Corporate Compliance and HIPAA 2013

1. Corporate Compliance and HIPAA 2013 Description Annual compliance update training, mandatory for all Aurora caregivers. Includes reminders, information regarding compliance references and resources, and training in areas of special importance. It’s estimated it will take 45 minutes to complete this course. Content Contact: Instructions for Printing to Paper • From the PowerPoint toolbar, select File, Print • Under “Print What”, select Handouts • Under “Color/Grayscale”, select Pure Black and White • Under “Handouts/Slides Per Page”, select 2 • Select OK. Nancy Vogt Director/Deputy Chief Compliance Officer Created: May 2005 Updated: January 2013

2. Learning Objectives After completing this course, you will be able to: • Describe your role and responsibilities in helping ensure that Aurora fulfills its legal and ethical obligations, including actions to take in the event of a compliance concern or question • Explain the healthcare laws that relate to the work that you do • Describe compliance resources that are available to you • Describe how to protect patient privacy in accordance with the HIPAA Privacy and Security Rules, and how to appropriately use and protect Aurora’s electronic systems

3. Where the Rubber Meets the Road You likely have heard the saying, “This is where the rubber meets the road.” Where the rubber meets the road is the most important point for something, the moment of truth. Athletes can train all day, but the race is where the rubber meets the road and they’ll know how good they really are. Your actions determine whether or not Aurora Health Care is an organization of high integrity and ethics, and compliant with laws and regulatory requirements. • Your behaviors • Your decisions • Your actions • …are where the rubber meets the road

4. Necessary care High quality The Rules of the Road Most health care laws and regulations support these values, through regulations aimed at high quality, medically necessary, and low cost care. Through teamwork, we can better understand our legal and regulatory requirements and we can hold ourselves accountable to do so. The Compliance Department is here to help all of us to follow the rules of the road. • Our Aurora values provide “the rules of the road.” • We believe every patient deserves the best care • We believe in responsibly managing resources • We believe in building a health workplace through accountability, teamwork and respect We help people live well • Aurora Values Low cost care

5. The Road to Ethical Conduct • Review Aurora’s Code of Ethical Conduct at least once per year. It guides our behaviors in ensuring: • Quality of care, patient safety, and patients’ rights (including confidentiality and privacy) • The prevention of fraud, waste and abuse • Appropriate physician relationships • Appropriate political activities • Appropriate response to government investigations • Ethical business relationships (prohibiting kickbacks, conflicts of interest, gifts) • Equal opportunity and fair treatment of our caregivers • Maintaining a safe environment and protecting Aurora’s assets

6. Finding your way • To locate the Code of Ethical Conduct, go to the Compliance and Ethics website on iConnect.

7. Behaviors that steer us in the right direction… Behavior #1 Ask yourself “doing what is right” questions before you act or make a decision

8. Doing what is right If you are “doing what is right,” you will be able to answer “yes” to the following questions: • Am I being honest and truthful? • Am I acting fairly? • Am I acting in the best interests of Aurora and our patients? • Would I be proud to tell someone about my actions? • Would I be comfortable seeing it in the news media? • Is it consistent with the law and Aurora’s policies?

9. Your responsibilities • You have the responsibility to act with integrity • You have the responsibility to report any suspected violations of law, regulation, or policy • You are required to complete and understand annual compliance training and to review the Code of Ethical Conduct

10. Keeping our eye on the finish line Why is acting with integrity important? • Put simply, it’s just the right thing to do • Our patients expect us to act ethically and to obey the law. It is important to them and therefore it is important to us • Working for an organization of high integrity makes us proud • Have you ever heard about situations where a company was accused of behaving badly (for example, Enron, BP, Fannie Mae, WorldCom, etc.)? Would you want to be associated with bad behavior because you were employed by that company? • We all have good reasons to act with integrity

11. Behaviors that steer us in the right direction… Behavior #2 Live up to our commitment to provide our patients the best care

12. Quality concerns Report quality concerns. • If you have a concern about patient quality or safety, report it to your immediate supervisor • If, for any reason, you are not comfortable reporting it to your immediate supervisor, report it to another leader in your area, the patient safety officer, or to the Risk Management Department • Only provide services within your legal scope of practice

13. Licensing, registration, certification If your job requires you to be licensed, registered, or certified: • You must renew your license, registration, and/or certification before it expires • If your license, registration or certification lapses or if limits are imposed, notify your supervisor immediately. Your supervisor will assist you in determining what to do. • If state law sets limits for your scope of practice, you must stay within those limits. If someone asks you to perform duties that are not within your scope of practice, contact your supervisor or a compliance officer for assistance. • If you are an Advanced Practice RN or a Physician Assistant, you must obtain a collaborative or supervising agreement signed by all supervising physicians on an annual basis

