Joseph S. Eastern, MD

The ongoing sea change in medicine has led to a substantial erosion of physician autonomy and to ever-increasing administrative burdens that hit small practices the hardest. Does this mean that the independent private physician practice model is doomed, as some predict? Absolutely not; but it will force many solo practitioners and small groups to join forces to protect themselves.

Those practices that offer unique services, or fill an unmet niche, may be able to remain small; but most smaller practices will need to consider a larger alternative. In my last column, I outlined the basics of arriving at a fair market value for a private practice; once that has been accomplished, you will be in a position to consider the various merger options that are available.

One attractive and relatively straightforward strategy is the formation of a cooperative group. In most areas, there are very likely several small practices in similar predicaments that might be receptive to discussing a collaboration on billing and purchasing. This allows each participant to maintain independence as a private practice, while pooling resources to ease the administrative burdens of all. Once that arrangement is in place, the group can consider more ambitious projects, such as the joint purchase of an integrated electronic health records (EHR) network, sharing personnel to lower staffing costs, and an integrated scheduling system. The latter will be particularly attractive to participants in later stages of their careers who are considering an intermediate option, somewhere between full-time work and complete retirement.

After a time, when the structure is stabilized and everyone agrees that his or her individual and shared interests and goals are being met, an outright merger can be contemplated. Obviously, projects of this scope require careful planning and implementation, and should not be undertaken without the help of competent legal counsel and an experienced business consultant.

A more complex but increasingly popular option is to join other small practices and providers in an independent practice association. An IPA is a legal entity, organized and directed by physicians for the purpose of negotiating contracts with insurance companies on their behalf. Because of its structure, an IPA is better positioned to enter into such financial arrangements and to counterbalance the leverage of insurers; but there are legal issues to consider. Many IPAs are vulnerable to antitrust charges because they include competing health care providers. You should check with legal counsel before signing on to an IPA, to make sure that it abides by antitrust and price fixing laws. IPAs have also been known to fail, particularly in states where they are not adequately regulated.

One proposed successor to the IPA is the accountable care organization (ACO), an entity born as a component of the Affordable Care Act. While the official definition remains nebulous, an ACO is basically a network of doctors and hospitals that shares financial and medical responsibility for providing coordinated and efficient care to patients. The goal of ACO participators is to limit unnecessary spending, both individually and collectively, according to criteria established by the Centers for Medicare & Medicaid Services (CMS), without compromising quality of care in the process. More than 600 ACOs had been approved by the CMS as of the beginning of 2014.

As the name implies, ACOs make providers jointly accountable for the health of their patients; they offer financial incentives to cooperate and to save money by avoiding unnecessary tests and procedures. A key component is the sharing of information. Providers that save money while also meeting quality targets are theoretically entitled to a portion of the savings.

As with IPAs, ACO ventures involve a measure of risk. ACOs that fail to meet the CMS performance and savings benchmarks can be stuck with the bill for investments made to improve care, such as equipment and computer purchases, and the hiring of mid-level providers and managers, and may be assessed monetary penalties as well. ACOs sponsored by physicians or rural providers, however, can apply to receive payments in advance to help finance infrastructure investments – a concession the Obama administration made after receiving complaints from rural hospitals. It is important to remember that the ACO model remains very much a work in progress.

Clearly, the price of remaining autonomous will be significant, and many private practitioners will be unwilling to pay it: Only 36% of physicians remained in independent practice at the end of the 2013, according to data from the American Medical Association – down from 57% in 2000; but those of us who remain committed to independence will find ways to preserve it, by mergers or other methods. In medicine, as in life, those most responsive to change will survive and flourish.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected].

The ongoing sea change in medicine has led to a substantial erosion of physician autonomy and to ever-increasing administrative burdens that hit small practices the hardest. Does this mean that the independent private physician practice model is doomed, as some predict? Absolutely not; but it will force many solo practitioners and small groups to join forces to protect themselves.

Those practices that offer unique services, or fill an unmet niche, may be able to remain small; but most smaller practices will need to consider a larger alternative. In my last column, I outlined the basics of arriving at a fair market value for a private practice; once that has been accomplished, you will be in a position to consider the various merger options that are available.

One attractive and relatively straightforward strategy is the formation of a cooperative group. In most areas, there are very likely several small practices in similar predicaments that might be receptive to discussing a collaboration on billing and purchasing. This allows each participant to maintain independence as a private practice, while pooling resources to ease the administrative burdens of all. Once that arrangement is in place, the group can consider more ambitious projects, such as the joint purchase of an integrated electronic health records (EHR) network, sharing personnel to lower staffing costs, and an integrated scheduling system. The latter will be particularly attractive to participants in later stages of their careers who are considering an intermediate option, somewhere between full-time work and complete retirement.

After a time, when the structure is stabilized and everyone agrees that his or her individual and shared interests and goals are being met, an outright merger can be contemplated. Obviously, projects of this scope require careful planning and implementation, and should not be undertaken without the help of competent legal counsel and an experienced business consultant.

A more complex but increasingly popular option is to join other small practices and providers in an independent practice association. An IPA is a legal entity, organized and directed by physicians for the purpose of negotiating contracts with insurance companies on their behalf. Because of its structure, an IPA is better positioned to enter into such financial arrangements and to counterbalance the leverage of insurers; but there are legal issues to consider. Many IPAs are vulnerable to antitrust charges because they include competing health care providers. You should check with legal counsel before signing on to an IPA, to make sure that it abides by antitrust and price fixing laws. IPAs have also been known to fail, particularly in states where they are not adequately regulated.

One proposed successor to the IPA is the accountable care organization (ACO), an entity born as a component of the Affordable Care Act. While the official definition remains nebulous, an ACO is basically a network of doctors and hospitals that shares financial and medical responsibility for providing coordinated and efficient care to patients. The goal of ACO participators is to limit unnecessary spending, both individually and collectively, according to criteria established by the Centers for Medicare & Medicaid Services (CMS), without compromising quality of care in the process. More than 600 ACOs had been approved by the CMS as of the beginning of 2014.

As the name implies, ACOs make providers jointly accountable for the health of their patients; they offer financial incentives to cooperate and to save money by avoiding unnecessary tests and procedures. A key component is the sharing of information. Providers that save money while also meeting quality targets are theoretically entitled to a portion of the savings.

As with IPAs, ACO ventures involve a measure of risk. ACOs that fail to meet the CMS performance and savings benchmarks can be stuck with the bill for investments made to improve care, such as equipment and computer purchases, and the hiring of mid-level providers and managers, and may be assessed monetary penalties as well. ACOs sponsored by physicians or rural providers, however, can apply to receive payments in advance to help finance infrastructure investments – a concession the Obama administration made after receiving complaints from rural hospitals. It is important to remember that the ACO model remains very much a work in progress.

Clearly, the price of remaining autonomous will be significant, and many private practitioners will be unwilling to pay it: Only 36% of physicians remained in independent practice at the end of the 2013, according to data from the American Medical Association – down from 57% in 2000; but those of us who remain committed to independence will find ways to preserve it, by mergers or other methods. In medicine, as in life, those most responsive to change will survive and flourish.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected].

The ongoing sea change in medicine has led to a substantial erosion of physician autonomy and to ever-increasing administrative burdens that hit small practices the hardest. Does this mean that the independent private physician practice model is doomed, as some predict? Absolutely not; but it will force many solo practitioners and small groups to join forces to protect themselves.

Those practices that offer unique services, or fill an unmet niche, may be able to remain small; but most smaller practices will need to consider a larger alternative. In my last column, I outlined the basics of arriving at a fair market value for a private practice; once that has been accomplished, you will be in a position to consider the various merger options that are available.

One attractive and relatively straightforward strategy is the formation of a cooperative group. In most areas, there are very likely several small practices in similar predicaments that might be receptive to discussing a collaboration on billing and purchasing. This allows each participant to maintain independence as a private practice, while pooling resources to ease the administrative burdens of all. Once that arrangement is in place, the group can consider more ambitious projects, such as the joint purchase of an integrated electronic health records (EHR) network, sharing personnel to lower staffing costs, and an integrated scheduling system. The latter will be particularly attractive to participants in later stages of their careers who are considering an intermediate option, somewhere between full-time work and complete retirement.

After a time, when the structure is stabilized and everyone agrees that his or her individual and shared interests and goals are being met, an outright merger can be contemplated. Obviously, projects of this scope require careful planning and implementation, and should not be undertaken without the help of competent legal counsel and an experienced business consultant.

A more complex but increasingly popular option is to join other small practices and providers in an independent practice association. An IPA is a legal entity, organized and directed by physicians for the purpose of negotiating contracts with insurance companies on their behalf. Because of its structure, an IPA is better positioned to enter into such financial arrangements and to counterbalance the leverage of insurers; but there are legal issues to consider. Many IPAs are vulnerable to antitrust charges because they include competing health care providers. You should check with legal counsel before signing on to an IPA, to make sure that it abides by antitrust and price fixing laws. IPAs have also been known to fail, particularly in states where they are not adequately regulated.

One proposed successor to the IPA is the accountable care organization (ACO), an entity born as a component of the Affordable Care Act. While the official definition remains nebulous, an ACO is basically a network of doctors and hospitals that shares financial and medical responsibility for providing coordinated and efficient care to patients. The goal of ACO participators is to limit unnecessary spending, both individually and collectively, according to criteria established by the Centers for Medicare & Medicaid Services (CMS), without compromising quality of care in the process. More than 600 ACOs had been approved by the CMS as of the beginning of 2014.

As the name implies, ACOs make providers jointly accountable for the health of their patients; they offer financial incentives to cooperate and to save money by avoiding unnecessary tests and procedures. A key component is the sharing of information. Providers that save money while also meeting quality targets are theoretically entitled to a portion of the savings.

As with IPAs, ACO ventures involve a measure of risk. ACOs that fail to meet the CMS performance and savings benchmarks can be stuck with the bill for investments made to improve care, such as equipment and computer purchases, and the hiring of mid-level providers and managers, and may be assessed monetary penalties as well. ACOs sponsored by physicians or rural providers, however, can apply to receive payments in advance to help finance infrastructure investments – a concession the Obama administration made after receiving complaints from rural hospitals. It is important to remember that the ACO model remains very much a work in progress.

