LeadingAge

Nine Federal agencies, including the Departments of Health
and Human Services (HHS), Housing and Urban Development (HUD), Veterans Affairs
(VA) and Labor (DOL), have published a final rule that will provide new
religious liberty protections for beneficiaries of federally funded social
service programs.

The rule also adds new protections for religious providers
to compete for government funds on the same basis as any other private
organization.

The regulations, which implement Executive Order 13559,
Fundamental Principles and Policymaking Criteria for Partnerships with
Faith-Based and Other Neighborhood Organizations, will become effective on May
3, 2016; however, providers will have 90 days to become compliant with the
requirements set forth in the final rule.

The final rule: 

• Requires agencies to ensure that all decisions
  about federal financial assistance are based solely on merit, without regard to
  an organization's religious affiliation or lack thereof, and free from
  political interference, or the appearance of such interference.

• Makes clear that faith-based organizations are
  eligible to participate in federally funded social service programs on the same
  basis as any other private organization. 

• Clarifies what activities can and cannot be
  supported with direct federal financial assistance by replacing use of the term
  "inherently religious activities" with the term "explicitly
  religious activities" and providing examples of such activities. 

• Prohibits organizations that receive federal
  financial assistance from discriminating against beneficiaries, including
  denying services or benefits, based on religion, a religious belief, a refusal
  to hold a religious belief, or a refusal to attend or participate in a
  religious practice. 

• Requires faith-based organizations that receive
  direct federal financial assistance for domestic social service programs to
  provide written notice of certain protections to beneficiaries of the
  program.  Specifically, an organization
  that receives direct federal financial assistance is required to give notice to
  beneficiaries that:
  • The organization may not discriminate against a
    beneficiary based on religion, a religious belief, a refusal to hold a
    religious belief, or a refusal to attend or participate in a religious
    practice
  • The organization may not require a beneficiary
    to attend or participate in any explicitly religious activities that are
    offered by the organization, and any participation by the beneficiaries in
    those activities must be purely voluntary
  • The organization must separate in time or
    location any privately funded explicitly religious activities from activities
    supported by direct federal financial assistance;If a beneficiary or prospective beneficiary
    objects to the religious character of the organization, the organization will
    undertake reasonable efforts to identify and refer the beneficiary to an
    alternative provider to which the beneficiary does not object; and
  • A beneficiary or prospective beneficiary may
    report violations of these protections, including any denials of services or
    benefits, to the federal agency or intermediary administering the program. 

   

LeadingAge is presently reviewing the final rule and will
provide updates as necessary to provide members with important details.

Computer hackers insert malware on a large hospital network, which encrypts the hospital’s systems, forcing the hospital to revert to paper records, and potentially compromising patient care. The only way the hospital can regain control of its systems is to pay a ransom — in bitcoin currency. 

It may sound like the plot of a Hollywood blockbuster, but this was the recent reality for Hollywood Presbyterian Hospital in Los Angeles for 10 days in February 2016, according to CliftonLarsonAllen. While the real-life data hostage situation took many by surprise, unfortunately, these situations are common — though most organizations are able to avoid the public relations nightmare that befell Hollywood Presbyterian. 

These types of cyberattacks involve hackers inserting malware (i.e., a computer virus) on the hospital’s network, which encrypts a variety of system and data files, making the data unreadable and the systems inaccessible. The insertion of the malware was likely via “phishing,” a method whereby hackers send emails to employees with a link containing the malware. Once an employee clicks the link, the malware is inserted onto the network. 

Ransomware locks down systems 

The malware in this type of cyberattack is called “ransomware” — malicious software that encrypts key system and data files and then demands a ransom in exchange for the encryption key to unlock the files. In this case, after 10 days of locked down systems, the hospital’s leadership decided to pay the ransom in order to regain access and control of the hospital’s systems. The hospital paid $17,000 in an internet currency known as “bitcoin,” a payment method designed to be untraceable. In addition to the ransom, the hospital will spend significant resources evaluating the event and remediating systems and processes to ensure it doesn’t happen again. 

Asking the right questions after an incident 

After a security breach, health care organizations must figure out how the event occurred, and why the organization was unable to react in a timely manner to isolate and quarantine the malware and restore systems to functionality. Answering the following questions will be a significant part of the post-incident analysis: 

1. Was backup data available and deployable? 
2. If this attack was delivered through email, did the employees have user awareness training on the topic of phishing and how to identify malicious emails? 
3. If this attack came from an employee visiting a website or clicking a link, did the organization have web content filtering in place? 
4. What controls should have been in place to either prevent the attack or mitigate the effects? 
5. Was a risk analysis done on the controls that existed prior to the attack? 

