Mandatory Vendor Compliance Training & Regulatory Requirements Overview
Mandatory Vendor Compliance Training
Regulatory Requirements
2024
1
2
Introduction
3
Code of Ethical Conduct
•
ECMCC has adopted a Code of Conduct that serves as an
organizational “Constitution” that applies to employees and vendors of
ECMCC
•
Vendors are expected to follow the Code of Conduct as well as
applicable ECMCC policies and procedures
•
A copy of the Code is enclosed with this training
4
O
M
I
G
C
o
m
p
l
i
a
n
c
e
P
r
o
g
r
a
m
R
e
q
u
i
r
e
m
e
n
t
s
The New York State Office of the
Medicaid Inspector General or
OMIG, enhances the integrity of
the New York State Medicaid
program by:
•
Preventing and detecting
fraudulent, abusive, and
wasteful practices within the
Medicaid program; and
•
Recovering improperly
expended Medicaid funds
while promoting a high quality
of patient care.
5
OMIG Compliance
Program Requirements
6
OMIG Compliance Program Risk Areas
7
According to OMIG
requirements, a Provider’s
Compliance Program shall
apply to the required
provider’s risk areas, which
are those areas of operation
affected by the compliance
program shown here.
ECMCC’s Compliance Program Overview
8
ECMCC’s Chief Compliance Officer
9
ECMCC Compliance Program Overview
10
ECMCC Compliance Program Overview
11
ECMCC Compliance Program Overview
12
ECMCC Compliance Program Overview
13
ECMCC Compliance Program Overview
14
Fraud, Waste and Abuse
2
0
2
2
The United States Department of Justice
collected more than $2 Billion dollars in
False Claims. It is important to know too
that government officials are increasingly
likely to take executives and other
individuals involved in corporate fraud,
waste and abuse to court.
2
0
2
3
Federal and State governmental agencies
continued to take an aggressive stance in
protecting taxpayer-funded healthcare
programs from fraud, waste and abuse.
15
Fraud and Abuse Laws
16
Fraud and Abuse Laws
17
Regulating Financial Arrangements - Anti-
kickback Statute & Stark Law
18
The Anti-Kickback Statute (AKS)
19
The Stark Law
20
The False Claims Act
▪
A
k
e
y
e
n
f
o
r
c
e
m
e
n
t
l
a
w
i
s
t
h
e
F
e
d
e
r
a
l
F
a
l
s
e
C
l
a
i
m
s
A
c
t
.
T
h
e
F
e
d
e
r
a
l
F
a
l
s
e
C
l
a
i
m
s
A
c
t
p
r
o
h
i
b
i
t
s
a
n
i
n
d
i
v
i
d
u
a
l
o
r
e
n
t
i
t
y
f
r
o
m
s
u
b
m
i
t
t
i
n
g
c
l
a
i
m
s
t
o
t
h
e
F
e
d
e
r
a
l
g
o
v
e
r
n
m
e
n
t
t
h
a
t
t
h
e
y
k
n
o
w
(
o
r
s
h
o
u
l
d
k
n
o
w
)
a
r
e
f
a
l
s
e
,
s
u
c
h
a
s
,
f
o
r
e
x
a
m
p
l
e
,
c
l
a
i
m
s
f
o
r
s
e
r
v
i
c
e
s
t
h
a
t
w
e
r
e
n
o
t
p
r
o
v
i
d
e
d
.
▪The New York False Claims Act similarly prohibits the submission of
false claims to the State of New York
▪ECMCC submits claims to both the Federal government and the State
of New York for services provided to patients enrolled in government-
funded healthcare programs, such as Medicare and Medicaid
21
The False Claims Act
•
F
a
l
s
e
C
l
a
i
m
s
:
w
h
e
n
a
n
e
n
t
i
t
y
k
n
o
w
i
n
g
l
y
r
e
c
e
i
v
e
s
m
o
n
e
y
i
t
s
h
o
u
l
d
n
o
t
a
n
d
s
a
y
s
n
o
t
h
i
n
g
o
r
c
o
n
c
e
a
l
s
t
h
a
t
a
n
a
m
o
u
n
t
i
s
o
w
e
d
.