Clearly, the price of remaining autonomous will be significant, and many private practitioners will be unwilling to pay it: Only 36% of physicians remained in independent practice at the end of the 2013, according to data from the American Medical Association – down from 57% in 2000; but those of us who remain committed to independence will find ways to preserve it, by mergers or other methods. In medicine, as in life, those most responsive to change will survive and flourish.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected].

Over the last couple of years, I’ve written quite a lot about the trend toward consolidation. That trend shows no sign of abating; more and more soloists and small groups are selling or merging their practices with hospitals, multispecialty groups, or other large entities.

I have seen evidence, though, that many sellers are not receiving a fair price for the equity that they have worked so hard to build over several decades. If you are contemplating selling or merging, it is important that you not simply take the buyer’s word for how much your practice is worth. You need an impartial appraisal.

Of course, a medical practice is trickier to value than an ordinary business, and usually requires the services of an experienced professional appraiser. Entire books have been written about the process, so I can’t hope to cover it completely in 750 words; but three basic yardsticks are essential for a practice appraisal:

• Tangible assets. Equipment, cash, accounts receivable and other property owned by the practice.

• Liabilities. Accounts payable, outstanding loans, and anything else owed to others.

• Intangible assets. Sometimes called “good will” – the reputation of the physicians, the location and name recognition of the practice, the loyalty and volume of patients, and other, well, intangibles.

Armed with those numbers, an appraiser can then determine the equity, or book value, of the practice.

Valuing tangible assets is comparatively straightforward, but there are several ways to do it, and when reviewing a practice appraisal you should ask which of them was used. Depreciated value is the book value of equipment and supplies as determined by their purchase price, less the amount their value has decreased since purchase. Remaining useful life value estimates how long the equipment can be expected to last. Market (or replacement) value is the amount it would cost on the open market to replace all equipment and supplies.

Intangible assets are more difficult to value. Many components are analyzed, including location, interior and exterior decor, accessibility to patients, age and functional status of equipment, systems in place to promote efficiency, reasons why patients come back (if in fact they do), and the overall reputation of the practice in the community. Other important factors include the “payer mix” (what percentage pays cash, how many third-party contracts are in place and how well they pay, etc.), the extent and strength of the referral base, and the presence of clinical studies or other supplemental income streams.

It is also important to determine to what extent intangible assets are transferable. For example, unique skills with a laser, neurotoxins, or filler substances, or extraordinary personal charisma, may increase your practice’s value to you, but they are worthless to the next owner, and he or she will be unwilling to pay for them unless your services become part of the deal.

Once again, there are many ways to estimate intangible asset value, and once again you should ask which were used. Cash Flow Analysis works on the assumption that cash flow is a measure of intangible value. Capitalization of Earnings puts a value, or capitalization, on the practice’s income streams using a variety of assumptions. Guideline Comparison uses various databases to compare your practice with other, similar ones that have changed hands in the past.

Two newer techniques, which some consider a better estimate of intangible assets, are the replacement method, which estimates the costs of starting the practice over again in the current market; and the excess earnings method, which measures how far above average your practice’s earnings (and thus its overall value) are.

Asset-based valuation is the most popular, but by no means the only method available. Income-based valuation looks at the source and strength of a practice’s income stream as a creator of value, as well as whether or not its income stream under a different owner would mirror its present one. This in turn becomes the basis for an understanding of the fair market value of both tangible and intangible assets. Market valuation combines the asset-based and income-based approaches, along with an analysis of sales and mergers of comparable practices in the community, to determine the value of a practice in its local market.

Whatever methods are used, it is important that the appraisal be done by an experienced financial consultant, that all techniques used in the valuation be divulged and explained, and that documentation is supplied to support the conclusions reached. This is especially important if the appraisal will be relied upon in the sale or merger of the practice. I’ll cover some sale and merger options that you may not have thought of next month.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected].

Over the last couple of years, I’ve written quite a lot about the trend toward consolidation. That trend shows no sign of abating; more and more soloists and small groups are selling or merging their practices with hospitals, multispecialty groups, or other large entities.

I have seen evidence, though, that many sellers are not receiving a fair price for the equity that they have worked so hard to build over several decades. If you are contemplating selling or merging, it is important that you not simply take the buyer’s word for how much your practice is worth. You need an impartial appraisal.

Of course, a medical practice is trickier to value than an ordinary business, and usually requires the services of an experienced professional appraiser. Entire books have been written about the process, so I can’t hope to cover it completely in 750 words; but three basic yardsticks are essential for a practice appraisal:

• Tangible assets. Equipment, cash, accounts receivable and other property owned by the practice.

• Liabilities. Accounts payable, outstanding loans, and anything else owed to others.

• Intangible assets. Sometimes called “good will” – the reputation of the physicians, the location and name recognition of the practice, the loyalty and volume of patients, and other, well, intangibles.

Armed with those numbers, an appraiser can then determine the equity, or book value, of the practice.

Valuing tangible assets is comparatively straightforward, but there are several ways to do it, and when reviewing a practice appraisal you should ask which of them was used. Depreciated value is the book value of equipment and supplies as determined by their purchase price, less the amount their value has decreased since purchase. Remaining useful life value estimates how long the equipment can be expected to last. Market (or replacement) value is the amount it would cost on the open market to replace all equipment and supplies.

Intangible assets are more difficult to value. Many components are analyzed, including location, interior and exterior decor, accessibility to patients, age and functional status of equipment, systems in place to promote efficiency, reasons why patients come back (if in fact they do), and the overall reputation of the practice in the community. Other important factors include the “payer mix” (what percentage pays cash, how many third-party contracts are in place and how well they pay, etc.), the extent and strength of the referral base, and the presence of clinical studies or other supplemental income streams.

It is also important to determine to what extent intangible assets are transferable. For example, unique skills with a laser, neurotoxins, or filler substances, or extraordinary personal charisma, may increase your practice’s value to you, but they are worthless to the next owner, and he or she will be unwilling to pay for them unless your services become part of the deal.

Once again, there are many ways to estimate intangible asset value, and once again you should ask which were used. Cash Flow Analysis works on the assumption that cash flow is a measure of intangible value. Capitalization of Earnings puts a value, or capitalization, on the practice’s income streams using a variety of assumptions. Guideline Comparison uses various databases to compare your practice with other, similar ones that have changed hands in the past.

Two newer techniques, which some consider a better estimate of intangible assets, are the replacement method, which estimates the costs of starting the practice over again in the current market; and the excess earnings method, which measures how far above average your practice’s earnings (and thus its overall value) are.

Asset-based valuation is the most popular, but by no means the only method available. Income-based valuation looks at the source and strength of a practice’s income stream as a creator of value, as well as whether or not its income stream under a different owner would mirror its present one. This in turn becomes the basis for an understanding of the fair market value of both tangible and intangible assets. Market valuation combines the asset-based and income-based approaches, along with an analysis of sales and mergers of comparable practices in the community, to determine the value of a practice in its local market.

Whatever methods are used, it is important that the appraisal be done by an experienced financial consultant, that all techniques used in the valuation be divulged and explained, and that documentation is supplied to support the conclusions reached. This is especially important if the appraisal will be relied upon in the sale or merger of the practice. I’ll cover some sale and merger options that you may not have thought of next month.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected].

Over the last couple of years, I’ve written quite a lot about the trend toward consolidation. That trend shows no sign of abating; more and more soloists and small groups are selling or merging their practices with hospitals, multispecialty groups, or other large entities.

I have seen evidence, though, that many sellers are not receiving a fair price for the equity that they have worked so hard to build over several decades. If you are contemplating selling or merging, it is important that you not simply take the buyer’s word for how much your practice is worth. You need an impartial appraisal.

Of course, a medical practice is trickier to value than an ordinary business, and usually requires the services of an experienced professional appraiser. Entire books have been written about the process, so I can’t hope to cover it completely in 750 words; but three basic yardsticks are essential for a practice appraisal:

• Tangible assets. Equipment, cash, accounts receivable and other property owned by the practice.

• Liabilities. Accounts payable, outstanding loans, and anything else owed to others.

• Intangible assets. Sometimes called “good will” – the reputation of the physicians, the location and name recognition of the practice, the loyalty and volume of patients, and other, well, intangibles.

Armed with those numbers, an appraiser can then determine the equity, or book value, of the practice.

Valuing tangible assets is comparatively straightforward, but there are several ways to do it, and when reviewing a practice appraisal you should ask which of them was used. Depreciated value is the book value of equipment and supplies as determined by their purchase price, less the amount their value has decreased since purchase. Remaining useful life value estimates how long the equipment can be expected to last. Market (or replacement) value is the amount it would cost on the open market to replace all equipment and supplies.

Intangible assets are more difficult to value. Many components are analyzed, including location, interior and exterior decor, accessibility to patients, age and functional status of equipment, systems in place to promote efficiency, reasons why patients come back (if in fact they do), and the overall reputation of the practice in the community. Other important factors include the “payer mix” (what percentage pays cash, how many third-party contracts are in place and how well they pay, etc.), the extent and strength of the referral base, and the presence of clinical studies or other supplemental income streams.

It is also important to determine to what extent intangible assets are transferable. For example, unique skills with a laser, neurotoxins, or filler substances, or extraordinary personal charisma, may increase your practice’s value to you, but they are worthless to the next owner, and he or she will be unwilling to pay for them unless your services become part of the deal.

Once again, there are many ways to estimate intangible asset value, and once again you should ask which were used. Cash Flow Analysis works on the assumption that cash flow is a measure of intangible value. Capitalization of Earnings puts a value, or capitalization, on the practice’s income streams using a variety of assumptions. Guideline Comparison uses various databases to compare your practice with other, similar ones that have changed hands in the past.

Two newer techniques, which some consider a better estimate of intangible assets, are the replacement method, which estimates the costs of starting the practice over again in the current market; and the excess earnings method, which measures how far above average your practice’s earnings (and thus its overall value) are.

Asset-based valuation is the most popular, but by no means the only method available. Income-based valuation looks at the source and strength of a practice’s income stream as a creator of value, as well as whether or not its income stream under a different owner would mirror its present one. This in turn becomes the basis for an understanding of the fair market value of both tangible and intangible assets. Market valuation combines the asset-based and income-based approaches, along with an analysis of sales and mergers of comparable practices in the community, to determine the value of a practice in its local market.

