The HHS (Health and Human Services) along with CMS (Centers for Medicare and Medicaid Services) developed the guidelines that must be followed for an Effective Compliance Program. The OIG (Office of the Inspector General) will enforce these guidelines. Overall, you determine if you will be moral and ethical and follow the rules.

For an effective Compliance Program, you should have at least three binders (HIPAA Compliance, OIG Compliance, and Policies and Procedures) or manuals.

Throughout these binders, you have documented evidence of the 7 (actually 8) elements of a compliance program (shown below).

You should also have individual(s) that monitor, maintain, and enforce the elements of your compliance program. The Compliance Program will be a continually evolving element in your office for the duration of your practice. It is not a ONE AND DONE event

7 Elements of a Compliance Program

1. Implementing written policies and procedures (Standards of Conduct Guide and Ethics policy)
2. Designating a compliance officer and compliance committee (Compliance Advisory Committee)
3. Conducting effective training and education (Compliance Training)
4. Developing effective lines of communication (Hotline)
5. Conducting internal monitoring and auditing (Internal Audits, Compliance Inspections, Peer Reviews, and External Audits, Reviews, and Inspections
6. Enforcing standards through well-publicized disciplinary guidelines (Consequences levied consistently regardless of the employee’s stature within the organization). Enforcement consistent with appropriate disciplinary action.
7. Responding promptly to detected problems and undertaking corrective action (Hotline procedures require two weeks for action; elevation to VP/President).
8. Every staff member and independent contractor should be checked through the OIG Exclusion list.

The OIG Work Plan sets forth various projects, including OIG audits and evaluations, that are underway or planned to be addressed during the fiscal year and beyond by OIG’s Office of Audit Services and Office of Evaluation and Inspections. Previous OIG work identified inappropriate payments for chiropractic services that were medically unnecessary, were not documented in accordance with Medicare requirements, or were fraudulent.

According to Medicare, there are two methods by which a subluxation can be proven:

1. X-rays
2. Examination

   Because there is a level of examination built into the manipulation (preassessment, manipulation, and post-assessment), that may be all the more evaluation that you do. However, keep in mind that this minimal level may not be enough to document Medical Necessity.

No this would be considered fraud (CMS Publication 100-02, Medicare Benefit Policy Manual, Chapter 15, Section 240.1.2.2A)

Re-evaluation: My patients, especially Medicare Patients, do not like having to pay for a re-evaluation. Is it required or can I stop doing them and make it more affordable to my patients?The following documentation requirements apply whether the subluxation is demonstrated by x-ray or by physical examination:

• History as stated above.
• Description of the present illness, including:
  • Mechanism of trauma.
  • Quality and character of symptoms/problem.
  • Onset, duration, intensity, frequency, location, and radiation of symptoms.
  • Aggravating or relieving factors.
  • Prior interventions, treatments, medications, secondary complaints, and
  • Symptoms causing patient to seek treatment.
  • These symptoms must bear a direct relationship to the level of subluxation. The symptoms should refer to the spine (spondyle or vertebral), muscle (myo), bone (osseo or osteo), rib (costo or costal) and joint (arthro) and be reported as pain (algia), inflammation (itis), or as signs such as swelling, spasticity, etc. Vertebral pinching of spinal nerves may cause headaches, arm, shoulder, and hand problems as well as leg and foot pains and numbness. Rib and rib/chest pains are also recognized symptoms, but in general, other symptoms must relate to the spine as such. The subluxation must be causal, i.e., the symptoms must be related to the level of the subluxation that has been cited. A statement on a claim that there is “pain” is insufficient. The location of pain must be described and whether the particular vertebra listed is capable of producing pain in the area determined.
• Evaluation of musculoskeletal/nervous system through physical examination.
• Diagnosis: The primary diagnosis must be subluxation, including the level of subluxation, either so stated or identified by a term descriptive of subluxation. Such terms may refer either to the condition of the spinal joint involved or to the direction of position assumed by the particular bone named.
• Treatment Plan: The treatment plan should include the following:
  • Recommended level of care (duration and frequency of visits)
  • Specific treatment goals
  • Objective measures to evaluate treatment effectiveness
• Date of the initial treatment.

(CMS Publication 100-02, Medicare Benefit Policy Manual, Chapter 15, Section 240.1.2.2A).

Medicare specifically requires that a re-evaluation be performed every 12 visits or 30 days (whichever occurs first). Other carriers will have their own guideline on this. CCGPP Guidelines state that a patient must be monitored for functional improvement every two weeks. If you are in network with a carrier, you are contractually obligated to comply with their guideline. Otherwise, you are obligated to follow state, federal and professional (medical board) guidelines.

