Have a Plan

  TMA Offers a Policy and Procedure Manual

Texas Medicine Logo

Practice Management Feature – March 2011

Tex Med. 2011;107(3):45-49.

By Crystal Conde
Associate Editor

 Managing a medical practice isn't easy. Not only do physicians have their hands full caring for patients, but they also have to oversee employee recruitment and safety; ensure the practice complies with federal, state, and local laws; address budgetary and financial concerns; and handle a whole host of other responsibilities.

Operational challenges abound, but a practice can enhance its ability to supervise day-to-day trials and unique situations that may arise with the help of a practice-customized policy and procedure manual adhered to by management and physicians, as well as clinical, business office, and administrative staff.

To help medical practices implement and enforce their own policies and procedures, the Texas Medical Association offers for purchase Policies & Procedures: A Guide for Medical Practices. Medical practices can tailor the guide to establish policies and procedures for tasks such as hiring employees and paying staff, developing an emergency response and preparedness plan, and much more.

TMA's new guide boasts 33 chapters divided into sections that cover policies and procedures related to the business office, clinical practice, patient and employee compliance, front desk operations, human resources, management responsibilities, medical records, and safety. The guide also features exhaustive manuals for Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act security and privacy compliance.

Charles Stiernberg, MD, MBA, chair of TMA's Council on Practice Management Services, says medical practices would be in "chaos" without policies and procedures.

"As a practice becomes larger, policies and procedures become even more important," he said.

In Dr. Stiernberg's Houston practice, which has about 25 physicians, new employees must meet with the practice administrator to thoroughly review the policies and procedures.

Upon purchasing a policy and procedure guide, Dr. Stiernberg recommends the physician owners of a medical practice assign the office manager to learn the manual's contents. The manager should then schedule meetings with staff members to educate them on the rules of the practice. He says it's also imperative that physicians become familiar with the guide's contents.

Dr. Stiernberg recommends that Texas physicians purchase TMA's policy and procedure guide because the information in it is germane to Texas laws and regulations.

"I'm a strong believer that you're better off purchasing TMA's policy and procedure guide because national organizations that sell manuals don't necessarily provide Texas-specific information and resources," he said.

A hard copy of the guide with customizable CD is $295 for members and $395 for nonmembers. The customizable CD alone is $255 for members and $355 for nonmembers.

To order the guide, call the TMA Knowledge Center at (800) 880-7955 or e-mail the TMA Knowledge Center.

P&P Guide Good Business

Deborah Hiser, JD, who specializes in health care regulatory and compliance matters in the Austin office of Brown McCarroll LLP, says medical practices should have a HIPAA policy and procedure manual that incorporates the HITECH requirements because HIPAA requires all covered entities, including medical practices, to be compliant.

"When the Office for Civil Rights [OCR] or the Texas attorney general's office investigates a complaint, the first thing they ask for is a copy of the practice's applicable HIPAA/HITECH policy. Without the policies and procedures, the practice is out of compliance with HIPAA and HITECH. The OCR has the authority to impose civil and criminal penalties on the practice. If a practice has an effective policy and has complied with that policy, the OCR considers this as a mitigating factor," she said.

Ms. Hiser and Ana Cowan, JD, wrote the HIPAA and HITECH privacy and security manuals for TMA's policy and procedure guide. The manuals include template policies and forms for:  

  • Staff training on the HITECH Act requirements,
  • Business associate agreements that incorporate the HITECH amendments,
  • Breach risk assessments, and
  • Use of e-mail with patients. 

Ms. Hiser recommends sharing the HIPAA/HITECH Security Compliance Manual with a practice's information technology officer or contractor. That officer can use the security compliance manual's complete list of HIPAA security requirements and template policies and procedures to develop the security program that complies with HITECH.

The HIPAA/HITECH Privacy Compliance Manual spans 119 pages and focuses on:  

  • Patient care management including written and verbal communication,
  • Documentation management,
  • Policy and procedure documentation,
  • Minimum necessary use and disclosure of personal health information,
  • Disciplinary actions for violations of HIPAA and mitigation of damages, and
  • Monitoring and enforcement.

TMA offers a webinar on HIPAA and the HITECH Act that guides physicians on preparing and implementing policies to comply with the new regulations. (See "HIPAA Regulations Compliance Help From TMA.")

In addition, health care payment plans may examine whether a medical practice has an effective and well-implemented policy and procedure guide as a condition to contracting with managed care networks.

