CONNECT WITH US!

www.rmcinc.org 800.538.5007

Audit Planning for 2020

2

Ransomware—Social Engineering that

Hurts 2-3

Tips for Accurate Code Assignment of Other specified vs

Unspecified Schizophrenia

Spectrum Disorder

3-4

New Codes for Health Behavior Assessment and

Intervention for 2020

4

RMC News 5-6

Vol. 10 Issue 1 1st Quarter 2020

I N S I D E T H I S I S S U E :

There are many procedures that are done to the nose, including turbinate resection, repair of nasal vestibular stenosis, septoplasty, endoscopic sinus surgery to name a few. These can be tricky to code in CPT, and documentation of course is key.

Turbinate hypertrophy can cause an altered sense of smell, dry mouth, nasal congestion, facial pain and snoring. This can be an acute or chronic condition and is often accompanied by a deviated septum. There are three levels of turbinates in each nasal cavity: the superior, middle and inferior. Different levels or severity of hypertrophy include normal, moderate, severe and obstructive, which can be caused by medication, infections (colds, sinusitis, etc.), dust or allergies (rhinitis). The inflammation caused by these conditions affects blood flow in the tissue, resulting in swelling of the turbinates and can cause obstructed breathing. This hypertrophy can be treated both conservatively with nasal steroids and decongestants, or invasively with surgery.

There are several different methods for treatment of nasal hypertrophy of the inferior nasal turbinates, including CPT codes 30130 (excision inferior turbinate, partial or complete, any method), 30140 (submucous resection inferior turbinate, partial or complete, any method), 30801 (ablation, soft tissue of inferior turbinates, unilateral or bilateral, any method, superficial), and 30802 (ablation, soft tissue of inferior turbinates, unilateral or bilateral, any method, intramural), (i.e. submucosal).

An inferior turbinate resection codes to 30130 when it involves incision into the mucosa and removal of part or the entire inferior nasal turbinate, with the appropriate modifier of RT, LT or 50. In this procedure fracture of the bony turbinate away from the lateral nasal wall is included in the code, and the turbinate is excised through a mucosal incision. This procedure is commonly performed for those with severe obstruction.

An inferior turbinate resection codes to CPT 30140 when it involves submucous resection, with the appropriate modifier of RT, LT or 50. In this procedure the provider removes a part or all of the inferior turbinate bone, “saves” or preserves the mucosa, and resects the submucosal tissue and bony turbinate. Documentation must show that the provider incised the mucosa and resected the inferior turbinate submucosally to support this code. Commonly providers will also perform outfracture (CPT 30930) in combination with the submucosal resection because it has been shown to improve long-term results, but per our CCI edits we cannot code it separately when both are performed on the same side. Refer to CPT Assistant, May 2003, Volume 05, Issue 13, pages 5-6 for more information.

Another treatment of inferior turbinate hypertrophy is ablation, which is reported with codes 30801 or 30802. This involves electrocautery, radiofrequency ablation or tissue volume reduction. This method treats the soft tissue, rather than the bony structure of the turbinate. Electrocautery destroys tissue with an electrical current and radiofrequency ablation uses radio waves to destroy tissue. Excessive or mucosal hypertrophy is ablated or cauterized and may be excised. CPT 30801 is for superficial tissue, and 30802 is used for intramural, or deep in the mucosa.

Join RMC’s presentation in April titled “What Tickles the Nose” for a deeper look into coding Nasal Procedures with CPT.

References: CPT Professional, Coders’ Desk Reference, CPT Assistant

Nasal Procedures in CPT – Who Nose How? By Jennifer Jones, RHIT, CCS, CCDS

Jennifer Jones, RHIT, CCS, CCDS is one of RMC’s Manager of Coding Services and also a CDI Specialist and has been with RMC since 2009. Jennifer has over 27 years of experience in the HIM field and has held such positions as Manager of Coding Services, Inpatient & Outpatient Coding Specialist, Medical Transcriptionist, Medical Assistant, Medical Biller, and Medical Receptionist Jennifer also has experience in Clinical Documentation Improvement starting in 2010. Jennifer has worked in 25-bed Critical Access Hospitals, midsize hospitals, and large trauma level 1 medical centers. Jennifer resides in Oregon and can be reached at jjones@rmcinc.org

