7 Ways To Prevent Identity Theft in Medical Offices

Posted on November 10, 2009 by Steven F. Palter, MD

I previously wrote about the proposed FTC “Red Flag” regulations that will make doctors responsible for verifying photo IDs and protecting patient identities that no one yet knows how to possibly deal with.

Here’s some immediate practical steps you can take —Seven steps you can take to thwart medical identity theft and minimize its impact on patients:

Verify the patient’s identity. Ask for photo identification and compare it to the insurance card. Make a copy of the ID the patient presents, and flag any characteristics of new patients that could help you to identify that patient later.

Don’t assume information in the medical record is correct. For example, double check the patient’s blood type. If the patient’s type does not match the information you have in your file, then that is a strong indicator that you are dealing with an imposter.

Keep patient records secure, as required by federal law and any specific laws in your state.

Be prepared to honor requests from patients to correct medical records resulting from identity theft, help them determine how and where the medical identity theft occurred, and obtain accountings of any disclosures of their information as permitted by HIPAA. If you are hesitant to remove data from the medical record, create a second file and ‘red flag’ that more than one person may be using the same name.

Watch your employees. Conduct background checks to filter out applicants involved in financial crimes. Beware of employees who inappropriately access patient files and loiter in areas where they should not be.

Have written policies on document destruction. Shred documents before putting them into a dumpster.

Assist victims of medical identity theft. A patient who had his/her identity stolen might be half-way across the country. They are going to be upset but a helpful attitude can go a long way towards assuaging a patient’s anger. Keep a contact list handy and take time to answer their questions.

Docinthemachine MedTech Podcast!

Posted on November 10, 2009 by Steven F. Palter, MD

Here’s the latest installment of the docinthemachine podcast. In this installment I review new FDA device approvals and then present an interview about HD technology for entertainment and medicine with Bob Ott (vice president of broadcast and professional audio/video products for Sony Electronics) recorded at the National Association of Broadcasters (NAB).

docinthemachine november 2009 [ 19:35 ] Play Now | Play in Popup | Download

Get Ready for TSA-Like ID Checks in Doctor’s Offices!

Posted on November 9, 2009 by Steven F. Palter, MD

The Red Flags Rule is an anti-fraud regulation, requiring “creditors” and “financial institutions” with covered accounts to implement programs to identify, detect, and respond to the warning signs, or “red flags,” that could indicate identity theft. Doctors have been included in the creditor definition.

FTC continues to assert that physicians’ practices are entities covered under the rule. For additional information, see a sample policy.

Here’s 7 immediate steps you can take to protect identity in medical practices.

What the Red Flags Rule Means to Physicians

Enforcement of the Red Flags Rule has been delayed again by the Federal Trade Commission (FTC) until June 1, 2010. This marks the fourth time since November 2008 that the FTC has delayed enforcement of the Red Flags Rule. Prior to the FTC’s most recent delay, the Red Flags Rule was scheduled for enforcement beginning November 1, 2009.

Why This is Being Done: This is not just in response to identity theft. Apparently in some areas people are “sharing” (ie giving) their insurance cards to others to get them covered for services they don’t have insurance for or medications. Under this plan your doctor will be reponsible for checking multiple forms of photo ID’s and putting you through airport security to enter the office.

The Red Flags Rule was promulgated as the result of a law enacted by Congress (the “Fair and Accurate Credit Transactions Act”) in which Congress directed the FTC to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. As a result, the FTC promulgated the rule to require all covered entities to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices, or specific activities—known as “red flags”- that could identity theft. The FTC interprets the term “creditor” very broadly, so that any medical practice that does not require full payment at time of service would be considered a “creditor” and subject to the terms of the rule.

I am really good at taking care of my patients–but I don’t have TSA in my office checking photo ID’s. The ASRM has joined with the American Medical Association and other medical societies to urge FTC and Congress that physicians are not “creditors” and should not be subject to the rule. We are pleased that the FTC has granted another delay.

The FTC’s Red Flags Web site, offers resources to help entities determine if they are covered and, if they are, how to comply with the Rule. It includes an online compliance template that enables companies to design their own Identity Theft Prevention Program through an easy-to-do form, as well as articles directed to specific businesses and industries, guidance manuals, and Frequently Asked Questions to help companies navigate the Rule.

