Healthcare comes under several Acts, optimizing patient care and health outcomes.
Healthcare is a diverse industry, that includes insurance, drug manufacture, medical instruments, and many other sectors before we get to patient care. Making sure that the many aspects of healthcare work well together takes a raft of regulations, which protect patients and providers.
Compliance with every regulation is complex when there are sometimes separate State and Federal legislation.
For healthcare providers, guaranteeing positive outcomes for patients includes compliance with regulations.
What is Healthcare Regulatory Compliance?
Healthcare regulatory compliance sets out expectations of how care is delivered, and what happens if providers fall short.
For patients, compliance is all about trust, that a practice will take care of them. If a healthcare provider isn’t following correct protocols, it leaves both patients and clinicians exposed.
What are the Main Areas of Healthcare Compliance?
The main areas of healthcare compliance are led by patient privacy, information regarding care, treatment, and prescribed medicine.
Regulations ensure terms of care are not dictated by outside pressures, from either drug or insurance companies.
Patient Safety
Patient safety is the foundation of regulatory compliance. A patient’s needs come first, no matter how a patient presents. Emergency room care is underwritten by law, but that does not mean it is guaranteed in all cases.
Efforts continue to establish a National Patient Safety Board following reports that estimate 400,000 preventable deaths occur while a patient is under the care of medical practitioners.
A recent study concluded one in four patients receiving care in the US experience harm that delays recovery or makes matters worse.
Patient Privacy and Data Security
Patient privacy and data security are important to build trust. The Health Insurance Portability and Accountability Act (HIPAA) Security Rule covers electronic protected health information (e-PHI). Under HIPAA, healthcare providers must give patients a Notice of Privacy Practices.
By law, it must address the following:
- Confidentiality, integrity, and availability of protected health information
- How e-PHI is protected from disclosure threats
- How threats are detected
- How misuse of e-PHI is not allowed
- How the workforce with access to e-PHI is certified compliant with regulations and privacy policy.
Billing and Coding Compliance
For all financial billing and coding documentation, claims, and medical records, a provider has to ensure that:
- Claims are completed in full, and accurate
- Codes for supplies and services are correct
- Documents, records, and associated paperwork are included
- Claims comply with all relevant State and Federal law
- Time limits adhered to
What are the Regulatory Requirements for Healthcare?
Healthcare comes under several Acts, optimizing patient care and health outcomes.
Health Insurance Portability and Accountability Act (HIPAA)
The Health Insurance Portability and Accountability Act protects personal medical information. It can’t be used for purposes not directly related to care without your permission. It can’t be passed on to employers, marketing, or commercial entities.
HIPAA covers health plans, healthcare providers, and associated businesses that are important for the operation of healthcare services. These include:
- Legal services
- Billing and accountancy
- Healthcare claims processing
- Health plan administration
- IT specialists
- Storage and medical record disposal
Safeguards put in place by compliance policies and procedures of healthcare providers must be adhered to by any subcontractors.
Under HIPAA, organizations may hold pertinent medical information about you, but not be required to comply with Privacy and Security rules:
- Life insurers
- Employers
- Workers compensation carriers
- Schools and school districts
- State agencies
- Law enforcement
- Municipal offices
If you believe data has been used inappropriately, make a complaint through the Health Department’s Office for Civil Rights.
Health Information Technology for Economic and Clinical Health (HITECH) Act
The Health Information Technology for Economic and Clinical Health (HITECH) incentivizes entities delivering Medicaid to develop electronic health records. Non-compliant entities can lose a percentage of their claim.
The HITECH Act put in place bigger fines penalizing noncompliance, specifically in the case of HIPAA patient data security.
Anti-Kickback Statute and Stark Law
The Anti-Kickback Statute (AKS) and Stark Law focus on fraud whereby clinical practitioners may not accept, nor make referrals to receive financial benefits.
- Under AKS providers must not pay for referrals or services covered by Medicaid, Medicare, or federal programs.
- The US Department of Health states that with Federal programs, paying for referrals is a crime.
Violating AKS may result in losing federal programs, fines, or jail time.
For physicians, Stark Law prohibits referrals to health service providers with whom they have financial associations.
Stark covers referrals to inpatient and outpatient care, laboratory, imaging, and various occupational and physical therapy services.
- Stark compliance is important because proof of specific intent is not required.
- Physicians guilty of self-referral violations face fines and exclusion from federal programs.
Emergency Medical Treatment & Labor Act
The Emergency Medical Treatment and Labor Act (EMTALA) provides for emergency medical treatment at Medicare-funded hospitals that have emergency facilities.
- A medical screening exam by a medical professional is required.
- Identifiable emergency conditions must be stabilized to prevent deterioration.
- In case of a medical facility’s inability to stabilize a condition, transfer to another hospital with the required capabilities must be offered.
EMTALA guarantees anyone can receive emergency medical treatment regardless of whether they are insured or have access to funds to pay for treatment.
A patient can’t be refused treatment due to race, color, sex, religion, age, disability, national origin, or whether they are a US citizen.
Violation of EMTALA, referred to as patient dumping, can cost hospitals fines of $250,000, for delayed treatment, no appropriate transfer, or failure to screen.
Affordable Care Act
The Affordable Care Act (ACA) requires employers with fifty or more full-time employees to provide health insurance coverage to a minimum of 95% of the workforce. Compliance with regulations is through the IRS.
To prevent Applicable Large Employers (ALE) from only hiring part-time workers, the ACA denotes full-time as 30 hours per week. A test determines whether employers are an ALE, accounting for hours worked and paid for.
The ACA test works like this:
If an ALE has 75 workers carrying out 20 hours of work each week –
75 x 20 = 1500 / 30 = 50 the ALE has an equivalent of 50 full-time workers, passing the ACA threshold.
If an ALE has a mix, i.e.40 full-time workers and 20 part-time workers carrying out 20 hours each week –
20 x 20 = 400 / 30 = 13 the ALE has an equivalent of 53 full-time workers, passing the ACA threshold.
The act has expanded access to Medicare and Medicaid.
Fines exist for noncompliant employers if the cover offered is unaffordable, does not cover the minimum requirements, or is not properly explained.
Patient Safety and Quality Improvement Act (PSQIA)
The Patient Safety and Quality Improvement Act (PSQIA) is a voluntary information-sharing system enhancing patient safety. The Patient Safety Organization (PSO) is a federal framework that receives anonymous data on near misses, unsafe conditions, and patient safety events.
The PSQIA guarantees the confidentiality of any reporting. Information gathered by PSOs is legally privileged. It is not allowable in most civil, criminal, or other legal proceedings.
False Claims Act (FCA)
The False Claims Act (FCA) empowers the government to pursue any person, or business committing fraud regarding contracts funded by Medicare, Medicaid, TRICARE, the Department of Veterans Affairs (VA), or the Federal Employee Health Benefits Program (FEHBP).
The FCA encourages whistleblowing and reporting by anyone with evidence of fraud. If found guilty, three times the government’s legal costs, plus recoverable overpayments, become due.
What are the Consequences of Non-compliance
The consequences of non-compliance are costly for medical entities or employers. Fines range from hundred-dollar fixed penalties to figures in the millions for large businesses.
Frameworks for regulatory compliance are set out quite clearly in the legislation. Accommodations exist for smaller businesses, making compliance as straightforward as possible. Still, the point of all the legislation is ultimately the maintenance and improvement of patient care. Consequences of noncompliance are often far worse than a simple dollar amount.
Real consequences of noncompliance include poor outcomes for patients, in-care injuries, patient safety events, and preventable deaths.
Join the conversation!