January 2017

The Regulatory Challenges of Population Health Management
By Keith Loria
For The Record
Vol. 29 No. 1 P. 18

A lot of data may be in the hands of a lot of parties, making compliance difficult.

While the idea of population health management is not new, the concept has gained more attention recently as health care costs have skyrocketed and access to care has been limited.

"As a result, the emphasis is shifting from volume to value, and physicians are being financially rewarded to reduce the cost of care required by their patients and to ensure that necessary care is delivered in the most cost-effective setting," says Maja Lacevic, an associate at Trenam Law. "Simply put, health care reimbursement is changing and health care providers need to acclimate. Organizations that focus on having systems in place that allow for patient-centered, quality health care across a population will come out ahead."

Rafael Villalobos, Jr, JD, a Philadelphia-based attorney with Eckert Seamans, says the biggest buzz in population health management involves Big Data, including predictive and prescriptive analytics.

"The concept of population health management involves hospitals, physicians, care managers, population health management organizations, employers, insurance companies, and other stakeholders all working together to improve the health and wellness of a defined population," Villalobos says. "These stakeholders are trying to achieve this objective as efficiently as possible and doing so in an environment of ever-increasing consumerism in which patients are far more informed about outcomes, mortality and morbidity rates, readmissions, quality, and safety."

Another emerging topic in population health management is the virtualization of health care, whose goal is to harness new and emerging technologies to ensure accessibility to quality health care while at the same time driving down the cost of providing that care.

"One of the ways stakeholders are attempting to drive down cost and improve flexibility/maneuverability related to market challenges, including reaction to the emergence of new retail players in the health care segment, is less focus on fixed assets and less bricks and mortar," Villalobos says. "Repurposing space and sharing services can contribute to these reductions in cost. Even the concept of 'wellness villages' has garnered some attention."

Population health management requires a change in the outlook and the practice patterns of health care providers. Health care organizations will need to embrace a new reimbursement model to support population health management, while at the same time encouraging their providers to adopt a new way of doing business and being rewarded.

Up for the Challenge
John Hoffstatter, director of clinical and operations strategy at Computer Task Group, says health care providers must understand that population health won't work if they are looking at one isolated system. It's essential to pay close attention to how patient data have been aggregated, he says.

"Think of it as the data supply chain—as we pull more information from multiple systems across the globe, it's crucial that we understand who owns what, the hand-offs, which contracts and business agreements need to be in place to meet HIPAA, and many other pertinent details," Hoffstatter says. "The biggest challenge in this is just making sure that health care providers are aware of the activity occurring. It can be difficult to discover the means by which your second and third parties are going about aggregating data with all of the new creative and nontraditional ways."

As more creative tactics come into play, it's important that health care providers are aware of today's regulatory pitfalls associated with population health programs. In that regard, Lacevic says organizations must ensure they have the internal and external capabilities, support, and expertise to gainfully implement and participate in population health management.

"Your team should include a robust compliance program and point person for that program, strong technological capabilities and network, as well as trusted external advisors, including a legal team to ensure that the organization's day-to-day operations comply with both state and federal regulatory requirements," she says. "At an operational level, this will mean that organizations may need to change their structure as well as workflows to implement population health management and adopt new automation tools to develop and report the data necessary to comply with new governmental and payer requirements."

Neal Singh, president and CEO of Caradigm, says the evolving health care landscape requires organizations to be adaptable and flexible. "The biggest overall challenge is that the health care industry is being asked to care for patients in a radically different manner than it had under the fee-for-service model. It's all new," he says. "Few organizations have more than a couple of years of experience in it, and CMS [Centers for Medicare & Medicaid Services] keeps throwing new wrinkles in every year to keep accelerating the shift to value-based reimbursement models.

"Another enormous challenge facing health care is data," he continues. "Having disparate health IT systems, such as having multiple EHRs, is the norm, particularly for clinically integrated networks. Organizations have to balance the need to consolidate patient data with the need to protect it."

Villalobos notes there is no shortage of federal and state agencies, no dearth of laws and regulations with which health care providers must contend. Ensuring compliance with these laws and regulations is a daunting task that is best tackled with an interdisciplinary approach.

Potential pitfalls include not only HIPAA and the HITECH Act but also stringent state confidentiality laws, antitrust concerns, breaches of contract, negligence, fraud and abuse, defamation, civil conspiracy, discrimination, restraint of trade, allegations of monopolizing activities, reputational damage, and loss of licensing and/or accreditation.

"In order to navigate safely, population health management organizations must rely upon in-house counsel, external counsel, IT experts, compliance officers, privacy and security officers, and consultants galore," Villalobos says. "Likewise, training is required related to best practices to ensure that providers can fully enjoy the protections of privileges and immunities, exceptions, exemptions, safe harbors, and carve outs. No one person, department, or area of specialization can master all of these areas of potential threats or potentially available protections."

Organizations need to use their compliance committees as a mechanism to obtain input from various stakeholders and provide education and training on salient issues. Additionally, the use of mandatory computer-based training modules can generate documentation to prove training occurred and provide an electronic mechanism to track and ensure compliance.