•
A
n
y
o
v
e
r
p
a
y
m
e
n
t
s
s
h
o
u
l
d
b
e
r
e
p
o
r
t
e
d
w
i
t
h
i
n
6
0
d
a
y
s
f
r
o
m
i
d
e
n
t
i
f
i
c
a
t
i
o
n
t
o
a
v
o
i
d
F
a
l
s
e
C
l
a
i
m
s
A
c
t
l
i
a
b
i
l
i
t
y
a
n
d
a
d
m
i
n
i
s
t
r
a
t
i
v
e
p
e
n
a
l
t
i
e
s
.
•
ECMCC combats fraud, waste and abuse in many ways, including but
not limited to, conducting internal audits and responding to external
audits.
I
f
y
o
u
b
e
c
o
m
e
a
w
a
r
e
o
f
a
n
a
c
t
u
a
l
o
r
p
o
t
e
n
t
i
a
l
o
v
e
r
p
a
y
m
e
n
t
,
y
o
u
s
h
o
u
l
d
i
m
m
e
d
i
a
t
e
l
y
n
o
t
i
f
y
t
h
e
O
f
f
i
c
e
o
f
C
o
r
p
o
r
a
t
e
C
o
m
p
l
i
a
n
c
e
a
t
7
1
6
-
8
9
8
-
6
4
5
7
s
o
t
h
a
t
E
C
M
C
C
c
a
n
p
r
o
m
p
t
l
y
d
e
t
e
r
m
i
n
e
w
h
e
t
h
e
r
i
t
h
a
s
r
e
c
e
i
v
e
d
a
n
o
v
e
r
p
a
y
m
e
n
t
a
n
d
r
e
p
a
y
a
n
y
o
v
e
r
p
a
y
m
e
n
t
s
i
t
d
i
s
c
o
v
e
r
s
22
The False Claims Act
The FCA contains so-called qui tam or “whistleblower” provisions”
•
Whistleblowers can file a lawsuit alleging an intentional violation of
the law.
•
Whistleblowers receive a percentage of the penalties that are
imposed if lawsuit is won.
•
Allows people both inside and outside of organizations to report
intentional fraud to the government.
•
Penalties may include treble damages:
•
Up to 3 times the amount of damages sustained by the government as a
result of the fraudulent claims
•
Substantial fines per claim
23
Exclusion Screening
•
We screen our staff for excluded providers or any excluded vendors
we have contracts with
•
Excluded providers cannot bill federal or state health care programs,
either directly or indirectly.
•
Inform your manager and the Office of Corporate Compliance
immediately if you are excluded from participation in any federal or
state health care program.
Failure to do so will result in severe sanctions.
24
Conflicts of Interest (COI)
G
i
f
t
s
f
r
o
m
I
n
d
u
s
t
r
y
•
ECMCC’s policy governing Gifts and Interactions with Industry
provides parameters for appropriate decision-making regarding the
acceptance or provision of business gratuities, gifts, activities, and
courtesies as well as other interactions between Individuals and
Industry.
•
Gifts from health care industry vendors are prohibited regardless of
any value.
•
Prohibits physicians from participating in industry sponsored
•
Employees should not be giving pharmaceutical and medical device
sponsored presentations unless it is their own work and complies
with the other requirements of our policy.
•
Pharmaceutical sales reps are prohibited from accessing our facilities
unless they make an appointment
25
Health Insurance Portability and Accountability
Act (HIPAA) and Patient Privacy
W
h
a
t
i
s
H
I
P
A
A
?
•
A set of rules enacted by the government which, among other
purposes, requires Northwell to protect the privacy and security of
individuals’ health information
H
I
P
A
A
A
p
p
l
i
e
s
T
o
:
•
Covered Entities, including ECMCC and its staff;
•
Business Associates (vendors and contractors acting on behalf of
ECMCC)
O
t
h
e
r
P
r
i
v
a
c
y
&
S
e
c
u
r
i
t
y
R
e
g
u
l
a
t
i
o
n
s
•
HIPAA / HITECH – All ECMCC facilities/programs
•
42 CFR Part 2 – Substance Abuse treatment
•
NYS Mental Hygiene Law – Mental Health treatment
26
Health Insurance Portability and Accountability
Act (HIPAA) and Patient Privacy
P
r
o
t
e
c
t
e
d
H
e
a
l
t
h
I
n
f
o
r
m
a
t
i
o
n
(
P
H
I
)
M
i
n
i
m
u
m
N
e
c
e
s
s
a
r
y
As healthcare providers, we must only request, use, or disclose, the
minimum necessary information about a patient in order to complete
the task at hand.
