Delegation

Contracting for Shredding or Storage of PHI: Delegation?


For as long as we've been involved with URAC, which dates back to the late 1990s, the delegation standards applied only to the functions covered by the main standards of the module that is the subject of the accreditation. In other words, if a substantative standard (not a back-office, administrative function), required an applicant to do something, and the applicant hired another organization to do it instead, it was considered delegation and therefore covered by what are now Core 6-9.

In recent months (the duration of this period is the subject of some dispute among observers and participants), this interpretation was broadened to include administrative functions that dealt with PHI, such as storage and shredding of PHI. In other words, if you hired a company like Iron Mountain to store your documents, you needed to comply with the delegation standards.

After discussion among URAC staff, committee members, accredited organizations, and consultants, URAC came up with the middle-ground on this issue, finding that Core 6, 7, and 9 do not apply in such circumstances. Instead, what is needed in the document submissions for Core 8 are:

  • A Business Associate Agreement and Vendor Agreement that addresses the following issues:

* Breach

* Breach remediation

* Transferring the data

* Requirement of training for the BA's staff

* Proper handling of the PHI

  • A policy on how IIHI (for workers comp) or PHI (For HIPAA covered entities and business associates) is handled within the organization and how IIHI or PHI is turned over to the vendor for shredding and destruction, whether onsite or offsite.

CORE, Version 3.0 CORE 9 - Delegation Oversight


The Basics

This standard sets forth the requirements for your delegation oversight mechanisms for your contractors that are not URAC-accredited.  For each such non-accredited contractor, you must:

  • conduct a periodic review (at least yearly) of your contractor's policies and procedures, as well as any documentation about quality improvement activities regarding the delegated functions;
  • verify (at least annually) that your contractor is complying with the requirements of your delegation agreement and applicable P&Ps; and
  • make sure that any financial incentives employed by your contractor do not compromise quality of care.

The trickiest of these elements is the last one.  You need to have a documented procedure to, first, know whether your contractor has financial incentives for its employees or agents.  If, as a result of your inquiry, you learn that the contractor does employ such incentives, you then need to document that you have conducted sufficient oversight to be comfortable that the incentives in no way compromise the well-being of patients.

Management Tips

The management key for this standard is documentation of oversight.  Most URAC-accredited companies keep all the documentation regarding a delicate in a dedicated binder.  Behind each tab (clearly marked, of course) are such documents as pre-delegation audits, the delegation agreement, reports submitted by the contractor regarding its performance under the delegation agreement, documented evidence of your organization's periodic review of the contractor's P&Ps, documentation of your compliance oversight process, and finally, documentation of a review of any impact financial incentives may have on patient care.

URAC Accreditation Tips

The element of the standard that addresses periodic monitoring for compliance with the contract is a mandatory element.  The other two elements are weighted 3 and 2.

The documentation required to be submitted with the initial application is simply the applicable delegation oversight  P&P.  just make sure that it contains all the required elements of this standard.  In addition, it would be prudent to submit any templates for audit mechanisms you may use in the implementation of that policy.

As was the case with the previous three standards, delegation binders will be the focus of the reviewer's attention during the on-site review.  The reviewer will have an expectation that those binders are complete, well-organized, and clearly marked.

CORE, Version 3.0 CORE 8 - Delegation Contracts


The Basics

This standard applies to all delegation arrangements, even to those with organizations that are accredited by URAC.  It lists eight specific requirements for the contract between your organization and all delegates.  Some of the requirements are perfunctory (e.g., that the contract describes which duties are being delegated and which duties are being retained by your organization), but there are several elements that you should not assume are already in all of your delegation agreements, particularly if you are a first-time applicant.  Two of those elements are mandatory and almost certainly are not in the delegation agreements of a first-time applicant.

Here are the particularly critical elements of the delegation agreement:

  • a requirement that the contractor performed a delegated functions in compliance with your organization's policies and procedures and URAC standards;
  • an affirmative requirement on your contractor that it notify your organization of any material change in its performance of the delegated functions;
  • authorization for your organization to conduct surveys of the contractor;
  • an affirmative requirement on the contractor to submit periodic reports to your organization regarding its performance of delegate function;
  • a description of the circumstances under which the contractor may further delegate the functions your organization has delegated to it; and
  • a requirement that, if the contractor does further delegate the delegated functions to a subcontractor, the agreement between the contractor and subcontractor specify that the subcontractor will perform the delegated functions under the terms of the delegation agreement between your organization and the contractor and URAC standards.

