While HIPAA training may feel tedious and appear to be a waste of time and payroll, it’s crucial not to take shortcuts when it comes to compliance!
First, HIPAA Privacy and Security Rules were created to protect sensitive patient information and improve the quality of care patients receive. Patients should feel comfortable sharing their most private health information with healthcare providers during their examinations and treatments. If patients fear their information will not remain confidential, they are less likely to be transparent, potentially impacting the care they receive.
Second, as a Covered Entity under HIPAA, the pharmacy is responsibility to ensure staff are adequately trained and appropriate safeguards are in place to secure protected health information (PHI). Look no further than the February 6, 2024 press release from the U.S. Department of Health and Human Services Office for Civil Rights (OCR) to see how expensive brushing off your obligations to the HIPAA Security Rule can be. According to the release, Montefiore Medical Center settled with OCR for a jaw dropping sum of $4.75 million dollars for several potential violations of the HIPAA Security Rule. As outlined in the release, an employee stole the electronic PHI of 12,517 patients and sold that information to an identity theft ring. The police notified Montefiore Medical Center of the situation after they had “evidence of theft of a specific patient’s medical information”. Only after the police notified Montefiore, two years after the employee stole the data, did the Medical Center perform an internal investigation and find the breach.
During the OCR’s investigation, they found “multiple potential violations of the HIPAA Security Rule, including failures by Montefiore Medical Center to analyze and identify potential risks and vulnerabilities to protected health information, to monitor and safeguard its heath information systems’ activity, and to implement policies and procedures that record and examine activity in information systems containing or using protected health information. Without these safeguards in place, Montefiore Medical Center was unable to prevent the cyberattack or even detect the attack had happened until years later.”
Lastly, learn from Montefiore Medical Center mistakes and follow these PAAS Tips:
- Prioritize having a comprehensive HIPAA training program
- In place for all employees involved in the handling of PHI
- Ensures HIPAA Rules are equally enforced across all levels of staff
- Employees understand the importance of taking their training seriously.
- HIPAA training should include information about civil, monetary, and criminal penalties for violations of the HIPAA Rules to reinforce the importance of compliance.
- Review and update, no less then annually, your HIPAA Risk Analysis to ensure you have the proper safeguards in place. This is a required HIPAA form and must be retained for six years.
- Ensure there are adequate safeguards in place to prevent and detect malicious behavior; for more information review the following Newsline articles:
If you are not sure where to start, contact PAAS National®® (608) 873-1342 for more information on PAAS’ FWA/HIPAA Compliance Program that is easy to set-up, web based and customized for your pharmacy.
Early Refills of Titrated Medications Lead to Recoupments
Titration is a common practice for certain medications where prescribers start a patient on a low dose and gradually increase the amount over time to find what’s most effective. Classic examples of titrated medications include: warfarin, antidepressants, antidiabetics like insulin and metformin, GLP-1s, opioids, and thyroid products.
Sometimes the titration directions will come on one prescription with the intention for the patient to increase their dose over time using the same medication strength (or even one prescription indicating multiple strengths, but not clearly written as additional prescriptions). Other times, prescribers will send multiple scripts for multiple strengths of these medications at the same time with the intention for the patient to refill the new strength once the current one is depleted. In all cases, it is important to …
Example 1:
Prescription written for Victoza® 18 mg/3 mL. Quantity 9 mL. Directions of inject 0.6 mg once daily for one week, then increase to 1.2 mg once daily for one week, then increase to 1.8 mg once daily.
The actual days’ supply of the first fill is 37. Each fill thereafter is a 30-day supply. If you refill the claim 25 days after the first fill, you are at risk of a “refill too soon.”
Example 2:
First prescription written for Mounjaro® 2.5 mg/0.5 mL. Quantity 2 mL. Directions of inject 2.5 mg once weekly for 4 weeks.
Second prescription written for Mounjaro® 5 mg/0.5 mL. Quantity 2 mL. Directions of inject 5 mg once weekly for 4 weeks.
Third prescription written for Mounjaro® 7.5 mg/0.5 mL Quantity 2 mL. Directions of inject 7.5 mg once weekly for 4 weeks.
Each prescription filled should last the patient 28 days. If you fail to place the 5 mg and 7.5 mg prescriptions on hold and fill all three at once, the 5 mg and 7.5 mg prescriptions are likely to be recouped for “refill too soon,” “therapeutic duplicate,” “over utilization,” or “clinical misuse.”