27
Health Insurance Portability and Accountability
Act (HIPAA) and Patient Privacy
I
n
d
i
v
i
d
u
a
l
l
y
I
d
e
n
t
i
f
i
a
b
l
e
I
n
f
o
r
m
a
t
i
o
n
28
Health Insurance Portability and Accountability
Act (HIPAA) and Patient Privacy
29
Monitoring Data for Inappropriate Use
30
ECMCC uses “FairWarning”
an audit program that shows
all accesses of our medical
record systems.
ECMCC will not tolerate Mishandling of our Data!
•
Privacy breach detection and reporting solution
that collects and aggregates data 24/7
•
Sends alerts to HIPAA Team about occurrences of
possible inappropriate access to medical records
•
New enhanced artificial intelligence controls
•
Used to conduct investigations in response to
reports/concerns
•
Discipline up to and including termination
Accessing Medical Record for Work
Your have a business-
You are only accessing
related reason
the PHI necessary for
treatment, payment or
other hospital operations
**Accessing a medical record for a purpose unrelated to your
assigned work may be a breach!
**Sharing information learned at work to someone for an unrelated
work purpose (including a family member or friend) may also be
a breach!
31
You cannot access a record for
personal reasons, including
To check on a family
member
To schedule an
appointment for yourself
To find out someone’s
birthday or address
Does something not feel right, or do you have
an issue you want to discuss?
We can help
.
R
e
p
o
r
t
i
n
g
o
b
l
i
g
a
t
i
o
n
s
•
It is the duty of every employee, vendor and all other individuals affiliated with ECMCC to
comply with all governing laws, regulations, ECMCC policies and procedures and the Code of
Conduct. Everyone must offer their complete cooperation with any investigation by ECMCC
and/or governing authorities.
•
You are required to report to the Office of Corporate Compliance, or the Compliance & HIPAA
Anonymous Hotline any actual or suspected violations of the Code, ECMCC’s policies and
procedures and/or federal or state law.
C
a
n
I
b
e
r
e
t
a
l
i
a
t
e
d
a
g
a
i
n
s
t
f
o
r
r
e
p
o
r
t
a
n
i
s
s
u
e
o
r
p
a
r
t
i
c
i
p
a
t
i
n
g
i
n
a
n
i
n
v
e
s
t
i
g
a
t
i
o
n
a
s
a
w
i
t
n
e
s
s
?
•
No. ECMCC does not permit retaliation against anyone for good faith and honest participation
in an internal or external investigation.
O
f
f
i
c
e
o
f
C
o
r
p
o
r
a
t
e
C
o
m
p
l
i
a
n
c
e
•
716-898-6439 Lindy Nesbitt, AVP Corporate Compliance
•
716-898-4595 Nadine Mund, Director of Corporate Compliance
•
716-898-5880 Laura Fleming, Privacy Officer
•
8
5
5
-
2
2
2
-
0
7
5
8
C
o
m
p
l
i
a
n
c
e
&
H
I
P
A
A
A
n
o
n
y
m
o
u
s
H
o
t
l
i
n
e
32
Quiz
Q
u
e
s
t
i
o
n
1
:
T
r
u
e
o
r
F
a
l
s
e
:
E
C
M
C
C
h
a
s
a
s
t
r
i
c
t
b
a
n
o
n
g
i
f
t
s
o
f
a
n
y
t
y
p
e
o
r
v
a
l
u
e
f
r
o
m
i
n
d
u
s
t
r
y
v
e
n
d
o
r
s
.