Whatever methods are used, it is important that the appraisal be done by an experienced financial consultant, that all techniques used in the valuation be divulged and explained, and that documentation is supplied to support the conclusions reached. This is especially important if the appraisal will be relied upon in the sale or merger of the practice. I’ll cover some sale and merger options that you may not have thought of next month.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected].

Recently I received a lengthy e-mail from a very worried woman. She claimed to be an established patient in my office, which I had no way of confirming because she did not sign her message. She asked many questions about sexually transmitted diseases and how they might affect her and a new boyfriend.

I was undecided on how to reply – or even whether to reply at all – so I queried several dozen dermatology colleagues around the country, as well as a few physician friends and acquaintances in other specialties.

Responses varied all over the map – from “I never answer patient e-mails,” to “What harm could it do, she’s better off getting correct answers from you than incorrect answers from some ‘advocacy’ web site” – and everything in between.

Clearly, this is a controversial issue which will only get more controversial in the future, so I decided to look at what has been published on the subject.

It turns out that as early as 1998, a group of investigators asked this same question and designed a study to address it. (Eysenbach and Diepgen: “Responses to unsolicited patient e-mail requests for medical advice on the World Wide Web. JAMA. 1998;280[15]:1333-5). Posing as a fictitious patient, they sent e-mails to random dermatologists describing an acute dermatological problem, tallied the responses they received, and followed up with a questionnaire to responders and nonresponders alike.

As with my informal survey, the authors found what they termed “a striking lack of consensus” on how to deal with this situation: Fifty percent responded to the fictitious patient’s e-mail. Of those, 31% refused to give advice without seeing the patient, but 59% offered a diagnosis, and a third of that group went on to provide specific advice about therapy. In response to the questionnaire, 28% said that they tended not to answer any patient e-mails, 24% said they usually replied with a standard message, and 24% said they answer each request individually. The authors concluded that “standards for physician response to unsolicited patient e-mail are needed.”

Indeed; but my own survey suggests that, 17 years later, there is still nothing resembling a consensus on this issue. In the interim, several groups, including the American Medical Informatics Association, Medem, and the AMA have proposed guidelines; but none have been generally accepted.

Until such time as that happens, it seems advisable for each individual practice to take the time to adopt its own guidelines. For ideas, take a look at the examples I’ve listed, plus any others you can find. When you’re done, consider running your list past your lawyer to make sure you haven’t forgotten anything, and that there are no peculiar requirements in your state.

Your guidelines may be very simple (if you decide never to answer any queries) or very complex, depending on your situation and personal philosophy. But all guidelines should cover such issues of authentication of patient correspondents, informed consent of those patients, licensing jurisdiction (if you receive e-mails from states in which you are not licensed), and above all, confidentiality.

Contrary to popular belief, the Health Insurance Portability and Accountability Act (HIPAA) does not prohibit such communication, nor require that it be encrypted. The HIPAA website says, “Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual.”

Still, if the lack of encryption and other privacy safeguards makes you (or your patients) uncomfortable, encryption software can be added to your practice’s e-mail system. Enli (www.enli.net), Sigaba (www.sigaba.com), Tumbleweed (www.axway.com), Zix (www.zixcorp.com), and many other vendors sell encryption packages. (As always, I have no financial interest in any product or enterprise mentioned in this column.)

But rather than simply encrypting your e-mail, consider adopting web-based messaging. Patients enter your web site and send a message using an electronic template that you design. You (or a designated staffer) will be notified by regular e-mail when messages are received, and you can post a reply on a page that can be accessed only by the patient. Besides enhancing privacy and security, you can state your guidelines in plain English to preclude any misunderstanding of what you will and will not address online.

Web-based messaging services can be freestanding or incorporated into existing secure websites. Medfusion (www.medfusion.net), and RelayHealth (www.relayhealth.com) are among the leading vendors of secure messaging services.

As for the e-mail query which triggered all this: I responded, but I told the patient I could not provide specific answers to such personal questions over the Internet, particularly when they were asked anonymously; but I would be happy to address her concerns in person, in my office.

And now, I’m writing my guidelines.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected].

Recently I received a lengthy e-mail from a very worried woman. She claimed to be an established patient in my office, which I had no way of confirming because she did not sign her message. She asked many questions about sexually transmitted diseases and how they might affect her and a new boyfriend.

I was undecided on how to reply – or even whether to reply at all – so I queried several dozen dermatology colleagues around the country, as well as a few physician friends and acquaintances in other specialties.

Responses varied all over the map – from “I never answer patient e-mails,” to “What harm could it do, she’s better off getting correct answers from you than incorrect answers from some ‘advocacy’ web site” – and everything in between.

Clearly, this is a controversial issue which will only get more controversial in the future, so I decided to look at what has been published on the subject.

It turns out that as early as 1998, a group of investigators asked this same question and designed a study to address it. (Eysenbach and Diepgen: “Responses to unsolicited patient e-mail requests for medical advice on the World Wide Web. JAMA. 1998;280[15]:1333-5). Posing as a fictitious patient, they sent e-mails to random dermatologists describing an acute dermatological problem, tallied the responses they received, and followed up with a questionnaire to responders and nonresponders alike.

As with my informal survey, the authors found what they termed “a striking lack of consensus” on how to deal with this situation: Fifty percent responded to the fictitious patient’s e-mail. Of those, 31% refused to give advice without seeing the patient, but 59% offered a diagnosis, and a third of that group went on to provide specific advice about therapy. In response to the questionnaire, 28% said that they tended not to answer any patient e-mails, 24% said they usually replied with a standard message, and 24% said they answer each request individually. The authors concluded that “standards for physician response to unsolicited patient e-mail are needed.”

Indeed; but my own survey suggests that, 17 years later, there is still nothing resembling a consensus on this issue. In the interim, several groups, including the American Medical Informatics Association, Medem, and the AMA have proposed guidelines; but none have been generally accepted.

Until such time as that happens, it seems advisable for each individual practice to take the time to adopt its own guidelines. For ideas, take a look at the examples I’ve listed, plus any others you can find. When you’re done, consider running your list past your lawyer to make sure you haven’t forgotten anything, and that there are no peculiar requirements in your state.

Your guidelines may be very simple (if you decide never to answer any queries) or very complex, depending on your situation and personal philosophy. But all guidelines should cover such issues of authentication of patient correspondents, informed consent of those patients, licensing jurisdiction (if you receive e-mails from states in which you are not licensed), and above all, confidentiality.

Contrary to popular belief, the Health Insurance Portability and Accountability Act (HIPAA) does not prohibit such communication, nor require that it be encrypted. The HIPAA website says, “Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual.”

Still, if the lack of encryption and other privacy safeguards makes you (or your patients) uncomfortable, encryption software can be added to your practice’s e-mail system. Enli (www.enli.net), Sigaba (www.sigaba.com), Tumbleweed (www.axway.com), Zix (www.zixcorp.com), and many other vendors sell encryption packages. (As always, I have no financial interest in any product or enterprise mentioned in this column.)

But rather than simply encrypting your e-mail, consider adopting web-based messaging. Patients enter your web site and send a message using an electronic template that you design. You (or a designated staffer) will be notified by regular e-mail when messages are received, and you can post a reply on a page that can be accessed only by the patient. Besides enhancing privacy and security, you can state your guidelines in plain English to preclude any misunderstanding of what you will and will not address online.

Web-based messaging services can be freestanding or incorporated into existing secure websites. Medfusion (www.medfusion.net), and RelayHealth (www.relayhealth.com) are among the leading vendors of secure messaging services.

As for the e-mail query which triggered all this: I responded, but I told the patient I could not provide specific answers to such personal questions over the Internet, particularly when they were asked anonymously; but I would be happy to address her concerns in person, in my office.

And now, I’m writing my guidelines.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected].

Recently I received a lengthy e-mail from a very worried woman. She claimed to be an established patient in my office, which I had no way of confirming because she did not sign her message. She asked many questions about sexually transmitted diseases and how they might affect her and a new boyfriend.

I was undecided on how to reply – or even whether to reply at all – so I queried several dozen dermatology colleagues around the country, as well as a few physician friends and acquaintances in other specialties.

Responses varied all over the map – from “I never answer patient e-mails,” to “What harm could it do, she’s better off getting correct answers from you than incorrect answers from some ‘advocacy’ web site” – and everything in between.

Clearly, this is a controversial issue which will only get more controversial in the future, so I decided to look at what has been published on the subject.

It turns out that as early as 1998, a group of investigators asked this same question and designed a study to address it. (Eysenbach and Diepgen: “Responses to unsolicited patient e-mail requests for medical advice on the World Wide Web. JAMA. 1998;280[15]:1333-5). Posing as a fictitious patient, they sent e-mails to random dermatologists describing an acute dermatological problem, tallied the responses they received, and followed up with a questionnaire to responders and nonresponders alike.

As with my informal survey, the authors found what they termed “a striking lack of consensus” on how to deal with this situation: Fifty percent responded to the fictitious patient’s e-mail. Of those, 31% refused to give advice without seeing the patient, but 59% offered a diagnosis, and a third of that group went on to provide specific advice about therapy. In response to the questionnaire, 28% said that they tended not to answer any patient e-mails, 24% said they usually replied with a standard message, and 24% said they answer each request individually. The authors concluded that “standards for physician response to unsolicited patient e-mail are needed.”

Indeed; but my own survey suggests that, 17 years later, there is still nothing resembling a consensus on this issue. In the interim, several groups, including the American Medical Informatics Association, Medem, and the AMA have proposed guidelines; but none have been generally accepted.

Until such time as that happens, it seems advisable for each individual practice to take the time to adopt its own guidelines. For ideas, take a look at the examples I’ve listed, plus any others you can find. When you’re done, consider running your list past your lawyer to make sure you haven’t forgotten anything, and that there are no peculiar requirements in your state.

Your guidelines may be very simple (if you decide never to answer any queries) or very complex, depending on your situation and personal philosophy. But all guidelines should cover such issues of authentication of patient correspondents, informed consent of those patients, licensing jurisdiction (if you receive e-mails from states in which you are not licensed), and above all, confidentiality.