These questions are the starting point of an in-depth, post-incident review designed to help the organization learn from the event and minimize the likelihood of recurrence. 

Risk assessment and mitigation 

The unfortunate events at Hollywood Presbyterian provide an opportunity for other organizations to learn from their hard lessons. Asking questions similar to post-incident questions can provide for proactive risk assessment and risk mitigation: 

1. If we lost or someone took our data tonight, could we get it back tomorrow? 
2. When was the last time the disaster recovery and business continuity plan were reviewed, tested, and updated? 
3. How have our systems changed since the last time your disaster recovery plan was updated? 
4. Do members of our team know how to spot a dangerous email? 
5. How often are we refreshing our training messages related to cybersecurity? 
6. Have we performed simulated email phishing attacks, and if yes, how did we fare? 
7. Are we using our computer systems appropriately? 
8. Which internet sites are actually needed to conduct business and which should be blocked? 
9. Have we completed a risk analysis and considered what types of threats exist? 
10. Have we corrected the issues that were identified as threats? 

Legal considerations after breaches 

Security incidents such as a ransomware attack can also raise unique legal questions and may trigger actions based on a number of statutes, regulations, and regulatory agencies. Finding the answers to these questions will require the advice of legal counsel. Organizations that have been the victim of ransomware may have to consider notification obligations, potential liability, reporting to regulatory bodies, and cyber insurance coverage. It will be necessary to determine whether the hospital’s information was accessed or compromised, and exactly which information was compromised. This data will determine how federal and state laws will apply, based on the statutory definition of a breach. 

Additionally, there will be a review of the health care organization’s cybersecurity insurance to determine whether the security incident is covered, and which associated expenses are covered. Finally, the long-term legal repercussions may include required patient notifications, investigation by the Department of Health and Human Services Office of Civil Rights (which investigates violations of HIPAA), and possibly private class action lawsuits for breach of privacy. 

How we can help 

Cybercrime is nothing new in the health care industry. It has been reported to be a six billion dollar a year problem. By all indications, the health care industry is increasingly a target for hackers, as the black market value of a health care record is worth 10 to 20 times more than a credit card number. Due to the amount of information in health care records, they have a longer shelf life in the black market than stand-alone financial information. 

The Hollywood Presbyterian example stands out because a ransom was demanded and paid. If you find it difficult to answer the questions above, or have concerns about your organization’s answers, it’s time to work with professionals who can provide you with the tools you need to mitigate the risks that are so prevalent today. 

The key to managing cybersecurity risks is advanced planning. The CLA health care information security team can help your organization identify potential weaknesses and provide recommendations to strengthen your defenses. If your organization is a victim of a security incident, CLA provides incident responders immediately. 

To manage legal risk, the law firm of Nilan Johnson Lewis has experience with incident response planning, risk assessments performed under attorney-client privilege, and incident response performed under attorney-client privilege. Together, CLA and Nilan Johnson Lewis can provide the technical and legal assistance needed to address cybersecurity risks. 

Randy Romes, Principal, Information Security 
randy.romes@CLAconnect.com or 612-397-3114 

Careen Martin, Nilan Johnson Lewis PA 
cmartin@nilanjohnson.com or 612-305-7691  

This article was reprinted with permission from CliftonLarsonAllen. 

On February 25, 2016, the Financial Accounting Standards Board (FASB) issued its long-awaited standard requiring lessees to recognize all leases with terms greater than 12 months on their balance sheet as lease liabilities with a corresponding right-of-use (ROU) asset. Accounting Standards Update (ASU) 2016-02, Leases (Topic 842), maintains the dual model for lease accounting, requiring leases to be classified as either operating or finance, with lease classification determined in a manner similar to existing lease guidance, according to BKD.

The ASU’s basic principle is that leases of all types convey the right to direct the use and obtain substantially all the economic benefits of an identified asset, meaning they create an asset and liability for lessees. Lessees will classify leases as either finance leases (comparable to current capital leases) or operating leases (comparable to current operating leases). Expenses will be reported on the income statement substantially as they are today—costs for a finance lease will be split between amortization and interest expense, with a single lease expense reported for operating leases.

Lessee Accounting

Under the ASU, lessees should recognize in their statement of financial position a liability to make lease payments (the lease liability) and an ROU asset representing their right to use the underlying asset for the lease term. Today’s capital leases and new leases that are determined to be effectively installment purchases by the lessee will be classified as finance leases, while current operating leases will retain their classification.

