Optimizing and MaintainingOperations and Workflows:HIM Life in a COVID WorldAngela Rose, MHA, RHIA, CHPS, FAHIMARita Bowen, MA, RHIA, CHPS, CHPC, SSGB8/25/2020 2020 MRO. All rights reserved.1

Listen to the recording of thiswebinar by clicking the link ording8/25/2020 2020 MRO. All rights reserved.2

Today’s PanelistsAngela RoseRita BowenStephanie KindlickVP of ImplementationServices and Corporate PolicyVP of Privacy, Complianceand HIM PolicySr. Director of Marketing& Host8/25/2020 2020 MRO. All rights reserved.3

Housekeeping8/25/2020 2020 MRO. All rights reserved.4

Housekeeping All attendees are on mute Please use the chat box feature during the presentation We will be addressing these questions at the end of today’s presentation We are recording this webinar and will send the playback along with asurvey We appreciate your feedback Webinar pre-approved by AHIMA for 1 CEU Participants who were unable to attend the live presentation will still receive 1 CEU Certificates of completion are not required – the presentation will be an option in yourAHIMA CEU portal Register for the rest of MRO’s 2020 webinar series Register at: 2020 MRO. All rights reserved.5

About MRO8/25/2020 2020 MRO. All rights reserved.6

MRO OverviewCompany Established in 20028/25/20202nd#1Largest DisclosureManagement ProviderKLAS Category Leaderfor 7 Years in a Row 2020 MRO. All rights reserved.7

Meet Today’s Speakers8/25/2020 2020 MRO. All rights reserved.8

Rita Bowen, MA, RHIA, CHPS, CHPC, SSGBVP, Privacy, Compliance and HIM Policy, MROIn her role as Vice President of Privacy, Compliance and HIM Policy, Bowen ensures newand existing client HIM policies and procedures are to code. Bowen also serves as thecompany’s Privacy and Compliance Officer (PCO), assuring timely reporting of anydisclosure incident. She is also responsible for reviewing legislation to assure industryresponse and compliance within MRO. Bowen has more than 40 years of experience inHealth Information Management (HIM), holding a variety of HIM director and consultingroles. Bowen currently sits on The Sequoia Project Board of Directors and is an activemember of the American Health Information Management Association (AHIMA). Sheserved as AHIMA President and Board Chair, as a member of the Board of Directors forsix years, and of the Council on Certification for three years. Bowen has also served onthe AHIMA Foundation Board of Directors, serving as its Board Chair. She has beenhonored with AHIMA’s Triumph Award in the mentor category; she is also the recipient ofthe Distinguished Member Award from the Tennessee Health Information ManagementAssociation (THIMA). Bowen is an established author and speaker on HIM topics and hastaught HIM studies at Chattanooga State and the University of Tennessee Memphis.Bowen holds a Bachelor of Medical Science degree from Emory University in Atlanta, GAwith a focus in medical record administration and a Master’s degree in Health Information/Informatics Management Technology from the College of Saint Scholastic in Duluth, MN.8/25/2020 2020 MRO. All rights reserved.9

Angela Rose, MHA, RHIA, CHPS, FAHIMAVP, Implementation Services and Corporate PolicyAs Vice President of Implementation Services for MRO, Rose oversees, and coordinates activitiesrelated to successfully onboarding new clients to MRO’s Release of Information (ROI) platform.She has more than 25 years of experience in Health Information Management (HIM), withfocused expertise in privacy and security. Prior to joining MRO, she served as Director of HIMPractice Excellence for the American Health Information Management Association (AHIMA). Roseis an active member of the American Health Information Management Association (AHIMA) andcurrently serves as the Education Co-Chair of the Pennsylvania Health Information ManagementAssociation (PHIMA). Rose is an established author and speaker on various HIM topics. She hasserved as adjunct faculty and various HIM Advisory Boards. She currently serves on theUniversity of Pittsburgh’s and Temple University’s HIM Advisory Boards. She received herBachelor of Science in HIM from the University of Pittsburgh and Master’s in HealthAdministration from the University of South Florida.8/25/2020 2020 MRO. All rights reserved.10

Agenda8/25/2020 2020 MRO. All rights reserved.11

Agenda Environmental Scan Legal Requirements HIPAA Compliance Other Federal Laws Telehealth Coding and CDI Release of Information Telecommuting Checklist Management and Thought Leadership Questions and Discussion8/25/2020 2020 MRO. All rights reserved.12