Of critical importance is that the language in your contract specifically mention URAC in both of the contexts described above.  Merely referring to "accreditation standards" will not suffice (although at one time such language would have been enough).

Management Tips

A sticking point for many applicants, delegation contracts require more attention than most aspects of a URAC accreditation application. 

A few things to remember:

If your delegate is URAC-accredited, this is the only standard that applies to that delegation relationship.

Subsection (b) is explicit about the agreement requiring that the delegate comply with URAC standards. A clause requiring the delegate to comply with your organization's standards (which, of course, comply with URAC standards) is not enough. Similarly, a clause requiring that the delegate comply with another accreditor's standards (e.g., NCQA) is not enough. 

Subsection (c) is another tricky one. Put simply, your contract must have a clause which confers an affirmative obligation on your delegate to let you know when circumstances have changed such that it can no longer perform the functions it's supposed to perform under the agreement. This is separate from the reporting obligation under subsection (e). Be explicit about this requirement on your delegate.

Subsections (g) and (h) are distinct requirements. Restated, (g) requires that your agreement describes what the delegate must do in order to subdelegate (e.g., get your permission in writing). If your agreement prohibits subdelegation, that will suffice. Subsection (h) is applicable only if subdelegation is permitted, and requires that your delegation agreement require that any subdelegation arrangement be subject not only to your organizational requirements but also to URAC's (or "applicable accreditation requirements").

URAC Accreditation Tips

The two elements that specifically reference URAC are both mandatory. The rest range in value between 2 and 4.

While URAC only requires that you submit your template delegation agreement, we also recommend that you submit a policy and procedure that requires that all delegation agreements comply with the standard.

During the on-site review, again, the reviewer's attention will be on the delegation binders.

CORE, Version 3.0 CORE 7 - Delegation Review


The Basics

While the previous standard requires that you have criteria for selecting delegates, this standard requires that you go through a process for applying those criteria to candidates for delegation to make sure that the candidates have the capacity, policies, and procedures necessary to perform the functions that you wish to delegate to them.

Management Tips

In addition to the documentation processes discussed in connection with the previous standard, make sure that you also have documentation that demonstrates that you have reviewed the delegation candidates' policies and procedures and anything else that would help you to assess whether the contractor has the capacity to perform the duties you wish to delegate.

This standard does not apply to contractors who are URAC-accredited for the functions you delegate to them.

URAC Accreditation Tips

Both elements of this standard are weighted 3.

As was the case with the previous standard, you should submit both policies and procedures that describe the pre-delegation screening process and any tools, such as audit sheets, that you use an implementation of that process.

During the on-site review, again, the focus will be on a review of the delegation binders and interviews of those charged with delegation oversight.

CORE, Version 3.0 CORE 6 - Delegation Review Criteria


The Basics

This standard requires that, before you delegate any function that is covered by your URAC accreditation program, you establish criteria to be used in your selection process for organizations to which you delegate that function.

This applies to anything under the scope of your URAC accreditation except network contracting.  If you don't delegate any URAC-relevant functions, this standard doesn't apply to your organization.  If the entity is performing an administration function and does not perform independently of the organization, this function would not be considered a delegated function. This is true even if PHI is involved. In such a case, all you need is a Business Associate agreement and a vendor agreement with the organization. Core 6-9 will not apply.

The delegation assessment need not consist of an on-site review.  Just make sure that all of your pre-delegation assessments comply with your policy and procedure on that topic.  In other words, if your P&P requires an on-site assessment, you must conduct one.  

Management Tips

The key here is not only to have a policy and procedure that covers pre-delegation assessment, but to have a systematic way of recording such assessments.  Documentation review audit sheets are a good example of such documentation.  It is also important to make sure that your contracting process for delegates doesn't have any leaks in it.  More than once, an applicant for accreditation has been tripped up by this standard when somebody in the company didn't get the memorandum, and entered into an agreement with a new delegate without using the required criteria or the standard delegation agreement described in Core 8.