We are now four years status post ICD-10 implementation. It was a day that many of us, never thought would arrive, however, we can now confidently state that the transition to ICD-10 wasn’t as damaging as predicted. According to studies, productivity is almost back to ICD-9 levels. However, coding quality still has room for improvement. Dating back to 2016, Central Learning has held an annual coding test. The recent results from the outpatient coding test, indicated an accuracy rate of 60.5 percent for primary diagnoses and 38.6 percent for secondary diagnoses. This raises many questions amongst coding professionals. RMC recommends that facilities should perform regular audits of their coding staff. The timing of these audits can be monthly, quarterly, bi-annual, annual, or as often as your facility decides. Depending on the scope of the audit, it can be performed retrospectively or concurrently (pre-bill worklist). Coding is an ever-evolving area for many healthcare organizations and performing regular audits helps determine any potential risk or areas for concern.

One area that RMC commonly notices coders are missing are reporting secondary diagnoses. Per the Official Coding Guidelines (OCG), secondary diagnoses are additional conditions that affect patient care in terms of requiring clinical evaluation, treatment, diagnostic procedures, extension of hospital stay, and nursing care or monitoring. In addition, in the outpatient setting, “chronic diseases treated on an ongoing basis may be coded and reported as many times as the patient receives treatment and care for the condition”. Coders should also pay close attention to the “use additional code” instructional notes that can be found in the Tabular Index. Common examples of this are:

• When coding diabetes, E11.-, use additional code to identify control (insulin or oral hypoglycemic drugs).

• When a condition such as obesity or morbid obesity has been diagnosed, add code (Z68.-) to identify body mass index, if known

• Assign a secondary code to identify tobacco exposure, use or dependence when coding hypertension.

Coders should also be aware of any specific facility guidelines that your hospital or facility may have implemented when deciding which secondary diagnoses should be reported. Facility guidelines are helpful but always remember they are specific to that facility and may not be the same for all facilities.

RMC encourages facilities to take the time and map out your auditing plan for 2020. It may also be helpful to incorporate the Office of Inspector General (OIG) work plan and Programs to Evaluate Payment Patterns Electronic Report (PEPPER) data information to decide which audits your facility should aim it’s focus on. Coding Managers should also track and trend RAC and commercial insurance denials to see where there is a high denial level. For example, if your facility is experiencing a high number or increase in sepsis denials, it may be necessary to start off with a retrospective audit to attain a base level of sepsis coding accuracy scores. This may also require collaboration with your facility’s clinical documentation integrity (CDI) department. Depending on the results of this audit, your facility may opt to initiate a pre-bill sepsis worklist that requires a second review on all sepsis cases before they are final billed. This is only one example, of where your facility can choose to be proactive.

Having an audit plan in place is necessary and one that will allow your coders and facility to thrive!

References: Official Coding Guidelines 2019 https://www.icd10monitor.com/national-coding-contest-indicates-outpatient-coding-is-getting-worse-not-better

Ransomware, a form of social engineering, is not new but it’s ever increasing use to blackmail healthcare organizations should place ransomware attacks as a definite possibility and a risk that needs to be mitigated. It’s critical for healthcare organizations to prepare for such malicious attacks. Preventing and quickly responding to malicious attacks should be a part of any healthcare organization’s risk management strategy.

The first place to start is with staff education. Phishing and spear phishing can and are leading to more than ransomware attacks. It can lead to network compromise, breach and an inability to address critical patient care. Staff need to know how to spot malicious links and email and what is and isn’t safe to click on. Training is one of the key steps in addressing ransomware.

As part of the training, healthcare organizations should run mock phishing exercises. A mock phishing exercise is a form of social engineering and it can be used to determine how many staff click on malicious links without harming the organization. This exercise helps identify staff who may need remedial training and it makes it real for staff. This should not be a onetime exercise. Ongoing training and social engineering exercises keep the threat of phishing in the forefront of staff’s minds.