Current Environment8/25/2020 2020 MRO. All rights reserved.13

Current Environment Healthcare Right Now Healthcare environment becoming overwhelmed (again)Quarantine/Stay-at-Home/Roll back ordersSocial distancing/Mask requirementRemote workforceIncreased use of telehealthPatients afraid to seek medical help Challenges Increased demand (varies by state)Shortage in supplies (again)Shortage in resources (again)Exhausted and limited workforceContinuously changing environment (laws, restrictions, etc.) Risks Compliance Customer Service8/25/2020 2020 MRO. All rights reserved.14

Legal Requirements in a DisasterCivil Rights Laws and HIPAA FlexibilitiesDuring the COVID-19 Emergency8/25/2020 2020 MRO. All rights reserved.15

HIPAA ComplianceGeneral Requirements Treatment Public Health Activities To a Public Health Authorities (45 CFR §§ 164.501 and 164.512(b)(1)(i)) At the Direction of a Public Health Authority or Foreign Government Agency (45 CFR164.512(b)(1)(i)) To Persons at Risk (45 CFR 164.512(b)(1)(iv)) Disclosures to Prevent a Serious or Imminent Threat (45 CFR 164.512(j)) Disclosures to Family, Friends, and Others Involved in an Individual’s Careand for Notification (45 CFR 164.510(b)) Disclosures to the Media or Others Not Involved in the Care of the Patient (45CFR 164.510(b)) Minimum Necessary (45 CFR 164.502(b))8/25/2020 2020 MRO. All rights reserved.16

HIPAA ComplianceGeneral Requirements Media Access to Individual PHI in Facilities (5/5/2020) NO CHANGE - Disclosures of PHI to media is not permitted Media and film crews are not permitted without patient authorization even if faces areblurred or masked; must obtain a valid signed HIPAA authorization Contacting Former COVID-19 Patients about Blood and PlasmaDonations (6/12/2020) Contacting a patient about blood and plasma donations is permitted under HIPAA as apopulation-based health care operations activity May not constitute marketing8/25/2020 2020 MRO. All rights reserved.17

HIPAA ComplianceDisclosures to Law Enforcement, Paramedics, First Responders, andPublic Health Permitted disclosures 8/25/2020To provide treatmentRequired by lawTo notify a public health authority to prevent or control spread of disease.First responders at risk of infectionNecessary to prevent/lessen threat to the health and safety of a person/publicCorrectional institutionLaw enforcement official with lawful custody of an inmate/other individual 2020 MRO. All rights reserved.18

HIPAA ComplianceEnforcement Discretions and Waivers Limited Waiver of HIPAA Sanctions and Penalties During a NationwidePublic Health Emergency Enforcement Discretions Business Associates - OCR will not impose potential penalties against providers or theirBAs under HIPAA provided: BA makes good faith disclosure for public health BA informs CE within 10 calendar days of the disclosure Community-Based Testing Sites During COVID-19 - Retroactive to 3/13/2020 OCR will not impose penalties or violations in connection with good faith participation in theoperations of testing sites8/25/2020 2020 MRO. All rights reserved.19

HIPAA ComplianceLimited Waiver of Sanctions and Penalties Applies to the following provisions of the HIPAA Privacy Rule: Requirements to obtain a patient's agreement to speak with family members or friendsinvolved in the patient’s care (45 CFR 164.510(b). ) Requirements to honor a request to opt out of the facility directory (45 CFR 164.510(a)) Requirements to distribute a notice of privacy practices (45 CFR 164.520) Patient's right to request privacy restrictions (45 CFR 164.522(a)) Patient's right to request confidential communications (45 CFR 164.522(b))8/25/2020 2020 MRO. All rights reserved.20

Other Legal RequirementsOther Federal Laws 21st Century Cures Act Information Blocking Rule and Interoperability SAMHSA 42 CFR Part 2 Revised Rule – effective 8/14/2020 Treatment records created by a non-part 2 provider not covered Records from a Part 2 provider to a non-provider and incorporated into non-provider’srecords are covered Disclosure consent no longer requires specific individual name New list of activities considered payment and healthcare operations permissible withwritten consent Permits disclosures for care coordination and case management with written consent New opioid treatment program provisions8/25/2020 2020 MRO. All rights reserved.21

Telehealth8/25/2020 2020 MRO. All rights reserved.22

Telehealth Today 0.1% to 43.5% 9% to 51% 50 states 9 million 27 billion IssueBrief MedicareTelehealth final7.29.20.pdf8/25/2020 2020 MRO. All rights reserved.23