PAAS Tips:
Walgreens Reaches $360 Million Settlement with Humana Regarding Inflated Prescription Drug Prices
In January 2024, Walgreens and Humana reached a $360 million settlement to resolve ongoing lawsuits where Humana argued that Walgreens violated the PBM agreement by artificially inflating prescription drug prices for years. Humana was initially awarded $642 million by an arbitrator a few years prior, which Walgreens challenged in court.
All of this back and forth is based on a dispute over the PBM contract definition of “Usual & Customary” (U&C) pricing and Walgreens’ Prescription Savings Club (PSC). Humana argued that the PSC prices represent Walgreens’ true U&C or cash prices and that Walgreens did not submit these prices on claims to Humana. Walgreens argued that PSC prices are not U&C because club prices are not available to the general public because members must sign up and pay an annual fee to get access to these lower PSC prices.
In an interesting twist, the law firm representing Humana in this dispute is the same law firm that Walgreens retained in 2008 to provide advice on structuring their PSC in the first place. Walgreens contends that the law firm “switched sides” and actively solicited Humana to pursue the lawsuit against Walgreens.
This is not the first lawsuit brought by an insurer against Walgreens (or CVS). These two chains are “big fish” with deep pockets and are much more susceptible to legal action. Despite the legal entanglements, Walgreens continues to offer their PSC nationwide.
While independent pharmacies are individually at much lower risk of legal actions from PBMs based on U&C pricing policies, the underlying contracts have similar language. PAAS National® has often seen PBM auditors ask pharmacies to provide cash prices for select drugs during onsite audits – any price quotes provided should be caveated that these prices are reflective of that business day only and may fluctuate based on date and pharmacy costs.
PAAS Tips:
Miebo™ Eye Drops – What is the Days’ Supply?
Miebo™ is the first and only prescription eye drop used to treat dry eye syndrome by directly targeting tear evaporation. PAAS National® has fielded several calls regarding Miebo™ asking how to calculate the days’ supply. Per DailyMed, Miebo™ comes in a package size of 3 mL. Section 16 of the package insert states it is supplied in a multi-dose 5 mL bottle. Which measurement, 3 mL, or 5 mL, should you use to calculate the days’ supply? Miebo™ is billed as 3 mL; there are 3 mL of active ingredient in a 5 mL multi-dose bottle, presumptively to make administration easier. However, based on information from the Bausch + Lomb website, the days’ supply calculation remains complicated. Miebo™ contains only one ingredient (perfluorohexyloctane), unlike other eye drops that contain water, preservatives, and steroids. Eye drop formulations with water have a typical drop size of 30 to 50 microliters. The Miebo™ drop size is much smaller at 11 microliters, causing problems with the traditional 15 to 20 drops per mL estimate.
PAAS Tips:
2024 Self-Audit Series #1: Insulin Prescriptions
Starting this month, we will be refreshing our Self-Audit Series with new and updated information. Each month will focus on different prescription types and provide pharmacies with information PAAS National® analysts are currently seeing on PBM audits. These articles can be an excellent training tool for new employees, and a great refresher for all pharmacy staff, to avoid audit discrepancies.
PAAS Tips:
Continuous Glucose Monitor (CGM) Billing and Supply Allowance
CMS has issued an update on the Glucose Monitor – Policy Article effective as of January 1, 2024. A supplier now has the option to bill and dispense up to a 90-day supply for procedure codes A4238 (Adjunctive CGM) and A4239 (Non-Adjunctive CGM).
The policy article states:
“Up to a maximum of three (3) months, ninety (90) days of the supply allowance may be billed for code A4238 or A4239 to the DME MAC at a time and suppliers may not dispense more than a ninety (90) day supply.”
Below is a helpful chart to categorize the Dexcom and FreeStyle CGM products, their respective NCPDP billing units, and corresponding days’ supply.
PAAS Tips:
Be on the Lookout for Eye Drops Requiring Extra Billing Consideration
Correctly billing eye drops requires a little extra thought and consideration, but it does not have to be a daunting task. Follow these simple steps and remember to be on the lookout for the unique eye drops listed below.