Contrary to popular belief, the Health Insurance Portability and Accountability Act (HIPAA) does not prohibit such communication, nor require that it be encrypted. The HIPAA website says, “Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual.”

Still, if the lack of encryption and other privacy safeguards makes you (or your patients) uncomfortable, encryption software can be added to your practice’s e-mail system. Enli (www.enli.net), Sigaba (www.sigaba.com), Tumbleweed (www.axway.com), Zix (www.zixcorp.com), and many other vendors sell encryption packages. (As always, I have no financial interest in any product or enterprise mentioned in this column.)

But rather than simply encrypting your e-mail, consider adopting web-based messaging. Patients enter your web site and send a message using an electronic template that you design. You (or a designated staffer) will be notified by regular e-mail when messages are received, and you can post a reply on a page that can be accessed only by the patient. Besides enhancing privacy and security, you can state your guidelines in plain English to preclude any misunderstanding of what you will and will not address online.

Web-based messaging services can be freestanding or incorporated into existing secure websites. Medfusion (www.medfusion.net), and RelayHealth (www.relayhealth.com) are among the leading vendors of secure messaging services.

As for the e-mail query which triggered all this: I responded, but I told the patient I could not provide specific answers to such personal questions over the Internet, particularly when they were asked anonymously; but I would be happy to address her concerns in person, in my office.

And now, I’m writing my guidelines.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News. Write to him at [email protected].

Long-time readers will chuckle – but after years of affirming and reaffirming that I would never adopt electronic records in my practice, I’m in the process of doing just that. It still runs contrary to my better judgment; but the advent of ICD-10, combined with space issues and other factors that I won’t bore you with, has forced my hand.

Before implementing any electronic health record system, you first must sign an end-user license agreement (EULA) with the EHR vendor. The sales manager for the company I had chosen assured me that the EULA was a “routine” document.

“Just sign it,” he said. “It’s all basic stuff ... but you can read it, if you would like.” Of course I would like. First, it was quite clear that the agreement was designed primarily to protect the vendor. (Not surprising, since the company’s lawyer wrote it.) But then I noticed that the vendor assumed no liability at all in the event of accidental destruction of my records. And when I saw, a few paragraphs later, that the vendor would have the unrestricted right to sell my practice data to third parties, I knew I would not be “just signing” anything.

My attorney referred me to a colleague with expertise in technology contracts and HIPAA law. I asked him if EULAs were always this one-sided. “Some are much worse,” he replied. Why would any physician sign such an egregious document, I asked? “Because most of them never read it.”

Wow.

A couple of weeks later, my attorney and the vendor’s counsel signed off on a much fairer agreement. The bill was significant – but it was money well spent.

A EULA details your and your vendor’s responsibilities relating to installation of your EHR, training your staff, and ongoing software and hardware support. Sales reps will often chide you (as mine did) for “taking this much too seriously.” Any legal document that you sign – and by which you will be bound for the foreseeable future – must be taken seriously. You should never allow yourself to be pressured into signing anything that you cannot comfortably live with in perpetuity.

So if you are taking the EHR plunge, find a lawyer who understands tech contracts and medical privacy laws before you sign anything. Make certain that he or she knows your concerns, and the provisions that you can and cannot live with. Among other things, my attorney succeeded in removing clauses requiring a minimum contract term, and a hefty fee if I wanted out; a nondisclosure clause preventing any public criticism of the vendor; and that crazy provision giving them the right to sell or give practice data to anyone who asked for it.

One EHR installation in three ultimately fails, according to one management firm; so more than anything else, you need to be certain that you do not get locked into a long-term contract should your EHR turn out to be a poor performer. Be sure that the agreement allows you to terminate the contract if the product’s performance – by your criteria – proves to be inadequate.

Some seemingly obvious considerations need to be spelled out; for example, that you will have ownership of your data. You need to know exactly what happens to your data if the vendor goes out of business, or if a flood wipes out its servers, or your contract is terminated by either party, or anything else that forces you to switch vendors. The process of migrating your records to a new platform can go smoothly, or it can be a nightmare – depending on the agreement in place. It should include specific methods by which data will be migrated; and be sure to lose any clauses that force you to pay a “ransom” to regain control of your own records.

You will want to know how your data is backed up – and how the backup is backed up – and whether you can maintain a separate backup in-house if necessary. My attorney also insisted on a “guarantee of system uptime,” including the steps the vendor agrees to take in the event of a significant crash or other prolonged downtime.

The basic point, of course, is never sign a EULA without having it reviewed by an experienced technology attorney. A good one should be able to eliminate the more onerous clauses; but don’t expect perfection. My vendor refused to cave on several of my attorney’s concerns. “The agreement is still one-sided,” he told me, but it’s the best we will get at this point. Once there is more competition in the EHR field, things will be different.”

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

Long-time readers will chuckle – but after years of affirming and reaffirming that I would never adopt electronic records in my practice, I’m in the process of doing just that. It still runs contrary to my better judgment; but the advent of ICD-10, combined with space issues and other factors that I won’t bore you with, has forced my hand.

Before implementing any electronic health record system, you first must sign an end-user license agreement (EULA) with the EHR vendor. The sales manager for the company I had chosen assured me that the EULA was a “routine” document.

“Just sign it,” he said. “It’s all basic stuff ... but you can read it, if you would like.” Of course I would like. First, it was quite clear that the agreement was designed primarily to protect the vendor. (Not surprising, since the company’s lawyer wrote it.) But then I noticed that the vendor assumed no liability at all in the event of accidental destruction of my records. And when I saw, a few paragraphs later, that the vendor would have the unrestricted right to sell my practice data to third parties, I knew I would not be “just signing” anything.

My attorney referred me to a colleague with expertise in technology contracts and HIPAA law. I asked him if EULAs were always this one-sided. “Some are much worse,” he replied. Why would any physician sign such an egregious document, I asked? “Because most of them never read it.”

Wow.

A couple of weeks later, my attorney and the vendor’s counsel signed off on a much fairer agreement. The bill was significant – but it was money well spent.

A EULA details your and your vendor’s responsibilities relating to installation of your EHR, training your staff, and ongoing software and hardware support. Sales reps will often chide you (as mine did) for “taking this much too seriously.” Any legal document that you sign – and by which you will be bound for the foreseeable future – must be taken seriously. You should never allow yourself to be pressured into signing anything that you cannot comfortably live with in perpetuity.

So if you are taking the EHR plunge, find a lawyer who understands tech contracts and medical privacy laws before you sign anything. Make certain that he or she knows your concerns, and the provisions that you can and cannot live with. Among other things, my attorney succeeded in removing clauses requiring a minimum contract term, and a hefty fee if I wanted out; a nondisclosure clause preventing any public criticism of the vendor; and that crazy provision giving them the right to sell or give practice data to anyone who asked for it.

One EHR installation in three ultimately fails, according to one management firm; so more than anything else, you need to be certain that you do not get locked into a long-term contract should your EHR turn out to be a poor performer. Be sure that the agreement allows you to terminate the contract if the product’s performance – by your criteria – proves to be inadequate.

Some seemingly obvious considerations need to be spelled out; for example, that you will have ownership of your data. You need to know exactly what happens to your data if the vendor goes out of business, or if a flood wipes out its servers, or your contract is terminated by either party, or anything else that forces you to switch vendors. The process of migrating your records to a new platform can go smoothly, or it can be a nightmare – depending on the agreement in place. It should include specific methods by which data will be migrated; and be sure to lose any clauses that force you to pay a “ransom” to regain control of your own records.

You will want to know how your data is backed up – and how the backup is backed up – and whether you can maintain a separate backup in-house if necessary. My attorney also insisted on a “guarantee of system uptime,” including the steps the vendor agrees to take in the event of a significant crash or other prolonged downtime.

The basic point, of course, is never sign a EULA without having it reviewed by an experienced technology attorney. A good one should be able to eliminate the more onerous clauses; but don’t expect perfection. My vendor refused to cave on several of my attorney’s concerns. “The agreement is still one-sided,” he told me, but it’s the best we will get at this point. Once there is more competition in the EHR field, things will be different.”

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

Long-time readers will chuckle – but after years of affirming and reaffirming that I would never adopt electronic records in my practice, I’m in the process of doing just that. It still runs contrary to my better judgment; but the advent of ICD-10, combined with space issues and other factors that I won’t bore you with, has forced my hand.

Before implementing any electronic health record system, you first must sign an end-user license agreement (EULA) with the EHR vendor. The sales manager for the company I had chosen assured me that the EULA was a “routine” document.

“Just sign it,” he said. “It’s all basic stuff ... but you can read it, if you would like.” Of course I would like. First, it was quite clear that the agreement was designed primarily to protect the vendor. (Not surprising, since the company’s lawyer wrote it.) But then I noticed that the vendor assumed no liability at all in the event of accidental destruction of my records. And when I saw, a few paragraphs later, that the vendor would have the unrestricted right to sell my practice data to third parties, I knew I would not be “just signing” anything.

My attorney referred me to a colleague with expertise in technology contracts and HIPAA law. I asked him if EULAs were always this one-sided. “Some are much worse,” he replied. Why would any physician sign such an egregious document, I asked? “Because most of them never read it.”

Wow.

A couple of weeks later, my attorney and the vendor’s counsel signed off on a much fairer agreement. The bill was significant – but it was money well spent.

A EULA details your and your vendor’s responsibilities relating to installation of your EHR, training your staff, and ongoing software and hardware support. Sales reps will often chide you (as mine did) for “taking this much too seriously.” Any legal document that you sign – and by which you will be bound for the foreseeable future – must be taken seriously. You should never allow yourself to be pressured into signing anything that you cannot comfortably live with in perpetuity.

So if you are taking the EHR plunge, find a lawyer who understands tech contracts and medical privacy laws before you sign anything. Make certain that he or she knows your concerns, and the provisions that you can and cannot live with. Among other things, my attorney succeeded in removing clauses requiring a minimum contract term, and a hefty fee if I wanted out; a nondisclosure clause preventing any public criticism of the vendor; and that crazy provision giving them the right to sell or give practice data to anyone who asked for it.

