Is Your Practice Prepared for a HIPAA Audit?

Now your state Attorney General can bring HIPAA actions.

HIPAA is a key component of your practice’s day to day policies. However, if you are not following your practice’s policies and procedures, your practice may land up in serious trouble.

The HITECH Act now requires the US Department of Health and Human Services (HHS) to periodically audit covered entities and business associates subject to HIPAA privacy and Security rules. 

Gear up for HIPAA – know what to expect when the auditors come calling!

All covered entities and business associates are targets of an audit. A HIPAA audit basically aims to determine whether you have all the HIPAA-required policies and procedures in place.

Here’s what you can expect in case of an audit:

• You have to show that you have been using these policies and procedures.
• You will need to provide a mountain of documentation that auditors will ask for – be it training policies, materials and rosters to your security incident policy and security incident report. So be prepared for it.
• You will get only three weeks’ notice to procure the substantial documentation and gear up for the on-site audit.
• Watch out: Auditors can randomly choose and interview any staff; be prepared or bear the consequences.
• The audits will be more specific and focus on some problem areas such as a) whether you have an updated NPP b) compliance with the new privacy rights and restrictions.  

HIPAA Omnibus Final Rule:

The HIPAA Omnibus final rule introduced and strengthened a new penalty structure. It also introduced new definitions pertaining to HIPAA violations.  Under the new penalty structure, you need to know the definitions for three terms: Reasonable Clause, Reasonable Diligence and Willful neglect. Get the detailed definitions HERE.

Moreover, willful neglect violations must be looked into and penalties are compulsory. The HITECH provisions allow corrective actions, even if there is no penalty. Note: Now your state Attorney General can bring HIPAA actions.

How HITECH §13409 apply to individuals

Under Wrong Disclosures (HITECH §13409), such breaches can be applicable to individuals and are now being used in criminal cases. Moreover, civil lawsuits covering HIPAA violations are becoming more commonplace.

Penalty under the new tiered penalty structure

Furthermore, effective for incidents post February 17, 2009, you are now facing steeper penalties for HIPAA violations. The new penalty for all violations of a similar type in one calendar year is $1.5 million. Tier 1: $100 to $50,000 per violation, Tier 2: $1,000 to $50,000 per violation; Tier 3: $10,000 to $50,000 per violation; Tier 4: $50,000 per violation.

Prepare Yourself With Novel Codes To Report Neurolysis

Keep a count of joints, irrespective of the numbers of nerves.

While reporting the paravertebral facet joint nerve injections in 2012, you will no more be counting nerves that your surgeon targeted. You have up to now been reporting injections for every nerve at a single vertebral level. Effective Jan. 1, you'll require adjusting your method to look for the precise anatomical site involved and also the work that your surgeon did. Read on for more on what changes to expect for these injections in CPT 2012: what goes obsolete and what new comes in.

Know the CPT 2012 Deletions

Here are four CPT codes that will be deleted in CPT 2012:

64622 (Destruction by neurolytic agent, paravertebral facet joint nerve; lumbar or sacral, single level)

+64623 (Destruction by neurolytic agent, paravertebral facet joint nerve; lumbar or sacral, each additional level [List separately in addition to code for primary procedure])

64626 (Destruction by neurolytic agent, paravertebral facet joint nerve; cervical or thoracic, single level)

+64627 (Destruction by neurolytic agent, paravertebral facet joint nerve; cervical or thoracic, each additional level [List separately in addition to code for primary procedure])

Look at New Codes

You will find four novel CPT codes in CPT 2012. These include the following:

64633 (Destruction by neurolytic agent, paravertebral facet joint nerve[s], with imaging guidance [fluoroscopy or CT]; cervical or thoracic, single facet joint)

+64634 (Destruction by neurolytic agent, paravertebral facet joint nerve [s], with imaging guidance [fluoroscopy or CT]; cervical or thoracic, each additional facet joint [List separately in addition to code for primary procedure])

64635 (Destruction by neurolytic agent, paravertebral facet joint nerve[s], with imaging guidance [fluoroscopy or CT]; lumbar or sacral, single facet joint)

+64636 (Destruction by neurolytic agent, paravertebral facet joint nerve[s], with imaging guidance [fluoroscopy or CT]; lumbar or sacral, each additional facet joint [List separately in addition to code for primary procedure])

Don't Distinctly Report Image Guidance

While reporting neurolysis defined by new CPT codes 64633-64636, ensure that your surgeon has used and documented the image guidance used to carry out the paravertebral facet joint nerve destruction. The CPT codes for 2012 are inclusive of the image guidance, so you do not individually report the fluoroscopy or CT guidance used for the paravertebral nerve localization.

Medical Coding Tip: You are not supposed to report 77003 (Fluoroscopic guidance and localization of needle or catheter tip for spine or paraspinous diagnostic or therapeutic injection procedures [epidural, subarachnoid, or sacroiliac joint], including neurolytic agent destruction) for fluoroscopic guidance and 77012 (Computed tomography guidance for needle placement [eg, biopsy, aspiration, injection, localization device], radiological supervision and interpretation) for CT guidance with 64633-64636.

