Identity Theft Compliance for Healthcare Providers Technology dominates our daily existence more than ever. From online banking, to Internet shopping, to web-based applications, to electronic patient records, we depend upon technology personally and professionally. Much of this electronic data contains information we would not want to share with a large population. In the wrong hands, some of this information could allow an unscrupulous individual to steal our identities. However, they must include reasonable policies and procedures that accomplish the following: What should you include when establishing a healthcare Red Flag Program? Wolters Kluwer Financial Services recommends the following steps in putting together a solid program: Once the team has been identified and the policies and procedures documented, you will need to train your staff and establish an effective oversight and monitoring mechanism. A communications plan must be developed to ensure everyone is aware of the rules and to provide appropriate feedback to those who need to be reminded. Remedial training should be provided and disciplinary action taken, if necessary. Insights Patient Access can implement several processes to detect Red Flags. The first, and most important, is to verify all information with the patient when completing a pre-registration or registration. Be sure to review and make copies of all insurance cards and drivers' licenses (or other form of picture ID) to confirm a patient's identity. Create tools for staff members that help them remember to look and confirm the patient's address, phone number, and the social security number on the account, compared to the ID cards, and other documentation the patient provides in person. There must be a quick and easy protocol enabling staff members to confidentially report instances of possible fraud without creating a confrontational situation with the person seeking care. Tools Summary Yours very truly,
In order to protect identities, the Federal Trade Commission (FTC) has issued its Red Flag Identity Theft Rules. Although the deadline for compliance has been amended, healthcare providers will have to comply with the rules by May 2, 2009. To meet this deadline, providers should begin preparing now.
In 2007 the FTC reported over 258,000 complaints of identity theft. Of the top five types of fraud reported, identity theft is number one. A recent survey estimated that three percent of identity theft victims had their personal information used to obtain medical services.
The new Red Flag Identity Theft Rules became effective January 1, 2008, with a compliance date of November 1, 2008. Due to confusion regarding which entities were governed by these rules, an extension was provided to financial institutions, which must now be compliant by May 2, 2009. The Red Flag Identity Theft Rules were developed with the intent to prevent identity theft by requiring financial institutions to establish reasonable procedures to combat this crime. These rules are meant to protect both the consumer and the provider of goods and/or services.
Initially, many healthcare providers questioned whether these new rules applied to them. Since most healthcare providers extend credit or hold consumer accounts (i.e. provide service and bill the consumer/patient), they do fall under the provisions of the new regulations. Some healthcare providers offer bank financing programs to assist patients in paying large balances. Financial Counselors and Patient Accounting staff may access credit reports to validate information provided on Financial Assistance applications, and to assess a patient's assets prior to approving payment plans or charity care applications. These and other revenue cycle activities qualify providers for inclusion under the rules.
Challenges
The new rules give providers flexibility in developing their Red Flag Identity Theft programs, allowing them to consider their relative organizational size and complexity in the development of their programs.
Create a Red Flags Team. Per the regulations, this must consist of the following:
For most healthcare providers, the Patient Access Department and the Patient Accounting Department will feel the greatest impact of these rules. Patient Access typically has a high staff turnover percentage, which makes training a greater challenge. The following should be included in a program for registration:
Emergency Departments are already one of the highest-risk areas in a hospital, relative to financial exposure, but they also have the highest probability of being victimized by identity theft. Hospitals must ensure they develop a process to review accounts at checkout, and must have a methodology that helps them identify repeat offenders. Communication with the Patient Accounting Department is essential in preventing ongoing fraud.
Numerous software vendors provide tools to help verify a patient's identity and discourage fraud. Many vendors offer address verification software that works in conjunction with the United States Postal Service database, credit reporting agencies, and credit card vendors. This technology allows address verification to occur during all phases of the Patient Access process, and gives the provider the opportunity to stop a possible identity theft prior to services being rendered.
Most healthcare providers today have already implemented processes that could lead to detection of possible identity theft situations, but the new regulations provide better guidelines and encourage the development and/or utilization of tools to better protect our patients. The key is to communicate clearly and consistently with Patient Access, Patient Accounting, and other appropriate provider staff, so they understand what "Red Flags" to watch for, and what to do when they detect something suspicious. Developing communication material that explains your Identity Theft Prevention Program to your patients will also help them feel more comfortable when Patient Access staff members ask for personal identification information. Many patients today do not want to provide their social security information or picture IDs, so providers need to be proactive in furnishing them with information that explains what the provider is doing to help protect them from identity theft.
Compliance with the Red Flag Identity Theft Rules is not optional. Any healthcare provider whose practices may be construed to include extension of credit or holding consumer accounts is obligated to comply with the regulation by May 2, 2009. By initiating and properly implementing your Red Flag Program over the next few months, you will ensure timely compliance and better protection for your patients.
We are pleased to have had the opportunity to provide this information to you. If you have any questions or need assistance in developing a Red Flag Program, please contact either Becky Peters, Consulting Manager, at 970-846-8557 or me at 610-517-1386.
Kim Hollingsworth
Partner
IMA Consulting