One EHR installation in three ultimately fails, according to one management firm; so more than anything else, you need to be certain that you do not get locked into a long-term contract should your EHR turn out to be a poor performer. Be sure that the agreement allows you to terminate the contract if the product’s performance – by your criteria – proves to be inadequate.

Some seemingly obvious considerations need to be spelled out; for example, that you will have ownership of your data. You need to know exactly what happens to your data if the vendor goes out of business, or if a flood wipes out its servers, or your contract is terminated by either party, or anything else that forces you to switch vendors. The process of migrating your records to a new platform can go smoothly, or it can be a nightmare – depending on the agreement in place. It should include specific methods by which data will be migrated; and be sure to lose any clauses that force you to pay a “ransom” to regain control of your own records.

You will want to know how your data is backed up – and how the backup is backed up – and whether you can maintain a separate backup in-house if necessary. My attorney also insisted on a “guarantee of system uptime,” including the steps the vendor agrees to take in the event of a significant crash or other prolonged downtime.

The basic point, of course, is never sign a EULA without having it reviewed by an experienced technology attorney. A good one should be able to eliminate the more onerous clauses; but don’t expect perfection. My vendor refused to cave on several of my attorney’s concerns. “The agreement is still one-sided,” he told me, but it’s the best we will get at this point. Once there is more competition in the EHR field, things will be different.”

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

Revision of the Health Insurance Portability and Accountability Act (HIPAA) rules has prompted numerous questions about business associates (BAs) and business associate agreements (BAAs). Apparently there is confusion about exactly which businesses qualify as BAs and how your BAAs should be modified to reflect the new provisions.

The criteria for identifying BAs are admittedly vague: The act defines them as nonemployees, performing “functions or activities” on behalf of the “covered entity” (your practice) that involve “creating, receiving, maintaining, or transmitting” personal health information (PHI).

Clearly, answering and billing services, independent transcriptionists, hardware and software companies, and any other vendors involved in creating or maintaining your medical records always qualify as BAs. Other businesses may or may not qualify, depending on whether they need direct access to PHI in order to provide their service. These include practice management consultants, attorneys, companies that store or microfilm medical records, and record-shredding services.

Specialty pharmacies are seldom mentioned in the BA discussion, but they probably should be. Pharmaceutical manufacturers are increasingly using them as intermediaries for their products – particularly the more expensive ones, such as biologics. Many of them ship products directly to patients, for which they require home addresses and other personal information, and in order to file payment paperwork and claim forms, they usually request diagnoses and associated medical information. By any reasonable interpretation of the new rules, this makes them BAs, and you should have BAAs in place before allowing them to fill your prescriptions.

To further complicate the situation, manufacturers and insurers routinely compile information about the real world uses of their products. To that end, they often ask specialty pharmacies to provide them with any patient data that they collect. Under the new rules, patients may restrict any PHI shared with third parties when patients pay for the drugs or services themselves. Your specialty pharmacy BAA should include a provision noting that the pharmacy is forbidden from disclosing any data to pharmaceutical companies or insurers from patients who self-pay and request confidentiality.

Mail carriers, package delivery people, cleaning services, copier repairmen, bank employees, and the like are not considered BAs. While they might conceivably come in contact with PHI on occasion, they don’t need it to do their job. You are required to use “reasonable diligence” in limiting the PHI that these folks may encounter, but you do not need to enter into written BA agreements with them.

Independent contractors who work within your practice – aestheticians and physical therapists, for example – are not considered BAs either, and do not need to sign a BA agreement. Just train them, as you do your employees.

Another source of confusion is the provision in the new rules that makes BAs directly responsible for their own HIPAA violations. While this might seem to eliminate the need for BAAs entirely, unfortunately that is not the case. In fact, even more responsibility has been placed on physicians for confidentiality breaches committed by their BAs. It is not enough to simply have a BAA in place; you are expected to use “reasonable diligence” in monitoring the work of your BAs. While BAs and their subcontractors are responsible for their own actions, the primary responsibility remains with you. Furthermore, you now must assume the worst-case scenario. Previously, when PHI was compromised, you would have to notify affected patients (and the government) only if there was a “significant risk of financial or reputational harm”; but now, any incident involving patient records is assumed to be a breach, and must be reported. Failure to do so could subject your practice, as well as the contractor, to significant fines.

If you haven’t yet revised your Notice of Privacy Practices (NPP) to explain your relationships with BAs, and their status under the new rules, do it now. (You should have done it last September.) You need to explain the breach notification process too, as well as the new patient rights mentioned above. You must post your revised NPP in your office, and make copies available there, but you need not mail a copy to every patient.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

Revision of the Health Insurance Portability and Accountability Act (HIPAA) rules has prompted numerous questions about business associates (BAs) and business associate agreements (BAAs). Apparently there is confusion about exactly which businesses qualify as BAs and how your BAAs should be modified to reflect the new provisions.

The criteria for identifying BAs are admittedly vague: The act defines them as nonemployees, performing “functions or activities” on behalf of the “covered entity” (your practice) that involve “creating, receiving, maintaining, or transmitting” personal health information (PHI).

Clearly, answering and billing services, independent transcriptionists, hardware and software companies, and any other vendors involved in creating or maintaining your medical records always qualify as BAs. Other businesses may or may not qualify, depending on whether they need direct access to PHI in order to provide their service. These include practice management consultants, attorneys, companies that store or microfilm medical records, and record-shredding services.

Specialty pharmacies are seldom mentioned in the BA discussion, but they probably should be. Pharmaceutical manufacturers are increasingly using them as intermediaries for their products – particularly the more expensive ones, such as biologics. Many of them ship products directly to patients, for which they require home addresses and other personal information, and in order to file payment paperwork and claim forms, they usually request diagnoses and associated medical information. By any reasonable interpretation of the new rules, this makes them BAs, and you should have BAAs in place before allowing them to fill your prescriptions.

To further complicate the situation, manufacturers and insurers routinely compile information about the real world uses of their products. To that end, they often ask specialty pharmacies to provide them with any patient data that they collect. Under the new rules, patients may restrict any PHI shared with third parties when patients pay for the drugs or services themselves. Your specialty pharmacy BAA should include a provision noting that the pharmacy is forbidden from disclosing any data to pharmaceutical companies or insurers from patients who self-pay and request confidentiality.

Mail carriers, package delivery people, cleaning services, copier repairmen, bank employees, and the like are not considered BAs. While they might conceivably come in contact with PHI on occasion, they don’t need it to do their job. You are required to use “reasonable diligence” in limiting the PHI that these folks may encounter, but you do not need to enter into written BA agreements with them.

Independent contractors who work within your practice – aestheticians and physical therapists, for example – are not considered BAs either, and do not need to sign a BA agreement. Just train them, as you do your employees.

Another source of confusion is the provision in the new rules that makes BAs directly responsible for their own HIPAA violations. While this might seem to eliminate the need for BAAs entirely, unfortunately that is not the case. In fact, even more responsibility has been placed on physicians for confidentiality breaches committed by their BAs. It is not enough to simply have a BAA in place; you are expected to use “reasonable diligence” in monitoring the work of your BAs. While BAs and their subcontractors are responsible for their own actions, the primary responsibility remains with you. Furthermore, you now must assume the worst-case scenario. Previously, when PHI was compromised, you would have to notify affected patients (and the government) only if there was a “significant risk of financial or reputational harm”; but now, any incident involving patient records is assumed to be a breach, and must be reported. Failure to do so could subject your practice, as well as the contractor, to significant fines.

If you haven’t yet revised your Notice of Privacy Practices (NPP) to explain your relationships with BAs, and their status under the new rules, do it now. (You should have done it last September.) You need to explain the breach notification process too, as well as the new patient rights mentioned above. You must post your revised NPP in your office, and make copies available there, but you need not mail a copy to every patient.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

Revision of the Health Insurance Portability and Accountability Act (HIPAA) rules has prompted numerous questions about business associates (BAs) and business associate agreements (BAAs). Apparently there is confusion about exactly which businesses qualify as BAs and how your BAAs should be modified to reflect the new provisions.

The criteria for identifying BAs are admittedly vague: The act defines them as nonemployees, performing “functions or activities” on behalf of the “covered entity” (your practice) that involve “creating, receiving, maintaining, or transmitting” personal health information (PHI).

Clearly, answering and billing services, independent transcriptionists, hardware and software companies, and any other vendors involved in creating or maintaining your medical records always qualify as BAs. Other businesses may or may not qualify, depending on whether they need direct access to PHI in order to provide their service. These include practice management consultants, attorneys, companies that store or microfilm medical records, and record-shredding services.

Specialty pharmacies are seldom mentioned in the BA discussion, but they probably should be. Pharmaceutical manufacturers are increasingly using them as intermediaries for their products – particularly the more expensive ones, such as biologics. Many of them ship products directly to patients, for which they require home addresses and other personal information, and in order to file payment paperwork and claim forms, they usually request diagnoses and associated medical information. By any reasonable interpretation of the new rules, this makes them BAs, and you should have BAAs in place before allowing them to fill your prescriptions.

To further complicate the situation, manufacturers and insurers routinely compile information about the real world uses of their products. To that end, they often ask specialty pharmacies to provide them with any patient data that they collect. Under the new rules, patients may restrict any PHI shared with third parties when patients pay for the drugs or services themselves. Your specialty pharmacy BAA should include a provision noting that the pharmacy is forbidden from disclosing any data to pharmaceutical companies or insurers from patients who self-pay and request confidentiality.

Mail carriers, package delivery people, cleaning services, copier repairmen, bank employees, and the like are not considered BAs. While they might conceivably come in contact with PHI on occasion, they don’t need it to do their job. You are required to use “reasonable diligence” in limiting the PHI that these folks may encounter, but you do not need to enter into written BA agreements with them.

Independent contractors who work within your practice – aestheticians and physical therapists, for example – are not considered BAs either, and do not need to sign a BA agreement. Just train them, as you do your employees.

