Health Care Operations

On March 1st, 2024, according to the Pennsylvania Broadband Development Authority, more than 276,000 households, businesses, schools, and libraries do not have access to broadband internet (PBDA, 2024a). For practices with patients who struggle with access to the internet due to living in a rural area or being unable to afford the internet, progress and hope have been made to help resolve these issues.

Click here to learn more.

The Change Healthcare cybersecurity attack continues to rock the healthcare community. PAMED will continue to share resources as they are available.

Click here to learn more.

For the first time, the USPSTF is recommending young and middle-age adults, especially pregnant and postpartum women, should be regularly assessed for anxiety and depression, even if they don’t have symptoms.  The recommendation was published Tuesday in JAMA, the American Medical Association’s journal.  The new guidelines affect asymptomatic adults ages 19 through 64.

The Preventive Services Task Force is an independent panel of doctors and other experts appointed by the Department of Health and Human Services to evaluate care aimed at prevention or early detection.    

You can find the USPSTF Bulletin here:  https://www.uspreventiveservicestaskforce.org/uspstf/sites/
default/files/file/supporting_documents/sads-adults-final-rec-bulletin.pdf

CMS has released a Proposed Rule to amend regulations to the Medicare Advantage (Part C) and Medicare Prescription Drug Benefit (Part D) plans. The rule changes would increase beneficiary protections, promote healthy competition, improve access to care, and promote equity in coverage and care.

The Proposed Rule aims to help people with Medicare to select and enroll in coverage options that “best meet their health care needs by preventing plans from engaging in anti-competitive steering of prospective enrollees based on excessive compensation to agents and brokers, rather than the enrollee’s best interests”.

Additionally, the Rule would strengthen network adequacy requirements and improve access to behavioral health care services by adding a new facility category called “Outpatient Behavioral Health” to CMS’ Medicare Advantage network adequacy requirements.  Specialists under this category include marriage and family therapists, mental health counselors, addiction medicine physicians, among others who provide addiction medicine and behavioral health counseling or therapy services.

CMS is also proposing to provide more flexibility to substitute biosimilar biological products other than interchangeable biological products for their reference products to give people with Medicare more timely access to lower-cost biosimilar drugs.  Treating such substitutions as maintenance changes would mean that any substitutions would apply to all enrollees (not only those who begin the therapy after the effective date of the change) following a 30-day notice, and enrollees would have earlier access to equally effective and potentially more affordable options.

To review the complete publication, see CMS Proposed Rule.  

UnitedHealthcare will not be implementing a gastroenterology endoscopy prior authorization policy set to take effect June 1^st, 2023, and instead, will set up an advance notification process for non-screening GI procedures.  

Effective immediately, UHC will implement an advance notification process, rather than prior authorization, for non-screening and non-emergent GI procedures.  UnitedHealthcare said screening colonoscopy procedures are not subject to the advance notification process.  Find the full UHC announcement here: 

United Healthcare Gastroenterology Endoscopy Advance Notification

Novitas Solutions, the local Medicare Administrative Contractor for CMS, has fully implemented Smart Edits for their electronic billing system, originally introduced in July 2023. Additional Smart Edits will be incorporated routinely. This enhancement will alert providers of any claims that can be repaired prior to a denial. The messages will display on the 277CA electronic claims acknowledgement response report and may require the claim to be resubmitted.

The Novitas Smart Edit Lists (Smart Edit List Part B)  include the effective dates and are updated as they are introduced.  Notification of new edits will also be sent to Novitas’ email lists as notification. If you are not currently receiving those emails, join here.  

The HHS Office for Civil Rights (OCR) published two resource documents to help providers communicate telehealth privacy and security risks to their patients.  The documents are entitled “Educating Patients about Privacy and Security Risks to Protected Health Information when Using Remote Communication Technologies for Telehealth” and “Telehealth Privacy and Security Tips for Patients”. 

Patients may not want to participate in telehealth services due to privacy and/or security risks.  These documents highlight the importance of continuing the use of telehealth and, at the same time, help communicate the risks.  The two documents can be found at these links: 

The Guidance on Educating Patients about Privacy and Security Risks to Protected Health Information when Using Remote Communication Technologies for Telehealth may be found at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/resource-health-care-providers-educating-patients/index.html.

The Guidance on Telehealth Privacy and Security Tips for Patients may be found at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/telehealth-privacy-security/index.html.