While many covered entities have already developed and implemented appropriate, risk-based programs, some – particularly small businesses and entities with a low risk of identity theft – remain uncertain about their obligations. The additional compliance guidance that the Commission will make available shortly is designed to help them. Among other things, Commission staff will create a special link for small and low-risk entities on the Red Flags Rule Web site with materials that provide guidance and direction regarding the Rule. The Commission has already posted FAQs that address how the FTC intends to enforce the Rule and other topics . The enforcement FAQ states that Commission staff would be unlikely to recommend bringing a law enforcement action if entities know their customers or clients individually, or if they perform services in or around their customers’ homes, or if they operate in sectors where identity theft is rare and they have not themselves been the target of identity theft.

More information on FTC’s decision is available at http://www2.ftc.gov/opa/2009/10/redflags.shtm.

Encrypt EHR — Else HIPAA Violations Need Be Reported To Government & Media

Posted on November 9, 2009 by Steven F. Palter, MD

Ensure Patient Info is Encrypted to Be Exempt from Breach Regs

New regulations issued by the US Department of Health and Human Services (DHHS) require physicians and other individuals and entities covered under the Health Insurance Portability and Accountability Act (HIPAA) to notify individuals when their health information has been breached. A “breach” means the “acquisition, access, use or disclosure of protected health information in a manner not permitted . . . which comprises the security or privacy of the protected health information.” Depending upon the number of patients whose health information may have been breached, a medical practice may be required to notify the DHHS and the statewide media in addition to notifying patients.For example, if a physician maintains patient information in a laptop computer containing the unsecured information of more than 500 patients and the laptop is stolen, the physician would be required to notify not only the patients affected by the breach, but would likely need to also notify the DHHS and the media. A medical practice need not report a breach if the patient information has been properly encrypted – because information that is encrypted is not considered “unsecure.”

NYS Med Society strongly recommended that if a medical practice maintains or stores patient information in electronic form, the medical practice should consider encryption. The Breach Notification requirements are very onerous and encryption will enable a medical practice to avoid the Breach Notification Requirements. The problem is most commercially available electronic medical records don’t yet offer encryption as an option!!!

For more information click here.

Medicare Ends Reimbursement for Consultation Codes January 1, 2010!!!

Posted on November 9, 2009 by Steven F. Palter, MD

A consultation is performed when one doctor requests another doctor perform a comprehensive evaluation of a patient. Its usually asked of a specialist for complex cases. The specialist will review all past records from the other doctor examine the patient order appropriate tests and then prepare a comprehensive written report back to the original doctor (if really complex I’ll call him directly myself to ensure he knows all the vital info I found).

Medicare has announced plans to stop payment for this service beyond a simple office visit despite the significant extra time and effort required. I understand the need to cut costs and reform but eliminating the minimal extra payment for the lengthly extra service delivered is not the right way to go.

While the document is 1,669 Pages in length, Pages 162 – 206 contains commentary and CMS’ responses about the elimination of all consultation codes except for three telehealth consultation G codes beginning on January 1, 2010. Medicare fee-for-service will no longer accept or reimburse for any consultation codes for services rendered on or after January 1, 2010. Billing for consults will need to be billed using the most appropriate E&M code for office or inpatient, new or established visit code.

Please read the attached CMS Press Release. The full Federal Register text is contained in this document.

Having a Bad Day at Work? Not as Bad as This Guy!

Posted on November 3, 2009 by Steven F. Palter, MD

A Really Bad Day…

Obesity Proven to Decrease IVF Success Rates

Posted on November 3, 2009 by Steven F. Palter, MD

I have been sharing details of outstanding presentations from te 65th American Society for Reproductive Medicine Annual International Conference. A multicenter study confirmed that maternal obesity lowers IVF success rates and the health of the pregnancy. The study was performed at U Michigan, Dartmouth, and Brigham and Women’s Hospitals. However the data was abstracted from our IVF proferssional society SART’s database of nearly all IVF cycles in America. I had a chance to see the data and chat with the authors.

The study looked at 48,682 IVF cycles. Women were categorized by BMI (adjusts for height and weight (here’s how to calculate yours) There were 3 categories of BMI–Women were categorized by their body mass index (BMI) as normal (18.5-24.9), overweight (25.0-29.9), or obese (Class I, 30.0-34.9; Class II, 35.0-39.9, Class III, ≥40.0).

The odds of pregnancy were significantly reduced for obese women 9% , 28%, and 35% for Class I, II, and III), and the odds of a live birth were reduced for overweight and obese women.

