Contracting for Shredding or Storage of PHI: Delegation?</h1> <article> <h1>Contracting for Shredding or Storage of PHI: Delegation?</h1> <p>Tom Goddard — Mon, 27 Feb 2012 21:38:42 +0000</p> <p>For as long as we've been involved with URAC, which dates back to the late 1990s, the delegation standards applied only to the functions covered by the main standards of the module that is the subject of the accreditation. In other words, if a substantative standard (not a back-office, administrative function), required an applicant to do something, and the applicant hired another organization to do it instead, it was considered delegation and therefore covered by what are now Core 6-9.</p> <p>In recent months (the duration of this period is the subject of some dispute among observers and participants), this interpretation was broadened to include administrative functions that dealt with PHI, such as storage and shredding of PHI. In other words, if you hired a company like Iron Mountain to store your documents, you needed to comply with the delegation standards.</p> <p>After discussion among URAC staff, committee members, accredited organizations, and consultants, URAC came up with the middle-ground on this issue, finding that Core 6, 7, and 9 do not apply in such circumstances. Instead, what <span style="text-decoration: underline;">is</span> needed in the document submissions for Core 8 are:</p> <ul> <li>A Business Associate Agreement and Vendor Agreement that addresses the following issues:</li> </ul> <p><span style="white-space: pre;"> </span><span style="white-space: pre;"> </span>* Breach</p> <p><span style="white-space: pre;"> </span><span style="white-space: pre;"> </span>* Breach remediation</p> <p><span style="white-space: pre;"> </span><span style="white-space: pre;"> </span>* Transferring the data</p> <p><span style="white-space: pre;"> </span><span style="white-space: pre;"> </span>* Requirement of training for the BA's staff</p> <p><span style="white-space: pre;"> </span><span style="white-space: pre;"> </span>* Proper handling of the PHI</p> <ul> <li>A policy on how IIHI (for workers comp) or PHI (For HIPAA covered entities and business associates) is handled within the organization and how IIHI or PHI is turned over to the vendor for shredding and destruction, whether onsite or offsite.</li> </ul> </article> <article> <h1>Specialty Pharmacy Accreditation, Version 2.0 PM 10 – Coordination of Care</h1> <p>Tom Goddard — Thu, 02 Feb 2012 11:09:12 +0000</p> <p><span style="font-family: Georgia; font-size: 24px; line-height: 24px;">The Basics</span></p> <p>This standard outlines the coordination of care that URAC requires to be included in the care management plans your patient management program designs for individual patients. URAC allows for some flexibility, providing in the standard that you may choose from among the following possible types of coordination:</p> <ul> <li>processes to share patient information among health care providers; or</li> <li>enhancing provider effectiveness through information technology; or</li> <li>creating a capability to allow providers to refer patients to one another.</li> </ul> <p>In addition, coordination of care activity should include descriptions of activities that should occur (e.g. care plan), clear identification of the persons designated to provide various services, and how transition of care will respond to patient needs.</p> <h1>Management Tips</h1> <p>Make sure that your policies and procedures and/or patient management program description addressing coordination of care includes all of the following:</p> <ul> <li>a method for determining the patient's benefit information;</li> <li>a clear description of the process for coordinating care with the client for care management activities:</li> <li>any processes in place for coordinating with other programs</li> <li>how your organization refers consumers with comorbidities;</li> <li>template document for loading data into your IT system.</li> </ul> <h1>URAC Accreditation Tips</h1> <p>The scoring on this standard is confusing, even poorly designed, as its stem suggests that some of the elements are in the alternative, yet each of them has point values, suggesting that you might not get the full amount of points unless you include all of the types of care coordination. In any event, the various elements are weighted either three or four points.</p> <p>For the desktop review, all you need submit is the applicable policies and procedures and/or the patient management program description.