The Privacy Rule (45 CFR Parts 160 and 164) applies specifically to covered entities (CEs), such as health plans, health care clearinghouses, and health care providers who maintain or transmit individually identifiable health information, called “protected health information (PHI).” The Privacy Rule does not regulate a CE’s or its business associates’ (BA) ability to request the vaccination status of an individual, it regulates how the CE and BAs use and disclose the PHI obtained. The Rule expressly states that a member of the CE’s workforce is not considered a BA and the rule does not prohibit an employer from requesting the vaccination status of its employees, a patient, or a visitor and the Rule does not limit an individual from disclosing their own information to another person. In other words, even though a pharmacy is considered a CE and staff must abide by the Privacy Rule daily when utilizing and disclosing PHI, when the pharmacy is acting in its capacity as an employer the Rule does not regulate its ability to ask employees, customers, or patients about their vaccination status. The employee, customer, or patient might believe they do not have to share this information per HIPAA; however, that is not a valid assertion since HIPAA does not regulate or prohibit an individual from sharing their own information. Outside of HIPAA, there may be other applicable state or federal laws which could overlap HIPAA regulations – refer to your healthcare attorney for additional clarifications.
Additionally, the Privacy Rule does not dictate what information can be requested of its employees as a condition of employment. Even the federal equal employment opportunity laws do not prevent an employer from requiring staff to be vaccinated before entering the workplace, as long as reasonable accommodations are made per the Americans with Disabilities Act (ADA). If an employer maintains confirmation or proof of vaccination, the ADA requires those records be stored separately from the individual’s personnel file. Furthermore, an employer can require each member of its workforce to sign a HIPAA authorization to obtain proof of vaccination directly from a covered health care provider and an employer may require its workforce to disclose their vaccination status to a patient, if asked.
The Privacy Rule does prohibit a CE and their BAs from using or disclosing an individual’s medical records, including vaccination status, to an individual’s employer or other entity unless the individual approves the request in advance, or the release pertains to treatment, payment, or other healthcare operations (TPO). Unless the individual has restricted the release of their PHI, the pharmacy can share the individual’s vaccination status with entities such as the individual’s primary care provider, their insurance company, and the state immunization database without the patient’s consent. For disclosure to an entity outside TPO, patients must first approve the release of their protected information (including vaccination history). Be sure to keep all HIPAA-related documentation for a minimum of six years.
PAAS Tips:
- PAAS Fraud, Waste and Abuse and HIPAA Compliance members, refer to section 10.5 of your Policy and Procedure Manual for additional information regarding the use and disclosure of PHI and Appendix B for the Request to Access or Release Protected Health Information form.
- Refer to the OCR’s guidance document for additional scenarios, including vaccine records maintained by schools, disclosure to public health authorities, and hospitals releasing PHI relating to an employee’s vaccination status (including documented side effects of the vaccine) to an employer.
HIPAA Guidance Regarding COVID-19 Vaccination Status in the Workplace
On September 30th, the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) released guidance regarding the Health Insurance Portability and Accountability Act (HIPAA) of 1996 Privacy Rule and its application to the workplace, specifically discussing the disclosure and request of COVID-19 vaccination status.
The Privacy Rule (45 CFR Parts 160 and 164) applies specifically to covered entities (CEs), such as health plans, health care clearinghouses, and health care providers who maintain or transmit individually identifiable health information, called “protected health information (PHI).” The Privacy Rule does not regulate a CE’s or its business associates’ (BA) ability to request the vaccination status of an individual, it regulates how the CE and BAs use and disclose the PHI obtained. The Rule expressly states that a member of the CE’s workforce is not considered a BA and the rule does not prohibit an employer from requesting the vaccination status of its employees, a patient, or a visitor and the Rule does not limit an individual from disclosing their own information to another person. In other words, even though a pharmacy is considered a CE and staff must abide by the Privacy Rule daily when utilizing and disclosing PHI, when the pharmacy is acting in its capacity as an employer the Rule does not regulate its ability to ask employees, customers, or patients about their vaccination status. The employee, customer, or patient might believe they do not have to share this information per HIPAA; however, that is not a valid assertion since HIPAA does not regulate or prohibit an individual from sharing their own information. Outside of HIPAA, there may be other applicable state or federal laws which could overlap HIPAA regulations – refer to your healthcare attorney for additional clarifications.