A re-examination is the process of performing selected tests and measures after the initial examination to evaluate progress and to modify or redirect interventions. Indications for a re-examination are new clinical findings or failure to respond to interventions. You should use the information gathered during a re-examination to determine if the current course of care is appropriate, or if modifications are necessary. Therefore, a re-evaluation is the process of retaining or modifying the plan of care.

The difference between an initial examination and re-examination is the initial exam establishes the original plan of care and re-exams are used to modify the plan of care, as indicated. An “assessment” is different than an evaluation or re-evaluation. An assessment is the measurement or quantification of a variable or the placement of a value on something. An assessment may be a component of examinations and re-examinations but should not be confused with these processes. An assessment may occur during each visit and is part of the overall service provided during a visit. Assessments are not reported separate from an evaluation or re-evaluation service unless the assessment is a separately identified service. Examinations are required prior to the initial treatment for all patients. This process helps you determine the most appropriate procedures to achieve treatment goals and desired outcomes. New patient exam codes are 99201 – 99205 and should be billed when the patient is evaluated for a new condition that results in a new plan of care. Reexaminations are appropriate to help refocus care and determine if the current plan of care is appropriate or needs modification and are billed with codes 99211 – 99215.

Re-examinations should be performed in the following situations:

1. When the patient’s condition or capacity to function substantively improves such that an update to the diagnosis and plan of care is necessary. Therefore, revise treatment plan.
2. When the patient’s condition or capacity to function substantively worsens (e.g., exacerbation) such that update to the diagnosis and plan of care is necessary. Therefore, revise the treatment plan and explain in detail why you think the patient is not improving.
3. When the patient’s condition or capacity to function remains substantially unchanged for too long a period of time. This re-evaluation should focus on why the condition is not improving, what will be done to obtain improvement; or, if not possible, the patient should be referred to a healthcare provider for another opinion, dismissed from treatment, or transferred to a preventive/maintenance plan of care at the patient’s expense.
4. The emergence of a new condition during treatment. Again, this requires a new plan of care that addresses both the current and new condition.
5. Sometimes at discharge (document the goals achieved, goals not achieved, instructions given, etc.).

The re-examination documentation should include the patient’s current status, updated examination findings, a discussion of progress or lack of, the updated plan of care, treatment goals, updated diagnosis, future services rendered with clinical rationale and discharge to wellness planning.

The following documentation requirements apply whether the subluxation is demonstrated by x-ray or by physical examination:

History (an interval history sufficient to support continuing need; document substantive changes):

• Review of chief complaint.
• Changes since last visit.

System review, if relevant

Physical exam (interval; document subsequent changes; a full repeat P.A.R.T. is not expected):

• • Exam of area of spine involved in diagnosis.
  • Assessment of change in patient condition since last visit.
  • Evaluation of treatment effectiveness.

Documentation of treatment given on day of visit: Documentation of how the day’s treatment fits within the plan of care (e.g. “visit 4 of planned 7 treatments”) and any way the treatment plan is being changed. (CMS Publication 100-02, Medicare Benefit Policy Manual, Chapter 15, Section 240.1.2.2B)

The treatment plan should include the following:

• Recommended level of care (duration and frequency of visits).
• Specific treatment goals.
• Objective measures to evaluate treatment effectiveness.

(CMS Publication 100-02, Medicare Benefit Policy Manual, Chapter 15, Section 240.1.2.2A)

What is Documentation Demonstrated by Physical Examination (aka “P.A.R.T.)?Standardized outcome assessments, questionnaires or tools are a vital part of evidence-based practice. Despite the recognition of the importance of outcomes assessments, questionnaires and tools, recent evidence suggests their use in clinical practice is limited. Utilization of the appropriate outcome assessment, questionnaires, and tools enhances clinical practice by:

• Identifying and quantifying body function and structure limitations
• Formulating evaluation, diagnosis, and prognosis
• Forming the plan of care
• Assisting in evaluating the patient progress towards the goals and validating the benefits of treatment
• Improving communication between client, clinician, and third-party payer
• Assisting to improve the documentation of care provided

(Lesher, et al., 2016; Potter, et al., 2011; Schenk, et al. 2016)

A functional outcome assessment is multi-dimensional and quantifies pain and musculoskeletal/neuromusculoskeletal capacity. These measurement tools focus on measuring a patient’s functional improvement before, during, and at/after discharge. The information gathered is used to assess the effectiveness of the care provided by the chiropractor. Outcomes also provide evidence about benefits, risks, and results of treatments so the doctor and patient can make more informed decisions. If the results are positive, meaning the patient returns to full function, it provides validation for developing and implementing clinical guidelines to recommend the same approach with other patients with similar conditions