This standard does not apply to contractors who are URAC-accredited for the functions you delegate to them.

URAC Accreditation Tips

This standard carries a weight of 3.

As you might expect, the initial documentation submitted should be be policy and procedure that prescribes pre-delegation assessment processes.  In addition, any templates used in the course of such assessments should also be submitted.

The on-site review for this and the subsequent delegation standards consists largely of a review of the delegation binders in an interview of staff members who are charged with delegation oversight.

Pharm Core 18 - Delegation Oversight


 

The Basics

This standard sets forth the requirements for your delegation oversight mechanisms for your contractors that are not URAC-accredited.  For each such non-accredited contractor, you must:

 

  • conduct a periodic review (at least yearly) of your contractor's policies and procedures, as well as any documentation about quality improvement activities regarding the delegated functions;
  • verify (at least annually) that your contractor is complying with the requirements of your delegation agreement and applicable P&Ps; and
  • make sure that any financial incentives employed by your contractor do not compromise quality of care.

 

The trickiest of these elements is the last one.  You need to have a documented procedure to, first, know whether your contractor has financial incentives for its employees or agents.  If, as a result of your inquiry, you learn that the contractor does employ such incentives, you then need to document that you have conducted sufficient oversight to be comfortable that the incentives in no way compromise the well-being of patients.

Management Tips

The management key for this standard is documentation of oversight.  Most URAC-accredited companies keep all the documentation regarding a delicate in a dedicated binder.  Behind each tab (clearly marked, of course) are such documents as pre-delegation audits, the delegation agreement, reports submitted by the contractor regarding its performance under the delegation agreement, documented evidence of your organization's periodic review of the contractor's P&Ps, documentation of your compliance oversight process, and finally, documentation of a review of any impact financial incentives may have on patient care.

URAC Accreditation Tips

The element of the standard that addresses financial incentives is a mandatory element.  The other two elements are each weighted 3.

The documentation required to be submitted with the initial application is simply the applicable delegation oversight  P&P.  just make sure that it contains all the required elements of this standard.  In addition, it would be prudent to submit any templates for audit mechanisms you may use in the implementation of that policy.

As was the case with the previous three standards, delegation binders will be the focus of the reviewer's attention during the on-site review.  The reviewer will have an expectation that those binders are complete, well-organized, and clearly marked.

 

Pharm Core 17 - Delegation Contracts


 

The Basics

This standard applies to all delegation arrangements, even to those with organizations that are accredited by URAC.  It lists eight specific requirements for the contract between your organization and all delegates.  Some of the requirements are perfunctory (e.g., that the contract describes which duties are being delegated and which duties are being retained by your organization), but there are several elements that you should not assume are already in all of your delegation agreements, particularly if you are a first-time applicant.  Two of those elements are mandatory and almost certainly are not in the delegation agreements of a first-time applicant.

Here are the particularly critical elements of the delegation agreement:

  • a requirement that the contractor performed a delegated functions in compliance with your organization's policies and procedures and URAC standards;
  • an affirmative requirement on your contractor that it notify your organization of any material change in its performance of the delegated functions;
  • authorization for your organization to conduct surveys of the contractor;
  • an affirmative requirement on the contractor to submit periodic reports to your organization regarding its performance of delegate function;
  • a description of the circumstances under which the contractor may further delegate the functions your organization has delegated to it; and
  • a requirement that, if the contractor does further delegate the delegated functions to a subcontractor, the agreement between the contractor and subcontractor specify that the subcontractor will perform the delegated functions under the terms of the delegation agreement between your organization and the contractor and URAC standards.

Of critical importance is that the language in your contract specifically mention URAC in both of the contexts described above.  Merely referring to "accreditation standards" will not suffice (although at one time such language would have been enough).

Management Tips

A sticking point for many applicants, delegation contracts require more attention than most aspects of a URAC accreditation application. 

A few things to remember:

If your delegate is URAC-accredited, this is the only standard that applies to that delegation relationship.