It’s important to implement a solid backup plan. A backup plan should cover all critical applications and data and backups of data should occur on a daily basis. Backup media should be stored offline or a better way to say it is the media should not be accessible from the Internet to avoid malicious access to the media. Backup media should be stored offsite and encrypted. If the media is stored offsite at a secure location, it is less likely that the media is accessible to unauthorized individuals.

Continued...

Ransomware – Social Engineering That Hurts

By Chris Apgar, CISSP, CCISO

Page 2 C O M P L I A N C E C O N N E C T I O N S

Marquita Rawlins, RHIA, CCS is RMC’s Director of Hospital Review Services. Marquita joined RMC in 2015, bringing with her over 12 years of experience in the Health Information Management field. She is a graduate of the University of Alabama in Birmingham, with a Bachelor’s of Science in Health Information Management. Marquita’s past positions include Coding Specialist, Manager of Audit Services, DRG RAC Auditor, and ICD-10 Auditor for acute care facilities nationwide. Marquita he has worked in both small and large bed hospitals prior to coming to RMC, and in her time with RMC has performed services for facilities ranging from small critical access hospitals to large multi-hospital networks including trauma level 1 medical centers. Marquita is an AHIMA approved ICD-10-CM and ICD-10-PCS Train the Trainer, and has been actively involved with RMC’s ICD-10 Training and education program. Marquita resides in Georgia and can be reached at mrawlins@rmcinc.org

Audit Planning for 2020 By Marquita Rawlins, RHIA, CCS

Page 3 C O M P L I A N C E C O N N E C T I O N S

All healthcare organizations need to develop and implement a formal security incident response plan. The time to plan is not when the ransomware attack occurs. A formal incident response team needs to be appointed and trained. A lot can go wrong in the event of a ransomware attack if a plan isn’t in place and a team has not been formally trained. The FBI stated healthcare organizations should not pay the ransom and should engage law enforcement if an attack occurs. That’s good advice but healthcare organizations need to know at what point the ransom needs to be paid to protect patients and provide needed patient care. You don’t know what that point is if you don’t have a plan and you don’t test the plan before a malicious attack occurs.

Developing a sound disaster recovery and business continuity plan is another step healthcare organizations can take to reduce the impact of a ransomware attack. Ideally healthcare organizations will maintain what is called a hot site – an alternate location that can be switched over to in the event of a ransomware attack. That is not always feasible especially for smaller healthcare organizations because of the cost. Alternately, a sound and tested plan can be used to identity critical assets such as EHRs and what steps need to be taken to continue the business of healthcare while the data is inaccessible and how to recover. Plans include such things as what vendors need to be contacted for replacement servers and other assets and what steps will be taken to rebuild a network and hardware to eradicate the malicious code.

In the end, it is key to make sure staff is trained, phishing tests run and that plans are in place to address malicious attacks before they happen. It’s more than a regulatory requirement. It is just sound business practice and is needed to provide patient care before, during and after a malicious attack. This is not a onetime event. The types of risk change over time resulting in the need to periodically test and update plans. People are the most significant risk hence ongoing training is also required.

Stay tuned – I’ll be covering the broader topic of social engineering in my webinar on May 14, 2020. It’s more than phishing and I’ll provide tools to reduce the threat of social engineering, including ransomware.

Coding diagnoses from ICD-10-CM, Chapter 5: Mental, Behavioral and Neurodevelopmental Disorders, does not prove to be an easy task. Psychiatry and mental health professionals use the Diagnostic and Statistical Manual of Mental Disorders, Fifth Edition (DSM-5) for applying diagnoses, which does not always correspond equally to codes from ICD-10-CM, and it is up to the coder to evaluate the documentation and apply the correct ICD-10-CM code, and knowing the background according to DSM-5 is helpful.

To code the diagnosis of Schizophrenia Spectrum Disorder, consult the index and start with the key word “disorder”, followed by “schizophrenia spectrum and other psychotic disorder”. There are two options, F28 and F29.