Worse yet –the odds of stillbirth were increased more than twofold for obese women as was the odds of preterm birth.

Here’s the data they presented:

The odds of pregnancy were significantly reduced for obese women (0.91, 0.72, and 0.65, respectively for Class I, II, and III), and the odds of a live birth were reduced for overweight and obese women (0.87, 0.80, 0.74, and 0.75, respectively). The odds of stillbirth were increased more than twofold for obese women, significantly for Class I and II. Among live births, the odds of early preterm birth significantly paralleled increasing obesity (1.26, 1.52, and 1.59, respectively for Class I, II, and III), and the odds of preterm birth were significantly increased for all women (1.16, 1.33, 1.38, and 1.34, respectively).

What You can Do About It: Obviously the strongest recommendation is for weight loss. In my practice at Gold Coast IVFwe individualize the approach for overweight women to maximize their chances of delivering a healthy baby. Due to this we do not see this degree of adverse pregnancy rates. Our interventions include

aggressive screeing PRETREATMENT for all risk factors and optimization PRIOR to treatment. This includes heart disease hypertension and diabetes and prediabetic insulin resistance
Individualized diet and exercise programs
Nutritional counseling and assistance
Medication regimens tailored for weight
Special techniques for insemination or embryo transfers in the obese women
Special hi resolution ultrasound equipment for the obese
Coordination with medical weight loss programs for those at weight extremes
Coordination of care with patient’s Ob.

See here for other breaking research on IVF and embryo genetic screening from ASRM.

Verizon Blitzes Smartphone Releases Next 60 Days

Posted on November 2, 2009 by Steven F. Palter, MD

Boygeniusreport just posted leaked verizon info that they plan on releasing up to 15 new smartphones by year’s end. Recommendations are to wait and not run to get the google android 2.0 Motorola droid when it releases at week’s end.

I use a smartphone on verizon wireless to continuoulsy synch my office schedule wirelessly with my GE office management centricity ((former millbrook). The iphone just did not sync with my practice management program continuously via wireless so I went with verizon for a windows mobile 6 Samsung Omnia. My previous Motorola Q also worked. The omni virtual touch keyboard is so small its practically unusable without a stylus. The droid looked like the best way to go with built in synch, video features, google map nav and hi speed processor.

Check out the post to see all the specs on what’s coming next. As he reports:

One of our really solid connects just had some information for us and we think you’re going to love it. With the Motorola DROID being Verizon’s hot handset at the moment, you’d figure that the Moto would be it for a while, right? Well, if our guy is right, we could soon be bombarded with a lot more handsets. Apparently if the DROID launch/sales go really well, (is probably will) Verizon will push up handset releases and practically aim for the smartphone crown. Were talking HTC Passion, Motorola Calgary, Curve2, etc.

Apparently the Curve2 or HTC Passion / Dragon will launch on Black Friday, “whatever is ready first.” The second device would be used in a holiday push around mid-December. I asked why Verizon wouldn’t space this out more and he/she said “best network, best smartphones campaign.” Fair enough.

There’s also some handsets coming soon that we “don’t know about,” apparently. Could all four Android devices really launch on Verizon before the end of the year, or really close to it? Plus a couple BlackBerrys, and some other stuff that hasn’t surfaced yet? It seems a little crazy, but hey, more power to them.

UPDATE: We’ve also been told that Verizon will release 15 new phones, mostly smartphones, starting with the BlackBerry Storm2 and continuing into the end of December.

Google Voice Activated:Should I Choose a Local Phone Number?

Posted on November 2, 2009 by Steven F. Palter, MD

Well I got a couple of invitations for google voice and decided it would be a cool idea to try out. However I am certainly not sure that telling the phone grid where I am 24/7 and how to follow me is thebbest idea. This is a bout as opposite as off the grid as I can get right now. Hopefully the privacy screening options will be worth it!

My big di,emma is what phone number to choose. So far you can’t yet port your old cell # to GV. That leaves two options 1) pick an cool easy to remember word spelled out in the number– advantage –slick but it will be in an area code far from where you have ever lived or 2) a local number that’s yet another random set of digits.

I went for the easy to remember non-local number. Unfortunately I now have an endless series of “when did you move to Chicago?” questions. Not the mention friends with landlines too upset at the toll charges.

Seems like a $10 fee to google will let me change to the meaningless local number. Wish a local number could spell something easy to remember in NY.