RED FLAG RULES

1. RED FLAG RULES Fighting Fraud with the Red Flag Rules February 2012

2. Does PVHS have a policy on Red Flag Rules? • YES! The policy is Identity Theft Prevention, Detection and Mitigation Program LD-58 • Policy is located on VIC; Public Area (tab)>System Policies (folder)>PVH or MCR (heading)>LD-58 Identity Theft Prevention, Detection and Mitigation Program • Federal Trade Commission (FTC) requires that all creditors have policies in place that identify how the facility takes measures to prevent identity theft and what to do in when an incident occurs. Public/System Policies/ LD-58

3. What are Red Flags? • Red Flags are potential identity theft indicators. • Any facility that provides more than one service to a customer in a life time and that accepts payments towards a final bill is considered to be a creditor. • All PVHS facilities are responsible for identifying red flags. Public/System Policies/ LD-58

4. Definitions of Theft • Identity Theft: A fraud committed or attempted using the identity of another person without authority • Theft of Services: Intentionally obtaining services by deception, fraud, coercion, false pretense or any other means to avoid payment for the services. Public/System Policies/ LD-58

5. Potential Identity Theft IndicatorsThe following are examples of Red Flags: • Suspicious discrepancies (i.e. the demographic information on the photo does not match the demographic information on the proof of insurance card presented). • Patient does not look like the photo ID presented. • Patient giving social security number different than the one given on a previous visit. • Idividual does not appear to be of an age consistent with previous service, gender mismatch, ethnicity mismatch. Public/System Policies/ LD-58

6. Potential Identity Theft… • Conflicting demographic information presented during registration or treatment. • Any suspicious or unreasonable discrepancies. • Patient signs a different name on the registration forms. • The identification or insurance card presented appears to be forged or altered • Payment denied by insurance because of the improbable or impossible that the insured received the service (spleen removed for the second time, pregnancy visit for a male, etc.). • Individual receives a bill and asserts he or she did not receive services and provides proof indicating it is true. Public/System Policies/ LD-58

7. PVHS Identity Procedure • Clinics, Hospital emergency departments, urgent cares, and all other registration/intake areas of PVHS facilities should scan and/or verify in each patient record: • a photo ID issued by a local, state, or federal government agency (e.g., a driver’s license; passport; military ID, etc.). • In the event the patient does not have photo ID, ask for two forms of non-photo ID, one of which has been issued by a state or federal agency (e.g., Social Security card and a company or school identification).   • Each time a patient visits, check whether the identification provided is valid, scan the identification provided (or verify the ID already scanned in the system), and match any photo to the patient. (please scan in the Allscripts EHR “Registration Update” with the current Insurance card) Public/System Policies/ LD-58

8. PVHS Identity Procedure… • No one should be refused care because they do not have acceptable identification with them. Patients should be asked to bring appropriate documents within 48 hours. • Emergency Care—NO DELAY: Providing identification is not a condition for obtaining emergency care. The process of confirming a patient’s identity must never delay the provision of an appropriate medical screening examination or necessary stabilizing treatment for emergency medical conditions. Public/System Policies/ LD-58

9. What do you do if you suspect Identity fraud? • Remain professional and courteous to the patient and complete the check in process. • Take all necessary documentation from the patient(ID card, Insurance Card, Social Security Number, etc) • It is important to record details that can be used for further investigation. • Do not update the health record at that point and time. We will need the account in its original form in order to put the pieces together. • Notify your supervisor. Your supervisor will then determine the appropriate course of action. They will also contact the compliance department. • The compliance office will than begin an investigation. Public/System Policies/ LD-58

10. What if a Patient alleged that they are a victim of Identity Fraud. • Advise the patient to report the identity theft to law enforcement • Report the concern to your Supervisor and the Compliance Office. • The compliance office will than begin an investigation. Public/System Policies/ LD-58

11. Medicare/Medicaid Fraud • Any PVHS employee with notice of Medicare or Medicaid Fraud must notify the Compliance Officer immediately. • When there is actual knowledge of Medicare or Medicaid Fraud (e.g. a patient uses another person’s Medicare/Medicaid information to obtain care), the compliance office must report the fraud immediately to the Office of Inspector General (OIG). Public/System Policies/ LD-58

12. Common Questions Patients may have regarding Red Flags • Why are you requesting to see my photo ID and why are you scanning it? • Your photo ID is being obtained for your protection. We want to ensure your protection in the event that another patient tries to present themselves as you. This information is kept secure and confidential within our system. • I do not have a photo ID with me; does this mean that I cannot have services? • PVHS will not refuse treatment because you do not have your ID; we obtain this information for your protection. Please be sure to bring your photo ID next time so that we can update your medical record.

13. Common Questions… • Why are you asking so many questions? Why do I have to do this so often? • These questions are asked to ensure that we have up to date information in your medical record and for your protection against medical identity theft. We want to ensure your protection in the event that another patient tries to present themselves as you. This information is kept confidential and is used as our assurance that we have accurate and complete information in your medical record. • Do I have to provide this information? Example: social security number or photo ID • For your protection, we prefer to have complete information in the event that there are other patients with similar information as you; this is our assurance that we have located the correct medical record when you present for services. • Also, your insurance company may require your social security number when we submit a claim. Without this information we can not bill your health insurance and you would be responsible for contacting them for reimbursement.

14. Common Questions… • Why would someone want to present themselves as me? • A person may present themselves as you because s/he is engaged in fraudulent or illegal activity. For example, the person may want to obtain benefits or services that they are not eligible for or that they do not want to pay for. • How do I know that your system is secure and that my information will not be misused or stolen? • All employees are held to our policies and behavior standards. We are only allowed to access your information on a need to know basis. All access is removed once an employee leaves the system. All employees’ actions within our computer system are also tracked by their user ID.

15. Common Questions… • Can you remove my social security number or photo ID from my medical record? • Remind the patient of why we ask for this information and assure them that it is kept confidential. If a patient wants his social security number or removed you may remove it from that visit.

16. Additional Tips • When verifying information, rather than volunteering data that the patient can agree with, ask the patient open ended questions which prompt him to recite information to you. • When appropriate, review scanned images from previous visits when a patient does not present a photo ID at the time of service. • Use good judgment. When identifying red flags, determine if it is appropriate to contact a supervisor immediately or wait until the registration is complete. • Our primary concern as PVHS employees is to provide excellent health care and world class service. We are not law enforcement; keep this in mind when identifying potential Red Flags, contact your supervisor regarding suspicious activity. • Avoid confrontational words when speaking with the patient, do not make assumptions or judge the person.

17. Facts: • Medical identity theft is the inappropriate or unauthorized misrepresentation of individually identifiable health information for the purpose of obtaining access to property or services. Medical ID theft typically leaves a trail of falsified info in medical records that can plague a victim’s medical and financial life for years.

18. Compliance Contacts Brenda Harstad Ethics, Compliance, and Privacy Officer blh@pvhs.org 970-237-7022 Le Meyer Clinic/Compliance and Risk Analyst lam12@pvhs.org 970-237-7021

19. QUESTIONS?