According to Allan Chernov, MD, Blue Cross and Blue Shield of Texas (BCBSTX) medical director for health care quality and policy, having a policy and procedure guide isn't a prerequisite to signing an initial practice agreement with BCBSTX. But he says the company does have an on-site physician office review program for primary care physicians, in which a nurse examines whether the practice has written policies and procedures. The nurse speaks with the physicians and staff and points out what the practice is doing well and some opportunities for improvement.

"If a practice didn't have a policy and procedure guide, after the on-site review, BCBSTX would develop a corrective action plan to address any deficiencies. The practice would then follow up with BCBSTX to document that it made the required changes. We'd conduct another on-site review within four to six months," Dr. Chernov said.

He adds that occasionally, when a practice has failed an on-site review, it might not be accepted into the BCBSTX network. Most on-site reviews, however, are positive experiences and received well by physicians, Dr. Chernov says.

He says BCBSTX considers a practice having written policies and procedures to be good business.

"A medical practice's chances of having things go wrong are greater without a formal, written plan," he said.

TMA Guide's Helpful Resources

To help physicians recruit and manage their employees, the human resources portion of the TMA guide has information on equal employment opportunity, advertising of job openings, employment interviews, reference and background checks, and employment confirmation and classifications. The chapter on employment features policies for employee orientation, staff conduct, absenteeism, use of practice property, personal calls and texting, e-mail and social media, and at-will employment.

The benefits chapter provides policies pertaining to health and dental insurance, the Consolidated Omnibus Budget Reconciliation Act, the Family and Medical Leave Act, workers' compensation, paid time off, jury duty, bereavement, military leave, voting, and leave of absence.

Regina Williams, JD, consulted with TMA in developing the human resources portion of the policy and procedure guide. She has some advice to help medical practices effectively implement the human resources policies and procedures. She says the office manager or other designated human resources professional should obtain written proof that the practice furnished new employees with the guide and instructed employees to read the guide. She adds it's a good idea for a practice to conduct an orientation session.

"Practices should arrange for an orientation session with all employees to explain the new policy and procedure guide. The practice should require proof of receipt of the manual and obtain in writing proof the employee attended the orientation session. The employee also has the opportunity to ask questions during the session," she said.

As the practice updates the manual, Ms. Williams says the same training and notification procedures should be required, with a written record of attendance and written proof the employee received the revised policies.

She says larger practices may choose to develop online training programs or employ training professionals, while smaller practices frequently designate the office manager as the human resources professional and require him or her to attend an employment update session annually.

Additionally, the latest version of TMA's guide features a new chapter on financial responsibilities. It includes policies for handling accounts payable and receivable; deposits; petty cash; daily, monthly, and annual reports; and the annual budget. 

Guide May Reduce Practice Liability

Caren Zuniga is the practice administrator of the Piazza Center for Plastic Surgery and Advanced Skincare, owned by Rocco C. Piazza, II, MD. She knows firsthand that a policy and procedure guide can provide some legal protection for medical practices. In her previous employment at a large gynecology and obstetrics group, she says a former employee sued the practice for wrongful termination.

"In that situation, the practice had the employee's signature page on file, showing receipt of the handbook. The practice was able to win the case by proving it followed the policies – as outlined in the manual – for terminating employment," she said.

Ms. Williams says a customized, effectively implemented manual can help a practice reduce its liability exposure.

"Because claims for unpaid vacation pay on termination are often the subject of conflict, a written vacation or paid time off policy that's followed can help a practice avoid claims and/or liability under the Texas Payday Law," she said.

Frequently in unemployment compensation hearings, Ms. Williams says, hearing officers give more credence to an employer's testimony if the practice has a written policy in place and if the employer can prove in writing the practice communicated the policies and procedures to the employee.

"If the employer can show the employee received notice of the written policy and violated the policy, an employer has a substantially better chance at avoiding paying unemployment compensation. The practice can show the employee refused to follow reasonable directives, as opposed to simply being terminated for poor performance," Ms. Williams said.

Adopting and complying with written policies and procedures can also help medical practices avoid claims of unfair or unequal treatment.

"For medium-size to larger practices subject to Title VII or any of the other human rights statutes, if a charge of discrimination is filed, a written policy is frequently considered by equal opportunity agencies in assessing whether probable cause exists to find discrimination," Ms. Williams said.