Lessees will maintain substantially the same expense recognition patterns for operating leases and finance leases (existing capital leases) as under the existing lease standard. Changes come in terms of the balance sheet and ongoing lease administration.

To help mitigate debt covenant concerns, FASB decided companies should classify lease liabilities as operating obligations in the financial statements, rather than obligations equivalent to debt.

A lessee will recognize the value of the asset created by the lease as an ROU asset and a corresponding lease liability for the minimum lease payments, discounted at the rate implicit in the lease (if the rate isn’t known, the lessee’s incremental borrowing rate will be used).

When measuring assets and liabilities arising from a lease, a lessee (and a lessor) should include payments to be made in optional periods only if the lessee is reasonably certain it will exercise an option to extend the lease or will not exercise an option to terminate the lease. Optional payments to purchase the underlying asset should be included in a similar manner. A lessee (and a lessor) will exclude most variable-lease payments in measuring lease assets and lease liabilities, other than those that depend on an index or a rate or are, in substance, fixed payments.

Lessor Accounting

Lessor accounting is substantially unchanged. However, the ASU contains some targeted improvements intended to align lessor accounting with the lessee accounting model and with the updated revenue recognition guidance issued in 2014 under Topic 606. Lessors will determine lease classification based on whether the lease is effectively a financing or a sale, rather than an operating lease—the concept underlying existing generally accepted accounting principles. Lessors will continue to reflect the underlying asset subject to the lease arrangement on the balance sheet for leases classified as operating; they also will continue to recognize lease income, generally on a straight-line basis over the lease term. For financing arrangements (direct finance or sales-type leases), the balance sheet will reflect a net investment in the lease, representing the sum of the lease receivable and the unguaranteed residual asset. For direct financing leases, the net investment is reduced by any deferred selling profit. 

The leases standard will have the biggest effect on chain pharmacies, large retailers, financial institutions, airlines, shipping and transportation companies and other enterprises that lease big-ticket items of equipment, as well as on real estate entities. Lessees will need to pay particularly close attention to the separation of lease and nonlease components.

Disclosures

The ASU requires both qualitative and specific quantitative disclosures to help investors and other financial statement users better understand the amount, timing and uncertainty of cash flows arising from leasing activities.

Effective Date

The new guidance is effective for public business entities for fiscal years beginning after December 15, 2018, including interim periods within those fiscal years, i.e., January 1, 2019, for a calendar-year entity. Nonpublic business entities should apply the new guidance for fiscal years beginning after December 15, 2019, i.e., January 1, 2020, for a calendar-year entity, and interim periods within fiscal years beginning after December 15, 2020. Early adoption is permitted for all entities.

Transition

The ASU allows companies to apply the lease guidance at a portfolio level and elect transition reliefs (termed “practical expedients”); it also provides guidance to help entities meet implementation requirements. Transition reliefs include the ability to:

• Forgo the requirement to review existing contracts for lease arrangements and evaluate lease classification for existing leases
• Forgo the need to identify initial direct costs for leases that commenced before the effective date
• Use hindsight in evaluating lessee options to extend or terminate a lease or purchase the underlying asset 

Companies are required to use a modified retrospective approach for leases that exist or are entered into after the beginning of the earliest comparative period in the financial statements. Full retrospective application is not permitted.

The update includes specific transition guidance for sale and leaseback transactions, build-to-suit leases, leveraged leases and amounts previously recognized in accordance with the business combinations guidance for leases.

Next Steps

BKD will continue to monitor various aspects of the new standard, including FASB’s plans to provide educational information, respond to technical inquiries and stage workshops. Stay tuned for BKD’s white paper on the leases standard, including an analysis of aspects of the standard likely to require judgment and other external auditor and board discussion topics.

Written By: Connie Spinelli, BKD

This article was reprinted with permission from BKD

The Minimum Data Set (MDS) and Staffing survey is continuing to be rolled out to more states in 2016. Organizations should understand the focus of the survey and prepare for it, because the results can impact its Nursing Home Compare five-star quality rating. 

In 2014, the Centers for Medicaid and Medicare Services (CMS) launched a voluntary pilot study in nursing homes with a special focus on the MDS and self-reported staffing data, as reported on CMS 671 and 672. The pilot survey was launched in 5 states and included 25 facilities. 

The survey can occur at any time and is above and beyond the annual regulatory survey that skilled nursing facilities and nursing facilities are required to do. No new regulations are involved in this survey, but the focus is on compliance with long-standing regulations and how the self-reported data matches those regulations. 

This new survey has 2 main components: 

1. Self-reported staffing data (CMS form 671 and 672), which is gathered during the annual regulatory survey.
2. Accuracy of MDS coding and how that relates to patient care, the five-star quality rating, and quality measures. 