a)
T
r
u
e
b)
F
a
l
s
e
33
Quiz
Q
u
e
s
t
i
o
n
2
:
T
r
u
e
o
r
F
a
l
s
e
:
Y
o
u
s
h
o
u
l
d
r
e
p
o
r
t
a
n
y
p
o
t
e
n
t
i
a
l
c
o
n
f
l
i
c
t
o
f
i
n
t
e
r
e
s
t
t
o
y
o
u
r
E
C
M
C
C
b
u
s
i
n
e
s
s
c
o
n
t
a
c
t
a
n
d
t
h
e
O
f
f
i
c
e
o
f
C
o
r
p
o
r
a
t
e
C
o
m
p
l
i
a
n
c
e
.
a)
T
r
u
e
b)
F
a
l
s
e
34
Quiz
Q
u
e
s
t
i
o
n
3
:
W
h
i
c
h
o
f
t
h
e
f
o
l
l
o
w
i
n
g
p
r
o
h
i
b
i
t
s
s
u
b
m
i
s
s
i
o
n
o
f
f
a
l
s
e
o
r
f
r
a
u
d
u
l
e
n
t
c
l
a
i
m
s
i
n
o
r
d
e
r
t
o
r
e
c
e
i
v
e
p
a
y
m
e
n
t
f
r
o
m
t
h
e
f
e
d
e
r
a
l
g
o
v
e
r
n
m
e
n
t
?
a)
H
I
P
A
A
b)
F
e
d
e
r
a
l
F
a
l
s
e
C
l
a
i
m
s
A
c
t
c)
E
M
T
A
L
A
d)
F
e
d
e
r
a
l
N
o
S
u
r
p
r
i
s
e
A
c
t
35
Quiz
Q
u
e
s
t
i
o
n
4
:
W
h
i
c
h
o
f
t
h
e
f
o
l
l
o
w
i
n
g
r
e
q
u
i
r
e
s
E
C
M
C
C
t
o
p
r
o
t
e
c
t
t
h
e
p
r
i
v
a
c
y
a
n
d
s
e
c
u
r
i
t
y
o
f
i
n
d
i
v
i
d
u
a
l
s
’
p
r
o
t
e
c
t
e
d
h
e
a
l
t
h
i
n
f
o
r
m
a
t
i
o
n
?
a)
S
t
a
r
k
L
a
w
b)
H
I
P
A
A
c)
E
M
T
A
L
A
d)
C
i
v
i
l
M
o
n
e
t
a
r
y
P
e
n
a
l
t
i
e
s
L
a
w
36
Quiz
Q
u
e
s
t
i
o
n
5
:
W
h
i
c
h
o
f
t
h
e
f
o
l
l
o
w
i
n
g
p
r
o
h
i
b
i
t
s
p
a
y
m
e
n
t
s
o
r
o
t
h
e
r
t
r
a
n
s
f
e
r
s
o
f
v
a
l
u
e
t
h
a
t
a
r
e
i
n
t
e
n
d
e
d
t
o
i
n
d
u
c
e
r
e
f
e
r
r
a
l
s
?
a)
S
t
a
r
k
L
a
w
b)
H
I
P
A
A
c)
E
M
T
A
L
A
d)
A
n
t
i
-
K
i
c
k
b
a
c
k
S
t
a
t
u
t
e
37
Welcome to ECMCC's mandatory compliance training for vendors covering regulatory requirements, compliance program overview, fraud Prevention, OMIG compliance, Code of Ethical Conduct, and communication policies. Learn about Stark Law, Anti-Kickback Statute, and False Claims Act for ethical conduct and integrity.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Mandatory Vendor Compliance Training Regulatory Requirements 2024 1
Compliance Program Overview & Requirements OMIG Compliance Program Requirements Fraud, Waste and Abuse Regulating Financial Arrangements The Anti-Kickback Statute Compliance With State and Federal Fraud and Abuse Laws The Stark Law The False Claims Act Exclusion Screening Conflict of Interest HIPAA Quiz & Attestation 2
Introduction Welcome to ECMCC s Mandatory Compliance Training for vendors. In order to receive credit for this course you will be required to pass a quiz and complete an attestation. ECMCC is committed to fostering a culture of compliance and integrity and to ensuring that all operate at only the highest standards for ethical conduct This training will provide you with important information regarding ECMCC s Compliance Program This training also will cover compliance with laws, rules and regulations that apply to ECMCC, including the Stark Law and Anti-Kickback Statute and the False claims Act Once you have completed this training course, please complete the attached attestation and return it to the Compliance Office to nmund@ecmc.edu If you have any questions about this training, please contact ECMCC s Office of Corporate Compliance at 716-898-6439 3
Code of Ethical Conduct Integrity Value Honesty Ethics Principles Choice Fairness ECMCC has adopted a Code of Conduct that serves as an organizational Constitution that applies to employees and vendors of ECMCC Vendors are expected to follow the Code of Conduct as well as applicable ECMCC policies and procedures A copy of the Code is enclosed with this training 4
OMIG OMIG Compliance Compliance Program Program Requirements Requirements The New York State Office of the Medicaid Inspector General or OMIG, enhances the integrity of the New York State Medicaid program by: Preventing and detecting fraudulent, abusive, and wasteful practices within the Medicaid program; and Recovering improperly expended Medicaid funds while promoting a high quality of patient care. 5
Lines of communication Policies and procedures Compliance Committee Elements of an effective compliance program Training and education Disciplinary Standards OMIG Compliance Program Requirements Compliance Officer Auditing and Monitoring Responding to Compliance Issues To assist providers in this effort, the OMIG provides comprehensive guidance related to provider compliance programs, self- disclosure, and Medicaid managed care fraud, waste, and abuse prevention program regulations. It is the responsibility of the Chief Corporate Compliance Officer to ensure we meet all of these requirements through our ECMCC Compliance Program. The requirements for an effective Compliance Program as defined by OMIG are shown here. 6