Title VII is a provision in the Civil Rights Act of 1964 that prohibits discrimination in employment on the basis of race, color, religion, sex, or national origin. Generally, it applies to employers with 15 or more employees working 20 or more weeks in the current or preceding calendar year in which the discrimination charge is filed, according to Ms. Williams.

She says that with increasing frequency, employees use time at work to monitor Facebook or other social networking websites. Employees may use the Internet on the office computer to search for another job or handle personal business. In these instances, Ms. Williams says a well-written policy and procedure guide can assist a practice in avoiding or successfully defending invasion-of-privacy claims brought by terminated employees who claim the practice engaged in unauthorized monitoring of e-mail accounts. The employer can guard against such claims by establishing in writing that the employee enjoys no expectation of privacy in such accounts, she says.

In addition, tailored HIPAA/HITECH security and privacy compliance manuals can help a medical practice reduce its liability exposure, Ms. Hiser says. Should a complaint be filed against a practice, she says adherence to the manuals will assist the practice in showing "good faith effort" to come into compliance with HIPAA and HITECH, minimizing the practice's risk of penalties.

"In the event of a breach, the practice has the available resources in the manual to conduct a risk assessment and provide the required notice to patients, too," she said.

Guide Must Be Updated, Customized, Enforced

But it's not enough for a practice simply to have a policy and procedure guide. It needs to be customized and updated, Dr. Stiernberg says.

"The environment in which physicians practice frequently changes. The medical board adopts new rules, the legislature enacts new laws, and Medicare and Medicaid make changes. The policy and procedure manual needs to be updated at least annually to reflect any alterations in laws and regulations that affect the practice," he said.

He adds technology can alter a medical practice's work atmosphere.

"As technology changes so must a medical practice's policies and procedures. Having a policy on staff telephone use isn't sufficient anymore. Now employees can communicate with text messages and social networking," Dr. Stiernberg said.

To address staff communication in the office, Dr. Stiernberg says his group added policies and procedures on office computer use, social networking, and texting to its manual.

When Ms. Zuniga joined the five-employee Piazza Center for Plastic Surgery and Advanced Skincare in Austin in November, she had the task of completing the practice's policy and procedure guide. Ms. Zuniga says she used the policy and procedure manual from her past employer as a model for the Piazza Center's guide.

In addition to outlining policies and procedures for employee performance and salary reviews, terminations, employment eligibility, paid time off, and other human resources topics, Ms. Zuniga customized some portions of the guide for the new practice.

"I did have to customize some of the employee benefits policies. The practice offers a beauty benefits package to employees, so I had to incorporate that into the guide. I also added a policy summary at the back of the handbook on dress code and certain staff responsibilities that need to be completed on a specific schedule," she said.

To successfully enforce a practice's policy and procedure guide, Ms. Hiser suggests that a practice provide training on the guidelines to all new and current employees. She adds that the guide should be reviewed annually to determine if new or amended laws require updates to the policies and procedures.

Crystal Conde can be reached by telephone at (800) 880-1300, ext. 1385, or (512) 370-1385; by fax at (512) 370-1629; or by e-mail.


HIPAA Regulations Compliance Help From TMA

 The Health Information Technology for Economic and Clinical Health (HITECH) Act significantly changes Health Insurance Portability and Accountability Act (HIPAA) privacy and security policies that affect physicians. Chief among them, according to Deborah C. Hiser, JD, are the new breach notification regulations, developed by the U.S. Department of Health and Human Services Office for Civil Rights. The new regulations require physicians to have systems to detect breaches of patients' private information and to notify them when a breach occurs.

To comply with the new regulations, Ms. Hiser says physicians need to develop written HITECH policies and procedures, including one for breach notification. (Read "Mum's the Word," August 2010 Texas Medicine, pages 49–53.)

The Texas Medical Association has developed resources, in conjunction with Ms. Hiser and Ana Cowan, JD, with the law firm of Brown McCarroll LLP, to help physicians comply with the new HIPAA privacy and security regulations. Both attorneys focus on health care regulatory and compliance matters.

TMA offers a webinar on HIPAA and the HITECH Act, presented by Ms. Hiser. The risk management seminar guides physicians on preparing and implementing policies to comply with new HIPAA and HITECH regulations.

TMA designates each educational activity for a maximum of 1 AMA PRA Category 1 Credit™. Each activity has been designated as 1 hour of ethics and/or professional responsibility education.

The recorded webinar can be accessed on the Distance Learning Center website.

Back to article

March 2011 Texas Medicine Contents
Texas Medicine Main Page