Your Documentation Has to Prove One Thing...
A healthcare compliance expert explains how documentation must prove providers delivered care to professional standards, not just satisfy payer requirements. Two common failures: histories too thin to support medical necessity, and vague procedure codes. The upcoming HIPAA cybersecurity rule will require certified EHR systems, not basic ones.
Chapters
The next thing then is that we move into the policy and procedure phase, and we set all of our clients up with an employment manual, and we walk them through that so that we tailor it to their practice, the way that they operate within their practice, meaning, you know, what do they provide for benefit structures? What are some of the basic rules, you know, that you want employees to live by within your practice and how you want to operate? And then once that's finished, we move into the actual compliance program and what we call the compliance work plan, because it is a work in progress. And how I explain that to clients when we begin that process is that as we march through our compliance policy manual or that work plan, I mean, we are covering all of the aspects of Medicare and then all of the federal and state regulations. We're looking at the— and covering HIPAA Privacy and Security Rule and OSHA. And as we go through each and every one of those policies, it's like running a fine-tooth comb through your hair. We raised 5 daughters at home. And so my job on Sunday mornings before church was to brush all their hair and get them into a ponytail. Well, we had a few yips and hollers during the process of that. And when we hit a snag, in the policy where it's like, okay, we're doing something wrong or whatever, we fix it, you know? And so we're just able to work through that practice. By the time we get done with the policy and procedures, we've got a practice that is really fully compliant, and then it's all about keeping them compliant. And so out of that regulations and the policy that we have that meets those regulations, there are tasks or things that need to get done, jobs that need to get done. Uh, and, uh, just based on the current status of the regulatory environment that we have now, that, that's like over 50 different things that need to be done in the practice throughout the year. Some of those things are once a month, some are once a year, some are a few times a year. Well, we've systematized that for the practice. And so what we've done, Val, like I mentioned earlier, is we've taken the complexity and we've wrapped our heads around it, our our team has, and we've gotten to a point where we've developed a system that we march practices through, and then we're able to do the monitoring and auditing, the ongoing work with that practice to document their compliance to their policy. And it's done very easily. It's done with the doctor, but not where the doctor is doing all the work.
I see. Well, that's fabulous. So you mentioned one of the top things in the hot target list was documentation. So where are practices actually most exposed today and what documentation mistakes create the biggest audit risk?
Yeah. So, so with Medicare guidelines and if we talk or give the example of, let's say, the chiropractic provider, Dr. Chiropractic, that's been laid out pretty succinctly what is required on the initial visit, what's required on the subsequent visit. Now, this isn't just for Medicare. Okay. And I lecture across the United States on this subject matter. And what I want providers and doctors to know is that when you document, you are documenting to be able to prove that you performed to a standard of care for which you are licensed to perform to. And a lot of docs don't think about it like that. They think about, oh, Medicare requires this, so I better put this in there. And oh, this is a cash patient, so I don't have to do that. Well, guess what? You know, you need to perform, you need to perform to your standard of care, which I'm not doubting that they do, but you need to have your documentation reflect that because that's the only way you can prove that you perform to the standard of care that's required for you to be licensed in your state. And, and the thing about that is that how do we know that we documented sufficiently to make that happen? Well, all of these requirements that Medicare has in terms of initial visit, documenting the history, past family medical social history, review of systems, documenting chief complaints, documenting your objective findings. Do you have a diagnosis? Do you have a treatment plan? What services are you performing? Do they meet the coding specifications? So on and so forth. And so all of this is important, not only from a payer perspective, but then, you know, just being able to document that to bill, demonstrate you performed. To the standard of care. And, and the common mistakes that we see are typically, um, twofold. Number one, uh, is in the history portion of that initial visit. Many times docs don't spend the time that they need to, to document the mechanism or the history behind the patient's chronic problem. And so it lacks medical necessity right off the bat. You know, and so like none of those treatments get approved if, if there's a lack of medical necessity established in the beginning. The second part that we see the most problem with is in the procedure section where we don't document to the specificity of the code that is needed, whether it's a manipulation code or maybe a therapeutic activity code, so on and so forth. And so those are really the two key areas. And then, you know, there's other areas that, you know, we can fall down on, certainly.
So what are the biggest misconceptions that providers have about compliance, especially around the EHR systems or HIPAA?
Well, it's funny you mention HIPAA because we do have the cybersecurity rule that is going to be, which is currently proposed, but it's going to be finalized. It was supposed to occur prior prior to this conversation, and it'll be happening sometime this year. Those cybersecurity rules, interestingly enough, lay out the difference between a certified EHR system and what they call a basic EHR system. You know, if we go way back to when EHR systems developed here, and that was through the incentive that the federal government gave to help providers, you know, purchase a certified EHR system. The whole idea behind that, by the way, was that they wanted all these systems to talk to each other, and that's why they wanted a certified, you know, system, and that these EHRs would maintain that. Well, in the chiropractic industry, unfortunately, the certification requirements, you know, they did them initially and then they let their certification go. And so there's EHR systems out there that are not certified in the chiropractic industry that have or may not be or are not meeting some of those cybersecurity requirements. And so that's why HIPAA, the OCR HHS in particular, has distinguished the difference between certified EHRs, ones that are currently certified in meeting a lot of the security measures that are required versus the basic ones where they may or may not meet them. And it's going to be incumbent upon the provider who is the covered entity of the patient records to make sure that they have those security measures met. Thanks so much for checking out that interview. If you liked it, we have plenty more available. You can check out the next interview right here.
