The Basics

This standard allows your organization to choose to report on any or all of the exploratory measures. Those measures are:

• Case Management: Contacting Consumers
• Complaint Response Timeliness
• Outpatient Newborn Visit Within One Month of Birth
• Diabetes: All or None Process Measure: Optimal Results for HbA1c, LDL-C, and BP

Management Tips

While not required, these optional standards give your organization a glimpse into what is involved in conducting measures that may someday be a part of the array of mandatory measurements. 

URAC Accreditation Tips

This standard is a Leading Indicator.

At the desktop review stage, you'll need to submit only a summary description of your current and/or future ability to report on the optional measures. Be sure your description includes the resources and mechanisms you'll need to conduct the required measurements. 

The onsite review activity for this standard is a conversation between the reviewer and the person(s) in charge of the measurement program.

The Basics

This standard establishes these requirements for your organization's compliance program:

• A compliance officer, whose duties are outlined in the compliance program description;
• Periodic review, updating, and approval of the training and education aspect of the compliance program, which review should be documented in some form, such as meeting minutes;
• Periodic, documented review to determine if any internal organizational changes, such as P&Ps, benefits, or protocols, have compliance implications;
• Ongoing communication with delegates about compliance issues;
• A thorough, documented review of applicable state and federal laws, including privacy and security, mental health, and fraud, waste, and abuse. This review should be conducted by an appropriate oversight body described in the program description. 

Management Tips

We advise our clients to have a comprehensive compliance program description. Our recommended minimum components of that description are as follows:

Compliance Program Outline

I. Governance

A. Compliance Officer(s)

B. Accountabilities/Reporting Structure

1. Administrative structure

2. Compliance Committee (if any)

3. Oversight of the compliance program by governing body

C. Reports

II. Tracking of Laws, Regulations, Administrative Rules, and Accreditation Standards

A. Process for assessing existing matrix of laws, regulations, rules, and standards

B. Process for updating compliance matrix with changes to laws, regulations, rules, and standards

III. Implementation of Compliance Program

A. Process for translating external standards into organizational policies and procedures

B. Training of governing body, employees, and agents in compliance program

C. Procedures for detecting non-compliant conduct by employees and agents

1. Audit and other monitoring mechanisms

2. Reporting mechanisms

D. Disciplinary mechanisms for non-compliant conduct by employees and agents

E. Post hoc analyses of instances of misconduct to determine whether a systemic change is suggested by the problem

F. Systems for assuring that both hiring and compensation practices encourage the creation and maintenance of a compliant work force

IV. Promotion of an organizational culture to encourage ethical conduct and a commitment to compliance with the law

V. Periodic evaluation of compliance program

A. Evaluation of training

B. Evaluation of organization P&Ps, protocols, etc.

URAC Accreditation Tips

Three of the elements of this standard relating to the review of state and federal laws and regulations are all mandatory; the remaining standards vary in weight between 2 and 4.

The desktop submission should include your Compliance Program Description and/or your comprehensive compliance P&Ps, as well as your compliance officer's job description. In addition, submit documentation of review and approval of the compliance program description by the appropriate oversight body, as well as sample compliance training materials.

The Basics

This standard describes the promotional requirements of your PCHCH program. Those requirements include the transparent communication of any incentives in the program to either providers or members. Incentives are not required, however, you must describe them if they exist. In addition, your organization must evaluate the effectiveness of your communications program and timely communicate to the affected parties any changes in the program's incentives.

Management Tips

Be sure your PCHCH P&Ps or program description describes in some detail your communications about the program, including modes of communication. Those modes must be designed to reach the a widespread audience. You have some flexibility in selection of modes, but URAC will have an expectation that you use multiple modalities. Be sure to include time frames for communication and evaluation of that communication in your documentation. Note, however, that those time frames must be met, and the failure to do so may be a violation of the requirements of Core 3(a).

URAC Accreditation Tips

The three elements of this standard are weighted either 3 or 4.

At the desktop review phase, submit samples of your communications to providers and members about your PCHCH program. In addition, submit the full complement of PCHCH policies and program description.

The onsite reviewer will want to see documentation of your evaluation of the PCHCH communications efforts, as well as sample notification to members and providers of changes in program incentives.

The Basics

This standard, based on the requirements of HIPAA, establishes specific, mandatory components of your approach when you learn of a potential breach. The federal government's web site has a lengthy explanation of "breach":

"A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information such that the use or disclosure poses a significant risk of financial, reputational, or other harm to the affected individual."

The site goes on to list three exceptions to this definition:

• the unintentional acquisition, access, or use of protected health information by a workforce member acting under the authority of a covered entity or business associate;
• the inadvertent disclosure of protected health information from a person authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the covered entity or business associate; and
• if the covered entity or business associate has a good faith belief that the unauthorized individual, to whom the impermissible disclosure was made, would not have been able to retain the information.

URAC's characterization of the HIPAA requirements in the event of a breach are that you must:

• record the date your organization became aware of the breach;
• notify the privacy and security officials;
• assess whether, in fact, a breach occurred.

Then, if you find out that a breach has occurred, your health plan must:

• mitigate the breach's cause;
• if you are acting as a business associate, notify your covered entity within 3 business days;
• notify the affected individuals in a manner compliant with HIPAA;
• notify HHS, as required; and
• conduct an analysis of specific aspects of the breach and perform appropriate remediation.

Management Tips

If your P&Ps are compliant with HIPAA, it is almost certain they are compliant with this standard. You may use this standard as an audit tool to double-check compliance.

You may be puzzled by the "business associate" reference. Yes, URAC knows that, as a health plan, your organization likely is a covered entity. It also knows, however, that it is possible for an organization to be  a covered entity and still act as a business associate. 

URAC Accreditation Tips

All eight elements of this standard are mandatory.

All you need to submit for desktop review are the applicable P&Ps. 

The onsite review, however, is more elaborate for this standard. The reviewer will want to examine your breach events log, as well as any documentation of follow up actions to a breach. In addition, the reviewer will interview the senior clinician, compliance and privacy officers, and staff and supervisors in customer services, UM, and QM.