Another source of confusion is the provision in the new rules that makes BAs directly responsible for their own HIPAA violations. While this might seem to eliminate the need for BAAs entirely, unfortunately that is not the case. In fact, even more responsibility has been placed on physicians for confidentiality breaches committed by their BAs. It is not enough to simply have a BAA in place; you are expected to use “reasonable diligence” in monitoring the work of your BAs. While BAs and their subcontractors are responsible for their own actions, the primary responsibility remains with you. Furthermore, you now must assume the worst-case scenario. Previously, when PHI was compromised, you would have to notify affected patients (and the government) only if there was a “significant risk of financial or reputational harm”; but now, any incident involving patient records is assumed to be a breach, and must be reported. Failure to do so could subject your practice, as well as the contractor, to significant fines.

If you haven’t yet revised your Notice of Privacy Practices (NPP) to explain your relationships with BAs, and their status under the new rules, do it now. (You should have done it last September.) You need to explain the breach notification process too, as well as the new patient rights mentioned above. You must post your revised NPP in your office, and make copies available there, but you need not mail a copy to every patient.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

While much has been written about the Center for Medicare & Medicaid Services (CMS) plan to shift its payment system away from fee for service and toward a “value-based” structure, most physicians in small and solo private settings have given little, if any, thought to its potential impact on their practices. That is about to change.

The principal vehicle for the CMS plan is something called the Value-Based Payment Modifier (VBM), a component of the Affordable Care Act (ACA). The VBM has been off the radar of smaller private practices, because up until now it has applied only to groups with more than 10 providers. Starting this year, it applies to everyone. If you accept Medicare patients, regardless of the size of your practice, VBM will become part of your life – because your 2017 Medicare payments will be adjusted based on your 2015 VBM “score.”

That score will be based on your “quality of care” (as defined by the CMS) and how much your care costs the system, compared with care provided by other physicians. The quality component will be calculated from measures reported through the Physician Quality Reporting System (PQRS). Your practice will then be “tiered” to determine whether your performance is statistically better, the same, or worse than the national mean. The CMS has not shared all the details of its “quality tiering” formula, but you can get an idea of their general criteria by reviewing the recently released “Quality Benchmarks for the 2015 Value Modifier” at CMS.org.

To calculate the cost component, the CMS will evaluate measures that include total overall costs per beneficiary, and total costs for a composite of chronic conditions, such as (for internists) chronic obstructive pulmonary disease, heart failure, coronary artery disease, and diabetes; no one has speculated on which diseases might be used for dermatology. Practitioners are eligible for a 1% bonus if their average score is in the top 25% of all scores nationwide. You can get some sense of where you stand in the national hierarchy by studying your Quality Resource and Use Report (QRUR), which gathers information about each practice’s quality and performance rates for the VBM. Reports for the first half of 2014 were released by the CMS in April, and can be downloaded from the QRUR section of CMS.gov.

The ACA requires that the program be budget neutral – which means that all bonuses to physicians in the highest 25% must be offset by penalties – “negative adjustments” – to those in the lowest 25%. The good news is that groups with two to nine providers, and solo practitioners who report successfully for PQRS, receive only the upward or neutral adjustment for 2017, with no downward adjustments. That means you will have at least one penalty-free year to determine where you stand in the VBM pecking order – and perhaps earn a bonus.

So in summary, here is what you have to do now, in 2015, to maximize your chances of earning that upward adjustment in 2017:

• If you haven’t already, make sure your practice data are correct in the Medicare Provider Enrollment, Chain, and Ownership System (PECOS). This is where CMS will gather data for the VBM and the Physician Feedback Reports.

• Study the Quality Benchmarks and download your practice’s QRUR, as mentioned.

• Report successfully for PQRS in 2015, which will also avoid an automatic penalty of 4% in 2017.

Are there serious potential consequences inherent in this unprecedented new system? I think so. For all the talk that the transition from fee-for-service to “value-based” reimbursement would result in better care at a lower cost, there is little evidence that care is improving, and even less that costs are decreasing.

In essence, the VBM establishes arbitrary practice standards and spending ceilings. It creates new incentives to practice “cookbook” medicine, and new disincentives to order tests, consults, or medications, even when doing so would clearly be in a patient’s best interest. Physicians who have the temerity to practice medicine as they see fit, irrespective of the costs involved, will be punished.

Patients will certainly not welcome their physicians’ new reluctance to recommend appropriate interventions for fear of generating excessive costs, and should a less-than-thorough work-up lead to a missed diagnosis, the ACA offers no protection at all from any resulting malpractice litigation.

All of that said, the VBM is a reality, and can no longer be ignored if you treat Medicare patients.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters.

While much has been written about the Center for Medicare & Medicaid Services (CMS) plan to shift its payment system away from fee for service and toward a “value-based” structure, most physicians in small and solo private settings have given little, if any, thought to its potential impact on their practices. That is about to change.

The principal vehicle for the CMS plan is something called the Value-Based Payment Modifier (VBM), a component of the Affordable Care Act (ACA). The VBM has been off the radar of smaller private practices, because up until now it has applied only to groups with more than 10 providers. Starting this year, it applies to everyone. If you accept Medicare patients, regardless of the size of your practice, VBM will become part of your life – because your 2017 Medicare payments will be adjusted based on your 2015 VBM “score.”

That score will be based on your “quality of care” (as defined by the CMS) and how much your care costs the system, compared with care provided by other physicians. The quality component will be calculated from measures reported through the Physician Quality Reporting System (PQRS). Your practice will then be “tiered” to determine whether your performance is statistically better, the same, or worse than the national mean. The CMS has not shared all the details of its “quality tiering” formula, but you can get an idea of their general criteria by reviewing the recently released “Quality Benchmarks for the 2015 Value Modifier” at CMS.org.

To calculate the cost component, the CMS will evaluate measures that include total overall costs per beneficiary, and total costs for a composite of chronic conditions, such as (for internists) chronic obstructive pulmonary disease, heart failure, coronary artery disease, and diabetes; no one has speculated on which diseases might be used for dermatology. Practitioners are eligible for a 1% bonus if their average score is in the top 25% of all scores nationwide. You can get some sense of where you stand in the national hierarchy by studying your Quality Resource and Use Report (QRUR), which gathers information about each practice’s quality and performance rates for the VBM. Reports for the first half of 2014 were released by the CMS in April, and can be downloaded from the QRUR section of CMS.gov.

The ACA requires that the program be budget neutral – which means that all bonuses to physicians in the highest 25% must be offset by penalties – “negative adjustments” – to those in the lowest 25%. The good news is that groups with two to nine providers, and solo practitioners who report successfully for PQRS, receive only the upward or neutral adjustment for 2017, with no downward adjustments. That means you will have at least one penalty-free year to determine where you stand in the VBM pecking order – and perhaps earn a bonus.

So in summary, here is what you have to do now, in 2015, to maximize your chances of earning that upward adjustment in 2017:

• If you haven’t already, make sure your practice data are correct in the Medicare Provider Enrollment, Chain, and Ownership System (PECOS). This is where CMS will gather data for the VBM and the Physician Feedback Reports.

• Study the Quality Benchmarks and download your practice’s QRUR, as mentioned.

• Report successfully for PQRS in 2015, which will also avoid an automatic penalty of 4% in 2017.

Are there serious potential consequences inherent in this unprecedented new system? I think so. For all the talk that the transition from fee-for-service to “value-based” reimbursement would result in better care at a lower cost, there is little evidence that care is improving, and even less that costs are decreasing.

In essence, the VBM establishes arbitrary practice standards and spending ceilings. It creates new incentives to practice “cookbook” medicine, and new disincentives to order tests, consults, or medications, even when doing so would clearly be in a patient’s best interest. Physicians who have the temerity to practice medicine as they see fit, irrespective of the costs involved, will be punished.

Patients will certainly not welcome their physicians’ new reluctance to recommend appropriate interventions for fear of generating excessive costs, and should a less-than-thorough work-up lead to a missed diagnosis, the ACA offers no protection at all from any resulting malpractice litigation.

All of that said, the VBM is a reality, and can no longer be ignored if you treat Medicare patients.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters.

While much has been written about the Center for Medicare & Medicaid Services (CMS) plan to shift its payment system away from fee for service and toward a “value-based” structure, most physicians in small and solo private settings have given little, if any, thought to its potential impact on their practices. That is about to change.

The principal vehicle for the CMS plan is something called the Value-Based Payment Modifier (VBM), a component of the Affordable Care Act (ACA). The VBM has been off the radar of smaller private practices, because up until now it has applied only to groups with more than 10 providers. Starting this year, it applies to everyone. If you accept Medicare patients, regardless of the size of your practice, VBM will become part of your life – because your 2017 Medicare payments will be adjusted based on your 2015 VBM “score.”

That score will be based on your “quality of care” (as defined by the CMS) and how much your care costs the system, compared with care provided by other physicians. The quality component will be calculated from measures reported through the Physician Quality Reporting System (PQRS). Your practice will then be “tiered” to determine whether your performance is statistically better, the same, or worse than the national mean. The CMS has not shared all the details of its “quality tiering” formula, but you can get an idea of their general criteria by reviewing the recently released “Quality Benchmarks for the 2015 Value Modifier” at CMS.org.

To calculate the cost component, the CMS will evaluate measures that include total overall costs per beneficiary, and total costs for a composite of chronic conditions, such as (for internists) chronic obstructive pulmonary disease, heart failure, coronary artery disease, and diabetes; no one has speculated on which diseases might be used for dermatology. Practitioners are eligible for a 1% bonus if their average score is in the top 25% of all scores nationwide. You can get some sense of where you stand in the national hierarchy by studying your Quality Resource and Use Report (QRUR), which gathers information about each practice’s quality and performance rates for the VBM. Reports for the first half of 2014 were released by the CMS in April, and can be downloaded from the QRUR section of CMS.gov.

The ACA requires that the program be budget neutral – which means that all bonuses to physicians in the highest 25% must be offset by penalties – “negative adjustments” – to those in the lowest 25%. The good news is that groups with two to nine providers, and solo practitioners who report successfully for PQRS, receive only the upward or neutral adjustment for 2017, with no downward adjustments. That means you will have at least one penalty-free year to determine where you stand in the VBM pecking order – and perhaps earn a bonus.

So in summary, here is what you have to do now, in 2015, to maximize your chances of earning that upward adjustment in 2017:

• If you haven’t already, make sure your practice data are correct in the Medicare Provider Enrollment, Chain, and Ownership System (PECOS). This is where CMS will gather data for the VBM and the Physician Feedback Reports.