Thyroid Coding: Learn When to Report Dissections Distinct From Thyroidectomy

Why not add a title?

this lens' photo

Remember, "Functional," "selective," and "radical" denote the same procedure.

Believing you know thyroidectomy codes completely may set you up for disaster. You actually have to study the code descriptors and identify the terminology related with neck dissection to precisely code these procedures. Follow this expert medical coding advice and know what CPT codes you should select in this case.

Medical Coding Tip: While coding for thyroidectomy procedures (60240-60271), keep a close watch on the code descriptors. A lot of of them include all of the procedures that the otolaryngologist carried out, thus you won't have to report further codes for the auxiliary services.

Decide Whether to Report Dissections

Test yourself with the following example.

Assume your otolaryngologist does away with both thyroid lobes with the isthmus and pyramid lobe tissue. He furthermore classifies and excises all enlarged lymph nodes. The malignancy has not spread considerably, thus the otolaryngologist excises merely a few selection of lymph nodes. Accordingly, he carries out a thyroidectomy with restricted neck dissection. What CPT codes must you report, and should you report a distinct code for the dissection?

Answer 1: You must report only 60252 (Thyroidectomy, total or subtotal for malignancy; with limited neck dissection). You must not report a distinct code for the dissection. This code comprises reimbursement for the thyroidectomy as well as the limited dissection.

What in case the physician states in the operative note that she carried out a "central neck dissection?" What would you code in this particular situation?

Answer 2: A central neck dissection is alike the example above and signifies a limited neck dissection, not a radical neck nor a modified radical neck dissection. Consequently, in case it is stated that a central neck dissection is carried out with a total thyroidectomy, you would report 60252 (Thyroidectomy, total or subtotal for malignancy; with limited neck dissection).

Let's try a different example. Throughout a total thyroidectomy, an otolaryngologist dissects all the levels of lymph nodes and should sacrifice the spinal accessory nerve, jugular vein along with the sternocleidomastoid muscles to eliminate a malignant lymphatic chain. What CPT codes should you report, and should you report a distinct code for the dissection?

Answer 3: In the above case, you must report only the thyroidectomy along with radical neck dissection with 60254 (Thyroidectomy, total or subtotal for malignancy; with radical neck dissection). By definition, you must not distinctly report the radical neck dissection (38720, Cervical lymphadenectomy [complete]).

CPT, though, throws you a curve ball once your physician combines thyroidectomy along with modified radical neck dissection. None of the thyroidectomy Supercoder CPT codes identify this combination, which you'll have to code out distinctly.

Do medical students, interns, and residents need National Provider Identifiers (NPIs)?

Question: Do medical students, interns, and residents need National Provider Identifiers (NPIs)?

Answer : All health care providers are eligible for NPIs and may apply for them. Because medical students, interns, residents, and fellows are health care providers, they are eligible for NPIs. If they do not transmit any health data in connection with a transaction for which the Secretary of Health and Human Services has adopted a standard, they are not “covered” health care providers under HIPAA and are not required by the NPI Final Rule to obtain NPIs.

If they do, however, they would be covered health care providers and they must get NPIs. If interns or residents prescribe medications for patients whose prescriptions are filled by pharmacies, refer patients to other health care providers, or order tests for patients from other health care providers, those pharmacies and other health care providers will need to identify them as prescribers or as providers who referred patients or who ordered tests for patients in the claims transactions that they submit to health plans.

Health plans may require that the NPI be used in those claims to identify the prescriber, the referring provider, and the ordering provider. Therefore, while the NPI Final Rule might not require these providers to obtain NPIs, it may be necessary for them to have NPIs in order for the pharmacies and providers described in the scenarios above to be reimbursed by health plans.

Which Healthcare Provider Taxonomy Code(s) should be selected by medical students, interns, residents and fellows when applying for National Provider

QuestionWhich Healthcare Provider Taxonomy Code(s) should be selected by medical students, interns, residents and fellows when applying for National Provider Identifiers (NPIs)?

Answer : The Healthcare Provider Taxonomy Code set is a code set which may be used in certain standard transactions to indicate health care provider type, classification, and/or specialization. A healthcare provider must select a Healthcare Provider Taxonomy Code from this code set when applying for a National Provider Identifier (NPI). The code set is maintained by the National Uniform Claim Committee (NUCC) and is made available to the public by the Washington Publishing Company (WPC). Information on requesting changes to the code set is available from the NUCC (www.nucc.org/). Frequently Asked Questions and information on printing or downloading the code set is available from the WPC (www.wpc-edi.com ).