TelehealthRelaxed Rules and Requirements Centers for Medicare and Medicaid (CMS) Licensing requirements Telehealth and audio-only visits Expanded services for beneficiaries Billing Drug Enforcement Agency (DEA ) Remote prescribing Department of Health and Human Services/Office for Civil Rights(HHS/OCR) Video technologies use Breach penalties due to telehealth not pursued8/25/2020 2020 MRO. All rights reserved.24

Telehealth Tomorrow Continued growth Permanent place in healthcare Policy and procedure needs Business Associate Agreements Documentation requirements Legislation changes Protecting Access to Post COVID-19 Telehealth Act KEEP Telehealth Options Act8/25/2020 2020 MRO. All rights reserved.25

Coding and CDI8/25/2020 2020 MRO. All rights reserved.26

Coding and CDIChallenges and Tips Staffing Morale Communication with providers Many changes with coding guidelines related to COVID-19 A lot of questions and new processes for second-level reviews, etc. Focus of providers on treatment not documentation8/25/2020 2020 MRO. All rights reserved.27

Release of Information8/25/2020 2020 MRO. All rights reserved.28

Release of InformationToday’s Environment About 50% walk-in windows closed Alternative workflows in place Workforce Remote Skeleton crews Volumes went down, but provider and patient volumes coming backstrong8/25/2020 2020 MRO. All rights reserved.29

Release of InformationToday’s Environment Audits and Reviews 8/25/2020Medicare Risk Adjustment (MRA) reviews – not suspendedMedicare Risk Adjustment Data Validation (RADV) audits – suspendedCMS Audits (Gov’t Audits) – Restarted August 3rdHEDIS (Medicare plans) - SuspendedHEDIS (Commercial & Medicaid plans) – no new requestsCommercial Risk Adjustment (CRA) reviews – not suspended 2020 MRO. All rights reserved.30

Receiving RequestsOnsite OptionsReceivingRequests Secure Drop Box MailVirtual/Electronic Options Fax Email Portals8/25/2020 2020 MRO. All rights reserved.31

Delivering RequestsVirtual/Electronic OptionsDeliveringRequests FaxEmailPortalsElectronic submission(i.e. esMD, SFTP,ERE)Onsite Options Scheduled appointments Minimal contact8/25/2020 2020 MRO. All rights reserved.32

Education and TrainingPatients/Requesters Instruction Sheet Contact information for immediate assistanceEmployees 8/25/2020Policy and ProcedureQuick TipsShort TrainingsContact information for immediate assistance 2020 MRO. All rights reserved.33

Telecommuting Checklist8/25/2020 2020 MRO. All rights reserved.34

Transitioning to a Remote Workforce Policy and Procedure Home Workspace RequirementsDevices and ConnectivityUse and Disclosure of PHIReporting IncidentsWork Days/HoursExpensesHelpSanctions Remote Access and Confidentiality Agreement Risk Assessment Education and Training8/25/2020 2020 MRO. All rights reserved.35

Remote Workforce Checklist Private workspace Smart homes (i.e. Alexa, Google Home, Nest, Ring, nanny cams) Devices (Personal vs. Organization Owned) Inventory and audit Secured (i.e. anti-virus protection, firewall, encryption) Updates and maintenance Functional secure connectivity Network access (i.e. VPN, VDI-Virtual Desktop Infrastructure) Internet Connection (i.e. WiFi, Ethernet) Proper authentication Effective communication solutions8/25/2020 2020 MRO. All rights reserved.36

Management and ThoughtLeadership8/25/2020 2020 MRO. All rights reserved.37

Pandemic Response Management Know your environment Monitor and track cases including exposures and potential exposures Understand organization policy and protocols Response timesAction itemsWorkforce exposure protocolReporting (to whom)Communication (internal and external)Sanitization schedulesContamination control Education and Training s/Essential-Critical-Workers Dosand-Donts.pdf8/25/2020 2020 MRO. All rights reserved.38

Think Outside the Box Benchmarks/Key Performance Indicators (KPIs) Productivity Expectation/Accountability Policies and Procedures Onsite schedules Regular Meetings/Touchbases Virtual meetings with video8/25/2020 2020 MRO. All rights reserved.39

Tips and Takeaways8/25/2020 2020 MRO. All rights reserved.40

7 Things to Remember1. HIPAA STILL APPLIES! It’s relaxed, not gone.2. Review/analyze current workflows/benchmarks and adjust as needed3. Create/review/update new policies and procedures as needed.4. Educate and train (staff and patients).5. Implement CDC recommended hygiene guidelines into new workflows andthe workforce environment.6. Communicate!7. Stay current!8/25/2020 2020 MRO. All rights reserved.41

