Authored by: Phallynn Espinoza
Patient health information (PHI) and offshoring regulations have been present for many years, but recently, several states have tightened their rules.
Texas, for example, recently passed regulations requiring Medicaid and Medicare claims to be handled stateside. Florida followed suit with tighter restrictions but focused on ePHI – how it can be accessed and how it is stored.
As more states pass regulations around revenue cycle offshoring and ePHI, many medical practices find themselves not fully up to speed on the changes and the potential implications. Here are a few pointers to set you on the path to stronger preparedness.
Revenue cycle outsourcing: Diving into uncharted territory
As new rules roll out, there are more questions than answers and gray areas persist. For example, as states rewrite regulations around the management and handling of PHI, new questions emerge about what constitutes “storing data.” If you have a website or web-based software application and a third-party employee opens it in India, cookies are stored. Technically, this means data is stored in another country. Does this constitute breaking a regulation?
Implications could also extend to areas such as customer service and billing support. Many third-party billing companies have call centers that allow patients to call and inquire about their bills. When using a third-party vendor, those functions could reside offshore. In this scenario, you now have contractors in another country accessing and viewing ePHI data; depending on your state, this scenario might constitute a compliance violation.
But here’s something else to consider: You might be breaking regulations without even knowing it.
I recently heard of a case where a third-party billing provider had most of their billers stateside. But that changed, and the company didn’t notify its customers. When customers discovered the offshoring practice, the partner disclosed it had an office in India where employees worked on-site in a location with high security standards. However, it was later determined that offshored employees worked at home, accessing ePHI. Presumably, with less oversight and less security. In some states, this may constitute a violation.
The potential impacts of offshoring and RCM management
As offshoring regulations evolve, many third-party billing companies aren’t moving fast enough or don’t have a solid plan to pivot.
Texas, for example, might arguably be one of the easiest states in which to litigate due to its strict new regulations. A medical practice using third-party support to process Medicaid and Medicare claims offshore in this state could quickly find themselves out of compliance.
And technically, compliance is the responsibility of practices. That being said, a third-party vendor that isn’t compliant in your state could be in breach of their contract with a practice. If the practice gets audited, they might go back to the third-party vendor with a breach of contract claim. But of course, that takes time, money, and resources – and is stressful. And practices don’t want to be in this situation.
Should you still use revenue cycle outsourcing?
Revenue cycle management outsourcing can help to improve efficiency and productivity. But as you move forward, I would recommend revenue cycle outsourcing that has compliance trends in mind.
Ask an existing partner (or a new one) how they handle evolving regulations. You could even get specific, asking whether they have clients in Texas or Florida and how they navigate the changes in those states and other states with different regulations.
Also, if a partner makes changes, such as implementing offshoring, does it have a policy for communicating changes to existing clients? Do they check state regulations regularly? You’ll want to know their internal processes.
And keep in mind that plenty of companies don’t offshore at all and have a fully stateside team.
Do you need support outsourcing revenue cycle management? Let us know – we can help!