For further details and background on the resources, please visit the following page from HHS: HHS OCR Resources for Health Care Providers and Patients/Telehealth Privacy and Security

Since the COVID-19 pandemic, the healthcare industry has continued to adopt different functionalities of Artificial Intelligence. As telemedicine and virtual care have been at the forefront of technology during the pandemic, Artificial Intelligence’s utilization in healthcare has exploded as well.

Click Here to Learn More

On March 1st, 2024, according to the Pennsylvania Broadband Development Authority, more than 276,000 households, businesses, schools, and libraries do not have access to broadband internet (PBDA, 2024a). For practices with patients who struggle with access to the internet due to living in a rural area or being unable to afford the internet, progress and hope have been made to help resolve these issues.

Click here to learn more.

The public health emergency expired on May 11^th, 2023, at 11:59 pm. We have entered the post-PHE world for the time being. Telehealth will have similarities to how it was during the PHE but with some changes from a regulatory standpoint. We will be covering those regulatory changes to help ensure that your practice is complying with the Department of Health and Human Services Office of Civil Rights.

During the Public Health Emergency, the requirement for Business Associate Agreements was waived. A HIPAA business associate agreement was to be required in order to comply with HIPAA regulations once the PHE ended. The reason behind the business associate agreements was to create a binding contract that would make the vendor liable for any HIPAA breach if it were to occur. During the PHE, the Department of HHS provided a list of vendors who advertised that they were HIPAA compliant and would enter into a Business Associate Agreement.¹ The following vendors listed were:

• Skype for Business / Microsoft Teams²
• Updox³
• VSee⁴
• Zoom for Healthcare⁵
• Doxy.me⁶
• Google Workspace⁷
• Cisco Webex Meetings / Webex Teams⁸
• Amazon Chime⁹
• GoToMeeting¹⁰
• Spruce Health Care Messenger¹¹

The Department of HHS did imply that the Office of Civil Rights has not reviewed the BAAs offered by these vendors and that there may be others that offer HIPAA Compliant technology and are willing to enter a BAA. To ensure that a vendor’s BAA meets HHS requirements, it would be recommended to review their definition and sample BAA provided on their site which can be found here.¹²

For guidance from HHS regarding HIPAA compliance and telehealth, here¹⁴ is a guide to compliance from the National Consortium of Telehealth Resource Centers shared by HHS. For additional information and guidance, the Department of HHS also shared a document regarding Telehealth and the HIPAA rules¹⁵.

References

1. (OCR), O. for C. R. (2021, June 28). Notification of enforcement discretion for telehealth. HHS.gov. https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html 
2. Virtual health with a HIPAA BAA in place automatically. TECHCOMMUNITY.MICROSOFT.COM. (2021, August 9). https://techcommunity.microsoft.com/t5/healthcare-and-life-sciences/virtual-health-with-a-hipaa-baa-in-place-automatically/ba-p/2621101 
3. Telehealth. Updox. (2022, August 12). https://www.updox.com/solutions/telehealth/
4. Most trusted HIPAA compliant telemedicine solution. VSee. (n.d.). https://vsee.com/ 
5. Comprehensive telehealth platform for Providers. Zoom. (2023, April 26). https://explore.zoom.us/en/industry/healthcare/ 
6. The easiest telemedicine solution. Doxy.me. (n.d.). https://doxy.me/en/providers/ 
7. Google. (n.d.). HIPAA compliance with Google Workspace and Cloud Identity. Google Workspace Admin Help. https://support.google.com/a/answer/3407054 
8. Webex. (2023, February 8). Exceptional telehealth experiences: Webex for Healthcare. Webex. https://www.webex.com/industries/healthcare.html 
9. Aggleton, P. (2015). Health. Amazon. https://aws.amazon.com/health/solutions/telehealth/ 
10. Unified Communications for Healthcare: HIPAA Compliant Video Conferencing: Goto. Healthcare | GoTo Suite. (n.d.). https://www.goto.com/healthcare 
11. Spruce Health. (n.d.). Spruce: Medical Communication. Spruce Health. https://www.sprucehealth.com/ 
12. (OCR), O. for C. R. (2023, January 17). Business associate contracts. HHS.gov. https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html 
13. (OCR), O. for C. R. (2023b, April 25). HHS Office for Civil Rights announces the expiration of COVID-19 public health emergency HIPAA notifications of enforcement discretion. HHS.gov. https://www.hhs.gov/about/news/2023/04/11/hhs-office-for-civil-rights-announces-expiration-covid-19-public-health-emergency-hipaa-notifications-enforcement-discretion.html 
14. TRC National Consortium of Telehealth Resource Centers. (2017, February 6). HIPAA & Telehealth: A stepwise guide to compliance. https://southwesttrc.org/sites/default/files/ resources/factsheets/HIPAA-Final.pdf 
15. (OCR), O. for C. R. (2022, June 10). Guidance: How the HIPAA rules permit covered health care providers and health plans to use remote communication technologies for audio-only telehealth. HHS.gov. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-audio-telehealth/index.html   

