March 2019 Healthcare Data Breaches

The Health and Human Services Office of Civil Rights (OCR) is responsible for enforcing civil right laws. Covered Entities such as Skilled Nursing Facilities and Business Associates must comply with HIPAA regulations which includes reporting breaches of Protected Health Information (PHI). Breaches affecting 500 or more individuals are posted by OCR on a public website. Breaches affecting less than 500 individuals are also required to be reported but are not posted for public viewing.

To give you an idea of the information available on the public site using March 2019 data, there were 32 breaches reported with 500 or more individuals involving 951,252 individuals. Of these 32 breaches, there were 22 Healthcare Providers, 4 Health Plans, and 6 Business Associates involved.

The types of breaches consisted of

  • 20 – Hacking/IT Incidents
  • 8 – Unauthorized Access/Disclosure
  • 4 – Thefts

Breaches involving email and network servers accounted for 893,502 of the impacted individuals (see chart below). This is why security awareness training, good password management practices, and virus protection are so important.

For a list of the names of companies impacted and other information, visit the OCR portal at https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

FY2020 Skilled Nursing Facility (SNF) PPS Proposed Rule

On Friday, April 19, 2019, CMS released the FY2020 skilled nursing facility (SNF) proposed rule for public inspection and comment.

There is estimated to be a 2.5% market basket increase for FY2020 aggregate payments as calculated through a 3.0% market basket increase and a 0.5% multifactor productivity adjustment resulting in an $887 million annual increase.

The proposed rule includes three proposed changes related to the Patient Driven Payment Model (PDPM). First, CMS proposes changing the definition of group therapy in a SNF setting to match the definition in the IRF setting. Specifically, CMS proposes defining group therapy in the SNF Part A setting as “a qualified rehabilitation therapist or therapy assistant treating two to six patients at the same time who are performing the same or similar activities.”

Second, CMS proposes using a subregulatory process to provide non-substantive updates to ICD-10 codes used in PDPM through the PDPM website, while substantive changes will still be made through the traditional notice and rulemaking process. Non-substantive updates are those made to maintain consistency with the most recent ICD-10 code set. CMS is proposing that this take effect with the start of PDPM on October 1, 2019.

The third and final proposed change is to update the regulation text to reflect changes in the assessment schedule under PDPM which were already finalized in the FY2019 final rule. These changes are to reflect the policy taking effect under PDPM on October 1, 2019. For the initial patient assessment, the proposed regulation changes would state that “the assessment schedule must include performance of an initial patient assessment no later than the 8th day of post-hospital SNF care.” Additional proposed changes to regulation text would reflect the optional interim payment assessment.

SNF Quality Reporting Program

This rule proposes to update the SNF QRP effective October 1, 2020 to include:

  • Expansion of data collection for the SNF QRP quality measures to all skilled nursing facility residents, regardless of their payer.
  • The addition of two Transfer of Health Information quality measures.
  • Exclusion of baseline nursing home residents from the Discharge to Community Measure.
  • Public display of the quality measure, Drug Regimen Review Conducted with Follow-Up for Identified Issues.

Request for information (RFI) on the importance, relevance, appropriateness, and applicability measures of standardized patient assessment data elements (SPADEs) for future years in the SNF QRP.

SNF Value Based Purchasing Program

The SNF VBP Program is proposing to change the name of the program’s measure to the “Skilled Nursing Facility Potentially Preventable Readmissions after Hospital Discharge” measure. The measure will retain its previous abbreviation (SNFPPR).

The proposed rule also includes an update to the public reporting requirements to ensure that CMS publishes accurate performance information for low-volume SNFs.

CMS encourages comments from stakeholders. The comment period is open until June 18, 2019.

Download the proposed rule from the Federal Register. Download the CMS fact sheet.

To learn more about Reliant’s preparedness for PDPM, visit our website today.