• Study the Quality Benchmarks and download your practice’s QRUR, as mentioned.

• Report successfully for PQRS in 2015, which will also avoid an automatic penalty of 4% in 2017.

Are there serious potential consequences inherent in this unprecedented new system? I think so. For all the talk that the transition from fee-for-service to “value-based” reimbursement would result in better care at a lower cost, there is little evidence that care is improving, and even less that costs are decreasing.

In essence, the VBM establishes arbitrary practice standards and spending ceilings. It creates new incentives to practice “cookbook” medicine, and new disincentives to order tests, consults, or medications, even when doing so would clearly be in a patient’s best interest. Physicians who have the temerity to practice medicine as they see fit, irrespective of the costs involved, will be punished.

Patients will certainly not welcome their physicians’ new reluctance to recommend appropriate interventions for fear of generating excessive costs, and should a less-than-thorough work-up lead to a missed diagnosis, the ACA offers no protection at all from any resulting malpractice litigation.

All of that said, the VBM is a reality, and can no longer be ignored if you treat Medicare patients.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters.

I’ve written about the Physician Payment Sunshine Act several times since it became law in 2013. My basic opinion – that it is a tempest in a teapot – has not changed. Nonetheless, now is the time to review the 2014 data reported under your name – and if necessary, initiate a dispute – before the information is posted publicly on June 30.

A quick review: The Sunshine Act, known officially as the “Open Payments Program,” requires all manufacturers of drugs, devices, and medical supplies covered by federal health care programs to report to the Centers for Medicare & Medicaid Services any financial interactions with physicians and teaching hospitals.

Reportable interactions include consulting, food, ownership or investment interest, direct compensation for speakers at education programs, and research. Compensation for clinical trials must be reported but is not made public until the product receives FDA approval, or until 4 years after the payment, whichever is earlier. Payments for trials involving a new indication for an approved drug are posted the following year.

Exemptions include CME activities funded by manufacturers and product samples for patient use. Medical students and residents are exempted entirely.

You are allowed to review your data and request corrections before information is posted publicly. You will have an additional 2 years to pursue corrections after the content goes live at the end of June, but any erroneous information will remain online until the next scheduled update, so you should find and fix errors as promptly as possible.

If you don’t see drug reps, accept sponsored lunches, or give sponsored talks, don’t assume that you won’t be on the website. Check anyway: You might be indirectly involved in a compensation that you were not aware of, or you might have been reported in error.

To review your data, register at the CMS Enterprise Portal (https://portal.cms.gov/wps/portal/unauthportal/home/) and request access to the Open Payments system.

The question remains as to what effect the law might be having on research, continuing education, or physicians’ relationships with the pharmaceutical industry. The short answer is that no one knows. The first data posting this past September came and went with little fanfare, and no repercussions directly attributable to the program have been reported as of this writing.

Sunshine laws have been in effect for several years in six states: California, Colorado, Massachusetts, Minnesota, Vermont, and West Virginia, plus the District of Columbia. (Maine repealed its law in 2011.) Observers disagree on their impact. Studies in Maine and West Virginia showed no significant public reaction or changes in prescribing patterns, according to a 2012 article in the Archives of Internal Medicine (now JAMA Internal Medicine).

Reactions from the public are equally inscrutable. Do citizens think less of doctors who accept the occasional industry-sponsored lunch for their employees? Do they think more of doctors who speak at meetings, or conduct industry-sponsored clinical research? There are no objective data. Anecdotally, I haven’t heard a peep – positive, negative, or indifferent – from any of my patients, nor have any other physicians that I’ve asked.

As of now, I stand by my initial prediction that attorneys, activists, and the occasional reporter will data-mine the information for various purposes, but few patients will bother to visit. Of course, that doesn’t mean you should ignore it as well. As always, I suggest you review the accuracy of anything posted about you, in any form or context, on any venue. This year’s data (reflecting all 2014 reports) have been available for review since April 6. You can initiate a dispute at any time over the next 2 years, before or after public release on June 30, but the sooner the better. Corrections are made each time CMS updates the system.

Maintaining accurate financial records has always been important, but it will be even more important now to support your disputes. CMS won’t simply take your word for it. A free app is available to help you track payments and other reportable industry interactions; search for “Open Payments” at your favorite app store.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

I’ve written about the Physician Payment Sunshine Act several times since it became law in 2013. My basic opinion – that it is a tempest in a teapot – has not changed. Nonetheless, now is the time to review the 2014 data reported under your name – and if necessary, initiate a dispute – before the information is posted publicly on June 30.

A quick review: The Sunshine Act, known officially as the “Open Payments Program,” requires all manufacturers of drugs, devices, and medical supplies covered by federal health care programs to report to the Centers for Medicare & Medicaid Services any financial interactions with physicians and teaching hospitals.

Reportable interactions include consulting, food, ownership or investment interest, direct compensation for speakers at education programs, and research. Compensation for clinical trials must be reported but is not made public until the product receives FDA approval, or until 4 years after the payment, whichever is earlier. Payments for trials involving a new indication for an approved drug are posted the following year.

Exemptions include CME activities funded by manufacturers and product samples for patient use. Medical students and residents are exempted entirely.

You are allowed to review your data and request corrections before information is posted publicly. You will have an additional 2 years to pursue corrections after the content goes live at the end of June, but any erroneous information will remain online until the next scheduled update, so you should find and fix errors as promptly as possible.

If you don’t see drug reps, accept sponsored lunches, or give sponsored talks, don’t assume that you won’t be on the website. Check anyway: You might be indirectly involved in a compensation that you were not aware of, or you might have been reported in error.

To review your data, register at the CMS Enterprise Portal (https://portal.cms.gov/wps/portal/unauthportal/home/) and request access to the Open Payments system.

The question remains as to what effect the law might be having on research, continuing education, or physicians’ relationships with the pharmaceutical industry. The short answer is that no one knows. The first data posting this past September came and went with little fanfare, and no repercussions directly attributable to the program have been reported as of this writing.

Sunshine laws have been in effect for several years in six states: California, Colorado, Massachusetts, Minnesota, Vermont, and West Virginia, plus the District of Columbia. (Maine repealed its law in 2011.) Observers disagree on their impact. Studies in Maine and West Virginia showed no significant public reaction or changes in prescribing patterns, according to a 2012 article in the Archives of Internal Medicine (now JAMA Internal Medicine).

Reactions from the public are equally inscrutable. Do citizens think less of doctors who accept the occasional industry-sponsored lunch for their employees? Do they think more of doctors who speak at meetings, or conduct industry-sponsored clinical research? There are no objective data. Anecdotally, I haven’t heard a peep – positive, negative, or indifferent – from any of my patients, nor have any other physicians that I’ve asked.

As of now, I stand by my initial prediction that attorneys, activists, and the occasional reporter will data-mine the information for various purposes, but few patients will bother to visit. Of course, that doesn’t mean you should ignore it as well. As always, I suggest you review the accuracy of anything posted about you, in any form or context, on any venue. This year’s data (reflecting all 2014 reports) have been available for review since April 6. You can initiate a dispute at any time over the next 2 years, before or after public release on June 30, but the sooner the better. Corrections are made each time CMS updates the system.

Maintaining accurate financial records has always been important, but it will be even more important now to support your disputes. CMS won’t simply take your word for it. A free app is available to help you track payments and other reportable industry interactions; search for “Open Payments” at your favorite app store.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

I’ve written about the Physician Payment Sunshine Act several times since it became law in 2013. My basic opinion – that it is a tempest in a teapot – has not changed. Nonetheless, now is the time to review the 2014 data reported under your name – and if necessary, initiate a dispute – before the information is posted publicly on June 30.

A quick review: The Sunshine Act, known officially as the “Open Payments Program,” requires all manufacturers of drugs, devices, and medical supplies covered by federal health care programs to report to the Centers for Medicare & Medicaid Services any financial interactions with physicians and teaching hospitals.

Reportable interactions include consulting, food, ownership or investment interest, direct compensation for speakers at education programs, and research. Compensation for clinical trials must be reported but is not made public until the product receives FDA approval, or until 4 years after the payment, whichever is earlier. Payments for trials involving a new indication for an approved drug are posted the following year.

Exemptions include CME activities funded by manufacturers and product samples for patient use. Medical students and residents are exempted entirely.

You are allowed to review your data and request corrections before information is posted publicly. You will have an additional 2 years to pursue corrections after the content goes live at the end of June, but any erroneous information will remain online until the next scheduled update, so you should find and fix errors as promptly as possible.

If you don’t see drug reps, accept sponsored lunches, or give sponsored talks, don’t assume that you won’t be on the website. Check anyway: You might be indirectly involved in a compensation that you were not aware of, or you might have been reported in error.

To review your data, register at the CMS Enterprise Portal (https://portal.cms.gov/wps/portal/unauthportal/home/) and request access to the Open Payments system.

The question remains as to what effect the law might be having on research, continuing education, or physicians’ relationships with the pharmaceutical industry. The short answer is that no one knows. The first data posting this past September came and went with little fanfare, and no repercussions directly attributable to the program have been reported as of this writing.

Sunshine laws have been in effect for several years in six states: California, Colorado, Massachusetts, Minnesota, Vermont, and West Virginia, plus the District of Columbia. (Maine repealed its law in 2011.) Observers disagree on their impact. Studies in Maine and West Virginia showed no significant public reaction or changes in prescribing patterns, according to a 2012 article in the Archives of Internal Medicine (now JAMA Internal Medicine).

Reactions from the public are equally inscrutable. Do citizens think less of doctors who accept the occasional industry-sponsored lunch for their employees? Do they think more of doctors who speak at meetings, or conduct industry-sponsored clinical research? There are no objective data. Anecdotally, I haven’t heard a peep – positive, negative, or indifferent – from any of my patients, nor have any other physicians that I’ve asked.

As of now, I stand by my initial prediction that attorneys, activists, and the occasional reporter will data-mine the information for various purposes, but few patients will bother to visit. Of course, that doesn’t mean you should ignore it as well. As always, I suggest you review the accuracy of anything posted about you, in any form or context, on any venue. This year’s data (reflecting all 2014 reports) have been available for review since April 6. You can initiate a dispute at any time over the next 2 years, before or after public release on June 30, but the sooner the better. Corrections are made each time CMS updates the system.

