Agreements from a Compliance Perspective

1. Agreements from a Compliance Perspective Kathleen Naughton Dir., Compliance / Privacy Program Presentation to UCSDHS Business Contracting & Business Officers March 11, 2008

2. Compliance ProgramOverview • Effective Compliance Program • 7 basic elements: Fed. Sentencing Guidelines • OIG: “An effective compliance program has the ability to prevent & detect fraud, waste and abuse.” • Fraud, Waste & Abuse • Submitting a claim for any health care service which is provided ‘inappropriately’

3. Leadership / oversight Policies: Code of Conduct Education Communication Monitoring / reviews / audits Corrective Actions Enforcement & reporting Communication: Process to promote reporting of quality / patient safety and other compliance concerns without fear of retaliation Chain of Command eQVR Compliance / Privacy Office 619-471-9150 Confidential Hot Line 1-866-319-0265 Compliance ProgramKey Elements

4. Ethical Principles Individual Responsibility & Accountability Respect for Rights & Dignity of Others Respect for Privacy Strive to Attain Highest Standards of Patient Care Medical Necessity Accurate Coding & Billing …Contracts / Grants Avoidance of Conflict of Interest or Commitment Ethical Conduct of Clinical Trials / Research Maintenance & Preservation of Accurate Records Compliance with Laws & Prevent Improper Referrals, Kickbacks and Influences on Clinical Decisions Respond to Government Investigations & Government Requests for Information Code of Conduct 12 Standards All workforce members should receive the Code at time of hire & acknowledge receipt. http://health.ucsd.edu/compliance

5. AgreementsCompliance Perspectives • Moonlighting Agreements – 2 types • Call compensation for add’l calls (residents) • Professional fee billing (non-GME fellows) • Select the correct template for the intended purpose • Other Agreements: • Affiliation Agreements • Clinical Service Agreements (CSAs) • Outside Consulting Agreements • Agreements with Industry • Considerations & Risk Areas

6. Moonlighting Agreements2 types of MSP payroll contracts • Call coverage: Limited to resident / fellows who are eligible to work extra hours for add’l compensation. • No prof.fee. billing • Attending services: Fellows in non-accredited fellowship programs may be eligible to apply for limited Med Staff privileges as an attending physician • Prof.fee billing is permitted – with restrictions

7. Non-Accredited Fellowshipsand Professional Fee Billing • Non-Accredited Fellowships are programs which are: • Non-ACGME … and there is • No ABMS Certificate available • These individuals are eligible to bill prof.fees. • Eligibility for prof. fee billing requires: • Valid California medical license; DEA#; • HIPAA National Provider ID # (also known as “NPI #”) • UCSDMC Medical Staff Privileges • UCSD SOM Faculty Appointment (Salaried or Non-Salaried) with a MSP Contract (for compensation) • UCSD Medical Group Provider Credentialing for payer contracts • Compliance / HIPAA Privacy / Security training

8. Non-Accredited Fellowshipsand Professional Fee Billing • Research Fellows: If the fellow is supported by a State or Federal research training grant, verify whether the grant requirements permit the individual to use free-time for taking clinical call or other clinical activities. • Research time commitments must be met. • VA Faculty: If the fellow has a VAMC WC (with compensation) appointment, • VA work hours (duty time) must be met.

9. Non-Accredited Fellowshipsand Professional Fee Billing • For 2113 “Visiting Faculty”: • The department Chair’s letter plus California Medical Board approval is required. • Not all insurance payers recognize *(or accept) 2113 appointments in lieu of a Calif medical license. • Refer to the SOM web-site for 2113 information http://som.ucsd.edu/academic/ca_medical_board_info/section_2113 • Special ID badge requirements: “Visiting Faculty” • Visa restrictions: • Certain visas (e.g., J-1) do not permit the individual to bill for professional fees.