Additionally, the Privacy Rule does not dictate what information can be requested of its employees as a condition of employment. Even the federal equal employment opportunity laws do not prevent an employer from requiring staff to be vaccinated before entering the workplace, as long as reasonable accommodations are made per the Americans with Disabilities Act (ADA). If an employer maintains confirmation or proof of vaccination, the ADA requires those records be stored separately from the individual’s personnel file. Furthermore, an employer can require each member of its workforce to sign a HIPAA authorization to obtain proof of vaccination directly from a covered health care provider and an employer may require its workforce to disclose their vaccination status to a patient, if asked.
The Privacy Rule does prohibit a CE and their BAs from using or disclosing an individual’s medical records, including vaccination status, to an individual’s employer or other entity unless the individual approves the request in advance, or the release pertains to treatment, payment, or other healthcare operations (TPO). Unless the individual has restricted the release of their PHI, the pharmacy can share the individual’s vaccination status with entities such as the individual’s primary care provider, their insurance company, and the state immunization database without the patient’s consent. For disclosure to an entity outside TPO, patients must first approve the release of their protected information (including vaccination history). Be sure to keep all HIPAA-related documentation for a minimum of six years.
PAAS Tips:
Accepting Gifts Can Be an FWA Violation
The U.S. Department of Justice issued a press release on September 30, 2021, outlining that a former public official accepted “gratuities” (aka gifts or kickbacks) in exchange for referring business to a specific outside vendor. The employee was sentenced to eight months in federal prison and required to pay almost $8,000 in restitution.
According to the press release, David Laufer worked at Walter Reed Medical Center and was the Chief of the Prosthetics and Orthotics Department. Mr. Laufer reportedly accepted thousands of dollars in cash and other gifts such as airline tickets, lodging and entertainment tickets from Pinnacle Orthopedic Services in exchange for steering business from 2012 to 2016. Mr. Laufer repeatedly hid these outside compensations from his employer despite being required to complete annual Confidential Financial Disclosure Forms intended to identify and deter this type of activity. Mr. Laufer also denied receiving any benefits from Pinnacle during interviews with federal agents as part of a corruption investigation at Walter Reed.
The press release makes it very clear that Mr. Laufer was fully aware that his activity was wrong and made multiple explicit attempts to avoid detection. Despite the efforts of his employer to prevent (through disclosure forms) and detect (through investigation) this bad actor was able to break the rules.
Just think how bad things would have been had his employer (the federal government) not had certain FWA prevention/detection elements in place.
PAAS Fraud, Waste & Abuse and HIPAA Compliance members have an electronic Code of Conduct, Business Ethics and Conflicts of Interest Policy that employees must sign annually as well as a policy about Receiving Gifts and Entertainment-Conflicts in Section 3.2.2 of the FWAC/HIPAA Policy and Procedure Manual.
PAAS Tips:
Telemedicine Audits: Are Your Prescriptions Legitimate?
During the Public Health Emergency, telemedicine has become a convenient, and much more common, way for patients to communicate with their healthcare team; especially when patients and healthcare facilities are wary of in-person appointments. Unfortunately, telemedicine also continues to be an easy target for bad actors, with pharmacies being caught in the middle.
In August, Prime Therapeutics reported that telemedicine schemes contributed to a 60% increase in reported false claims during 2020. In one investigation, Prime pointed to a pharmacy’s use of “high-risk, low-value” products that allowed a pharmacy to transmit $300K in their first month of doing such business. This pharmacy was terminated from the network, reported to the Board of Pharmacy and Department of Insurance, and had funds recouped.
Another example is the DEA’s announced criminal charges in a September 17, 2021 press release against 138 defendants across 31 federal districts for alleged participation in fraud schemes including $1.1 billion in telemedicine fraud. Court documents noted that telemedicine executives paid doctors and nurse practitioners to order unnecessary equipment, tests, and pain medications either without having any patient interaction or after a simple phone call with the patient whom they had never met or saw for a medical purpose. Fraudulent claims were then submitted to Medicare and other government insurers, including for telehealth consultations that did not happen in the way they were represented to the insurers. Profits made off these schemes were found to have been spent on luxury items like yachts, vehicles, and real estate.