The purpose of this new survey is to verify the accuracy of data that does not have a built in system of checks and balances. 

In the pilot study, 24 out of the 25 facilities were cited for incorrect staffing data and/or MDS coding errors. 

Why is this self-reported data important? 

CMS uses the MDS data in a variety of ways:

• To drive the care planning process as mandated by the Omnibus Budget Reconciliation Act of 1987.  
• To drive payment for Medicare, and in some states, Medicaid. 
• To compile quality measure data. 
• To generate the organization’s five-star quality rating. 

CMS is aware that organizations may increase staffing when the survey window opens, so it wanted a wider view of facilities’ actual staffing patterns. Staffing information, in addition to MDS data, are used to generate the five-star quality rating as seen on Nursing Home Compare. 

Expansion 

In 2015, this survey was launched in all remaining states not included in the original pilot program. CMS will be working with each state to determine which facilities will be looked at as the survey continues roll out in 2016. 

CMS has indicated that 2 surveyors (with web-based training provided by CMS) will conduct each survey over a 2-day period. 

Survey Process 

Upon arrival at each facility, the surveyors will provide an “entrance conference” worksheet with 12 listed items. The facility must prepare these items for the surveyors, within a designated time frame. 

The survey will include a review of 10 resident records, staff and resident interviews, and resident observation. This information will be used to substantiate or refute the MDS coding data. Surveyors will also observe the MDS department to examine the following issues: 

• Staffing ratio to workload. 
• Completion of the MDS (done by a registered nurse). 
• MDS policy and procedures that specify who is responsible for each section of the MDS, and how and when sections are to be completed. 

Surveyors will also be looking at the number of residents per facility, how many MDS surveys are being completed and submitted, and how many staff members are participating in the resident assessment instrument (RAI) process. 

Though they will initially look at specific areas of the MDS, surveyors may expand the survey process at any point based on their observations. The pilot study focused on 7 main MDS areas, 4 of which had the most citations or incorrect coding associated with them. 

1. Restraints (errors) 
2. Falls with major injury (errors)  
3. Pressure ulcers (errors)  
4. Late loss activities of daily living (errors) 
5. Urinary tract infections  
6. Urinary catheters  
7. Use of antipsychotic medication 

Coding of these sections can have a significant impact on quality measures and the facility’s five-star quality rating, which is why these sections are examined. In addition to accuracy, surveyors will also look for timely completion and submission of the MDS data and timely completion of the planning process. 

Possible Outcomes 

The facility will receive a traditional CMS 2567 Statement of Deficiencies and Plan of Correction form after completing the survey and the survey team will use F Tags, which provide associated descriptions of a facility’s deficiency, for citations. The F tags most likely to be used will be F272-287, which relate to the RAI and assessment process. (F tags descriptions can be found in the State Operations Manual SOM appendix PP.) 

As the survey team looks at staffing ratios, it will determine if a facility is at an acceptable level based on whether it is providing the required needs for patient safety and care—meeting the state mandated minimum ratio will not be enough to ensure the facility meets the acceptable level that CMS desires. 

With the 2567 report, the staffing and quality measure domains of the five-star quality rating will be affected if the facility has received citations. It is unclear if they will be adjusting the health inspection domain. 

How to Prepare

In advance of the MDS survey, consider the suggestions below to help improve your processes.  

• Use the “entrance conference” sheet as a guideline and tool to prepare your staff for this unique survey. 
• Develop policies and procedures as they relate to the RAI process. 
• Target your own high-risk areas. CMS has determined high-risk areas, but you should look beyond these.  
• Do mock surveys and random chart audits to determine documentation accuracy. 
• Team involvement is important and the organizational administration should lead the way. Set up an internal system of accountability and demand a commitment to better documentation. 
• MDS accuracy is of utmost importance. 

How We Can Help 

As your facility prepares for the MDS survey, CLA can help you use your MDS software to point you in the direction of potential inconsistencies and errors. We can also help you develop policies and procedures that will meet the survey requirement of the RAI process.

In addition, we can provide documentation audits to determine if your data is correct, if the RAI manual is being followed correctly, and if you have high-risk conditions that are not being monitored or followed up on.

Our mock survey can help you determine if your organization is ready for the survey team and help develop risk meetings to make sure you are addressing both the MDS target areas as well as the annual regulatory survey. 

CLA can guide individual facilities and organizations during the actual survey process to help work through the requests from the survey team using our benchmarking and analytic data tools. 

This article was reprinted with permission from CliftonLarsonAllen.