Refuah Community Health Collaborative (RCHC) PPS Compliance Partner Training 2018

Welcome! In this training presentation, you will: Learn about Privacy and Data Sharing within DSRIP Learn about RCHC’s Compliance Program and Partner Responsibility under the Compliance Program Know who to contact with DSRIP related compliance questions

Privacy and Data Sharing Guidance Document released October 2017 Data sharing of state provided data between PPS Partners, other than the Lead PPS, PPS Partner can establish appropriate BAAs that cover direction of data sharing PPS Partner that wishes to share specific information may also request that the PPS Lead share that specific information with the other PPS Partner

Privacy and Data Sharing Continued A PPS Partner may share data with other PPS Partners with affirmative member consent to share the data PPS Leads must ensure that any Medicaid data related to members that have opted out of DSRIP data sharing, are not included in current data sets and not utilized by the PPS or shared

Possible Methods for Data Sharing within PPS PPS Lead and PPS Partner are both part of same Organized Health Care Arrangement under HIPAA and PPS Provider’s Notice of Privacy Practice indicates data may shared with PPS Lead PPS Lead is made a HIPAA Business Associate of the PPS Partner so that the PPS Lead is, on behalf of PPS Partner, creating, receiving, maintaining, or transmitting clinical data for a function or activity regulated by HIPAA

PHI Generated within the PPS Clinical data may be generated by 1) general health care providers; 2) mental health providers; or 3) substance use disorder (SUD) treatment providers. Clinical data may be shared with adequate and appropriate consent of the patient. PHI maintained by general health care providers, including HIV information, may also be shared under the terms of a contract with a contractor that creates, receives, maintains, or transmits PHI on behalf of the covered entity who generated the PHI.

PHI Generated within the PPS Health care providers may share the clinical data with a PPS Lead Organization for the purposes of reimbursement in the form of DSRIP payments for achievement of project milestones and population- based metrics Disclosures of mental health data must be permitted under MHL Section 33.3, where applicable. SUD data may be shared with a consent from the patient that meets requirements of 42 CFR Part 2 or under a Qualified Service Organization (QSO).

PHI Generated by MCOs or Managed by QEs PHI data that is provided to the MCO on the PPS’ attributed members can be shared with the PPS Lead as long as member has not opted out. Other PHI data can be shared based on agreements between MCO and PPS. PHI can be managed by QEs as a) a contractor for a PPS Lead; or b) health information exchange organization to facilitate the exchange of data among QE Participants.

RCHC Compliance Program

RCHC’s Compliance Program Introduction What exactly is compliance? Establishes and promotes a culture of integrity and ethical behavior Utilizes tools to prevent and/or detect violations of law or policy Encourages problems to be reported Provides a mechanism for constant monitoring Provides assistance in complying with complex governmental regulations Safeguards public and private funds; helps control fraud, waste, and abuse

RCHC’s Compliance Program Introduction As a Partner, what am I expected to do? Participate in good faith in meeting the applicable metrics of the DSRIP program Implement training and education provided by the PPS Lead Develop or maintain a compliance program where required under NYS law Observe contractual and other compliance requirements as required by the PPS Lead and state law, regulation, and policy

RCHC’s Compliance Program Consists of… Compliance Committee and oversight from EGB Compliance Plan Designation of a Chief Compliance Officer Written policies and procedures Anonymous reporting mechanism Training and education responsibilities And more!

RCHC Compliance Plan Mission is to instill a culture of prevention, detection, and resolution of all instances of non-compliance with DSRIP Rules and Regulations as well as PPS Protocols. Ensures that PPS Providers and Personnel are familiar with DSRIP conditions of participations, applicable federal and state rules and regulations, and properly implement PPS Project Plans. Compliance Plan can be found online at: http://www.refuahchc.org/compliance/ Any questions about the Compliance Plan or policies and procedures should be directed to Azizza Graziul, Esq. at agraziul@refuahchc.org

RCHC Policies and Procedures: Where can I find them? Can be found on RCHC’s website: http://www.refuahchc.org/compliance/ Includes all PPS approved policies: Compliance Policies Financial Policies Check often for new policies added and/or revisions to made to existing policies

Designation of Chief Compliance Officer RCHC has designated a Chief Compliance Officer charged with the day to day operations and monitoring of the Compliance Program. RCHC’s Chief Compliance Officer is Azizza Graziul, Esq. She can be reached at 845-354-9300 x 1257 or by email at agraziul@refuahchc.org

Standards of Conduct General Standards: Standards place affirmative duty on all personnel to report actual or perceived violations Personnel are expected to be familiar with and abide by RCHC’s Compliance Program and policies and procedures. No employment, engagement, or payment to excluded entities or persons: In order to receive federal funds under DSRIP, a partner must not be an excluded entity. Monthly exclusion checks are performed. Personnel must appropriately and accurately record and report DSRIP-related information, transactions and activities, including records related to patients and their care.

Standards of Conduct Confidentiality- Patient Information: All personnel must abide by HIPAA privacy and security standards regarding protected health information Patient information must be treated with utmost confidentiality Confidentiality- Business Information: Personnel may gain access to confidential information by virtue of his/her participation in or position within their respective organization. Personnel may not communicate confidential information about its organization, partners, or any patients covered by the DSRIP program as it pertains to RCHC, including information of or about another RCHC participating entity or its patients, to anyone and may not be used as a basis for personal or family gain

Who Do I Contact with DSRIP Related Compliance Concerns? Speak with your supervisor or manager Contact RCHC’s Chief Compliance Officer, Azizza Graziul, Esq., directly at 845-354-9300 x 1257 or agraziul@refuahchc.org You may report any potential instances of non- compliance anonymously through the Compliance Hotline: By Phone: (844) 280-0009. The Hotline is open 24/7/365 and its focus is encourage reporting of any fraud, waste, and abuse. By Email: reports@lighthouse-services.com

Training and Education Partners are expected to disseminate all trainings and education to their organization from RCHC Partner will attest to the dissemination of all trainings to RCHC “Targeted” trainings will be provided to individual partners engaged in RCHC projects