How does a pharmacy avoid the bad actors in telemedicine and still help their legitimate patients? Background research may be necessary to understand whether prescriptions were generated from a real patient-prescriber relationship and are medically necessary. The following items should be considered before dispensing any telemedicine prescription.
Prescription:
Patient:
Prescriber:
Further exemplified by the US Department of Health and Human Services-Office of Inspector General report issued October 18, 2021, 84% of Medicare beneficiaries who received telehealth services had an established relationship with the provider prior to the telehealth visit.
Finally, if your pharmacy does fill prescriptions for telemedicine, and you determine the prescriptions are legitimate, you also need to follow any state Boards of Pharmacy pertaining to mailing or delivery of prescriptions. This includes confirming if your pharmacy needs to be licensed in a state other than your own that you may be shipping medications to and within PBM contractual limits that may prohibit mailing or delivery outside a certain mile radius of your pharmacy.
LIVE WEBINAR NOV. 18: PBM FWA Trends and COVID-19 Vaccine Audit Risks
Join President of PAAS National®, Trenton Thiede, PharmD, MBA for a LIVE webinar “PBM FWA Trends and COVID-19 Vaccine Audit Risks” on November 18, 2021 from 2-2:30pm CT as he discusses:
We will allow for some Q&A at the end of the webinar.
SIGN UP TODAY!
PAAS Audit Assistance members will have access to a recording on the PAAS Member Portal if they are unable to attend the live event.
PREP Act Ninth Amendment – Overview and Audit Guidance for Subcutaneous REGEN-COV
The ninth amendment to the Public Readiness and Emergency Preparedness (PREP) Act was published in the Federal Register on September 14th, 2021, which granted pharmacists the authority to order and administer COVID-19 therapeutics and qualified pharmacy technicians and pharmacy interns to administer COVID-19 therapeutics under the supervision of a pharmacist. The PREP Act only covers COVID-19 therapeutics by subcutaneous, intramuscular, or oral administration—therefore, IV infusion would not be covered under this amendment.
At the time of publishing, only one COVID-19 therapeutic is available for administration under the ninth amendment of the PREP Act. The co-formulated solution, REGEN-COVTM, qualifies because it has FDA emergency use authorization (EUA) for administration via subcutaneous injection in addition to IV infusion. REGEN-COVTM contains two monoclonal antibodies (mAbs), casirivimab and imdevimab, and is authorized for the treatment of certain patients with COVID-19 and for post-exposure prophylaxis in eligible patients.1,2
ICD-10 Code
U07.1
IV infusion is preferred, but subcutaneous injection is authorized when infusion is not feasible or would delay treatment.
ICD-10 Code
Z20.822
≥ 40 kg)
600 mg casirivimab + 600 mg imdevimab
REPEAT EXPOSURE
Patients with repeat exposure expected to last more than one month may receive additional doses once every 4 weeks for the duration of the ongoing risk
300 mg of casirivimab + 300 mg of imdevimab
1FDA EUA for REGEN-COVTM, September 9, 2021. https://www.fda.gov/media/145610/download. (Accessed September 13, 2021).
2FDA Fact Sheet for Health Care Providers EUA of REGEN-COVTM (casirivimab and imdevimab). September 2021. https://www.fda.gov/media/145611/download. (Accessed October 12, 2021).
3NIH Anti-SARS-CoV-2 Monoclonal Antibodies Treatment Guidelines. August 4, 2021. https://www.covid19treatmentguidelines.nih.gov/therapies/anti-sars-cov-2-antibody-products/anti-sars-cov-2-monoclonal-antibodies/. (Accessed September 27, 2021).
4Close Contact per CDC criteria: https://www.cdc.gov/coronavirus/2019-ncov/php/contact-tracing/contact-tracing-plan/appendix.html#contact. (Accessed September 29, 2021).
5REGEN-COVTM: Subcutaneous Injection Instructions for Healthcare Providers COMBATCOVID.HHS.gov. July 28, 2021. https://www.phe.gov/emergency/events/COVID19/therapeutics/Documents/REGEN-COV-SubQ-FactSheet-July2021-508.pdf?utm_medium=email&utm_source=govdelivery. (Accessed October 12, 2021).