14. Reporting criminal conduct Regardless of your job title or requirements, you must report the following, in accordance with Aurora policy and State law: • Having been charged with or convicted of (or pled no contest) to any crime, including municipal ordinance violations • Substantiated findings of or current investigations related to abuse, neglect, or misappropriation • Professional credential restrictions, limitations, or revocations • Program licensure limitations, revocations or denials • Discharge from any branch of the U.S. Armed Forces, including any reserve component • Residency outside the state of Wisconsin • Rehabilitation review requests

15. Criminal background checks • Failure to provide the required notice may lead to discipline, up to and including termination of employment. A pending charge or criminal conviction will not necessarily result in disciplinary action. • If you have something to report, you must make your report: • To the Human Resources Department; • In writing; and • As soon as possible and within 3 days of the occurrence of the event • It’s also important for you to know that Aurora performs criminal background checks on all caregivers, and in doing so, complies with Wisconsin law

16. Behaviors that steer us in the right direction… Behavior #3 Protect our patients’ rights

17. Discrimination/decision-making Avoid discrimination and recognize the patient’s right to make decisions. • Provide services in such a way that all patients can access appropriate care, without regard to race, creed, color, national origin, ancestry, religion, gender, sexual orientation, marital status, age, or disability • Communicate in an open and honest manner with patients, and recognize each patient’s right to be involved in decision-making about his/her care Caregivers who work in a hospital, click here for additional training.

18. EMTALA Do not deny services to an individual with an emergency medical condition. • EMTALA (the Emergency Medical Treatment and Active Labor Act) applies to any individual presenting on the hospital “campus,” which means the physical area immediately adjacent to the hospital’s main buildings, and other areas and structures that may not adjoin the main buildings but are located within 250 yards of the main buildings • If an emergency medical condition exists, treatment must be provided until the emergency medical condition is resolved or stabilized. If the hospital does not have the capability to treat the emergency medical condition, the patient will be transferred to another hospital. • 50 • 125 • 250 yards

19. EMTALA (cont’d) Comply with all EMTALA requirements. • Do not ask for a patient’s financial information until a medical screening examination has been performed, or until after triage if the patient is waiting and agrees to proceed with registration • Do not discuss appropriate alternative health care settings until a physician (or Qualified Medical Professional) documents that a medical screening exam has been performed and that the patient does not have an emergency medical condition (“EMC”), the patient's EMC has been stabilized, or the patient cannot be stabilized and needs to be transferred • Do not instruct an ambulance or EMT’s, if already on hospital property, to take the patient to another hospital without first examining the patient – a medical screening exam must first be performed • Hospitals with specialized capabilities are obligated to accept transfers from hospitals who lack the capability to treat certain unstable emergency medical conditions

20. Finding your way Additional resources for caregivers who work in hospitals include: • The Patient Rights Policy (System Policy #98) provides more details regarding requirements. See the new requirements related to visitors in the hospital. Click here if you wish to review the policy now. • The EMTALA: Screening, Stabilization, and Transfer Policy (System Policy #179) provides more details related to individuals who present requesting emergency services. Click here if you wish to review the policy now. • The EMTALA 101 course is available on Learning Connection. Search on “EMTALA.”

21. Civil rights Provide services in a manner that complies with civil rights’ laws. • Make a reasonable accommodation, free of charge, for a person with a disability who requests it. If the person is deaf or hard of hearing and requires a language sign interpreter, offer, at the very least, an interpreter who has met minimum national certification requirements. • Arrange to provide a qualified oral interpreter to a person who cannot speak English well enough to be able to fully participate in our programs or services. In most cases, a family member is not a qualified interpreter. If a family member/friend insists on interpreting, a qualified interpreter must also be present to assist the clinician.

22. Finding your way • Two policies will address these requirements. These are currently being developed: • The Auxiliary Aids and Services for Persons with Disabilities Policy (System Policy #TBD) lays out requirements for providing assistive aids and services. • The Language Assistance and Access Policy for Persons with Limited English Proficiency (System Policy #TBD) details the policy and procedure for providing interpreting services to our patients. Click here if you wish to review the policy now.

23. Behaviors that steer us in the right direction… Behavior #4 Preserve confidentiality and privacy

24. Preserve confidentiality Preserve confidentiality and privacy. • Disclose patients’ protected health information only as is allowed for treatment, payment, and health care operations or otherwise permitted by the law, or with the patient’s signed authorization. If you are not sure if a signed authorization is required, check the Disclosure Manual on the Privacy website on iConnect, or contact your local privacy officer for assistance. • Maintain appropriate safeguards to protect the privacy of our patients’ information • Restrict your own access to patients’ protected health information to only that which you need to know in order to perform your job duties • If your job requires transporting patient information in a vehicle or maintaining it in an off-site location, secure the information at all times

25. Privacy safeguards Safeguard privacy. • Keep your voice low when discussing patient information within earshot of others • Take extra care when faxing patient information to ensure the right number has been entered or recipient has been selected • When providing paper information to a patient, make sure every page is for that particular patient • Before discussing information with or in front of a patient’s family member or friend, ask for the patient’s permission and document the verbal permission in the patient’s record. If the patient is incapacitated or otherwise not available to give permission, disclose limited information as long as you believe it is in the patient’s best interests to do so.