Maintaining accurate financial records has always been important, but it will be even more important now to support your disputes. CMS won’t simply take your word for it. A free app is available to help you track payments and other reportable industry interactions; search for “Open Payments” at your favorite app store.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

When I last wrote about the International Classification of Diseases, 10th Revision (ICD-10) – last year, at about this time – the switchover was scheduled to take place on Oct. 1. Shortly thereafter, of course, Congress decided to delay the inevitable for 1 year. While the House Energy and Commerce Committee has hinted at the possibility of further postponements, we must all assume, until we hear otherwise, that the day of reckoning will arrive as scheduled. You will need to be ready if you expect to be paid come October.

Remember, on Sept. 30 you will be using ICD-9 codes, and the next day you will have to begin using ICD-10. There is no transition period; all ICD-9–coded claims will be rejected from Oct. 1 forward, and no ICD-10 codes can be used before that date. Failure to prepare will be an unmitigated disaster for your practice’s cash flow.

First, decide which parts of your coding and billing systems – and EHR, if you have one – need to be upgraded, how you will do it, and what it will cost. Then, you must get familiar with the new system.

Coders and billers will need the most training on the new methodology, but physicians and other providers must also learn how the new codes are different from the old ones. In general, most differences are in specificity and level of documentation (left/right, acute/chronic, etc.), but there are new codes as well.

I suggest you start by identifying your most-used 20 or 30 diagnosis codes, and then study in detail the differences between the ICD-9 and ICD-10 versions of them. Once you have mastered those, you can go on to other, less-used codes. Take as much time as you need to do this: Remember, everything changes abruptly on Oct. 1, and you will have to get it right the first time.

Be sure to cross-train your coders and other staff members. If a crucial employee quits in the middle of September, you don’t want to have to start from square one. Also, ask your employees to plan their vacations well in advance – and not during the last 3 months of the year. That goes for you, too. This will not be a good time for you to be away, or for the office to run short-staffed.

Next, I suggest you contact all of your third-party payers, billing services, and clearinghouses. Be aggressive; ask them how, exactly, they are preparing for the changeover, and stay in continuous contact with them. Unfortunately, many of these organizations are as behind as most medical practices in their preparations.

Many payers and clearinghouses (including the Centers for Medicare & Medicaid Services) are staging test runs during which you can submit practice claims using the new system. Payers will determine whether your ICD-10 code is in the right place and in the right format; whether the code you used is appropriate; and whether the claim would have been accepted, rejected, or held pending additional information. You will need to do this for each payer, because each will have different coding policies. Many of those policies have not yet been released, and, in some cases, have not even been developed.

You can register for CMS testing sessions through your local Medicare Administrative Contractor (MAC) website. Use the sessions to test your internal system as well, to ensure that everything works smoothly from the time you code a claim until payment is received. Select commonly used ICD-9 claims and practice coding them in ICD-10. The American Academy of Dermatology offers an assortment of training aids at its website, aad.org.

Even the best-laid plans can go awry, however, so it would be prudent to put aside a cash reserve or secure a line of credit to cover expenses during the first few months of the transition, in case the payment machinery falters and large numbers of claims go unpaid. For the same reason, consider postponing major capital investments until early 2016.

You may have heard that ICD-10 is only a transition system; that ICD-11 will be following closely on its heels. I doubt it. In all probability, we will be using ICD-10 a lot longer than CMS originally planned. Besides, ICD-11 is essentially a refinement of ICD-10, not the significant departure that the 10th revision is over the 9th.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

When I last wrote about the International Classification of Diseases, 10th Revision (ICD-10) – last year, at about this time – the switchover was scheduled to take place on Oct. 1. Shortly thereafter, of course, Congress decided to delay the inevitable for 1 year. While the House Energy and Commerce Committee has hinted at the possibility of further postponements, we must all assume, until we hear otherwise, that the day of reckoning will arrive as scheduled. You will need to be ready if you expect to be paid come October.

Remember, on Sept. 30 you will be using ICD-9 codes, and the next day you will have to begin using ICD-10. There is no transition period; all ICD-9–coded claims will be rejected from Oct. 1 forward, and no ICD-10 codes can be used before that date. Failure to prepare will be an unmitigated disaster for your practice’s cash flow.

First, decide which parts of your coding and billing systems – and EHR, if you have one – need to be upgraded, how you will do it, and what it will cost. Then, you must get familiar with the new system.

Coders and billers will need the most training on the new methodology, but physicians and other providers must also learn how the new codes are different from the old ones. In general, most differences are in specificity and level of documentation (left/right, acute/chronic, etc.), but there are new codes as well.

I suggest you start by identifying your most-used 20 or 30 diagnosis codes, and then study in detail the differences between the ICD-9 and ICD-10 versions of them. Once you have mastered those, you can go on to other, less-used codes. Take as much time as you need to do this: Remember, everything changes abruptly on Oct. 1, and you will have to get it right the first time.

Be sure to cross-train your coders and other staff members. If a crucial employee quits in the middle of September, you don’t want to have to start from square one. Also, ask your employees to plan their vacations well in advance – and not during the last 3 months of the year. That goes for you, too. This will not be a good time for you to be away, or for the office to run short-staffed.

Next, I suggest you contact all of your third-party payers, billing services, and clearinghouses. Be aggressive; ask them how, exactly, they are preparing for the changeover, and stay in continuous contact with them. Unfortunately, many of these organizations are as behind as most medical practices in their preparations.

Many payers and clearinghouses (including the Centers for Medicare & Medicaid Services) are staging test runs during which you can submit practice claims using the new system. Payers will determine whether your ICD-10 code is in the right place and in the right format; whether the code you used is appropriate; and whether the claim would have been accepted, rejected, or held pending additional information. You will need to do this for each payer, because each will have different coding policies. Many of those policies have not yet been released, and, in some cases, have not even been developed.

You can register for CMS testing sessions through your local Medicare Administrative Contractor (MAC) website. Use the sessions to test your internal system as well, to ensure that everything works smoothly from the time you code a claim until payment is received. Select commonly used ICD-9 claims and practice coding them in ICD-10. The American Academy of Dermatology offers an assortment of training aids at its website, aad.org.

Even the best-laid plans can go awry, however, so it would be prudent to put aside a cash reserve or secure a line of credit to cover expenses during the first few months of the transition, in case the payment machinery falters and large numbers of claims go unpaid. For the same reason, consider postponing major capital investments until early 2016.

You may have heard that ICD-10 is only a transition system; that ICD-11 will be following closely on its heels. I doubt it. In all probability, we will be using ICD-10 a lot longer than CMS originally planned. Besides, ICD-11 is essentially a refinement of ICD-10, not the significant departure that the 10th revision is over the 9th.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.

When I last wrote about the International Classification of Diseases, 10th Revision (ICD-10) – last year, at about this time – the switchover was scheduled to take place on Oct. 1. Shortly thereafter, of course, Congress decided to delay the inevitable for 1 year. While the House Energy and Commerce Committee has hinted at the possibility of further postponements, we must all assume, until we hear otherwise, that the day of reckoning will arrive as scheduled. You will need to be ready if you expect to be paid come October.

Remember, on Sept. 30 you will be using ICD-9 codes, and the next day you will have to begin using ICD-10. There is no transition period; all ICD-9–coded claims will be rejected from Oct. 1 forward, and no ICD-10 codes can be used before that date. Failure to prepare will be an unmitigated disaster for your practice’s cash flow.

First, decide which parts of your coding and billing systems – and EHR, if you have one – need to be upgraded, how you will do it, and what it will cost. Then, you must get familiar with the new system.

Coders and billers will need the most training on the new methodology, but physicians and other providers must also learn how the new codes are different from the old ones. In general, most differences are in specificity and level of documentation (left/right, acute/chronic, etc.), but there are new codes as well.

I suggest you start by identifying your most-used 20 or 30 diagnosis codes, and then study in detail the differences between the ICD-9 and ICD-10 versions of them. Once you have mastered those, you can go on to other, less-used codes. Take as much time as you need to do this: Remember, everything changes abruptly on Oct. 1, and you will have to get it right the first time.

Be sure to cross-train your coders and other staff members. If a crucial employee quits in the middle of September, you don’t want to have to start from square one. Also, ask your employees to plan their vacations well in advance – and not during the last 3 months of the year. That goes for you, too. This will not be a good time for you to be away, or for the office to run short-staffed.

Next, I suggest you contact all of your third-party payers, billing services, and clearinghouses. Be aggressive; ask them how, exactly, they are preparing for the changeover, and stay in continuous contact with them. Unfortunately, many of these organizations are as behind as most medical practices in their preparations.

Many payers and clearinghouses (including the Centers for Medicare & Medicaid Services) are staging test runs during which you can submit practice claims using the new system. Payers will determine whether your ICD-10 code is in the right place and in the right format; whether the code you used is appropriate; and whether the claim would have been accepted, rejected, or held pending additional information. You will need to do this for each payer, because each will have different coding policies. Many of those policies have not yet been released, and, in some cases, have not even been developed.

You can register for CMS testing sessions through your local Medicare Administrative Contractor (MAC) website. Use the sessions to test your internal system as well, to ensure that everything works smoothly from the time you code a claim until payment is received. Select commonly used ICD-9 claims and practice coding them in ICD-10. The American Academy of Dermatology offers an assortment of training aids at its website, aad.org.

Even the best-laid plans can go awry, however, so it would be prudent to put aside a cash reserve or secure a line of credit to cover expenses during the first few months of the transition, in case the payment machinery falters and large numbers of claims go unpaid. For the same reason, consider postponing major capital investments until early 2016.

You may have heard that ICD-10 is only a transition system; that ICD-11 will be following closely on its heels. I doubt it. In all probability, we will be using ICD-10 a lot longer than CMS originally planned. Besides, ICD-11 is essentially a refinement of ICD-10, not the significant departure that the 10th revision is over the 9th.

Dr. Eastern practices dermatology and dermatologic surgery in Belleville, N.J. He is the author of numerous articles and textbook chapters, and is a longtime monthly columnist for Dermatology News.