All health care providers are eligible for NPIs and may apply for them. Because they are health care providers, medical students, interns, residents, and fellows are eligible for NPIs. If they do not transmit any health data in connection with a transaction for which the Secretary of Health and Human Services has adopted a standard, they are not “covered” health care providers under HIPAA and are not required by the NPI Final Rule to obtain NPIs. If they do, however, they would be covered health care providers and they must get NPIs.• A Healthcare Provider Taxonomy Code for classifying medical students, and interns and residents who are not yet licensed (based on state licensing requirements), is available for use: Student, Health Care (390200000X). The code is defined as follows: An individual who is enrolled in an organized health care education/training program leading to a degree, certification registration, and/or licensure to provide health care. Medical students, interns, and residents who are not licensed should select the Student, Health Care code when applying for NPIs.• Once licensed as an allopathic or osteopathic physician, the physician should update his/her data in the National Plan and Provider Enumeration System (NPPES) by submitting a change in the Healthcare Provider Taxonomy Code to reflect the change in status from medical student to physician. (If they are “covered” health care providers, they are required to do so, and any such change must be provided to the NPPES within thirty days of the change).• If physicians who have been assigned NPIs become board-certified in other specialties or subspecialties, the physicians should update his/her data in the NPPES with these changes or additions in their specializations (i.e., they would indicate the changes or additions by changing their Healthcare Provider Taxonomy Codes). (If they are “covered” health care providers, they are required to do so, and any such change must be provided to the NPPES within thirty days of the change.)

National Provider Identifier (NPI)?

Question: Should all institutional providers submit a taxonomy code on their claims after the implementation of the National Provider Identifier (NPI)?

Answer : Only institutional providers that currently bill Medicare using more than one legacy identifier in order to identify sub-parts of their facility are required to submit a taxonomy code on all of the claims they submit to Medicare. Medicare legacy identifiers are six digit Medicare provider numbers, also called OSCAR numbers.

A table of legacy identifiers that were used to identify sub-parts is included as an attachment to CMS Change Request 5243. Taxonomy codes shall be reported by these facilities whether or not the facility has applied for individual NPIs for each of their subparts. Institutional providers that do not currently bill Medicare for sub-parts are not required to use taxonomy codes on their claims to Medicare. The list of taxonomy codes is available at http://www.wpc-edi.com/content/view/793/1

Taxonomy Code for a non-individual provider

Question: May the Billing Provider Loop for the X12 837P be used to report a provider Taxonomy Code for a non-individual provider when the usage notes in the adopted Version of the Implementation Guide requires reporting only in certain situations?

Answer : The Healthcare Provider Taxonomy Code (HPTC) that is permitted for certain situations in the 4010/4010A1 837P Implementation Guide is a 10-character alphanumeric administrative code that identifies the health care provider type, classification, and, for some classifications, the area of specialization of health care providers. The code set is maintained and updated by the National Uniform Claim Committee (NUCC). Health care providers may have more than one HPTC depending on their classifications and specializations, and select their own HPTCs from a list of available codes that is published by the Washington Publishing Company (available at www.wpc-edi.com/taxonomy.) While HPTCs are not health care provider identifiers, they do identify provider type, classification, and/or specialization, which is information that is often needed by health plans to determine claim reimbursement and subscriber benefits.

The Version 4010/4010A1 of the 837P Implementation Guide (for professional claims) states that it is not compliant to send the HPTC in both the Billing/Pay-to Provider Specialty Loop (PRV 2000A) and in the Rendering Provider Identifier loop (2310B), except in certain situations. Only when the Billing and Rendering Provider are the same is it permissible to report the HPTC in the Billing Provider Loop (2000A). The inability to report a Billing Provider’s type, classification, or specialization, except when the Billing/Pay-to Provider is the same as the Rendering Provider, can burden health plans with the need to suspend claims, telephone providers for the additional information, and, in some cases, incorrectly adjudicate claims because needed information is not permitted by the IG to be submitted on the original claim.

This problem with the 4010/4010A1 837P Implementation Guide arose with the implementation of the NPI because the NPI does not contain intelligence about the type, classification, or specialization of the health care provider it identifies; whereas the previously used legacy identifier numbers often did. In order to obtain health care provider type, classification, or specialization information, some health plans are requesting submission of the HPTC in the Provider Specialty Loop (PRV 2000A) when the Billing Provider and Rendering Provider are not the same, even though this is inconsistent with the instructions in the Implementation Guide. For example, an Acute Care Testing medical group may have a number of different specialty providers within the group. In order to adjudicate a claim, a health plan may need to identify the specialty of the billing provider with a taxonomy code in the Loop 2000A PRV segment, even though, according to the 837 P 4010/4010A1 Implementation Guide, this segment is not used when the Billing or Pay-To Provider is a group and the individual Rendering Provider is identified in Loop 2310B.


There is an incompatibility between the 4010/4010A1 Implementation Guide requirements and the business need of the Billing Provider’s type, classification, specialization. Therefore, until the adoption of a new Version of the professional health care claims transaction standard that corrects this problem, CMS will exercise enforcement discretion if HPTCs are reported for Billing Providers in the 837P claims transactions where the Billing Provider and the Rendering Provider are different. Each complaint will be evaluated on a case-by-case basis.