1) Question

Below identify the risks, and develop a work plan (see a work plan example(s).) charts/tables, etc...

RISK ASSESSMENT / WORK PLAN EXERCISE

Community Health Plan, a licensed HMO, provides services to Medicare enrollees. It recently hired a firm to audit the plan's compliance with Medicare requirements. The firm reported that the plan did not comply with Medicare regulations in two areas: (1) marketing to beneficiaries; and (2) grievance and appeal procedures.

The Centers for Medicare & Medicaid Services (CMS) informed Community Health Plan that it will be conducting an audit within the next twelve months.

Community Health Plan has established HIPAA policies and procedures to safeguard PHI. It has mandatory HIPAA training for all planning staff at orientation, yearly training updates, and specialized training for medical records staff. In an interview with the HIPAA Compliance Officer, she acknowledged that the Plan's privacy policies are not always followed: staff sends PHI in the unencrypted email to business associates; some vendors receive PHI before entering business associate agreements, and she receives at least one written HIPAA complaint each month about a patient's PHI that was shared with a caretaker family member without the patient's authorization.

Last year, the State Managed Care Department fined Community Health Plan $250,000 for failing to comply with the State's law regarding prompt payments to physicians. Since then, the Plan has implemented a corrective action plan, established new policies and procedures for processing claims, and purchased new software to pay claims on time.