Subsection (b) is explicit about the agreement requiring that the delegate comply with URAC standards. A clause requiring the delegate to comply with your organization's standards (which, of course, comply with URAC standards) is not enough. Similarly, a clause requiring that the delegate comply with another accreditor's standards (e.g., NCQA) is not enough. 

Subsection (c) is another tricky one. Put simply, your contract must have a clause which confers an affirmative obligation on your delegate to let you know when circumstances have changed such that it can no longer perform the functions it's supposed to perform under the agreement. This is separate from the reporting obligation under subsection (e). Be explicit about this requirement on your delegate.

Subsections (g) and (h) are distinct requirements. Restated, (g) requires that your agreement describes what the delegate must do in order to subdelegate (e.g., get your permission in writing). If your agreement prohibits subdelegation, that will suffice. Subsection (h) is applicable only if subdelegation is permitted, and requires that your delegation agreement require that any subdelegation arrangement be subject not only to your organizational requirements but also to URAC's (or "applicable accreditation requirements").

URAC Accreditation Tips

The two elements that specifically reference URAC are both mandatory. The rest range in value between 2 and 4.

While URAC only requires that you submit your template delegation agreement, we also recommend that you submit a policy and procedure that requires that all delegation agreements comply with the standard.

During the on-site review, again, the reviewer's attention will be on the delegation binders.

 

Pharm Core 16 - Delegation Review


The Basics

 

While the previous standard requires that you have criteria for selecting delegates, this standard requires that you go through a process for applying those criteria to candidates for delegation to make sure that the candidates have the capacity, policies, and procedures necessary to perform the functions that you wish to delegate to them.

Management Tips

In addition to the documentation processes discussed in connection with the previous standard, make sure that you also have documentation that demonstrates that you have reviewed the delegation candidates' policies and procedures and anything else that would help you to assess whether the contractor has the capacity to perform the duties you wish to delegate.

This standard does not apply to contractors who are URAC-accredited for the functions you delegate to them.

URAC Accreditation Tips

Both elements of this standard are weighted 3.

As was the case with the previous standard, you should submit both policies and procedures that describe the pre-delegation screening process and any tools, such as audit sheets, that you use an implementation of that process.

During the on-site review, again, the focus will be on a review of the delegation binders and interviews of those charged with delegation oversight.

 

Pharm Core 15 - Delegation Review Criteria


 

The Basics

This standard requires that, before you delegate any function that is covered by your URAC accreditation program, you establish criteria to be used in your selection process for organizations to which you delegate that function.

This applies to anything under the scope of your URAC accreditation except network contracting.  If you don't delegate any URAC-relevant functions, this standard doesn't apply to your organization.

The delegation assessment need not consist of an on-site review.  Just make sure that all of your pre-delegation assessments comply with your policy and procedure on that topic.  In other words, if your P&P requires an on-site assessment, you must conduct one.  

Management Tips

The key here is not only to have a policy and procedure that covers pre-delegation assessment, but to have a systematic way of recording such assessments.  Documentation review audit sheets are a good example of such documentation.  It is also important to make sure that your contracting process for delegates doesn't have any leaks in it.  More than once, an applicant for accreditation has been tripped up by this standard when somebody in the company didn't get the memorandum, and entered into an agreement with a new delegate without using the required criteria or the standard delegation agreement described in Pharm Core 17.

This standard does not apply to contractors who are URAC-accredited for the functions you delegate to them.

URAC Accreditation Tips

This standard carries a weight of 3.

As you might expect, the initial documentation submitted should be be policy and procedure that prescribes pre-delegation assessment processes.  In addition, any templates used in the course of such assessments should also be submitted.

The on-site review for this and the subsequent delegation standards consists largely of a review of the delegation binders in an interview of staff members who are charged with delegation oversight.

 

Core 6-9 -- Delegation


The Basics

Delegation occurs any time (with but one exception for health plans and networks) your organization is required to do something by a URAC standard and you have somebody else do it. The only exception is provider contracting: if you have someone else (like an IPA or a PPO) contract with the providers in your network, you haven't delegated provider contracting. 

Simple, right?