26. Making sure you’re on the right track Question: I saw my neighbor in the hallway at the hospital and it appeared she was here to receive treatment. Can I look up her medical record to determine why she is here? Answer: • Yes, but only because I am concerned regarding my neighbor. • No. It is not legal to look up information about anyone I know unless I have a job-related reason to do so.

27. Making sure you’re on the right track Question: I saw my neighbor in the hallway at the hospital and it appeared she was here to receive treatment. Can I look up her medical record to determine why she is here? Answer: • Yes, but only because I am concerned regarding my neighbor. • No. It is not legal to look up information about anyone I know unless I have a job-related reason to do so. Correct.

28. Making sure you’re on the right track Question: I saw my ex-girlfriend was scheduled to see one of the doctors at our clinic and I told her friend about it. Now she is angry at me for sharing that information. I told her friend because I was worried and wanted to make sure my ex-girlfriend had support. Did I do something wrong? Answer: • No. I had my ex-girlfriend’s best interests in mind. • Yes. I cannot reveal any information about any patient to any other person, even if I think I am acting in their best interest, unless they are authorized to receive that information and it is part of my job to disclose that information. Since the ex-girlfriend didn’t authorize sharing this information, it was illegal to do so.

29. Making sure you’re on the right track Question: I saw my ex-girlfriend was scheduled to see one of the doctors at our clinic and I told her friend about it. Now she is angry at me for sharing that information. I told her friend because I was worried and wanted to make sure my ex-girlfriend had support. Did I do something wrong? Answer: • No. I had my ex-girlfriend’s best interests in mind. • Yes. I cannot reveal any information about any patient to any other person, even if I think I am acting in their best interest, unless they are authorized to receive that information and it is part of my job to disclose that information. Since the ex-girlfriend didn’t authorize sharing this information, it was illegal to do so. Correct.

30. Finding your way The Privacy Website on iConnect includes: • Additional information and guidance on policies and practices • Aurora’s Disclosure Manual, with specific information regarding when a written authorization from the patient is required • Privacy officer contact information Click here to review this helpful website now.

31. Behaviors that steer us in the right direction… Behavior #5 Prevent fraud, waste, and abuse

32. Fraud, waste, and abuse Ensure compliance with the False Claims Act and other laws related to fraud, waste, and abuse. • Do not commit fraud, even if you think your intentions are good. While anyone can make an honest mistake, fraud is different. Fraud involves deliberate deception and is illegal. • Do not participate in or contribute to the submission of a billing claim that is false or fraudulent. The federal False Claims Act, as well as State laws, prohibit us from doing so. • Maintain good practices that result in accurate billing, like clear charge codes and accurate and complete documentation. Failing to do so can be viewed as waste or abuse by the government. .

33. False claims Examples of false claims include, but are not limited to: • Billing for services that were performed by an improperly supervised or unqualified employeeExample: a nurse performs hospital rounds on patients but the doctor bills for the service • Billing for services that were not providedExample: submitting a higher level E&M code for a lower level of service provided • Billing for services that were not medically necessaryExample: ordering an MRI when a lower cost test would have beenjust as effective

34. SmartChart accuracy To ensure the accuracy of our SmartChart records: • Appropriately edit any information created using copy/paste, “Make Me the Author,” carry forward functionality, and templates to accurately describe the patient's condition and the services performed during the current encounter. • Use copy/paste and carry forward functionality discriminately so that only information that is relevant to the current encounter is carried forward. • More documentation is not necessarily good or appropriate documentation and may also result in inaccurate billing.

35. Claim accuracy Ensure the accuracy of our claims by: • Maintaining timely and accurate patient records, and accurate and truthful billing practices • Documenting diagnosis and treatment accurately and in a timely manner • Billing only for services that are actually provided and appropriately documented • Correcting any billing errors and refund money received in error within 60 days of identifying the error • Refunding any overpayments within 60 days of identifying the overpayment • Adhering to applicable laws regarding discounting services

36. Finding your way The Detecting Fraud, Waste, and Abuse Policy (System Policy #174) includes more information and guidance. Click here if you wish to review this policy now. The Hospital Co-Signature Requirements grid on the Compliance & Ethics website is helpful in determining order and signature requirements on hospital documentation. Click here if you wish to review the grid now.