</p> <p>The on-site reviewer will conduct interviews with staff members to assess their understanding of the program's care coordination approaches. In addition, the review of randomly selected case files will involve an assessment of whether your own policies and procedures are in care coordination are followed.</p> <p> </p> </article> <article> <h1>Specialty Pharmacy Accreditation, Version 2.0 PM 4 - Patient Management Periodic Reassessment Process</h1> <p>Tom Goddard — Thu, 02 Feb 2012 11:09:10 +0000</p> <p><span style="font-family: Georgia; font-size: 24px; line-height: 24px;">The Basics</span></p> <p>Under this standard, your organization must reassess no less frequently than anually the patient management program for compliance with the previous two standards. This assessment must examine both clinical matters (appropriateness, safety) and financial matters, such as the cost effectiveness of the program. While the standard doesn't require this, the most appropriate body for such a reassessment is the clinical oversight body.</p> <h1>Management Tips</h1> <p>The key management responsibility here is both providing a clear description of the process in your management documents and insure that implementation of those policies and procedures is thoroughly documented. Make sure your meeting minutes are robust and show a discussion of both clinical and financial aspects of the reassessment.</p> <p><span style="font-family: Georgia; font-size: 24px; line-height: 24px;">URAC Accreditation Tips</span></p> <p>This is a mandatory standard.</p> <p>In addition to submitting a patient management program description and or policy and procedure that clearly describes the reassessment process, we also recommend that you submit one or two sets of minutes from the clinical oversight body taken at meetings at which the body discusses such reassessment.</p> <p>The on-site reviewer will conduct a thorough examination of meeting minutes of the clinical oversight body to demonstrate compliance with the standard. In addition, the reviewer will talk to members of the patient management staff to make sure the they are familiar with the reassessment process.</p> </article> <article> <h1>Health Plan, Version 7.0 P-NM 1 - Scope of Services</h1> <p>Tom Goddard — Wed, 11 Jan 2012 20:34:01 +0000</p> <p><span style="color: #3a3980; font-family: Georgia; line-height: 24px; font-size: 24px;">The Basics</span></p> <p>With this standard, you are required to answer the question, what services do we provide, and where do we provide them?</p> <p>This standard is important to URAC reviewers, because it helps them understand the nature of your network. Are you a general healthcare services network or specialty network? Do you provide health care services in a small region, statewide, or nationally? The rest of the review will be guided by the documentation and answers to interview questions that you provide in connection with this standard.</p> <p>Your organization likely answers both of these questions in official documents, such as marketing documents, regulatory filings, and the geo-access maps that help you manage your provider network. Make sure you are familiar with how your organization officially answers these questions.</p> <h1 style="margin-bottom: 0.5em; font-size: 24px; font-family: Georgia; font-weight: normal; line-height: 24px; letter-spacing: -0.5px; color: #3a3980;">Management Tips</h1> <p>Remember, you do not get credit for doing things that you do not document. So, the fact that you operate in a certain area and provide certain health care services is insufficient for purposes of this accreditation process. Rather, you need to be able to document, with official company documents, what services you provide and where you provide them. You are allowed a good deal of flexibility in how you do this. Your documentation might be in marketing materials, regulatory materials, internal policies and procedures or plans, or reports.</p> <h1 style="margin-bottom: 0.5em; font-size: 24px; font-family: Georgia; font-weight: normal; line-height: 24px; letter-spacing: -0.5px; color: #3a3980;">URAC Accreditation Tips</h1> <p>Each of the two elements of this standard is weighted 4.</p> <p>Your desktop review documentation is likely to be some combination of plans (business, marketing, strategic), service area maps, geo-access analyses, and regulatory filings.</p> <p>The on-site reviewer will verify your compliance with the standard through an examination of your organizational documents and interviews with network management and provider relations management personnel.