In regards to code F28, the tabular lists the description as “other psychotic disorder not due to a substance or known physiologic condition”. Per DSM-5 this category applies to presentations in which symptoms characteristic of a schizophrenia spectrum and other psychotic disorder that cause clinically significant distress or impairment in social, occupational, or other important areas of functioning predominate but do not meet the full criteria for any of the disorders in the schizophrenia spectrum and other psychotic disorders class. This diagnosis is used in situations in which the clinician chooses to communicate the specific reason that the presentation does not meet the criteria for any specific schizophrenia spectrum and other psychotic disorder. This is done by recording “Other Specified Schizophrenia Spectrum and Other Psychotic Disorder” followed by the specific reason (e.g., persistent auditory hallucinations). Examples that can be specified using the “other specified” designation include the following:

1. Persistent auditory hallucinations

2. Delusions with significant overlapping mood episodes

3. Attenuated psychosis syndrome

4. Delusional symptoms in a partner of individual with delusional disorder

Note: In ICD-10-CM, there is no edit to use additional code for the specific reason, and there is no Excludes1 or 2 with code F28. This code includes chronic hallucinatory psychosis and other specified schizophrenia spectrum and other psychotic disorder.

In regards to code F29, the tabular lists the description as “unspecified psychosis not due to a substance or known physiologic condition”. Per DSM-5 this category applies to presentations in which symptoms characteristic of a schizophrenia spectrum and other psychotic disorder that cause clinically significant distress or impairment in social, occupational, or other important areas of functioning predominate but do not meet the full criteria for any of the disorders in the schizophrenia spectrum and other psychotic disorders diagnostic class. The unspecified schizophrenia spectrum and other psychotic disorder category is used in situations in which the clinician chooses not to specify the reason that the criteria are not met for a specific schizophrenia spectrum and other psychotic disorder, and includes presentations in which there is insufficient information to make a more specific diagnosis (e.g., in emergency room settings).

“Ransomware” Continued...

Chris Apgar, founder of Apgar & Associates is a Certified Information systems Security Professional (CISSP). He is one of the country’s foremost experts and spokespersons on healthcare privacy, security, regulatory arriafs, state and federal compliance and secure and efficient electronic health information exchange. Chris has more than 19 years of experience in regulatory compliance and is a leader of regional and national privacy, security and health information exchange forums. As a member of Workgroup for Electronic Data Interchange, and serving on the Board of Directors since 2006, Chris is an honest, reliable, trustworthy expert in the field of privacy and security.

Apgar & Associates deliver training webinars on regulations and best practices related to HIPAA, HITECH and cybersecurity issues. To learn how Apgar & Associates privacy and security expertise can help your organization, give us a call at 503.384.2538.

Tips for Accurate Code Assignment of Other specified vs Unspecified Schizophrenia Spectrum Disorder

By Jennifer Jones, RHIT, CCS, CCDS

Continued...

Note: In ICD-10-CM, there is an Excludes1 for mental disorder NOS (F99) and unspecified mental disorder due to known physiologic condition (F09).

In summary, it is necessary to make sure the ICD-10-CM code assignment matches provider documentation - is it “other” or is it “unspecified” schizophrenia spectrum disorder? One word makes a difference in appropriate coding of this diagnosis.

Watch for the ACE audio conference presentation coming this summer for more behavioral health coding information!

References: 2020 ICD-10-CM Expert, Diagnostic and Statistical Manual of Mental Disorders, Fifth Edition (DSM-5)

There were 6 codes deleted for 2020 and 9 new codes were added under the Health Behavior Assessment and Intervention section. These family of codes were first established in 2002. With increased awareness and need for these types of services there was a need for more code revisions. Codes 96150-96155 have been deleted and replaced with the new codes 96156, 96158, 96159, 96164, 96165, 96167, 96168, 96170 and 96171.

Health and behavior assessment and intervention services are used to identify and address the emotional, psychological, behavioral, cognitive and interpersonal factors that are essential to the assessment and/or treatment of the physical health problem(s). The term “physical health problem” is key to these family of codes. The patient’s primary diagnosis needs to be a medical condition. The patient can have a mental health condition also, but this is not the reason for these codes. These new codes are to be used for assessment and intervention to help improve and focus on factors that are complicating the medical condition(s) and the treatment of the patient’s physical illness, diagnosis or symptoms. These services do not represent preventative medicine counseling and risk factor reduction interventions. These are used to help the patient deal with their medical condition(s).