*Additional conditions can be found on the CDC’s COVID-19 Underlying Conditions or People with Certain Medical Conditions webpage
1FDA Fact Sheet for Health Care Providers EUA of REGEN-COVTM (casirivimab and imdevimab). September 2021. https://www.fda.gov/media/145611/download. (Accessed October 12, 2021).
2CDC. COVID-19 Underlying Medical Conditions. May 2021. https://www.cdc.gov/coronavirus/2019-ncov/hcp/clinical-care/underlyingconditions.html. (Accessed October 12, 2021).
2CDC. COVID-19 People with Certain Medical Conditions. Aug 2021. https://www.cdc.gov/coronavirus/2019-ncov/hcp/clinical-care/underlyingconditions.html. (Accessed October 13, 2021).
When billing REGEN-COVTM, request reimbursement only for the administration fee (aka incentive amount) since the therapeutic agent is provided to the pharmacy at no cost by the federal government. To bill Medicare, the pharmacy must be enrolled as a Part B provider and utilize a medical billing intermediary. For claims billed to plans other than Part B, REGEN-COVTM may or may not be covered by either the pharmacy or medical benefit and cost-sharing is possible. Based on guidance from CMS, below are the billing codes for REGEN-COVTM (NDC 61755-0039-01; 10 mL vial).
(1,200 mg total)
(1,200 mg total)
(600 mg total)
(600 mg total)
*This rate covers the administration fee plus the minimum required 1-hour post-injection clinical observation period
PAAS Tips:
Stark Law and Anti-Kickback Violations –Indictments Handed Down for Medically Unnecessary Claims
According to a September 17, 2021 press release from the Department of Justice (DOJ), a podiatrist was indicted for defrauding Medicare and Medicaid “by prescribing and dispensing medically unnecessary foot bath medications.” The podiatrist owned a foot clinic along with several in-house pharmacies. When the doctor wrote prescriptions, which were subsequently filled at an in-house pharmacy, he benefited financially from the “drug cocktail” prescribed – the higher the price of the cocktail, the higher the profit for the podiatrist. The article explains the “cocktails included capsules, creams, and powders that were not indicated to be dissolved in water and some of which were not water soluble.” To illustrate how expensive these “medically unnecessary” prescriptions were, over one year, Medicare paid the pharmacy over $18,000 for a single patient’s claims. The podiatrist faces up to 50 years in prison for his scheme to defraud Medicare and Medicaid.
Less than a month later, on October 4, 2021, the DOJ released another statement regarding medically unnecessary foot soaks. In this case, a federal grand jury indicted a pharmacist for allegedly utilizing a marketing company to solicit prescriptions for “foot bath” medications, paying the marketing company kickbacks by providing a percentage of the profit gained off each prescription obtained through their service, knowingly filling prescription which were medically unnecessary, and knowingly filling prescriptions where a valid patient/provider relationship was not established. The pharmacist faces one count of health care fraud and three counts of violations of the Anti-Kickback Statute [42 U.S.C. § 1320a-7b(b)]. Willingly incentivizing prescribers or patients by directly or indirectly providing remuneration is a clear violation of the Anti-Kickback Statue which could result in exclusion from all Federal health care programs, criminal penalties, and monetary penalties including up to three times the amount of the kickback.
Being aware of the prescriber/pharmacy relationship is important due to the Physician Self-Referral Law, better known as the Stark Law. If a physician or a member of the physician’s immediate family has a financial relationship with a pharmacy and the prescriber refers a patient to that pharmacy, there is a potential violation of the Stark Law. The law also prohibits billing an item as a result of the prohibited referral. Additional information, including covered items or services and exceptions can be found on CMS.gov or within section 1877 of the Social Security Act (42 U.S.C. § 1395nn).
The relationship between the medication prescribed, the route of administration, and the indication for use should also be considered prior to dispensing. Claims billed under federally funded plans for prescriptions utilized for non-FDA approved indications and for administration by non-FDA approved routes (e.g., topical antifungal cream dissolved in a foot bath) may be subject to recoupment. These claims may be flagged due to lack of supporting evidence for use in Part D compendia. PAAS National® analysts continue to see enforcement of this policy.