One might think so, but look at the rules of delegation from URAC's Core standards 15-18.  Those rules cover:

  • CORE 6 - Delegation Review Criteria (requiring the establishment and implementation of criteria and processes for pre-delegation assessments of prospective contractors)
  • CORE 7 - Delegation Review (requiring a pre-delegation review of P&Ps and ability to perform delegation)
  • CORE 8 - Delegation Contracts (specifying 8 required elements in all delegation contracts)
  • CORE 9 - Delegation Oversight (requiring a delegation oversight mechanism involving annual P&P and QM activities review, annual verification of contractor's compliance with the organization's P&Ps, and oversight of financial incentives to assure consumer safety)

Yikes. A lot going on there. How can I make it simpler?

Delegate to a URAC accredited company. Why?, because Core 6, 7, and 9 vanish when you do so, and you are left with only Core 8's requirements. Getting rid of 3 of the 4 applicable standards by contracting only with URAC-accredited companies is a sure-fire way to reduce the burden of delegation oversight. All that's left is that you execute a contract with the contractor that complies with Core 8, and you've complied with URAC's standards.

But what if you cannot avoid contracting with non-URAC-accredited company?

Take a deep breath, and learn the other three standards. Here's what that entails, in summary:

Core 6 -- figure out, before you undertake a delegation, how you are going to discern those oganizations you'll ask to do things for you from those you won't. Are there quality criteria, conditions of contracting, etc.? IF so, write them down.

Core 7 -- Then, using the criteria you've developed for Core 6, and after reviewing the P&Ps of the prospective contractor, and after making sure the contractor has adequate qualified staff to do what they say they'll do, document the process of approving the contractor to do the delegated function for you.

Core 9 -- Finally set up a system under which, every year, you review the contractor's P&Ps and performance under the delegation agreement, and that you make sure that the contractor doesn't have any financial incentives that could be bad for your consumers.

More on the delegation agreement:

What about the agreement with the contractor? Any tricks there? You bet! Here are the most common mistakes:

Lots of applicants fail to appreciate the importance of subsection (b), which requires that the delegation agreement specifically require the contractor to comply with URAC standards, not just yours.

Many have missed subsection (c)'s requirement that the contact place an affirmative obligation on the contractor to let you know if anything happens that threatens its ability to do what you've asked it to do.

Many applicants have not been rigorous about subsections (g) and (h), especially (h). The trick here is to make sure that the agreement imposes URAC standards on the subdelegates of your contractors, and that it specify the conditions under which it may delegate (such as getting your written permission).

Management Tips

All of this can be made much easier if you require that you track your relationship with each delegate in a delegation binder.  URAC reviewers love delegation binders, especially well-labeled ones.  You will, too.  A complete one usually contains a tab for each of the following types of documentation: 

  • Pre-contracting assessment 
  • Contract
  • Reports from the contractor
  • Audit reports
  • Correspondence

Also, we strongly recommend that you audit all your contracts.  Many an accreditation has been subverted by a non-compliant delegation agreement.  Core 8 can sink your ship if you're not careful.

URAC Accreditation Tips

The elements of the delegation standards standards are, generally, weighted 3, with a couple weighted 2 or 4.  The mandatory elements to watch out for are the two elements in the delegation contract standard (Core 8) that mention URAC and the delegation oversight provision requiring that your organization make sure (at least annually) that the contractor is complying with the contract.  More specifically on the mandatory URAC provisions: 

Your contract with the contractor must require the contractor (1) to follow your P&Ps and URAC standards and (2) if it delegates to a subcontractor, to require that subcontractor to follow the terms of the delegation contract and URAC standards.  The contract must mention URAC in both cases. 

What documents do you need? One P&P on delegation that covers all of the above, sample reports of your audit process, and a template of your delegation agreement. During the onsite review, have one "delegation binder" for each contractor, and make sure the binder contains the delegation agreement with the contractor, any periodic reports the contractor submits to you, the P&Ps you've reviewed, and any audit or survey reports for that contractor. If the contractor is URAC-accredited, include some evidence (copy of the URAC accreditation certificate or a screen-shot of the URAC web site listing the contractor as accredited).

The onsite review will involve a thorough examination of your delegation binders, with particular attention to your contracts and oversight and reporting mechanisms.  In an ideal world, your delegation binders will answer nearly all their questions.