FTC Mandates Vendors Notify Patients of Breaches

The Federal Trade Commission (FTC) has amended its Health Breach Notification Rule to require vendors of personal health records (PHR) and related entities not covered by HIPAA to notify individuals, the FTC, and, at times, the media, when a breach in protected health information (PHI) occurs. The change will take effect July 29. 

Physicians do not have to notify patients if their PHI is leaked via a PHR vendor that is not a business associate of the physician. That responsibility falls to the vendors themselves.  

Network Adequacy Waiver Hearings

TDI will hold virtual public hearings to consider insurers' requests to waive network adequacy standards. Health care providers and consumers can share information for TDI's consideration.

G-Code Frustration

Deepening ongoing physician concerns over the implementation of Medicare’s add-on code for complex care, two major payers have either reduced payment for G2211 claims or announced plans to stop paying certain claims associated with the code altogether for particular plan members.

Cyberattack Added to MIPS Hardship Exemption

Due to the ongoing impact of the Change Healthcare cyberattack on an increasing number of physician practices, the Centers for Medicare & Medicaid Services (CMS) has added an option to cite the cyberattack when requesting a hardship exemption within the 2024 Merit-based Incentive Payment System (MIPS).

CMS has added the option to the Extreme and Uncontrollable Circumstances (EUC) application. The 2024 MIPS EUC portal is now open, and physicians have until Dec. 31 to file a hardship application and avoid a 2026 MIPS negative payment adjustment

Avoid Medicaid Disenrollment

Physicians Must Validate Email to Avoid Medicaid Disenrollment, Payment Delays
By Emma Freer

Texas Physicians who care for Medicaid patients should confirm their email address is valid in the Texas Medicaid and Healthcare Partnership’s (TMHP’s) Provider Enrollment Management System (PEMS) to ensure effective communication and timely payments from the state Medicaid administrator. 

Without a valid email address on file in PEMS, clinicians will not receive online correspondence from TMHP, including reminders regarding their upcoming revalidation due dates, or be able to start a revalidation request, among other consequences.

Clinicians who fail to complete their respective revalidations by their given due dates will be disenrolled from Medicaid.

For step-by-step instructions on how to add and verify your email address in PEMS, check out TMHP’s handout.

TMHP also encourages clinicians to add the “TMHP.com” domain to their safe senders list in their email system and to avoid unsubscribing from TMHP emails.  

For more information, reach out to TMHP via email or by calling (800) 925-9126.

Virtual Vigilance

“The Change outage was disruptive to the business of my practice, but most importantly it was disruptive to my patients,” Dr. Bruggeman testified. “Every minute my staff spent trying to reconcile [electronic remittance advice] with received payments, assessing which patients received incorrect bills, [and] resubmitting prior authorizations is time taken away from patient care.”

Robust Cybersecurity Can Safeguard Practices
By Alisa Pierce Texas Medicine June 2024

Data held hostage 


. . . cautions that ransomware attacks can be delivered via multiple platforms, such as in email attachments or links within an email. Malicious attachments can include documents, zip files, and executable applications, and suspicious email links can bring users directly to websites that are used to place malware on a system.  

Similarly, “phishing” email scams can give hackers access to internal business systems that could reveal confidential information like credit card numbers, personal identity data, and passwords. Often these emails appear to come from real companies or trusted individuals. 

From there, hackers steal electronic patient data, even encrypted information; block the practice from accessing it; and demand a ransom for its return, much like “a hostage situation,” according to Shannon Vogel, TMA’s associate vice president of health information technology. 

If that data aren’t backed up, practices don’t have much leeway. At that point, they can either hope the data can be retrieved by law enforcement or move forward without patient records.  

“It’s vital that practices talk to their [electronic health record] and other vendors about redundant systems so that all is not lost,” Ms. Vogel said. “Otherwise, it would be like starting from scratch.” 

UHC Notably Absent from Congressional Hearing

Quotes from Texas Medicine 4/19/2024, Emma Freer Article

“The attack has exposed the vulnerability in our health care system and the disproportionate burden placed on physician practices by insurers, government payers, and third-party vendors,” Dr. Bruggeman told lawmakers.

“The Change outage was disruptive to the business of my practice, but most importantly it was disruptive to my patients,” he said. “Every minute my staff spent trying to reconcile [electronic remittance advice] with received payments, assessing which patients received incorrect bills, [and] resubmitting prior authorizations is time taken away from patient care.”

“To add insult to injury, some of these practices were purchased by Optum during the crisis,” he said. “There were even reports of Optum using the financial emergency caused by the cyberattack on its own subsidiary as legal justification to expedite its acquisition of physician practices.” 

In the meantime, Dr. Bruggeman called on Congress to pass legislation that would insulate physician practices from industry consolidation and other existential threats. 

“Allowing physicians to practice in the setting that is best for them, their patients, and the broader community should be the hallmark of our United States health care system,” he said. “Instead, the increase in administrative burden, including the new threat of potential cyberattacks, makes such events catastrophic for many providers.”

For the full very interesting article: https://www.texmed.org/TexasMedicineDetail.aspx?id=64062&utm_campaign=TMT&utm_medium=email&_hsenc=p2ANqtz-9E4jpFAqBr1fYThi6pjc3ECIrkJtF4-urerPcLF78JmZ4BixUPkxoA-ngiRvbPx06ORd5U2bsbiOEFK-CaqUP6-URb8jMZ6SEHyZL-aPXwfFmCQ9w&_hsmi=303492305&utm_content=303492305&utm_source=hs_email

Reduced 2024 Medicare Physician Pay Cut Now in Effect.

Thanks to the passage of a new federal spending bill, the 3.4% Medicare physician pay cut that took effect on Jan. 1 was reduced to 1.68% as of March 9. This reduced cut and the corresponding new conversion factor of $33.2875 will remain in effect through Dec. 31.

Putting Patient Care Before Paperwork

  • Do you spend two hours completing documentation and EHR management for every one hour of treating patients?
  • Do you feel Administrative work is causing increased burnout? 
  • Are you completing EHR work at home?
  • Are you looking to take steps to reduce the myriad of bureaucratic burdens?

Receive More Accurate Payment for Medicare Complex Visits.

The new code will take effect Jan. 1, 2024. The 2024 Medicare Physician Fee Schedule allows physicians to list G2211 in addition to codes used in-office or outpatient visits for new or established patients (i.e., 99202-99215). Physicians can also use it for telehealth visits.  

 Texas Medical Association continues to push for additional guidance as confusion over the code’s use persists.