OMIG Compliance Program Risk Areas Billings According to OMIG requirements, a Provider s Compliance Program shall apply to the required provider s risk areas, which are those areas of operation affected by the compliance program shown here. Coding Ordered Services Quality of Care Medical Necessity Mandatory Reporting Contractor, Subcontractor, agent or independent contract oversight Payments Governance Credentialing Other Risk Areas identified through organizational experience 7
ECMCCs Compliance Program Overview ECMCC s Compliance Program is designed to promote compliance with federal and state laws and the rules governing participation in government healthcare programs, such as Medicare and Medicaid ECMCC s Compliance Program incorporates, among other things, elements considered to be essential to an effective compliance program: 1.A designated Compliance Officer and Compliance Committee 2.Written policies, procedures and standards of conduct 3.Compliance training and education 4.Lines of communication between personnel and the Compliance Officer 5.Policy of Non-Retaliation and Non-Intimidation 6.Internal monitoring and auditing 7.Disciplinary guidelines for enforcement of standards 8.Protocols for prompt response to detected offenses and the undertaking of corrective action 8
ECMCCs Chief Compliance Officer ECMCC has designated an individual to serve as its Chief Compliance Officer, Lindy Nesbitt. The Chief Compliance Officer is the focal point for ECMCC s compliance program and is responsible for the day-to-day operation of the compliance program. The Chief Compliance Officer leads the ECMCC Compliance Program. The Chief Compliance Officer reports to the Audit and Compliance Committee of the ECMCC Board, and the Chief General Counsel on at least a quarterly basis. 9
ECMCC Compliance Program Overview Policies and Procedures ECMCC policies and procedures function like internal laws that govern the conduct of employees, agents, contractors and other staff (including medical staff) Vendors are expected to follow applicable policies and procedures as well as the ECMCC Code of Conduct 10
ECMCC Compliance Program Overview Monitoring and Auditing The Office of Corporate Compliance develops annual monitoring and auditing plans base on a compliance risk assessment that considers: Identified areas of compliance concern for ECMCC, specifically, and for the healthcare industry generally Regulatory guidance, such as the annual OIG and OMIG Work Plan The Office of Corporate Compliance conducts annual reviews of its compliance program to determine its effectiveness, and whether any revision of corrective action is required. The Office of Corporate Compliance partners with many departments across the organization to ensure that we are documenting, coding and billing appropriately and accurately. 11
ECMCC Compliance Program Overview Disciplinary Standards ECMCC has published system-wide compliance disciplinary standards All individuals within the ECMCC system, regardless of position, are subject to ECMCC s disciplinary standards Disciplinary standards with respect to vendors may include measures up to and including reassignment or vendor personnel or suspension or termination of contract. 12
ECMCC Compliance Program Overview Communicating with the Office of Corporate Compliance ECMCC provides multiple lines of communication to the Office of Corporate Compliance to ensure that all employees and vendors are aware of and feel comfortable raising questions or reporting concerns regarding possible violations of the Code of Ethical Conduct, policies and procedures, or any applicable law, regulation or administrative rule It is critical that you immediately notify your supervisor or the Compliance Officer if you believe that there has been a potential violation of: Your contract with ECMCC, ECMCC s Code of Ethical Conduct, or any ECMCC policies and procedures applicable to your contract Criminal, civil or administrative laws The rules governing participation in any federal or state healthcare program The Office of Corporate Compliance can be reached at 716-898-6439. Confidential Compliance & HIPAA Anonymous Hotline at 855-222-0758 available 24 hours a day, seven days a week. The Office of Corporate Compliance will make a good-faith investigation into reports about ECMCC, whether received through the hotline or otherwise. 13