10. Moonlighting AgreementsMSP attending MD contract - prof. fee billing • Other Considerations for non-GME fellows: • Impact: Moonlighting hours vs. fellow’s experience, work schedule, health, patient care, service complexity • Place of Service restrictions • Scope of Practice restrictions • Malpractice insurance coverage – limitations • Other commitments: funding; research /training grants; • Documentation and processing time: • Medical Staff privileges • MSP contract & Non-Salaried Academic Appointment • Medical Group – provider credentialing for billing

11. Affiliated Institutions Outpatient / ED only Cannot overlap with the training program hours & scope of program Hours count towards 80 duty hour/wk limit Limited attending MD privileges MSP contract approvals: Program Dir., GME & Dean’s office UC Malpractice: Available Provider credentialing for billing (Medical Group) Non-Affiliated Institutions Any location, including inpatient Training hours: N/A Attending privileges: must apply with each outside hospital UC Malpractice: None! Moonlighting Agreementsfor professional fee billing Common to both columns: Compliance / HIPAA training; DRA; OIG/GSA exclusion screening; Accurate accounting for house staff FTEs on Cost Report.

12. Visiting Residents / Fellows? • In order to practice medicine as a trainee, visiting medical residents / fellows must be formally registered and affiliated with the UCSDMC OGME Office • Contact the GME-Medical Director for advice before making commitments to non-affiliated trainees. • Non-registered trainees are not permitted to provide patient care or to participate in conferences / lectures which are not normally open to the public. • Other issues: Health screening, background / sanctions checks, privacy training, liability issues

13. Affiliation AgreementsOther non-UC HC training programs • What do the outside agency’s staff need to know if they work at UCSDMC facilities? • Formal affiliation agreement needed (SOM & MC) • UC Standards of Business Conduct • Deficit Reduction Act (DRA) – UC whistleblower policies; non-retaliation; how to report concerns • HIPAA Privacy / Security: Workforce training; confidentiality agreement; computer security & use agreement; access to PCIS/Epic (training); data security – no records / data taken off-site!; BAAs <?> • Electronic medical records: Own access; documentation standards (timeliness and authentication) • Photo ID badges; keys; access controls • Policies: Med Center MCPs & Unit specific policies • Verify licensure, credentials, scope of practice standards

14. Affiliation AgreementsAllied Health Professionals (non-UC) • Formal affiliation agreement needed (SOM & MC) • UC Standards of Business Conduct • Deficit Reduction Act (DRA) – UC whistleblower policies; non-retaliation; how to report concerns • HIPAA Privacy / Security: Workforce training; confidentiality agreement; computer security & use agreement; access to PCIS/Epic (training); data security – no records / data taken off-site!; BAAs <?> • Electronic medical records: Own access; documentation standards (timeliness and authentication) • Photo ID badges; keys; access controls • Policies: Med Center MCPs & Unit specific policies • Verify licensure, credentials, training, supervision standard, scope of practice / collaborative procedures, record authentication

15. Outside Consulting Agreements Reality check to reduce risks • FMV analysis – appropriate $$ for time / services • Payment limited to actual (identifiable) & necessary services • Not determined in any manner that takes into account the volume or value or referrals or other business generated between the parties • Written agreement between the parties • Liability coverage: Obtain personal ins for liability exposure • Seek legal advice prospectively! • Address related UC policies before signing Note: “UCSD SOM Clinical Services Agreements” address these considerations automatically.

16. Outside Consulting AgreementsReview for consistency with UC Policies • Academic Employment issues: • APM-025, Outside Activities: Annual report of activities & time; • APM-670, Comp Plan: Outside income & time limits • Calif PRA and COI (conflict of interest / commitment): • Can’t use UC position to influence decisions in which you have a financial interest; public documents • Research & Clin. Svc. Agreements: 700-U disclosures of economic int. • Inventions: Pre-existing obligation to disclose to UC • Patent and Intellectual Property rights • Technology Transfer relationships • Non-Disclosure / Confidentiality agreements • Publication restrictions • Limitations: Use of UC resources (staff / facilities) for outside activities; use of UC name; UC malpractice/liability ins = N/A!

