1. Refuah Community Health Collaborative (RCHC) PPS
Compliance Partner Training
2018

2. Welcome! In this training presentation, you will:
Learn about Privacy and Data Sharing within DSRIP
Learn about RCHC’s Compliance Program and Partner Responsibility under the Compliance Program
Know who to contact with DSRIP related compliance questions

3. Privacy and Data Sharing
Guidance Document released October 2017
Data sharing of state provided data between PPS Partners, other than the Lead PPS, PPS Partner can establish appropriate BAAs that cover direction of data sharing
PPS Partner that wishes to share specific information may also request that the PPS Lead share that specific information with the other PPS Partner

4. Privacy and Data Sharing Continued
A PPS Partner may share data with other PPS Partners with affirmative member consent to share the data
PPS Leads must ensure that any Medicaid data related to members that have opted out of DSRIP data sharing, are not included in current data sets and not utilized by the PPS or shared

5. Possible Methods for Data Sharing within PPS
PPS Lead and PPS Partner are both part of same Organized Health Care Arrangement under HIPAA and PPS Provider’s Notice of Privacy Practice indicates data may shared with PPS Lead
PPS Lead is made a HIPAA Business Associate of the PPS Partner so that the PPS Lead is, on behalf of PPS Partner, creating, receiving, maintaining, or transmitting clinical data for a function or activity regulated by HIPAA

6. PHI Generated within the PPS
Clinical data may be generated by 1) general health care providers; 2) mental health providers; or 3) substance use disorder (SUD) treatment providers.
Clinical data may be shared with adequate and appropriate consent of the patient. PHI maintained by general health care providers, including HIV information, may also be shared under the terms of a contract with a contractor that creates, receives, maintains, or transmits PHI on behalf of the covered entity who generated the PHI.

7. PHI Generated within the PPS
Health care providers may share the clinical data with a PPS Lead Organization for the purposes of reimbursement in the form of DSRIP payments for achievement of project milestones and population- based metrics
Disclosures of mental health data must be permitted under MHL Section 33.3, where applicable.
SUD data may be shared with a consent from the patient that meets requirements of 42 CFR Part 2 or under a Qualified Service Organization (QSO).

8. PHI Generated by MCOs or Managed by QEs
PHI data that is provided to the MCO on the PPS’ attributed members can be shared with the PPS Lead as long as member has not opted out. Other PHI data can be shared based on agreements between MCO and PPS.
PHI can be managed by QEs as a) a contractor for a PPS Lead; or b) health information exchange organization to facilitate the exchange of data among QE Participants.

9. RCHC Compliance Program

10. RCHC’s Compliance Program Introduction
What exactly is compliance?
Establishes and promotes a culture of integrity and ethical behavior
Utilizes tools to prevent and/or detect violations of law or policy
Encourages problems to be reported
Provides a mechanism for constant monitoring
Provides assistance in complying with complex governmental regulations
Safeguards public and private funds; helps control fraud, waste, and abuse

11. RCHC’s Compliance Program Introduction
As a Partner, what am I expected to do?
Participate in good faith in meeting the applicable metrics of the DSRIP program
Implement training and education provided by the PPS Lead
Develop or maintain a compliance program where required under NYS law
Observe contractual and other compliance requirements as required by the PPS Lead and state law, regulation, and policy

12. RCHC’s Compliance Program
Consists of…
Compliance Committee and oversight from EGB
Compliance Plan
Designation of a Chief Compliance Officer
Written policies and procedures
Anonymous reporting mechanism
Training and education responsibilities
And more!

13. RCHC Compliance Plan
Mission is to instill a culture of prevention, detection, and resolution of all instances of non-compliance with DSRIP Rules and Regulations as well as PPS Protocols.
Ensures that PPS Providers and Personnel are familiar with DSRIP conditions of participations, applicable federal and state rules and regulations, and properly implement PPS Project Plans.
Compliance Plan can be found online at:
Any questions about the Compliance Plan or policies and procedures should be directed to Azizza Graziul, Esq. at

14. RCHC Policies and Procedures:
Where can I find them?
Can be found on RCHC’s website:
Includes all PPS approved policies:
Compliance Policies
Financial Policies
Check often for new policies added and/or revisions to made to existing policies

15. Designation of Chief Compliance Officer
RCHC has designated a Chief Compliance Officer charged with the day to day operations and monitoring of the Compliance Program.
RCHC’s Chief Compliance Officer is Azizza Graziul, Esq. She can be reached at x 1257 or by at

16. Standards of Conduct General Standards:
Standards place affirmative duty on all personnel to report actual or perceived violations
Personnel are expected to be familiar with and abide by RCHC’s Compliance Program and policies and procedures.
No employment, engagement, or payment to excluded entities or persons:
In order to receive federal funds under DSRIP, a partner must not be an excluded entity. Monthly exclusion checks are performed.
Personnel must appropriately and accurately record and report DSRIP-related information, transactions and activities, including records related to patients and their care.

17. Standards of Conduct Confidentiality- Patient Information:
All personnel must abide by HIPAA privacy and security standards regarding protected health information
Patient information must be treated with utmost confidentiality
Confidentiality- Business Information:
Personnel may gain access to confidential information by virtue of his/her participation in or position within their respective organization.
Personnel may not communicate confidential information about its organization, partners, or any patients covered by the DSRIP program as it pertains to RCHC, including information of or about another RCHC participating entity or its patients, to anyone and may not be used as a basis for personal or family gain

18. Who Do I Contact with DSRIP Related Compliance Concerns?
Speak with your supervisor or manager
Contact RCHC’s Chief Compliance Officer, Azizza Graziul, Esq., directly at x 1257 or
You may report any potential instances of non- compliance anonymously through the Compliance Hotline:
By Phone: (844) The Hotline is open 24/7/365 and its focus is encourage reporting of any fraud, waste, and abuse. By

19. Training and Education
Partners are expected to disseminate all trainings and education to their organization from RCHC
Partner will attest to the dissemination of all trainings to RCHC
“Targeted” trainings will be provided to individual partners engaged in RCHC projects