00023-9163-60
Carton of 60 vials
Caution: Restasis® is also available in a 5.5 mL multi-dose preservative-free bottle NDC 00023-5301-05
PAAS Tips:
2024 DMEPOS Series #1: Diabetic Test Strips
Many pharmacies struggle with DMEPOS audits due to the complexity in medical billing and the onerous documentation requirements. Medicare Part B suppliers need to be able to produce all the required documentation if audited and make sure all documentation meets Medicare Part B standards. This DMEPOS series is intended to help you understand these complexities and gather the needed documents.
In particular, you should be able to show the following if audited on diabetic test strips:
Standard Written Order (SWO):
Dispensing/Proof of Delivery:
Delivery/Mailing:
Medical Records:
Billing:
PAAS Tips:
Dosing Increments for Insulin Pens
While insulin pens allow ease and convenience for diabetic patients, they also come with increased audit risks, for a variety of reasons, including dosing.
Prescribers are often unaware of what each insulin pen is capable of dispensing. Pharmacies must be hypervigilant of possible instructions that the insulin pen would not be able to deliver. Clinically, the patient would not be able to receive the prescribed number of units, and an audit discrepancy could be flagged. Appealing these types of discrepancies can often be very difficult.
While most insulin pens can be dialed in 1-unit increments, this is not the case for all pens. There are strengths of insulin pens that can only be dialed in 0.5-unit, 2-unit and 5-unit increments. Prior to dispensing these exceptions, the pharmacy must ensure the instructions for use are administrable with the pen prescribed. If the directions don’t coincide with the dosing increments (e.g., 57 units of Tuojeo® Max Solostar®), contact the prescriber for a correction.
PAAS Tips:
Employer Pays $4.75 Million after Employee Stole, then Sold, Protected Health Information
While HIPAA training may feel tedious and appear to be a waste of time and payroll, it’s crucial not to take shortcuts when it comes to compliance!
First, HIPAA Privacy and Security Rules were created to protect sensitive patient information and improve the quality of care patients receive. Patients should feel comfortable sharing their most private health information with healthcare providers during their examinations and treatments. If patients fear their information will not remain confidential, they are less likely to be transparent, potentially impacting the care they receive.
Second, as a Covered Entity under HIPAA, the pharmacy is responsibility to ensure staff are adequately trained and appropriate safeguards are in place to secure protected health information (PHI). Look no further than the February 6, 2024 press release from the U.S. Department of Health and Human Services Office for Civil Rights (OCR) to see how expensive brushing off your obligations to the HIPAA Security Rule can be. According to the release, Montefiore Medical Center settled with OCR for a jaw dropping sum of $4.75 million dollars for several potential violations of the HIPAA Security Rule. As outlined in the release, an employee stole the electronic PHI of 12,517 patients and sold that information to an identity theft ring. The police notified Montefiore Medical Center of the situation after they had “evidence of theft of a specific patient’s medical information”. Only after the police notified Montefiore, two years after the employee stole the data, did the Medical Center perform an internal investigation and find the breach.
During the OCR’s investigation, they found “multiple potential violations of the HIPAA Security Rule, including failures by Montefiore Medical Center to analyze and identify potential risks and vulnerabilities to protected health information, to monitor and safeguard its heath information systems’ activity, and to implement policies and procedures that record and examine activity in information systems containing or using protected health information. Without these safeguards in place, Montefiore Medical Center was unable to prevent the cyberattack or even detect the attack had happened until years later.”
Lastly, learn from Montefiore Medical Center mistakes and follow these PAAS Tips:
If you are not sure where to start, contact PAAS National®® (608) 873-1342 for more information on PAAS’ FWA/HIPAA Compliance Program that is easy to set-up, web based and customized for your pharmacy.
Additional Audit Assistance Member Benefits
As we start 2024, keep in mind your Audit Assistance membership includes more than just assistance on audits and a monthly printed newsletter. Members have access to additional Newsline content online in the Member Portal, in addition to an archive of articles.
Plus, as a member benefit you have access to additional audit tactics and prevention tips:
PAAS Audit Assistance Administrators can keep their employees engaged and lower audit risk by adding employees to the Portal so the entire staff can access these resources and the eNewsline.
If you have any questions on accessing the Member Portal or need help adding employees, please contact us at (608) 873-1342 or info@paasnational.com and our staff can assist you.