17. Agreements Involving Solicitations from Industry • To assure independence, individuals involved in purchasing decisions or recommendations in procurement process should not be involved (directly or indirectly) in seeking research agreements / funding from vendors. • Refer vendor offer of add’l arrangements (donation or research arrangement) to the appropriate UCSD Office (Gift Office or Purchasing Office) and emphasize that any such potential arrangement will not be considered in the negotiation / procurement processes. • To reduce the risk / appearance of inducements, UCSD personnel should not discuss potential research arrangements or equipment donations with the vendor’s sales / marketing divisions. • To assure transparency in arrangements, equipment donations should be handled by Purchasing as “in-kind” discounts under purchasing agreements, e.g., documented within the discount exception safe harbor.

18. Clinical Service Agreements (CSAs) • FMV for professional services rendered • FMV lease agreements, off-site facilities • Description of services to be provided • Legal language – avoiding Stark, Anti-Kickback and COI risks, compliance with HIPAA… • Compliance with other UC policies: inventions, patents, confidentiality, use of UC name, terms / conditions …etc. • If prof.fee billing is handled by a 3rd party, then a “Billing Vendor Agreement” is needed • HIPAA BAA (Business Associate Agreements) – required anytime access to UC’s ePHI is part of the scope of work

19. Agreement CompensationGainsharing, Kickbacks • Compensation may not take into account the volume or value of referrals or business otherwise generated between the parties for which payment may be made in whole or in part under the Medicare or a State health care program. • Compensation may be linked to FMV rates for a specific time / effort, based on specific goals (deliverables), performance criteria, e.g., time / effort related to quality improvement activities; personally rendered clinical care, measurable. • Practice Tip: Obtain legal review of agreements; submit time reports on a regular basis.

20. Other ConsiderationsRelevant to most agreements

21. Risk Areas – Common ThemesFinancial Penalties, CMP, ? Publicity

22. Privacy / Security Reminders • Only access data on a “need to know” purpose • Never share or post passwords; use strong passwords • YOU are responsible for data security at rest, in transit on mobile devices, flash drives, e-mail, paper records • Best practice: Don’t store identified data on mobile devices • If there is a critical UC business purpose which requires restricted data to be stored on mobile devices – or sent outside UCSD via email: • Encrypt it!! (128+ or stronger); delete the file ASAP • Report data loss to the Help Desk (x-3HELP) or the Privacy Office (619-471-9150), e.g., laptop thefts / computer breach. • Cal AB1298 requires consumer notice of identity theft risks – including medical information!

23. Privacy Training Reminders • Who is responsible for providing HIPAA Privacy / Security training to workforce members – including faculty, staff, visiting trainees, volunteers, students and temporary staff working in clinical locations? • Each of department (you and I) are responsible to assure that workforce members receive appropriate training in privacy / data security – appropriate for the user’s responsibilities. • Access the privacy / security training modules on the web:http://health.ucsd.edu/compliance/hipaa.shtml • Inform Purchasing to add a HIPAA Business Associate Agreement (BAA) to P.O.s /contracts for vendors and consultants who need access to patient protected health information to provide a service to UCSD.

24. Data Security • If the consulting agreement involves access, use or disclosure of patient protected health information, a HIPAA BAA (Business Associate Agreement) is required – inform Purchasing. • The entity must adhere to the UCSD Minimum Network Security Standards regarding transmission & storage of identified data. Refer to policy on Blink! • Use Encryption (128+) to avoid AB1298 risks and delete data as soon as it is no longer needed.

25. Questions? • Kathleen Naughton • Dir., Compliance / Privacy Program • 619-471-9152 / knaughton@ucsd.edu • Lee Giddings, M.D. • Chief Compliance / Privacy Officer • 619-471-9028 / lgiddings@ucsd.edu • http://health.ucsd.edu/compliance