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) created an opportunity for organizations to check the vulnerability of their electronic systems (CISA, 2024a). This act was signed into federal legislation to assist in the development of protecting organizations from Ransomware and cyberhackers. This service allows organizations to improve their cybersecurity around their business, which is even more important for healthcare organizations responsible for protecting Protected Health Information. The Cybersecurity & Infrastructure Security Agency (CISA) created and implemented this service.

This service is referred to as the Cyber Hygiene Vulnerability Scanning Service. The program will allow CISA to determine weak points or vulnerabilities that could expose an organization’s system to ransomware or cyberhackers. By performing this analysis, CISA is currently using a piloted program referred to as Ransomware Vulnerability Warning Pilot (RVWP), which will be able to notify those critical infrastructure entities that are at risk for possible ransomware exploitation (CISA 2023).  

CISA’s RVWP utilizes the Cyber Hygiene Vulnerability Scanning Service along with other existing data sources, technologies, and authorities to assist in determining vulnerabilities within organizations before a ransomware event occurs (CISA, 2024b). Beyond utilizing the Cyber Hygiene Vulnerability Scanning Service, CISA has another resource to help in the adoption of strong security measures on their website: https://www.stopransomware.gov

In order for an organization to use the free Cyber Hygiene Vulnerability Scanning Service to check for possible cybersecurity vulnerabilities and to prevent cybersecurity or ransomware actors from damaging your organization, you can reach out to vulnerability@cis.dhs.gov with the subject line “Requesting Cyber Hygiene Services” to get started in strengthening your cybersecurity measures within your practice(s) (CISA, 2024c).

References:

1. CISA. (2024a, January 1). Cyber incident reporting for critical infrastructure act of 2022 (CIRCIA): CISA. Cybersecurity and Infrastructure Security Agency CISA. https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia 
2. CISA. (2023, March 13). Ransomware vulnerability warning pilot (RVWP) - CISA. RVWP Fact Sheet. https://www.cisa.gov/sites/default/files/2023-03/rvwp-fact-sheet-508c.pdf 
3. CISA. (2024b, January 1). Ransomware vulnerability warning pilot (RVWP): CISA. Cybersecurity and Infrastructure Security Agency CISA. https://www.cisa.gov/stopransomware/Ransomware-Vulnerability-Warning-Pilot 
4. CISA. (2024c, January 1). Cyber Resource Hub: CISA. Cybersecurity and Infrastructure Security Agency CISA. https://www.cisa.gov/cyber-resource-hub 

On February 9^th, Doximity announced a beta (testing) application of a new program called DocsGPT (Diaz, 2023). This program is currently free and allows providers who are registered with Doximity to utilize the current Doximity e-faxing applications with assistance from ChatGPT, which is an AI (Artificial Intelligence) program (Doximity, 2024a). ChatGPT is owned by Open AI and has received increased recognition in different industries throughout the United States such as Academia, Business, and Legal industries (OpenAI, 2024). In fact, Microsoft has partnered with Open AI since 2019, with an announcement in January 2023 regarding further investment into Open AI to accelerate the current AI breakthroughs (Capoot, 2023).

In case you are not familiar with Doximity, this is a program that allows providers to perform many tasks both on phone and on the computer. Some examples are telehealth, electronic faxing, and internal and external communication among physicians (Doximity, 2024b). Doximity received the most attention during the height of the COVID-19 pandemic as an application to perform HIPAA-compliant telehealth.

Chat GPT has only been around since November 2022. This AI is referred to as an AI Chatbot and has so far passed the bar, and medical licensing examinations (Landi, 2023). There are other Chatbots that have been tested and used by healthcare organizations with success. One example is AllianceChicago, a health services organization, using an AI chatbot known as Quincy from QliqSOFT to increase child immunizations and well-child checks (AllianceChicago, 2023a)(AllianceChicago, 2023b). The hope behind DocsGPT is that it will reduce the administrative burden that providers face daily. The concern and recommendations by Doximity are that the ChatGPT is not always accurate in regard to medical citations that are involved in creating prior authorization letters to send to insurance companies. They have listed when using DocsGPT, prior to sending, “PLEASE EDIT FOR ACCURACY BEFORE SENDING”, and “Since the letter content is AI-generated, please make sure to review and ensure accuracy before you submit.” in the fax box itself (Fox, 2023).