Examples of Outcome Assessment Tools

• Back Bournemouth Questionnaire
• CTS Questionnaire
• Functional Rating Index
• Headache Disability Index
• Health Status Questionnaire (HSQ-12)
• Health Status Questionnaire (RAND 36)
• Low Back Disability Questionnaire (Oswestry)
• Low Back Disability Questionnaire (Revised Oswestry)
• Low Back Pain Disability Questionnaire (Roland–Morris)
• Lower Extremity Functional Scale
• Neck Bournemouth Questionnaire
• Neck Pain Disability Index
• Oswestry Disability Questionnaire
• Oswestry Disability Questionnaire (Metric)
• Oswestry Disability Questionnaire
• Patient-specific Functional and Pain Scales (PSFS)
• Promis Pain Intensity Scale
• Promis Pain Interference 4a
• Quadruple Visual Analogue Scale
• Upper Extremity Functional Index

The P.A.R.T. evaluation process is recommended as the examination alternative to the previously mandated demonstration of subluxation by x ray/MRI/CT for services, beginning January 1, 2000. The acronym P.A.R.T. identifies diagnostic criteria for spinal dysfunction (subluxation).

• P – Pain/tenderness evaluated in terms of location, quality, and intensity: the perception of pain and tenderness is assessed. Most primary neuromusculoskeletal disorders manifest primarily by a painful response. Pain and tenderness findings may be identified through one or more of the following: observation, percussion, palpation, provocation, etc. Furthermore, pain intensity may be assessed using one or more of the following: visual analog scales, algometers, pain questionnaires, etc.
• A – Asymmetry/misalignment identified on a sectional or segmental level: observation (posture and heat analysis), static palpation for misalignment of vertebral segments, diagnostic imaging, etc.
• R – Range of motion abnormality (changes in active, passive, and accessory joint movements resulting in an increase or a decrease of sectional or segmental mobility. Range of motion abnormalities may be identified through one or more of the following: motion palpation, observation, stress diagnostic imaging, range of motion, measurement(s), etc.
• T – Tissue, tone changes in the characteristics of contiguous or associated soft tissues including skin, fascia, muscle and ligament: abnormalities in tone, texture and/or temperature may be identified through one or more of the following procedures: observation, palpation, use of instrumentation, test of length and strength, etc. To demonstrate a subluxation based on physical examination, two of the four (P.A.R.T.) criteria are required, one of which must be asymmetry/misalignment or range of motion abnormality. Documentation of changes in the patient’s examination, status, progression must be recorded at each visit.

This Act was established in order to protect the patient, the facility or provider and the insurance companies.

• First, it protects the patient against “Surprise Billing”, also known as Balance Billing.
• Next, it protects the facility/provider from any repercussions when a Good Faith Estimate along with Communication regarding the process, services and charges is established.
• Lastly, it protects the Insurance Companies through an Independent Dispute Resolution (IDR) process regarding settlements.

More details can be found in our help document.

The Privacy Rule standards address the use and disclosure of individuals’ health information (known as “protected health information”) by entities subject to the Privacy Rule. These individuals and organizations are called “covered entities.” The Privacy Rule also contains standards for individuals’ rights to understand and control how their health information is used. A major goal of the Privacy Rule is to ensure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well-being. The Privacy Rule strikes a balance that permits important uses of information while protecting the privacy of people who seek care and healing.

The following types of individuals and organizations are subject to the Privacy Rule and considered covered entities:

• Healthcare providers: Every healthcare provider, regardless of size of practice, who electronically transmits health information in connection with certain transactions. These transactions include claims, benefit eligibility inquiries, referral authorization requests, and other transactions for which HHS has established standards under the HIPAA Transactions Rule.
• Health plans: Entities that provide or pay the cost of medical care. Health plans include health, dental, vision, and prescription drug insurers; health maintenance organizations (HMOs); Medicare, Medicaid, Medicare + Choice, and Medicare supplement insurers; and long-term care insurers (excluding nursing home fixed-indemnity policies). Health plans also include employer-sponsored group health plans, government- and church-sponsored health plans, and multi-employer health plans.
• Exception: A group health plan with fewer than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity.
• Healthcare clearinghouses: Entities that process nonstandard information they receive from another entity into a standard (i.e. standard format or data content), or vice versa. In most instances, healthcare clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or healthcare provider as a business associate.
• Business associates: A person or organization (other than a member of a covered entity’s workforce) using or disclosing individually identifiable health information to perform or provide functions, activities, or services for a covered entity. These functions, activities, or services include claims processing, data analysis, utilization review, and billing.