The Role of Compliance Officers
Compliance officers and organizational leadership will be at the forefront of ensuring that population health management is properly implemented and coordinated across care settings and service lines.

"Compliance officers will need to work with organizational and institutional leadership, including physicians, to set clear organizational goals, maintain continuous assessment of technology, and have an effective rollout strategy," Lacevic says. "Population health management links a broad spectrum of distinct providers who may or may not be otherwise jointly owned or affiliated. This type of proactive clinical management creates potential legal and regulatory exposures that compliance officers need to be aware of and monitor."

Even with the best systems in place, there may be outliers whose lack of compliance with portals or failure to meet the required metrics will hinder the program's success if they're not proactively addressed.

Villalobos notes that not only must compliance officers stay abreast of developments in state and federal laws and regulations, but they also must be able to educate stakeholders, primarily through a compliance committee. "Compliance officers need to follow the flow of data. What information is going into the electronic system? Who is putting it in? Is it accurate? Where is it going? Who has access to it? Is access appropriate and protected?" he says. "A compliance officer would also be wise to review, along with counsel, the consent forms being executed by patients."

Learning the Ropes
Because population health management is just now gaining a wider footprint, it can be challenging for compliance officers who are unfamiliar with its concepts. To help combat this inexperience, Lacevic recommends turning to a trusted team of advisors who can answer the most nuanced and situational of questions regarding automation tools and reporting.

Compliance officers can stay abreast of the constantly evolving governmental rules and regulations by paying regular visits to the websites of CMS, Health and Human Services, and the Centers for Disease Control and Prevention Division of Population Health.

Other groups and resources available to assist compliance officers include the Health Care Compliance Association, the American Health Lawyers Association, the Center for Medical Interoperability, the Institute for Health Technology Transformation, and the Institute for Healthcare Improvement.

Technical and Creative Updates
The adoption of effective HIT is essential to the success of population health management. For example, to manage population health effectively, an organization must be able to track and monitor the health of individual patients, Lacevic notes.

However, EHR adoption is only the first step toward creating the required infrastructure. The population health management organization and participating providers require access to medical records, data, and analytics in order to appropriately manage the heath care needs of their patients. "Systems need to be consistently and continuously updated to maintain privacy and security and for new changes in technology as well as new governmental regulations, including the rules governing business associates," Lacevic says.

Much like in other sectors of HIT, usability and interoperability concerns remain a major focus of population health management initiatives. Systems must communicate easily and effectively in order to assemble, aggregate, and meaningfully analyze and leverage data.

Villalobos is confident the industry can meet the challenge. "New services are being introduced with enhanced data mining capabilities," he says.

Technological and creative updates associated with HIPAA/HITECH compliance are having a major effect on population health initiatives. "Cybersecurity continues to emerge as an area of concern for providers and payers," Villalobos says. "There have been numerous events involving hospital computer systems being hacked into and systems taken hostage by cyber criminals. Given the fact that there are so many individuals and organizations accessing electronic systems within the population health management framework, there are many entry points for those with nefarious intent."

Hoffstatter cautions organizations on their use of data derived from a population health management initiative. Just because an assortment of patient information is now more accessible, organizations must be judicious in using it only when appropriate, he notes.

"Crossing domains of use like states or applications can get sticky—and with little transparency, it can be hard to be aware of some of the new and nontraditional ways data are being aggregated," Hoffstatter says. "With so many resources to pull from, compliance with HIPAA/HITECH ensures the security of patient information."

When negotiating a population health agreement, organizations must clearly define key goals and adopt a strategy that addresses both quick wins and long-term goals, Singh says. Population health management initiatives must also be prepared to readjust as requirements evolve, he adds.

"Population health contracts are most successful when they set up a framework for a strong partnership and collaboration between parties and constituents such as payer organizations and employers," Singh says. "As health care systems look to address evolving population health needs such as value-based care, contracts can play an important role in success as they can be used to both define and educate the organization and the solution provider on what each party will bring to the partnership."

The Last Word
While adherence to pathways, protocols, and guidelines is at the core of a successful population health management program, there will be situations where a patient's comorbidities or other factors make adherence inappropriate. Lacevic notes that agreements and transactions need to be structured so that physicians and other providers can use their professional judgment in applying pathways, protocols, and guidelines.

"If the system involves the formation of a separate entity, the authority to take certain actions can be placed in the entity's organizational documents, such as bylaws, with a required contractual commitment from participants in the system to abide by the relevant provisions of the governing documents," she says. "Furthermore, the standards for admission and continuous eligibility to be a participant must be reasonable and clearly expressed in provider agreements and well-defined policies and procedures."

Population health management requires participants in the health care marketplace to develop new skill sets and structures for delivering care. To stay viable, providers, health systems, and other organizations need to make the transition to population health management, but they can't do it alone.

"We are still in the infancy stages of population health, but with the adoption of analytics and applications, we are getting better at identifying and stratifying populations," Hoffstatter says. "Technology can support population health programs, but it is the processes, innovative interventions, and patient engagements that will ultimately lead to improvements in these populations. The success is in the services provided, and getting these populations motivated is what makes all of the difference."

— Keith Loria is a freelance writer based in Oakton, Virginia.