Transportation Provider Compliance Training

1. Transportation Provider Compliance Training

2. Fraud, waste and Abuse (FWA)

3. FWA Training Purpose • We are all responsible for preventing and reporting suspected cases of Fraud, Waste, and Abuse (FWA) without fear of punishment • Training will give you basic information necessary to understand what FWA is and what your obligations are if you suspect it is happening • By looking out for FWA, we protect Federal funding given to Medicaid and Medicare programs for NEMT

4. Agenda • Centers for Medicare and Medicaid Services (CMS) • What is FWA: Laws and Regulations • MTM’s Quality and Compliance Department • HIPAA, PHI, and DUA

5. CMS • Centers for Medicare and Medicaid Services, also referred to as CMS: • An agency within the US Dept. of Health and Human Services • Responsible for several health care programs and rules regarding FWA that must be followed by MTM, First Tier, Downstream and Related Entities • Providers, drivers and office staff

6. MTM and CMS • MTM partners with Medicare and Medicaid clients • Clients are required by CMS to conduct FWA training with: • Transportation Providers • Drivers • Office Staff • As MTM clients are regulated by CMS, so are MTM employees and its subcontractors (transportation providers) • Documentation of annual FWA training must be maintained and available to CMS and MTM clients when requested

7. FWA: What is Fraud? • An intentional deception or misrepresentation made by a person with knowledge that deception could result in unauthorized benefit to himself or another person • Includes any act that constitutes fraud under applicable Federal and State laws

8. FWA: What is Waste? • Overutilization of services or other practices that result in unnecessary costs • Generally not caused by criminally negligent actions but rather misuse of resources

9. FWA: What is Abuse? • Defines ways that, either directly or indirectly, result in unnecessary costs to the Medicare or Medicaid Program • Reimbursement for unnecessary services or services that fail to meet professionally recognized standards for healthcare

10. FWA Laws and Regulations • Suspected violations of: • False Claims Act; 31 U.S.C. §3729 • Law prohibits incorrect claims from being submitted to Medicare and Medicaid • Stark Law • Law was written to prevent doctors and other clinicians from referring patients to their own practices (physician self-referral) • Anti-Kickback Statute • Law keeps doctors, hospitals and other clinicians from offering or receiving kick-backs for referring patients to certain practices

11. FWA Laws and Regulations • Acts defined in 18 U.S.C. - HITECH Act of 2009 which widened scope of privacy and security protections available under HIPAA • Health Insurance Portability and Accountability Act (HIPAA) • State-specific laws and regulations that address Medicaid/Medicare FWA - Laws that a state implements that are more strict than the federal privacy law

12. FWA: Your Obligations • Comply with all policies and procedures developed and amended by MTM in relation to FWA • Acknowledge that payments made to you consist of Federal and State funding • You may be held civilly/criminally liable for non-performance or misrepresentationof FWA services • Immediately refer all suspected or confirmed FWA to MTM’s Quality and Compliance department - 1-866-436-0457

13. Examples of Member FWA • Changing, forging, or altering: • Prescriptions • Medical records • Referral forms • Lending insurance card to another person • Identity theft • Using NEMT for non-medical services • Misrepresenting eligibility status • Resale of medications to others • Medication stockpiling • Doctor shopping

14. Resolution Options for Member FWA • Add a note to member’s file advising MTM for future trips • Add member’s name to a list of frequent abusers • Trip requests will be monitored and managed to prevent potential future FWA • Report issue to MTM's client liaison, who will determine the best way to report to other entities

15. Examples of Provider FWA • Falsifying credentials • Billing for services not rendered • Inappropriate billing • Double billing • Fraudulent billing • Collusion among providers • Falsifying information submitted through prior authorization or other mechanism to justify coverage

16. Resolution Options for Provider FWA • MTM's investigations specialists will determine which, if any, of the following actions are appropriate • Recover trip cost • Provide education • Make recommendation for an audit of trip records • Establish Corrective Action Plan (CAP) • Disciplinary action • Dismissal from MTM network of providers

17. Who is Responsible for Identifying FWA?

18. Who Monitors FWA at MTM? • Potential cases reported to MTM’s Quality and Compliance department • Quality Investigation Specialist investigates each reported incident • Note results of investigation in member’s file • FWA reported against Transportation providers, drivers, and office staff are handled in the same manner • MTM reports incidents of FWA to clients on a monthly basis

19. Preventing FWA • Preventing FWA before it happens is critical • Transportation providers should report incidents of FWA they suspect to MTM’s Quality Management department immediately Report all cases of suspected FWA to MTM immediately

20. Preventing FWA • MTM staff are diligent and watch carefully for signs of potential FWA • Deny a trip if it seems “suspect” • Push trip request up internal chain of command to Team Lead • Contact client and get their guidance • Report suspicious activity to Quality Management department for investigation

21. Reporting FWA • Contact MTM’s Quality Management department • 1-866-436-0457 • Try to include all pertinent information:

22. Corporate Compliance Hotline • MTM has a Compliance Hotline to report unethical or illegal behavior in an anonymous and confidential manner • Types of issues that may be reported to the hotline include inappropriate billing practices, falsified credentialing documentation, violations of HIPAA or informational security standards, or other unethical or illegal practices