A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations:

• Disclosure to the individual (if the information is required for access or accounting of disclosures, the entity MUST disclose to the individual)
• Treatment, payment, and healthcare operations
• Opportunity to agree or object to the disclosure of PHI (informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object)
• Incident to an otherwise permitted use and disclosure
• Public interest and benefit activities—The Privacy Rule permits use and disclosure of protected health information, without an individual’s authorization or permission, for 12 national priority purposes:
  • • When required by law
    • Public health activities
    • Victims of abuse or neglect or domestic violence
    • Health oversight activities
    • Judicial and administrative proceedings
    • Law enforcement
    • Functions (such as identification) concerning deceased persons
    • Cadaveric organ, eye, or tissue donation
    • Research, under certain conditions
    • To prevent or lessen a serious threat to health or safety
    • Essential government functions
    • Workers Compensation
    • Limited dataset for research, public health, or healthcare operations

While the HIPAA Privacy Rule safeguards protected health information (PHI), the Security Rule protects a subset of information covered by the Privacy Rule. This subset is all individually identifiable health information a covered entity creates, receives, maintains, or transmits in electronic form. This information is called “electronic protected health information” (e-PHI). The Security Rule does not apply to PHI transmitted orally or in writing.

To comply with the HIPAA Security Rule, all covered entities must do the following:

• Ensure the confidentiality, integrity, and availability of all electronic protected health information
• Detect and safeguard against anticipated threats to the security of the information
• Protect against anticipated impermissible uses or disclosures
• Certify compliance by their workforce
• Covered entities should rely on professional ethics and best judgment when considering requests for these permissive uses and disclosures. The HHS Office for Civil Rights enforces HIPAA rules, and all complaints should be reported to that office. HIPAA violations may result in civil monetary or criminal penalties.

For more information, visit the Department of Health and Human Services HIPAA website: https://www.hhs.gov/hipaa/index.html

The HIPAA Security Rule (45 C.F.R. § 164.308 (a)(5)(ii)(B) requires that all software used by Covered Entities and Business Associates be kept current and up to date with updates from the software vendor. If a vendor no longer supports a software program, it cannot be used. On July 10, 2018, Windows 8 reached end of support and extended support ended on July 11, 2023. Simply having a Windows 8, or any previous version computer on your network is a HIPAA violation. The WCA Help Desk advises that you upgrade to the latest Windows software, Windows 11.

Although training is one piece of the compliance puzzle, there is more that goes into a complete compliance program outside of just training. This includes a security risk analysis, specific policies and procedures, action plans, and more.

Yes, the law is constantly changing to help protect PHI as the technology around us continues to evolve. It is best to work with a 3rd party vendor for compliance to keep your practice up to date with the latest changes.

Working with an IT company is one important factor to protect the PHI of your patients but that only satisfies your technical safeguard requirements. In addition to the technical safeguards, you will also need to establish administrative and physical safeguards for your HIPAA compliance program.

The Occupational Safety and Health Administration is a large regulatory agency of the United States Department of Labor that originally had federal visitorial powers to inspect and examine workplaces. Wisconsin is under federal OSHA jurisdiction, which covers most private sector workers within the state. State and local government workers are not covered by federal OSHA. The Occupational Safety and Health Act of 1970 (OSH Act) was passed to prevent workers from being killed or seriously harmed at work. This law created the Occupational Safety and Health Administration (OSHA), which sets and enforces protective workplace safety and health standards. OSHA also provides information, training, and assistance to employers and workers. Under the OSH Act, employers have the responsibility to provide a safe workplace.

RIGHTS AND RESPONSIBILITIES
Employers must:

• Follow all relevant OSHA safety and health standards.
• Find and correct safety and health hazards.
• Inform employees about chemical hazards through training, labels, alarms, color-coded systems, chemical information sheets and other methods.
• As of January 1, 2015, notify OSHA within 8 hours of a workplace fatality or within 24 hours of any work-related inpatient hospitalization, amputation or loss of an eye (1-800-321-OSHA [6742]); www.osha.gov/report_online).
• Provide required personal protective equipment at no cost to workers. *
• Keep accurate records of work-related injuries and illnesses.
• Post OSHA citations, injury and illness summary data, and the OSHA Job Safety and Health – It’s The Law poster in the workplace where workers will see them.
• Not retaliate against any worker for using their rights under the law.

Employees have the right to:

• Working conditions that do not pose a risk of serious harm.
• Receive information and training (in a language workers can understand) about chemical and other hazards, methods to prevent harm, and OSHA standards that apply to their workplace.
• Review records of work-related injuries and illnesses.
• Get copies of test results done to find and measure hazards in the workplace.
• File a complaint asking OSHA to inspect their workplace if they believe there is a serious hazard or that their employer is not following OSHA rules. When requested, OSHA will keep all identities confidential.
• Use their rights under the law without retaliation. If an employee is fired, demoted, transferred, or retaliated against in any way for using their rights under the law, they can file a complaint with OSHA. This complaint must be filed within 30 days of the alleged retaliation.