ECMCC Compliance Program Overview Investigations and Corrective Actions ECMCC takes seriously any compliance concerns raised ECMCC s Office of Corporate Compliance will follow up on any compliance concerns that may be identified through investigations, reports, auditing or monitoring The Office of Corporate Compliance, in consultation with applicable stakeholders, will determine whether corrective action is required to addr4ess compliance risks and vulnerabilities The office of Corporate Compliance may perform re-audits, implement new or amended policies and procedures, or implement new or enhanced monitoring processes, among other things The Office of Corporate Compliance may call on you to assist with evaluating the need for or implementing corrective actions, where appropriate 14
Fraud, Waste and Abuse 2022 2022 The United States Department of Justice collected more than $2 Billion dollars in False Claims. It is important to know too that government officials are increasingly likely to take executives and other individuals involved in corporate fraud, waste and abuse to court. 2023 2023 Federal and State governmental agencies continued to take an aggressive stance in protecting taxpayer-funded healthcare programs from fraud, waste and abuse. 15
Fraud and Abuse Laws Refer to these ECMCC policies that are designed to ensure compliance with fraud and abuse laws: Corporate Compliance: Billing and Coding Fraud, Waste and Abuse Compliance Non-Retaliation and Non-Intimidation Physician Compensation Policy Vendor Access Policy Competitive Bidding Procedure Interactions Between ECMCC and Industry Sanction Screening Policy 16
Fraud and Abuse Laws Civil Monetary Penalties Law Prohibits the submission of claims for unnecessary items and services or items and services that were not actually provided Prohibits giving Medicare and Medicaid patients something of value to influence the patient to choose a specific provider. Penalties for violations can be severe. 17
Regulating Financial Arrangements - Anti- kickback Statute & Stark Law The Anti-Kickback Statute (AKS) and Stark Law are designed to prevent fraud and abuse that could harm federal healthcare programs and patients The AKS and the Stark Law prohibit a variety of financial relationships that would be completely permissible in other industries Laws Emphasize both substance (Is the nature and intent of the arrangement appropriate?) and form (Is the agreement in writing? Does it include required provisions?) A financial relationship might be illegal even if it doesn't feel or seem wrong Even well-intentioned arrangements can violate the law Compliance with laws governing financial arrangements with sources or recipients of referrals is essential to protecting ECMCC against: Significant fines and penalties Reputational risk Legal costs incurred defending against an investigation 18
The Anti-Kickback Statute (AKS) The AKS prohibits payments or other transfers of value that are intended to induce referrals The AKS prohibits ECMCC from knowingly and willfully offering, requesting, giving, or taking any remuneration basically, anything of value in exchange for healthcare business A relationship will violate the AKS if just one purpose is an intent to improperly induce referrals Violations of the AKS may result in significant civil and criminal penalties Example: A hospital chain settled for $513 million with the federal government for AKS violations stemming from above-fair-market value payments made to OB-GYN clinic operators. The federal government contended that the payments to the clinic were made to induce referrals back to the hospital chain and its subsidiaries Forfeiture of federal healthcare program reimbursement Treble damages under the False Claims Act An underlying AKS violation renders claims per se false under the False Claims Act Exclusion from federal healthcare programs Prison 19
The Stark Law The Stark Law prohibits a physician from referring Medicare and Medicaid patients for certain designated health services to a facility with which the physician group, physician (or an immediate family member) has a financial relationship, unless a specific exception is met ECMCC is able to employ and contract with physicians if the arrangements fit within exceptions to the Stark Law If a financial relationship violates the Stark Law, every single Medicare or Medicaid referral for designated health services that the physician makes to ECMCC is impermissible ECMCC must repay any Medicare or Medicaid reimbursement that is received for designated health services referred by the physician Additional fines and penalties are possible as well Example: The Stark Law allows employed physicians to make referrals to their employer so long as certain requirements are met, including that compensation does not take into account the volume or value of referrals. One South Carolina hospital settled for $72.4 million with the federal government because, in part, they offered productivity bonuses to physicians that took into account their volume of referrals, running afoul of this requirement 20
