overtime hours worked.

Increase in Overtime Pay

The requirement that incentive, production, and attendance bonuses be included in computation of an employee's regular hourly rate causes a proportionate increase in his overtime pay, since the regular rate is the basis of FLSA overtime compensation.

No Offset Against Overtime Pay

Incentive and production bonuses may not be credited against overtime pay required by the FLSA. They are part of the employees' regular earnings. This is true even if the percentage of the bonus above a certain quota is directly increased in proportion to the number of hours worked.

Fixed Percentage Bonus

An employer is not required to retrospectively recalculate the regular rate if the employer pays a fixed percentage bonus that simultaneously pays overtime compensation due on the bonus. For example, a bonus that is 10 percent of straight-time wages (the hourly rate × straight-time hours worked up to 40) and 10 percent of overtime wages (1.5 × the hourly rate × straight-time hours worked over 40) does not require recalculation of the regular rate because the bonus includes the overtime compensation due on the bonus as an arithmetic fact, fully satisfying the FLSA’s overtime requirements. Similarly, a bonus that is 10 percent of total compensation—including hourly wages, overtime, bonuses, commissions, etc.—does not require recalculation.

If you are not a retainer client, contact us to learn about our services by calling 423-764-4127 or click here.

 
<< first < Prev 11 12 13 14 15 16 17 18 19 20 Next > last >>

Page 11 of 345