37. Making sure you’re on the right track Question: My supervisor asked me to change the diagnosis on a note of a physician visit so it would be covered by the patient’s insurer. Can I do this? Answer: • Yes, because it is important to the patient that the insurance company pays the claim. • No. Documentation must accurately reflect when the service was actually provided. If a diagnosis was recorded incorrectly, the physician can make an addendum to correct the error. It is never appropriate to falsify a record.

38. Making sure you’re on the right track Question: My supervisor asked me to change the diagnosis on a note of a physician visit so it would be covered by the patient’s insurer. Can I do this? Answer: • Yes, because it is important to the patient that the insurance company pays the claim. • No. Documentation must accurately reflect when the service was actually provided. If a diagnosis was recorded incorrectly, the physician can make an addendum to correct the error. It is never appropriate to falsify a record. Correct.

39. Making sure you’re on the right track Question: What should I do if I think a charge processing or billing error has occurred? Answer: • I should immediately notify my supervisor or other person responsible for billing, or report the issue to the Compliance Department. All billing errors must be corrected. • I should report the error only if I am the one who made it. It is not my responsibility to report errors made by other Aurora caregivers.

40. Making sure you’re on the right track Question: What should I do if I think a charge processing or billing error has occurred? Answer: • I should immediately notify my supervisor or other person responsible for billing, or report the issue to the Compliance Department. All billing errors must be corrected. Correct. • I should report the error only if I am the one who made it. It is not my responsibility to report errors made by other Aurora caregivers.

41. Behaviors that steer us in the right direction… Behavior #6 Make sure all our interactions with physicians comply with the federal Ethics in Patients Referrals Act (aka the Stark Law) and the Anti-Kickback Statute

42. Physician financial relationships Avoid problematic interactions with physicians. • Do not pay, offer to pay, or offer anything of value in exchange for the referral of patients • Do not accept payments or anything of value for the referrals we make • Appropriately document our financial relationships with physicians • Do not make payments to physicians unless there is an appropriate employment agreement or contractual agreement in effect

43. Keeping our eye on the finish line Why are laws related to physician financial relationships so strict? • Law makers and regulatory agencies have been concerned that physicians may refer their patients to certain facilities for the wrong reasons – because there is a financial benefit to the physician rather than because the physician believes the facility offers the highest quality and best services to their patients. Similarly, physician relationships with vendors might lead to choosing a certain medication or device for the wrong reasons. • There is a great deal of ongoing scrutiny and enforcement by government agencies. For example, a new law called The Physician Sunshine Act takes effect in March, 2013. Under this law, all pharmaceutical and medical device companies will need to inform the government of anything of value that is provided to physicians and teaching hospitals. This will then be made available to the public.

44. Making sure you’re on the right track Question: An independent (not employed by Aurora) physician on our medical staff will be assisting with a quality improvement project I am working on. Can this physician be paid for his time and effort? Answer: • Yes, as long a written agreement is created and signed. • No, we can never pay physicians unless they are employed.

45. Making sure you’re on the right track Question: An independent (not employed by Aurora) physician on our medical staff will be assisting with a quality improvement project I am working on. Can this physician be paid for his time and effort? Answer: • Yes, as long a written agreement is created and signed. Correct. • No, we can never pay physicians unless they are employed.

46. Behaviors that steer us in the right direction… Behavior #7 Comply with IRS requirements by not engaging in certain political activities while working

47. Political activities Do not engage in certain political activities while working in an Aurora facility. • Do not make political contributions or work on political campaigns during work hours • Do not use Aurora resources to assist a political campaign • Do not use Aurora resources to try to influence the personal decisions of others to contribute to, or otherwise support, any political party or candidate

48. Prohibited use of Aurora resources Examples of prohibited use of “Aurora resources” include, but are not limited to: • Using Aurora’s e-mail system for political purposes • Making copies of political campaign information on an Aurora copy machine/printer • Using Aurora’s phone system to make campaign calls • Using iConnect to identify names of Aurora employees to contact for political purposes

49. Making sure you’re on the right track Question: I am a volunteer for a local political candidate’s campaign. May I invite other Aurora caregivers to an event in support of this candidate at an Aurora facility? Answer: • Yes, as long the event has been approved by an Aurora leader and will be funded by the campaign. • No, you may not hold an event for a political candidate at an Aurora facility. You may invite Aurora caregivers as long as you do not use any Aurora resources to do so, do not do so while working, and you hold the event outside of work hours in non-Aurora space.

50. Making sure you’re on the right track Question: I am a volunteer for a local political candidate’s campaign. May I invite other Aurora caregivers to an event in support of this candidate at an Aurora facility? Answer: • Yes, as long the event has been approved by an Aurora leader and will be funded by the campaign. • No, you may not hold an event for a political candidate at an Aurora facility. You may invite Aurora caregivers as long as you do not use any Aurora resources to do so, do not do so while working, and you hold the event outside of work hours in non-Aurora space. Correct.