Thank You!Angela Rose, MHA, RHIA, CHPS, FAHIMARita Bowen, MA, RHIA, CHPS, CHPC, SSGBVice President, Implementation Services and Corporate PolicyMRO [email protected]: 610-994-7500 x324Twitter: @adrose1014LinkedIn: President, Privacy, Compliance, HIM PolicyMRO [email protected]: 610-994-7500 x526LinkedIn: 5/2020 2020 MRO. All rights reserved.42

Questions?8/25/2020 2020 MRO. All rights reserved.43

MRO 2020 Webinar Series HIM Workforce Training: Developing an Engaged Team Mariela Twiggs, Senior Director of Motivation and Development Wednesday, September 16, 2020 at 2pm EST Security in a Virtual Environment: Protecting Your Workforce at Home Anthony Murray, Chief Information Officer and Angela Rose, Vice President ofImplementation Services and Corporate Policy Wednesday, October 21, 2020 at 2pm EST Information Blocking Rule: The Impact to HIM Rita Bowen, Vice President of Privacy, Compliance and HIM Policy Wednesday, November 18, 2020 at 2pm EST 2020 MRO. All rights reserved.44

Resources8/25/2020 2020 MRO. All rights reserved.45

COVID-19 ResourcesHHS/OCR and HIPAA Office for Civil Rights Coronavirus s/special-topics/hipaa-covid19/index.html HHS/OCR Bulletin: HIPAA Privacy and Novel /february-2020-hipaa-and-novel-coronavirus.pdf COVID-19 & HIPAA Bulletin: Limited Waiver of HIPAA Sanctions and Penalties During aNationwide Public Health 8.pdf HHS/OCR Bulletin: Civil Rights, HIPAA and the Coronavirus Disease 2019 ocr-bulletin-3-28-20.pdf?language es8/25/2020 2020 MRO. All rights reserved.46

COVID-19 ResourcesHHS/OCR COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and publichealth /covid-19-hipaa-and-first-responders-508.pdf Notification of Enforcement Discretion to Allow Uses and Disclosures of PHI by Business Associates forPublic Health and Health Oversight Activities During COVID-19 Nationwide Public Health otification-enforcement-discretion-hipaa.pdf OCR Guidance on Media Access to PHI about Individuals in their guidance-on-media-and-film-crews-access-to-phi.pdf OCR Guidance on Providers Contacting Former COVID-19 Patients about Blood and 5/2020 2020 MRO. All rights reserved.47

COVID-19 ResourcesHHS/OCR and CMS COVID-19 and HIPAA: Disclosures to law enforcement, paramedics, other first responders and publichealth /covid-19-hipaa-and-first-responders-508.pdf Notification of Enforcement Discretion to Allow Uses and Disclosures of PHI by Business Associates forPublic Health and Health Oversight Activities During COVID-19 Nationwide Public Health otification-enforcement-discretion-hipaa.pdf CMS Flexibilities to Fight COVID-19 – What Providers Need to Know About Medical Record a-and-part-d.pdf CMS to Resume Medicare Audits August rovider%20Burden%20FAQs%2007 06 20(1).pdf8/25/2020 2020 MRO. All rights reserved.48

COVID-19 ResourcesTelehealth Resources FAQs on Telehealth and HIPAA During the COVID-19 Nationwide Public Health telehealth-faqs-508.pdf Notification of Enforcement Discretion for Telehealth Remote Communications During the COVID-19Nationwide Public Health ion-enforcement-discretiontelehealth/index.html New! HHS Telehealth Online Resource Center: has technical assistance on telehealth: House Telehealth Leaders Move to Cement Regulatory Changes for Virtual -for-virtual-care CMS Telemedicine Billing Decision Tree: 19-faqs-508.pdf Telehealth and the HIM Professional’s quires-strong-leadership/8/25/2020 2020 MRO. All rights reserved.49

COVID-19 ResourcesGeneral Resources CDC Coronavirus index.html COVID-19 Policy Tracker (information broken out by icy-tracker Cybersecurity & Infrastructure Security Agency (CISA) FBI Coronavirus Homepage - Urges Vigilance During COVID-19 Pandemic has technical assistance on 2020 2020 MRO. All rights reserved.50

OCR HIPAA Resources HIPAA and Public special-topics/public-health/index.html HIPAA Privacy Rule