References:

1. Diaz, N. (2023, February 14). Doximity rolls out CHATGPT integration for physicians. Becker’s Hospital Review. https://www.beckershospitalreview.com/innovation/doximity-rolls-out-chatgpt-integration-for-physicians.html
2. Doximity. (2024a, January 1). Doximity GPT. https://www.doximity.com/doximity-gpt-info 
3. OpenAI. (2024, January 1). Introducing chatgpt. Introducing ChatGPT. https://openai.com/blog/chatgpt/
4. Capoot, A. (2023, February 7). Microsoft announces new multibillion-dollar investment in CHATGPT-maker openai. CNBC. https://www.cnbc.com/2023/01/23/microsoft-announces-multibillion-dollar-investment-in-chatgpt-maker-openai.html  
5. Doximity. (2024b, January 1). The Professional Medical Network for physicians. About Doximity. https://www.doximity.com/about/company 
6. Landi, H. (2023, February 11). Doximity rolls out beta version of chatgpt tool for docs aiming to streamline administrative paperwork. Fierce Healthcare. https://www.fiercehealthcare.com/health-tech/doximity-rolls-out-beta-version-chatgpt-tool-docs-aiming-streamline-administrative
7. AllianceChicago. (2023a, November 13). Innovating for better health. https://alliancechicago.org/ 
8. AllianceChicago. (2023b, January 17). AllianceChicago publishes digital intervention study using Chatbots to increase well-child visits and immunizations. https://alliancechicago.org/alliancechicago-publishes-digital-intervention-study-using-chatbots-to-increase-well-child-visits-and-immunizations/     
9. Fox, A. (2023, February 21). DocsGPT in beta targets physician burnout. Healthcare IT News. https://www.healthcareitnews.com/news/docsgpt-beta-targets-physician-burnout 

On Wednesday, November 15^th, 2023, the Centers for Medicare and Medicaid Services’ Office of Burden Reduction and Health Informatics (OBRHI) hosted a virtual conference titled “Optimizing Healthcare Delivery to Improve Patient Lives”. CMS's goal for this conference was to convene leadership from the federal government, health provider organizations, and patient advocacy communities to determine ways to reduce administrative burden, strengthen access to quality care, and make it easier for clinicians to render this care (CMS OBRHI, 2023).

The AAFP (American Academy of Family Physicians) recognized from a 2017 report that there is a significant percentage of time family physicians spend on administrative and EHR tasks (Arndt et al., 2017). These tasks are:

            Chart Review: 32.1%

            Billing and Coding: 3.9%

            Visit Documentation: 23.7%

Also, Deloitte published in their “Global Health Care Outlook 2023” document that administrative or clerical burdens are one of the primary contributors to burnout (Deloitte, 2023). According to the Surgeon General’s Advisory on Addressing Health Worker Burnout, 35 – 54% of nurses and physicians in the United States Health Workforce and 45 – 60% of medical students and residents all reported symptoms of burnout (HHS, 2022).  This data represents the need for addressing these concerns as this will help in improving the lives of physicians and reducing the harmful consequences of burnout and administrative burnout such as decreased time spent between provider and patient, increased medical errors, and hospital-acquired infections among patients and staffing shortages (HHS, 2022).

The other area of focus for this conference is to strengthen access to quality care. According to the CDC, in 2021 the United States had 84 million people who lived in Primary Care Health Professional Shortage Areas (CDC, 2023). Access to care is a continued concern in the United States, and addressing this issue connects to solving the other issues surrounding this conference.