</p> </article> <article> <h1>Core 6-9 -- Who is a delegate?</h1> <p>Tom Goddard — Wed, 11 Jan 2012 10:33:00 +0000</p> <p>Is every organization to which your organization delegates functions to be considered a "contractor" for purposes of URAC?</p> <p>No. But it has not always been easy to figure out who's a contractor and who is not.</p> <p>Here's our analysis of the current interpretation of the applicable standards:</p> <ul> <li><strong>Relevant to our accreditation? </strong>Begin with the question, "does the accreditation module under which we're seeking accreditation require our organization to do this function?" This will get rid of the things that you do that aren't in the scope of your accreditation. For example, if you are a multi-faceted medical management company but are accredited only under HUM, a function that is only under your disease management program that you delegate to a contractor would be excluded from the application of these standards because it is not within the scope of the HUM accreditation standards.</li> <li><strong>Business entity or individual? </strong>If you're required by the accreditation standards to do the function and you have hired an individual to do it, it is not delegation. Only firms can be contractors, as URAC defines the term: "A business entity that performs delegated functions on behalf of the Organization." If you hire an outside individual to do a function for you, he/she is more likely to fall under the term "staff", which is not limited to employees: "The Organization’s employees, including full-time employees, part-time employees, and consultants."</li> <li><strong>Related to key processes? </strong>The next question is whether the function you are delegating is "related to key processes". Here's what URAC has to say about this: "For the purposes of these standards, the term “contractor” includes only those contractors that perform functions related to the key processes of the Organization. It is not URAC’s intent to include contractors that provide services unrelated to key processes. Forexample, a contractor that provides catering services would not fall within the definition of “contractor” in these standards. Conversely, a company that provides specialty physician reviewers to a UM organization would clearly fall within the definition of “contractor.”"</li> <li><strong><em>Special update to the "Key Processes" issue.</em></strong> There has been a good bit of discussion lately about whether a company that stores PHI (like Iron Mountain) is a contractor. URAC seems to have, sensibly in our view, decided that the answer is "no." If the entity is performing an administration function and does not perform independently of the organization, this function would not be considered a delegated function. This is true even if PHI is involved. In such a case, all you need is a Business Associate agreement and a vendor agreement with the organization. Core 6-9 will not apply.</li> </ul> </article> <article> <h1>New URAC Accreditation Summary Report Offers More Detail (as of 10/1/11)</h1> <p>Tom Goddard — Tue, 04 Oct 2011 14:07:26 +0000</p> <p>Effective October 1, 2011, the Accreditation Summary Report that URAC provides to organizations that have completed the accreditation process, has been expanded to provide more detail than ever before. The new ASR includes:</p> <ul> <li>Overall application scores</li> <li>Individual module score</li> <li>Description of the accreditation category</li> <li>Books of business excluded from the scope of the accreditation</li> <li>Locations of sites included within the accreditation</li> <li>Individual standard/element scoring category</li> <li>Terms of the accreditation</li> <li>Notes</li> </ul> </article> <article> <h1>Specialty Pharmacy Accreditation, Version 2.0 PHARM-OP 15 - Compounding</h1> <p>Tom Goddard — Wed, 15 Jun 2011 10:09:35 +0000</p> <h1>The Basics</h1> <p>If your organization compounds drugs, its P&Ps must, at a minimum address these four issues:</p> <ul> <li>the promotion of safety;</li> <li>the prevention of drug contamination;</li> <li>the promotion of a sterile environment; and</li> <li>compliance with laws and regulations that apply to drug compounding.</li> </ul> <h1>Management Tips</h1> <p>The US Pharmacopeia is a good resource for guidelines on compounding. </p> <h1>URAC Accreditation Tips</h1> <p>All four elements of this standard are mandatory.</p> <p>For the desktop review, submit the drug compounding P&P.</p> <p>The onsite reviewer will examine documentation demonstrating implementation of your compounding P&P. In addition, she will interview pharmacists and other staff members involved in the compounding process to assure their familiarity with your P&Ps and applicable laws and regulations.</p> </article> <article> <h1>Specialty Pharmacy Accreditation, Version 2.0 PHARM-OP 14 - Quality and Error Management in the Facility</h1> <p>Tom Goddard — Wed, 15 Jun 2011 10:04:29 +0000</p> <h1>The Basics</h1> <p>This standard requires, for each distribution channel, </p> <ul> <li>mechanisms to address quality and safety of drug inventory, distribution, and service;</li> <li>the means to track, report, and analyze errors; and</li> <li>report findings regarding errors to the quality management committee (or other appropriate committee).</li> </ul> <h1>Management Tips</h1> <p>Be specific in your P&P as you address criteria for quality and error reduction/elimination. Provide for the assessment of performance related to correct drug, directions, dosage, quantity, patient, labeling, as well as proper handling and distribution. Include near misses in your error reporting.</p> <h1>URAC Accreditation Tips</h1> <p>Four of the elements are mandatory, and the remaining two are weighted 3.</p> <p>For the desktop review, submit your P&Ps as well as any evidence of tracking distribution accuracy. Error logs would be appropriate for submission at this phase.</p> <p>The onsite reviewer will examine quality management committee minutes to assess error reporting frequency and completeness. In addition, the reviewer will talk to both the QM leadership and other senior management members regarding implementation of quality and error policies. She also will examine recent error reports.</p> </article> <article> <h1>Specialty Pharmacy Accreditation, Version 2.0 PHARM-OP 13 - Facility Safety and Security</h1> <p>Tom Goddard — Wed, 15 Jun 2011 09:57:36 +0000</p> <h1>The Basics</h1> <p>This standard imposes a number of oversight and safety responsibilities that relate to the pharmacy's facilities. The facility oversight program should address:</p> <ul> <li>access to the facility and within the facility;</li> <li>clear identification of individual employee access to machines;</li> <li>management and security of controlled substances;</li> <li>security clearances for controlled substances;</li> <li>technology controls to minimize fraud;</li> <li>systems back-up and disaster recovery;</li> <li>safe storage, handling, and disposal of hazardous materials and drugs;</li> <li>access to the Material Safety Data Sheets;</li> <li>preparedness for emergencies;</li> <li>employee safety, including spill kits and eye wash stations.</li> </ul> <h1>Management Tips</h1> <p>In addition to the above-described specific issues addressed in the standard, your facilitites P&P may also include issues such as air flow, separation of mail opening from the main building, and any additional federal or state legal requirements. </p> <h1>URAC Accreditation Tips</h1> <p>All but two of the elements of this standard are mandatory.</p> <p>Submission of the applicable facilities P&P should suffice at the desktop review stage.</p> <p>The onsite review will focus on an interview of facilities management staff members.</p> </article> <article> <h1>Specialty Pharmacy Accreditation, Version 2.0 PHARM-OP 12 - Oversight of Pharmacy Safety</h1> <p>Tom Goddard — Wed, 15 Jun 2011 09:49:22 +0000</p> <h1>The Basics</h1> <p>This standard requires that your organization properly oversees pharmacy operations. Proper oversight involves:</p> <ul> <li>pharmacist accountability;</li> <li>clearly stated roles in the dispensing process;</li> <li>direct supervision in preparation and dispensing of drugs; and</li> <li>compliance with requirements of the FDA and drug manufacturers.</li> </ul> <p>URAC will look for evidence of compliance with this standards both in your documents and in the understanding of staff members of oversight mechanisms.</p> <h1>Management Tips</h1> <p>The P&Ps and organization documents should clearly describe reporting relationships and job responsibilities at both the pharmacist and technician level. Clarity in this area is considered an important safety precaution for patients. </p> <h1>URAC Accreditation Tips</h1> <p>All the elements of this standard are mandatory.</p> <p>The desktop submission will consist of P&Ps that clearly describe reporting and accountability responsibilities of pharmacists and pharmacy technicians.</p> <p>Onsite, the reviewer will examine job descriptions and interview staff members to test for their understanding of staff member roles and responsibilities.</p> </article> </main></body></html>