In this second monthly edition of Health Care Provider Insights, we provide the following insights to help you protect your practice.

Tip #1: Documentation for Initial Hospital Visits

Lately, auditors have been attempting to deny or pay less for level 3 initial hospital visits (CPT Code 99223). CPT Code 99223 requires documentation to support a contention that the patient is unstable or has a significant new problem or complication. Medicare administrative contractors (MACs) are able to pay less by converting the code into a code for a less-complex visit, such as code 99231, which only requires documentation to support that the patient is stable, recovering or improving, or code 99222, which requires documentation to support that the patient's problem is of moderate severity.

The denials or downgrading of codes happens because doctors' medical records fail to support medical necessity or to comply with the codes' documentation requirements. Therefore, it is important that you fully document the following components: (1) comprehensive history, (2) comprehensive exam and (3) the level of medical decision-making. Ensure that the complexity of the patient's problem corresponds with the billing code you assign to the visit. You also should make sure that your history and exam meet the strict requirements for billing under CPT Code 99222 (moderate level of complexity) or CPT Code 99223 (high level of complexity). To meet the requirements, you should (1) ask the patient about risks his or her relatives may have, (2) document a complete review of systems (at least 10 of the 14 systems or body areas must be in the record), and (3) make sure that the patient's presenting problem warranted your comprehensive history and exam.

Tip #2: Billing for E/M Service and Procedure

When you evaluate a patient and perform a procedure, a billing question that arises is whether you can bill for an E/M (evaluation and management) and the procedure with modifier 25 (significant, separately identifiable E/M service) or only for the procedure. According to the National Correct Coding Institute (NCCI), "the decision to perform a minor surgical procedure is included in the payment for the minor surgical procedure and should not be reported separately as an E/M service." However, NCCI also states that "a significant, separately identifiable E&M service ... may be prompted by the symptom or condition for which the procedure and/or services was provided."

The answer to whether you can bill for the E/M and the procedure with modifier 25 may depend on whether (1) you already knew about the patient's problem and did the evaluation only to determine the appropriateness of the procedure or (2) you discovered a new problem that requires a procedure. If you already knew about the patient's problem and did the evaluation to determine appropriateness of the procedure, then you can probably only bill for the procedure. You can probably only bill for the procedure (not the evaluation) when, for example, you perform a second cortisone injection, placement of an IUD in a gynecology office, or other planned, minor procedures. However, if during a patient visit you discover a new problem that the patient has, and this new problem leads to the need to perform a procedure, then you can bill for E/M and use modifier 25 for the procedure.

Tip # 3: Avoiding Ransomware Attacks

Ransomware attacks have recently affected medical providers in Europe and Asia and may affect medical providers in the United States. In May 2017, a ransomware product called WannaCry, initiated through phishing emails, convinced users to download a program that spreads a virus automatically to other computers in the network. Although it is believed that WannaCry has been temporarily contained, it is important to be prepared for other such attacks.

For example, you should:

  • Use a "versioning" backup system that lets you access an earlier version of your files if the latest one is corrupted.
  • Purchase or renew cyber insurance coverage, and consider purchasing ransomware coverage packages.
  • Make sure that your insurance covers new drives and servers in addition to your liability with respect to patients whose health records could be lost in the event of a ransomware attack.
  • Stop using Windows XP because its security is no longer supported by Microsoft, and maintain your security by using security patches and updates.
  • Use application white-listing, which specifies which applications can be used on your computer and as a result prevents you from accidentally downloading ransomware programs.

Tip # 4: CMS's Social Security Number Removal Initiative

In accordance with the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA), CMS has begun an initiative called the Social Security Number Removal Initiative (SSNRI), under which Medicare cards that currently have Social Security−based Health Insurance Claim Numbers (HICNs) will be replaced by new cards that have Medicare Beneficiary Identifiers (MBIs) by April 2019. The new cards will be sent out beginning in April 2018. There will be a transition during which either number can be used until December 2019.

To comply with SSNRI, there are certain steps your practice should take, starting with a plan for how to handle the transition to MBIs. You need to determine (1) where and how your practice uses the HICN, (2) how your practice communicates with patients regarding billing or ID changes, and (3) how to prepare staff, patients and patients' families for the change. You should advise your staff that as soon as they become aware of a patient's new MBI, they should update the practice management system with the new number. You should also have your staff explain the change to patients and their families. Toward the beginning of 2018, you or your staff should speak with your Health Information Technology (HIT) vendor to facilitate the transitioning of the MBI numbers in your billing software. In addition, your practice should use an enterprise master patient index (EMPI), which will assign a single identifier for patients so that you can find their records easily, based on the HICN, the MBI or neither.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.