For the health behavior assessment, the provider evaluates the patient through various ways – observation, talking with the patient and formulating clinical decision making. During this session the provider is accessing the patient’s medical illness/injury, how the patient is coping and their ability to follow a treatment plan. This new code is 96156 – Health behavior assessment, or re-assessment. This code is no longer time-based. It replaced 96150 and 96151.

An example of health behavior assessment – a 34-year-old with severe chronic pain, phantom pain and his medication causes somnolence is referred for behavior assessment to determine his psychological factors and to determine if an intervention could be helpful is his overall treatment plan.

Once the patient has the assessment the next step would be the health behavior intervention (96158-96159). Per AMA CPT 2020 “Health behavior intervention include promotion of functional improvement, minimizing psychological and /or psychological barriers to recovery and management of and improved coping with the medical condition(s). These services emphasize active patient/family involvement. These interventions may be provided individually or in a group (2 or more patients) and/or the family with or without the patient.”

96158 Health behavior intervention, individual face to face – initial 30 minutes

+96159 Health behavior intervention, individual face to face each additional 15 minutes

Example of an intervention: A 71-year-old female with heart disease, osteoarthritis and diabetes is referred for health behavior services to improve patient treatment compliance and engagement in self-management of her chronic conditions.

• Health Behavior Group Intervention (96164-96165) These have been added to report face to face group health behavior intervention. A group consists of 2 or more patients. 96164 is reported for the initial 30 minutes and 96165 is an add on code for each additional 15 minutes.

• Family Intervention WITH patient present (96197 and 96168) are used for face to face family health behavior intervention with the patient. 96167 is the first 30 minutes and add on code 96168 is each additional 15 minutes.

• Family Intervention WITHOUT the patient present (96170-96171) reporting of these codes does not require the patient being pre-sent. 96170 is the first 30 minutes and 96171 is each additional 15 minutes

It is important when credentialing a qualified healthcare provider that will be providing health behavior assessment and intervention services that focus on medical diagnosis must be credentialed on the medical side and behavioral health side as well. It is up to the insurance payors to determine who can use these codes. This can vary by state as well. Read the new text very carefully in your CPT book or encoder.

Reference: AMA CPT 2020 guidelines

Page 4 C O M P L I A N C E C O N N E C T I O N S

New Codes for Health Behavior Assessment and Intervention for 2020

By Chris Breithoff, CPC, CPCO, CDRO, CRC

Chris Breithoff, CPC, CPCO, CDEO, CRC is the Director of Physician Coding Services at RMC. She has worked in the medical arena since 1985 with an emphasis on coding & compliance for 18 years. Chris has a diverse background which includes managing large private practices, and managing a physician coding department for a large teaching hospital. In these roles, Chris was responsible for the day to day coding, education of coders and providers, as well as overall compliance of the revenue cycle. Chris’ areas of expertise include Evaluation and Management coding, Critical Care, Emergency Room, Gastroenterology, Pulmonary, Cardiology and Sleep Medicine. Chris joined RMC in 2012 as an Auditor, and took the helm of the Physician Coding Services in 2015. She has done an outstanding job assuring exceptional services to our clients and focusing on RMC staff engagement. Chris can be reached at cbreithoff@rmcinc.org.

“Tips for Accurate Code Assignment” Continued...

Page 5 C O M P L I A N C E C O N N E C T I O N S

Yep. You read that right. Totally free.

Visit our website: www.rmcinc.org to submit your questions today!

Our new website features a “Coding Questions” button. Submit your question, and one of our

RMC coding experts will reply.

*Also - don’t forget to follow RMC on Facebook, LinkedIn and Twitter. We post coding tips, reminders and updates weekly!

Page 6 C O M P L I A N C E C O N N E C T I O N S

Camille Walker: cwalker@rmcinc.org or Kristin Gibson: kristin@rmcinc.org

• Average coding experience of 20 years

• Friendly, Reliable & Consistent

• AHIMA and/or AAPC credentialed

• Monthly/concurrent internal audits to ensure quality

• Internal education & training programs