PAAS Tips:
Vaccinating Outside of Approved COVID-19 Emergency Use Authorization Has Legal Ramifications
As reported in a September 27, 2021 article by the US Attorney’s Office, the owner of a pharmacy in Juana Díaz, Puerto Rico, “knowingly and willfully” administered vaccine outside of the Emergency Use Authorization (EUA) and subsequently billed Medicaid for the claims. Twenty-four children between 7-11 years of age were vaccinated with the Pfizer-BioNTech COVID-19 vaccine. The current EUA is solely for the age group of 12-15 years of age, with patients 16 years or older FDA-approved. Pharmacies are required to follow the requirements pertaining to COVID-19 vaccine administration set forth by the FDA, which includes any EUAs in place. Due to the violations, the owner was charged with “participating in a felony conspiracy to convert government property and to commit health care fraud”, to which they plead guilty. For the guilty plea, they voluntarily forfeited their right as a provider for all federal health care programs for five years and returned the reimbursement paid to the pharmacy by the illegitimate Medicaid claims to the United States. In addition, they face up to five years in prison, a fine of up to $250,000, and three years of supervised release.
Due to the seriousness of administering COVID-19 vaccine outside of FDA guidance, this case reiterates the importance of confirming patient eligibility. Due diligence must be performed to substantiate the patient receiving a vaccine dose, including an additional “third” or booster dose. Short of obtaining the patient’s medical record, utilizing PAAS’ COVID-19 Vaccine Self Attestation document, located on the PAAS Portal under Tools & Aids for PAAS Audit Assistance members, will help support a vaccine dose was appropriately given. For more information PAAS Audit Assistance members can refer to the October 2021 Newsline article, COVID-19 Vaccine Administration Audit Risk.
MedImpact is Turning Up the Heat on FWA Investigations
PAAS National® has recently received several FWA audit results requiring the pharmacy to submit additional, and arduous, supporting documentation. Pharmacies need to be aware of the audit risks for medications with high Average Wholesale Prices (AWP) and narrow FDA approved indications (e.g., Pennsaid®). Significant time and effort must be put forth by the pharmacy, prescriber and potentially the patient, to support these claims.
MedImpact FWA audit results are requesting numerous items to support the claims submitted by the pharmacy. Important to note, these results have included many claims that were never paid by the plan. Any claim submitted to a PBM can be requested for audit, even if rejected at point of sale. Clearly these FWA audits are not focusing solely on financial recoupment, but also suspicious conduct by the pharmacy (i.e., test claims). Keep the following in mind:
With the current public health emergency, pharmacies must be diligent in verifying the legitimacy of telemedicine prescriptions, especially for high AWP medications. See the June 2019 PAAS Newsline article, Telemedicine: Questions to Consider from an Audit Perspective for more information.
Are You Violating PBM Return to Stock Policies? (including New PAAS Chart)
PAAS National® continues to see pharmacies losing money due to violating PBM Return to Stock policies. Each PBM sets a timeframe that unclaimed prescriptions must be reversed and returned to stock. Full recoupment of the claim can occur when a PBM discovers prescriptions are dispensed to patients outside this timeframe. Staying up to date on Return to Stock requirements is imperative. PAAS has a chart available on the PAAS Member Portal (portal.paasnational.com) in our Tools & Aids section so you can stay up-to-date on these policies.
The strictest Return to Stock Policy is 10 calendar days. Pharmacies that currently have a policy for 14 days are running the risk of full claim recoupment from these specific PBMs.
Recoupments are preventable if pharmacies follow through on this very important task. PAAS Fraud, Waste & Abuse and HIPAA Compliance Program members have a customized policy in their manual.
PAAS Tips:
Not a PAAS Fraud, Waste & Abuse and HIPAA Compliance Program member? Contact PAAS today at (608) 873-1342 or info@paasnational.com and save $120 by combining services.
Billing Insulin & Related Supplies – Medicare Part B vs Part D
PAAS National® analysts frequently field questions about billing insulin and related supplies – this can be particularly confusing when the patient has Medicare coverage. Coverage of insulin and related supplies may depend on both the type of Medicare benefit and how the item is being used. Specifically, insulin vials and alcohol swabs could be covered under either Medicare Part B or Part D!
Remember that Medicare patients could have prescription and medical benefits that are separate or combined.
Here is a chart to help you identify the correct payer depending on the type of Medicare benefit and the item in question.
(Part B/DMEPOS)
(MAPD)
A few nuances to keep in mind:
PAAS Tips: