Important News for your Practice

(631) 403 6687

Visit our website

January 16, 2019

Missing Business Associate Agreement Results in $500,00 fine

Florida-based Advanced Care Hospitalists was fined $500,000 by the Office for Civil Rights for multiple HIPAA compliance failures, including sharing protected health information with an unknown vendor.

The OCR investigation determined that ACH never entered into a business associate agreement with First Choice as required by HIPAA.

ACH was founded in 2005, but the company failed to conduct a risk analysis until March 4, 2014. Even with that Risk Analysis, they failed to implement a Risk Mitigation plan.

“This case is especially troubling because the practice allowed the names and social security numbers of thousands of its patients to be exposed on the internet after it failed to follow basic security requirements under HIPAA,” OCR Director Roger Severino said in a statement.

A copy of the resolution agreement that ACH signed with the Department of Health and Human Services can be found HERE

All TLD customers can locate their Risk Mitigation Plan on their dashboard. Make sure you log into your account, know what is in your Risk Mitigation Plan and take steps to implement that plan

HIPAA UPDATES

‌

I am pleased to announce that we now have introduced a special program for PICA policyholders.

As of January of this year, all PICA policyholders are eligible for a discount of 10% off our regular fees. To get your 10% discount all you need to do is fill out a form that demonstrates you are a PICA policy holder.

Please note, we will verify your status as a PICA policyholder and by filling out and submitting the form you are granting TLD Systems permission to share your information with PICA for the purposes of verification.

To request the 10% discount for PICA policy holders please fill out this form.

Updates from TLD Systems

Security Updates

This section contains information you will want to share with your IT staff and IT consultants.

SamSam Ransomware

The Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) and the Federal Bureau of Investigation (FBI) are issuing this activity alert to inform computer network defenders about SamSam ransomware, also known as MSIL/Samas.A. Specifically, this product shares analysis of vulnerabilities that cyber actors exploited to deploy this ransomware. In addition, this report provides recommendations for prevention and mitigation.

Cyber Actors Target Home and Office Routers and Networked Devices Worldwide

Cybersecurity researchers have identified that foreign cyber actors have compromised hundreds of thousands of home and office routers and other networked devices worldwide The actors used VPNFilter malware to target small office/home office (SOHO) routers. VPNFilter malware uses modular functionality to collect intelligence, exploit local area network (LAN) devices, and block actor-configurable network traffic. Specific characteristics of VPNFilter have only been observed in the BlackEnergy malware, specifically BlackEnergy versions 2 and 3.

Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices

Update: On April 19, 2018, an industry partner notified NCCIC and the FBI of malicious cyber activity that aligns with the techniques, tactics, and procedures (TTPs) and network indicators listed in this Alert. Specifically, the industry partner reported the actors redirected DNS queries to their own infrastructure by creating GRE tunnels and obtained sensitive information, which include the configuration files of networked devices.

Upcoming CME Online Webinars

We are pleased to announce that CMEonline has been approved by the Council on Podiatric Medical Education to be a Provider of Continuing Education in Podiatric Medicine.

Some of the presentations may be eligible for CEU credits. As programs are developed that are eligible for credits they will be posted here and the links will have all of the relevant details for the educational offering.

Annual HIPAA Training for Doctors and Staff

HIPAA requires that all staff members who come into contact with patient information have annual training. We provide this training free to all of our clients.

If you have a new employee they must be trained within 30 days of starting work. Employeed who have had previous training need to have repeat training annually.

This training webinar is presented monthly so that your office can stay compliant with this HIPAA regulation.

Upcoming HIPAA Training Webinars:

Tuesday Jan 22 at 6 PM EST

Tuesday Feb 19 at 12 noon EST

Blood Borne Pathogen Training

OSHA requires annual training in Blood Borne Pathogens.

“Bloodborne pathogens” means pathogenic microorganisms that are present in human blood and can cause disease in humans. These pathogens include among others hepatitis B virus (HBV), which causes hepatitis B; human immunodeficiency virus (HIV), which causes AIDS; hepatitis C virus and other pathogens, such as those that cause malaria. Proper precautions are necessary to prevent the spread of these diseases to both patients and health care workers. Objectives : Learn how to minimize the occurrence of needlestick injuries Understand Universal Precautions Learn how to keep your practice safe for both patients and health care workers

Upcoming Blood Borne Pathogen Training Webinar:

Thursday Feb 28 at 7 PM EST

Coding Pearls

The Proper Billing, Coding and Documentation for Skin Biopsies

Since we are on the cusp of a new calendar year, this article will be geared to the appropriate billing, coding and documentation for skin biopsies for 2019.

Before discussing the actual biopsy procedures, I feel that it is important to understand the various definitions and techniques that are utilized to perform skin biopsies. In 2019, these will directly impact the CPT code that is selected for the procedure that is performed.

Biopsy: When a designated biopsy procedure code is billed (ie. 11102, 11103, 11104, 11105, 11106, 11107), the procedure is performed for one reason only. That is to obtain tissue for a diagnostic, histopathologic examination. This procedure is distinct or unrelated from other procedures that were performed at the same time. If biopsies are performed on different lesions or at different sites on the same date of service, they may be reported separately. They are not considered to be components of other procedures.

When certain procedures are performed on the skin such as excision, destruction or shaving, the suspect tissue that is removed is often submitted for pathological analysis. The obtaining of specimens for pathological analysis during the course of these procedures is considered a component part of these procedures and is not separately reimbursable.

The purpose of the procedure must always be clearly indicated.

Partial thickness biopsy : This type of biopsy is utilized to sample a portion of the skin that does not penetrate below the dermis.

Full thickness biopsy: This type of biopsy is utilized to sample a portion of the skin deep to the dermis into the subcutaneous tissue.

Tangential biopsy (eg. shave, scoop, saucerize, curette): This type of biopsy is performed using a sharp blade (ie. flexible biopsy blade, obliquely oriented scalpel, curette). The purpose of this type of biopsy is to obtain a tissue sample from a designated lesion purely for a diagnostic, pathologic examination. This type of biopsy entails the removal of a superficial sample and does not involve the full thickness of the dermis.

Punch biopsy : This type of biopsy is performed using an instrument to remove a full thickness, cylindrical sample of the skin. The intent of this biopsy is to obtain a cylindrical, sample of a cutaneous lesion solely for the purpose of a diagnostic, pathological examination. Simple closure is included and is not separately payable.

Incisional biopsy: This type of biopsy is performed using a scalpel to remove a full thickness sample of tissue. The biopsy penetrates deep to the dermis into the subcutaneous space. The intent of this biopsy is to obtain a full thickness sample of a skin lesion for the purpose of a diagnostic, pathological examination. Simple closure is included and is not separately payable.

What about the actual CPT codes involved?

Biopsy:

11102: Tangential biopsy of skin (eg. shave, scoop, saucerize, curette); single lesion

11103: each separate/additional lesion (List separately in addition to the code for the primary procedure)

11104: Punch biopsy of skin (including simple closure, when performed); single lesion

11105: each separate/additional lesion (List separately in addition to the code for the primary procedure)

11106: Incisional biopsy of skin (eg. wedge) [including simple closure when performed]; single lesion

11107: each separate /additional lesion (List separately in addition to the code for the primary procedure)

It should be noted that as of January 1, 2019, CPT codes 11100 and 11101 will be deleted.

Removal of Skin Tags:

Removal by scissoring, or by any sharp method, ligature strangulation, electrosurgical destruction, or a combination of treatment modalities, including chemical destruction or electrocauterization of the wound, with or without local anesthesia.

11200: Removal of skin tags, multiple fibrocutaneous tags, any area; up to and including 15 lesions

11201 each additional 10 lesions, or part thereof (List separately in addition to the code for the primary procedure)

Shaving of Epidermal or Dermal Lesions:

Shaving is the sharp removal by transverse incision or horizontal slicing to remove epidermal and dermal lesions without a full thickness dermal excision. This includes local anesthesia, chemical or electrocauterization of the wound. The wound does not require suture closure.

11300: Shaving of epidermal or dermal lesion, single lesion, trunk, arms or legs; lesion diameter 0.5cm or less

11301: lesion diameter 0.6 to 1.0 cm

11302: lesion diameter 1.1 to 2.0 cm

11303: lesion diameter over 2.0 cm

11305: Shaving of epidermal or dermal lesion, single lesion, scalp, neck, hands, feet, genitalia; lesion diameter 0.5cm or less

11306: lesion diameter 0.6 to 1.0 cm

11307: lesion diameter 1.1 to 2.0 cm

11308: lesion diameter over 2.0 cm

Excision – Benign Lesions:

Excision (including simple closure) of benign lesions of skin (eg. neoplasm, cicatricial, fibrous, inflammatory, congenital, cystic lesions) includes local anesthesia. Excision is defined as full thickness, through the dermis, removal of a lesion including margins and includes simple, non-layered closure when performed. Code selection is based upon measuring the greatest clinical diameter of the apparent lesion plus that margin required for complete excision. Lesion diameter plus the narrowest margins required equals the excised diameter.

11400: Excision, benign lesion including margins, except skin tag (unless listed elsewhere), trunk, arms or legs; excised diameter 0.5 cm or less

11401: excised diameter 0.6 to 1.0 cm

11402: excised diameter 1.1 to 2.0 cm

11403: excised diameter 2.1 to 3.0 cm

11404: excised diameter 3.1 to 4.0 cm

11406: excised diameter over 4.0 cm

11420: Excision (benign lesion including margins, except skin tag (unless listed elsewhere), scalp, neck, hands, feet, genitalia; excised diameter 0.5 cm or less

11421: excised diameter 0.6 to 1.0 cm

11422: excised diameter 1.1 to 2.0 cm

11423: excised diameter 2.1 to 3.0 cm

11424: excised diameter 3.1 to 4.0 cm

11426: excised diameter over 4.0 cm

Excision – Malignant Lesions:

Excision (including simple closure) of malignant lesions of skin (eg. basal cell carcinoma, squamous cell carcinoma, melanoma) includes local anesthesia. . Excision is defined as full thickness, through the dermis, removal of a lesion including margins and includes simple, non-layered closure when performed. Code selection is based upon measuring the greatest clinical diameter of the apparent lesion plus that margin required for complete excision. Lesion diameter plus the narrowest margins required equals the excised diameter.

11600: Excision, malignant lesion including margins, trunk, arms or legs; excised diameter 0.5cm or less

11601: excised diameter 0.6 to 1.0 cm

11602: excised diameter 1.1 to 2.0 cm

11603: excised diameter 2.1 to 3.0 cm

11604: excised diameter 3.1 to 4.0 cm

11606: excised diameter over 4.0 cm

11620: Excision, malignant lesion including margins, scalp, neck, hands, feet, genitalia; excised diameter 0.5 cm or less

11621: excised diameter 0.6 to 1.0 cm

11622: excised diameter 1.1 to 2.0 cm

11623: excised diameter 2.1 to 3.0 cm

11624: excised diameter 3.1 to 4.0 cm

11626: excised diameter over 4.0 cm

As far as selecting the most appropriate ICD-10-CM code to link to the CPT code that will be billed, my suggestion is to wait until the specimen that was biopsied is sent for pathological analysis and a pathology report is produced with a definitive diagnosis. I would then either use the EHR software or more appropriately, Volume II of the ICD-10-CM Manual and access the “ICD-10-CM Table of Neoplasms” in order to obtain the most accurate ICD-10-CM code to bill.

This is my opinion.

Michael G. Warshaw, DPM, CPC

THE 2018 Podiatry Coding Manual is available in either Book or Flashdrive formats. Many offices across the country consider this to be their “Bible” when it comes to coding, billing and documentation. The price is only 125.00 including shipping! To purchase, access the website drmikethecoder.com.

Are you in compliance with Medicare concerning your billing, coding and documentation? Find out your status before you are audited by your Medicare carrier. Drmikethecoder special: Have 5 dates of service audited for 250.00 (new clients only). Contact drmikethecoder.com for more information.

Security Updates

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Connect and Adobe Digital Editions. An attacker could exploit one of these vulnerabilities to take control of an affected system.

The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), encourages users and administrators to review Adobe Security Advisories APSB19-05 and APSB19-04, and apply the necessary updates.

Juniper Networks Releases Multiple Security Updates

Juniper Networks has released multiple security updates to address vulnerabilities in various Juniper products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), encourages users and administrators to review Juniper’s Security Advisories webpage and apply the necessary updates

Microsoft Releases January 2019 Security Updates

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker could exploit one of these vulnerabilities to take control of an affected system.

The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and Infrastructure Security Agency (CISA), encourages users and administrators to review Microsoft’s January 2019 Security Update Summary and Deployment Information and apply the necessary updates.

CMS and Carrier Updates

MIPS Eligible Clinicians Affected by Super Typhoon Yutu

The MIPS Extreme and Uncontrollable Circumstances policy applies to MIPS eligible clinicians affected by triggering events that affect an entire region or locale. Given the Northern Mariana Islands Super Typhoon Yutu’s Federal Emergency Management Agency (FEMA) designation on October 26, 2018, we consider it to be such a triggering event, and the automatic extreme and uncontrollable circumstance policy therefore applies to the counties listed below:

Northern Islands (Municipality)
Rota (Municipality),
Saipan (Municipality) and
Tinian (Municipality)

Now Available: Accredited Online Course With Continuing Education Credit - Quality Payment Program in 2018: Group Participation

The Quality Payment Program in 2018: Group Participation Web-Based Training Course is available through the MLN LMS.

Learn about:

The difference between a group and a virtual group
Different reporting mechanisms
Reporting requirements for groups for each performance category
How scoring and payment adjustments work for groups

Participants will gain knowledge and insight on the program all while earning valuable continuing education credit. Keep checking back with us for updates on new courses. First time participants will need to register for the MLN Learning Management System. Once registered, you will be able to access additional courses without having to register. For information on how to login or find training, please visit our MLN Learning Management System FAQ sheet.