The recordings for the meeting can be accessed online at:

https://cmsburdenreductionconference.com/session-recordings/

To stay connected with this event and other events under the CMS OBRHI you can sign up for their newsletter at:

https://public.govdelivery.com/accounts/USCMS/subscriber/new?topic_id=USCMS_12350

References:

1. CMS OBRHI. (2023, September 11). CMS burden reduction conference. CMS Burden Reduction Conference. https://cmsburdenreductionconference.com/  
   1. Arndt BG, Beasley JW, Watkinson MD, et al. Tethered to the EHR: primary care physician workload assessment using EHR event log data and time-motion observations. Ann Fam Med. 2017;15(5):419-426.
      1. Deloitte. (2023, February 22). Global Health Care Outlook 2023 - Deloitte. Global Health Care Outlook 2023. https://www.deloitte.com/content/dam/assets-shared/legacy/docs/gx-UPDATED-Health-care-Outlook-2023_Consolidated.pdf  
      2. HHS. (2022, May 20). Addressing health worker burnout - HHS.gov. The U.S. Surgeon General’s Advisory on Building a Thriving Health Workforce. https://www.hhs.gov/sites/default/files/health-worker-wellbeing-advisory.pdf  
      3. CDC. (2023, September 1). Health Care Access. Centers for Disease Control and Prevention. https://www.cdc.gov/dhdsp/health_equity/health-care-access.htm

ONC hired a Recognized Coordinating Entity (RCE) to build, implement, and maintain what is known as the Trusted Exchange Framework and Common Agreement (TEFCA) (ONC, 2024). The release of the 21^st Century Cures Act required the Office of the National Coordinator for Health Information Technology to create TEFCA, which is ONC’s interoperability framework for a Nationwide Health Information Exchange. ONC hired the Sequoia Project as their RCE. To be a part of TEFCA, organizations must form a group, meet the standards of TEFCA, and apply to become a Qualified Health Information Network (QHIN) (ONC, 2024). These QHINs will then communicate with each other to share Personal Health Information nationwide. So, what does this mean for private practices? This could open the doors for private practices to have better access to their patients’ records.

How does a private practice become part of a QHIN?

There are Electronic Medical Record (EMR) vendors who have announced their commitment to being a part of the QHIN. The QHIN would need to follow a strict common agreement which in turn will trickle down and require its subsidiaries to also follow the agreement. I’ve provided a hyperlink below to the developed common agreement:

Common Agreement: https://rce.sequoiaproject.org/common-agreement/

The QHIN would have to also meet the technical requirements which is the Trusted Exchange Framework aspect of TEFCA. Once these are met, and the organization is approved to be a QHIN, it will go through an onboarding process that involves testing its product with other QHINs and making sure that they are meeting all the requirements needed to belong to TEFCA. The Sequoia Project has common Frequently Asked Questions to help organizations understand TEFCA and how they can participate (The Sequoia Project, 2024). I’ve provided the Sequoia Project’s detailed step-by-step process for an organization to become a QHIN and their FAQ page below:

Sequoia Project’s QHIN Process: https://rce.sequoiaproject.org/qhin-process/

Sequoia Project’s FAQ Page for TEFCA: https://rce.sequoiaproject.org/

Now, many practices are a part of the P3N which is a group of about 5 Health Information Organizations that share and exchange medical records through different query processes. These HIOs are KeyHIE, Lehigh Valley Health Network, Central PA Connect HIE, Clinical Connect HIE, and HealthShare Exchange.

P3N Landing Page: https://www.dhs.pa.gov/providers/Providers/Pages/
Health%20Information%20Technology/Health-Information-Exchange-Providers.aspx

Will the P3N become a QHIN?

At this time, the P3N is not planning to apply to be a QHIN at least during the first round of applications. Some notable organizations that were planning to apply to become or be a part of a QHIN are CommonWell, eHealth Exchange, EPIC, Health Gorilla, Kno2, and NextGen.

CommonWell: https://www.businesswire.com/news/home/20220831005757/en/
CommonWell-To-Apply-to-Become-One-of-TEFCA%E2%80%99s-First-Qualified-Health-Information-Networks

eHealth Exchange and CRISP: https://www.healthcareitnews.com/news/ehealth-exchange-crisp-plan-join-tefca-qhins

EPIC: https://ehrintelligence.com/features/ehr-vendor-epic-systems-applying-as-tefca-qhin-a-logical-next-step

Health Gorilla: https://ehrintelligence.com/news/large-health-it-networks-unveil-plans-to-become-qhin-under-tefca

Kno2: https://ehrintelligence.com/news/large-health-it-networks-unveil-plans-to-become-qhin-under-tefca

NextGen: https://www.healthcareitnews.com/news/nextgen-says-it-will-apply-qualified-health-information-network

References:

1. ONC. (2024, January 3). Trusted Exchange Framework and common agreement (TEFCA). HealthIT.gov. https://www.healthit.gov/topic/interoperability/policy/trusted-exchange-framework-and-common-agreement-tefca 
2. The Sequoia Project, . (2024, February 4). ONC TEFCA RCE. https://rce.sequoiaproject.org/