23. FWA Reporting Protections • Whistleblowers offered protection against retaliation under the False Claims Act • Employees discharged, demoted, harassed, or otherwise discriminated against for reporting FWA are entitled to protection under the False Claims Act

24. FWA Conclusion • Training has given you: • Knowledge about what FWA is and why it is important to identify cases of suspected FWA • Tools necessary to feel confident in reporting suspected FWA without fear of reprisal • Understanding of why MTM requires training • Knowledge that everyone is responsible for reporting FWA • Knowledge that preventing FWA is critical—stop it before it happens

25. Health insurance portability and accountability act (HIPAA)

26. HIPAA Privacy Rule • Ensures consistent protection nationwide for all health information • Imposes restrictions on use and disclosure of Protected Health Information (PHI) • Gives people greater access to their own medical records • Provides people with more control over health information

27. HIPAA Background

28. Protected Health Information (PHI) • PHI is individually identifiable health information that is: • Transmitted or maintained in electronic media • Transmitted or maintained in any other form or medium • When an MTM member, agency, or health provider gives personal information to MTM, that information becomes PHI

29. Examples of PHI

30. HITECH Act • HITECH Act promotes the adoption and meaningful use of health information technology

31. HIPAA Expectations • Use or disclose PHI only for work related purposes • Exercise reasonable caution to protect PHI under your control • Understand and follow MTM privacy policies • Report potential HIPAA violations to MTM’s Quality and Compliance department

32. Use or Disclosure of PHI • HIPAA's privacy rule covers how we can use or disclose PHI • Designed to minimize careless or unethical disclosure • PHI can’t be used or disclosed unless it is permitted or required by the Privacy Rule

33. Use vs. Disclosure • PHI is used when it is: • Shared • Examined • Applied • Analyzed • PHI is disclosed when it is: • Released/transferred • Accessed in any way by any one outside entity holding information

34. Use or Disclosure of PHI • Payment: Various activities of healthcare and healthcare related providers (such as you) to obtain payment or be reimbursed for services

35. Use or Disclosure of PHI • Transportation Providers permitted to use or disclose PHI for: • Scheduling trip information • Confirming special needs or adaptive equipment • Incidental use such as talking to a facility or medical provider

36. Minimum Necessary • Use or disclosure of PHI should be limited to minimum amount of health-related information necessary to accomplish intended purpose of use or disclosure • MTM has developed policies and procedures to make sure least amount of PHI is shared If you have no need to review PHI, then stop!

37. Data Use Agreement (DUA)

38. Data Use Agreement DUA • The Data Use Agreement (DUA) is an agreement between MTM, MTM’s clients, and MTM’s subcontractors • This agreement states that all information obtained by transportation providers including PHI will remain confidential and will be disposed of properly

39. Data Use Agreement DUA • DUA applies to all MTM employees, transportation providers, and drivers who have access to confidential client information

40. Transportation Provider Responsibilities • Transportation provider will secure access to all clients’ confidential information and ensure that it is only used in a manner that is approved under the DUA • Transportation provider is required to secure any form of paper documentation that contains client PHI • Transportation provider is required to secure mobile devices by a PIN number or equivalent security that contains client PHI

41. Transportation Provider Responsibilities • Transportation providers will establish appropriate penalties against any member of its workforce that violates the sharing of client information • Responsible for compliance with sending and destroying of confidential information

42. Transportation Provider Responsibilities • Transportation providers will deliver written certification of compliance when requested • Upon termination, the transportation provider is required to retain documentation pursuant to contractual obligations

43. Transportation Provider Responsibilities • Transportation providers will designate a person to implement the security requirements of the DUA

44. Transportation Provider Responsibilities • Transportation providers assure that their employees/drivers are only provided information as needed to complete job requirements • Transportation providers must have and maintain a list of employees/drivers, and their signatures, titles, and the date they agreed to the terms of the DUA

45. Transportation Provider Responsibilities • Transportation providers will adhere to the policies and procedures relating to the use of confidential information as set forth in the DUA, the Business Associate Agreement and the Medical Transportation Service Agreement

46. Transportation Provider Responsibilities • All data transferred and communicated will be through secure systems • A completed ‘DUA Agreement’ is required and maintained with MTM • A completed ‘DUA Authorized User List’ is maintained and regularly updated for users accessing data

47. What is a Breach of the DUA? • Any incident where PHI is used in an unsecure or unauthorized manner • Accessing client information that is not job related • Sharing client information over social media, text, or screen shots • Disposing of trip sheets in the trash of a public place

48. What is a Breach of the DUA and HIPAA? • Lending your mobile device that contains client information • Emailing or storing client information in the cloud in an unsecured manner

49. If a Breach is Suspected • Transportation providers will cooperate fully with MTM in investigating any breach of confidential information • Transportation providers have no more than 24 hours after discovery of a breach to report the event or breach of the security policy to MTM

50. DUA Guidelines • DUA is effective on the date of execution • All DUA users must be on the authorized user list • The DUA ends upon termination of the Service Agreement with the exception of retention provisions