The False Claims Act A key enforcement law is the Federal False Claims Act. The Federal False Claims Act prohibits an individual or entity from submitting claims to the Federal government that they know (or should know) are false, such as, for example, claims for services that were not provided. The New York False Claims Act similarly prohibits the submission of false claims to the State of New York ECMCC submits claims to both the Federal government and the State of New York for services provided to patients enrolled in government- funded healthcare programs, such as Medicare and Medicaid 21
The False Claims Act False Claims: when an entity knowingly receives money it should not and says nothing or conceals that an amount is owed. Any overpayments should be reported within 60 days identification to avoid False Claims Act liability and administrative penalties. ECMCC combats fraud, waste and abuse in many ways, including but not limited to, conducting internal audits and responding to external audits. False Claims within 60 days from If you become aware of an actual or potential overpayment, you should If you become aware of an actual or potential overpayment, you should immediately notify the Office of Corporate Compliance at immediately notify the Office of Corporate Compliance at 716 716- -898 898- -6457 so that ECMCC can promptly determine whether it has 6457 so that ECMCC can promptly determine whether it has received an overpayment and repay any overpayments it discovers received an overpayment and repay any overpayments it discovers 22
The False Claims Act The FCA contains so-called qui tam or whistleblower provisions Whistleblowers can file a lawsuit alleging an intentional violation of the law. Whistleblowers receive a percentage of the penalties that are imposed if lawsuit is won. Allows people both inside and outside of organizations to report intentional fraud to the government. Penalties may include treble damages: Up to 3 times the amount of damages sustained by the government as a result of the fraudulent claims Substantial fines per claim 23
Exclusion Screening We screen our staff for excluded providers or any excluded vendors we have contracts with Excluded providers cannot bill federal or state health care programs, either directly or indirectly. Inform your manager and the Office of Corporate Compliance immediately if you are excluded from participation in any federal or state health care program. Failure to do so will result in severe sanctions. 24
Conflicts of Interest (COI) Gifts from Industry Gifts from Industry ECMCC s policy governing Gifts and Interactions with Industry provides parameters for appropriate decision-making regarding the acceptance or provision of business gratuities, gifts, activities, and courtesies as well as other interactions between Individuals and Industry. Gifts from health care industry vendors are prohibited regardless of any value. Prohibits physicians from participating in industry sponsored Employees should not be giving pharmaceutical and medical device sponsored presentations unless it is their own work and complies with the other requirements of our policy. Pharmaceutical sales reps are prohibited from accessing our facilities unless they make an appointment 25
Health Insurance Portability and Accountability Act (HIPAA) and Patient Privacy What is HIPAA? What is HIPAA? A set of rules enacted by the government which, among other purposes, requires Northwell to protect the privacy and security of individuals health information HIPAA Applies To: HIPAA Applies To: Covered Entities, including ECMCC and its staff; Business Associates (vendors and contractors acting on behalf of ECMCC) Other Privacy & Security Regulations Other Privacy & Security Regulations HIPAA / HITECH All ECMCC facilities/programs 42 CFR Part 2 Substance Abuse treatment NYS Mental Hygiene Law Mental Health treatment 26
Health Insurance Portability and Accountability Act (HIPAA) and Patient Privacy Protected Health Information (PHI) Protected Health Information (PHI) Individually Identifiable health information Protected Health Information (PHI) Identifiers Minimum Necessary Minimum Necessary As healthcare providers, we must only request, use, or disclose, the minimum necessary information about a patient in order to complete the task at hand. 27
