We are already more than halfway through 2017 and there is a lot going on in the pharmacy world. Independent pharmacy owners have seen a huge increase in what they need to have in place in terms of paperwork and trainings. It has all started with HIPAA- it never seems to go away. HIPAA has grown into a giant beast since it first went into effect in 2003. In the event that this giant beast attacks, this post will guide and prepare your pharmacy for its best chance of survival!
Surviving Desk Audits and On-site Inspections
The Office of Civil Rights (OCR) enforces HIPAA and have been increasing desk audits and on-site inspections drastically. A desk audits is a HIPAA audit requesting you submit certain items for federal review. These include:
- Specific Policies & Procedures OCR will request
- Risk Analysis
- Risk Management Plan
- Disaster Recovery Plan
- Annual Assessments for both Privacy and Security
- Breach Notification
Survival Scenario: On-site Inspections
An OCR inspector comes into the pharmacy to check in. When an inspector comes into the pharmacy they tend to go to the front counter and ask the first employee they see for the Notice of Privacy Practice. The employee's reaction will help the OCR inspector determine if the employee has been properly trained. Also, they are checking that this document is in the correct format, readily available and dated after July 1, 2013. Sometimes that is all the inspector requests, but there are also times when the inspector will go into a deeper phase of the inspection. When this occurs, the inspector will show you their credentials and ask to inspect your Risk Analysis, Risk Management Plan and your Disaster Recovery/Contingency Plan. If these documents are on hand and your employees are properly trained, this is where the on-site inspection typically concludes. However, if an employee is improperly trained or you do not have the requested documents available the beast will attack. You will most likely spend the rest of your day with the inspector. They will ask for all HIPAA policies & procedures.
Some questions you may be asked:
- Do you have a policy & procedure for privacy safeguard?
- Or Uses and Disclosures for law enforcement?
- Is the patient requesting a restriction of uses and disclosures?
All these policies are mandated and you need to update them properly. Your staff should be able to comprehend each policy & procedure and be able to perform the task. Properly training all of your staff for on-site inspections is crucial, even if you have all of your documents in place. Neglecting to do so can result in an immediate fine of $1,000, but HIPAA fines can rack up to 1.5 million dollars. So employee training is an essential aspect of your pharmacy; you need to make sure you have taken care of this requirement. That’s the biggest thing with enforcing HIPAA.
Surviving Attestations
Attestations are when you have to certify that you have completed your Fraud, Waste and Abuse (FWA) and HIPAA compliance trainings. As well as document that you run your OIG exclusion verifications every month and your conflict of interest certifications are signed. Attestations usually come in the fall from all Part D carriers. When you receive these it is important to complete them promptly and accurately.
Surviving Credentialing
Credentialing comes out of Medicare Part D. CMS has given Part D enforcement and oversight to the Pharmacy Benefit Manager (PBM). The PBMs all have different processes, but essentially they are going to request documentations- specifically policies and procedures.
Do you have a policy & procedure for:
- Usual customary?
- Recall procedures?
- Expiration of your medications?
There are approximately 35 policies that PBMs can ask for.
Survival Scenario: Credentialing Notices
When you get these credentialing notices, they are sent by mail, fax, or email. The key thing is to address them immediately. The PBM will give you anywhere from 30 to 45 days to respond. You must get them completed quickly.
Make sure you have:
- Your Surety bond
- Your certificates of liability insurance
- Your pharmacy licenses
- Your pharmacist’s licenses
CVS Caremark is the worst as far as volume of documents. If you have all the documentations, it will take you a couple of hours just to gather it. You cannot have a policy that you borrowed from elsewhere, it has to be implemented.
When auditors come into the pharmacy, they will want to know what your processes are, and that your policies & procedures are compliant. When credentialings are sent to the pharmacy do not put them off till later; get your staff to help you. Start making copies of various documents; do not just do it for one. When you start doing them, save those documents for the next credentialing requirement.
Top 3 Survival Tips for Pharmacy Hurdles in 2017
I. Training, Training, Training
- Ensure that every staff member is properly trained
“A chain is only as strong as its weakest link” – Mark Grey
II. Complete tasks IMMEDIATELY
- Do not let your responsibilities pile up, or audits and inspections will become more daunting
“Never put off till tomorrow what you can do today” – Ben Franklin
III. Organization is key
- When an auditor comes you don’t want to be fined due to disorganized documentation
“For every minute spent in organizing, an hour is earned” – Ben Franklin
Still Not Confident on Your Chances of Surviving these Hurdles? R.J. Hedges & Associates can be Your Guide!
R.J. Hedges & Associates provides compliance and accreditation experts who can equip you with programs that are guaranteed to make life easier for you when the audits come around.
We have pharmacy compliance programs for:
- Pharmacy
- Compounding
- HIPAA
- Diabetic Shoes
- DMEPOS/Medicare
- FWA Prevention
- Immunizations
Go to www.RJHedges.com to find out more
Or contact us at 724-357-8380 to talk with one of our strategists
We are here to keep you stress free and in compliance!™