Health Insurance Portability and Accountability Act (HIPAA) and Patient Privacy Individually Identifiable Information Individually Identifiable Information Demographic data relating to an individual s past, present or future Payment for the provision of health care Physical or mental health or condition Treatment 28
Health Insurance Portability and Accountability Act (HIPAA) and Patient Privacy It is the responsibility of all ECMCC employees and vendors to protect the security of our patients PHI and prevent disclosures to unauthorized individuals. Any vendor that has access to PHI of ECMCC patients is required to sign a Business Associate Agreement which includes requirements for securely handling and storing PHI. Any employee or vendor who becomes aware that PHI may have been improperly disclosed to unauthorized individuals must notify the Privacy Officer immediately at 716-898-5880. 29
Monitoring Data for Inappropriate Use ECMCC will not tolerate Mishandling of our Data! Privacy breach detection and reporting solution that collects and aggregates data 24/7 ECMCC uses FairWarning an audit program that shows all accesses of our medical record systems. Sends alerts to HIPAA Team about occurrences of possible inappropriate access to medical records New enhanced artificial intelligence controls Used to conduct investigations in response to reports/concerns Discipline up to and including termination 30
Accessing Medical Record for Work You cannot access a record for personal reasons, including To check on a family member Your have a business- related reason You are only accessing the PHI necessary for treatment, payment or other hospital operations To schedule an appointment for yourself To find out someone s birthday or address **Accessing a medical record for a purpose unrelated to your assigned work may be a breach! **Sharing information learned at work to someone for an unrelated work purpose (including a family member or friend) may also be a breach! 31
Does something not feel right, or do you have an issue you want to discuss? We can help. Reporting obligations Reporting obligations It is the duty of every employee, vendor and all other individuals affiliated with ECMCC to comply with all governing laws, regulations, ECMCC policies and procedures and the Code of Conduct. Everyone must offer their complete cooperation with any investigation by ECMCC and/or governing authorities. You are required to report to the Office of Corporate Compliance, or the Compliance & HIPAA Anonymous Hotline any actual or suspected violations of the Code, ECMCC s policies and procedures and/or federal or state law. Can I be retaliated against for report an issue or participating in an Can I be retaliated against for report an issue or participating in an investigation as a witness? investigation as a witness? No. ECMCC does not permit retaliation against anyone for good faith and honest participation in an internal or external investigation. Office of Corporate Compliance Office of Corporate Compliance 716-898-6439 Lindy Nesbitt, AVP Corporate Compliance 716-898-4595 Nadine Mund, Director of Corporate Compliance 716-898-5880 Laura Fleming, Privacy Officer 855-222-0758 Compliance & HIPAA Anonymous Hotline Compliance & HIPAA Anonymous Hotline 32
Quiz Question 1: Question 1: True or False: ECMCC has a strict ban on gifts of any type or value from industry vendors. a) a) True True b) b) False False 33
Quiz Question 2: Question 2: True or False: You should report any potential conflict of interest to your ECMCC business contact and the Office of Corporate Compliance. a) a) True True b) b) False False 34
Quiz Question 3: Question 3: Which of the following prohibits submission of false or fraudulent claims in order to receive payment from the federal government? a) a) HIPAA HIPAA b) b) Federal False Claims Act Federal False Claims Act c) c) EMTALA EMTALA d) d) Federal No Surprise Act Federal No Surprise Act 35
Quiz Question 4: Question 4: Which of the following requires ECMCC to protect the privacy and security of individuals protected health information? a) a) Stark Law Stark Law b) b) HIPAA HIPAA c) c) EMTALA EMTALA d) d) Civil Monetary Penalties Law Civil Monetary Penalties Law 36
Quiz Question 5: Question 5: Which of the following prohibits payments or other transfers of value that are intended to induce referrals? a) a) Stark Law Stark Law b) b) HIPAA HIPAA c) c) EMTALA EMTALA d) d) Anti Anti- -Kickback Statute Kickback Statute 37
