Answers from AOPA Reimbursement and Compliance Experts

Joe McTernan is the assistant director of reimbursement services for the American Orthotic & Prosthetic Association (AOPA). AOPA is a not-for-profit trade association providing O&P-specific business services and products for professionals.

Through government relations efforts, AOPA works to influence policies affecting the future of the O&P profession.

Do you have a question for an AOPA Expert? Call (471) 431-0876 or visit www.AOPAnet.org.

Q: I am considering opening a new O&P practice. What steps do I need to take in order to bill Medicare?

A: To bill Medicare for O&P services, you must apply for a DMEPOS Supplier Number issued by the National Supplier Clearinghouse (NSC). The application and instructions for the CMS 855S supplier enrollment application can be downloaded at www.cms.hhs.gov/MedicareProviderSupEnroll/downloads/cms855s.pdf.

Any missing or incomplete information on this application may cause a delay in the issuance of your supplier number.

You must also submit copies of the following documents to the NSC in order for a supplier number to be issued:

• State or local business licenses required to operate a business.
• Professional licenses for clinical staff if required by the state in which your practice is located.
• State and local tax certificates if you are required to collect sales tax. If O&P services are exempt in your state it is a good idea to include a copy of the state code indicating the exemption.

Once everything is submitted, the NSC has 60 days to review and issue a supplier number.

Assuming your application is complete, the NSC may send an inspector to your facility to ensure that your business is in full compliance with the 21 current Medicare Supplier Standards.

Once the application is processed, the NSC will issue a Medicare supplier number effective the date NSC approved the application. Any services provided to Medicare beneficiaries prior to the effective date are not eligible for reimbursement by Medicare.

Q: If my practice is expanding to a second location, can I use my existing supplier number for both the new location and the old location?

No. Medicare rules are very clear: supplier numbers for patient care facilities are location specific and may not be shared.

The Code of Federal Regulations states: "The supplier must enroll separate physical locations it uses to furnish Medicare-covered DMEPOS, with the exception of locations that it uses solely as warehouses or repair facilities." This requirement does not apply to services provided in a patient's home or in an alternate location such as a Skilled Nursing Facility or a long-term care facility.

Q: Where can I review a copy of the current Medicare Supplier Standards to ensure my facility is in full compliance?

A: The full version of the 21 current Medicare Supplier Standards is available on the AOPA Web site, www.AOPAnet.org.

This is a reproduction of the Supplier Standards listed in the Code of Federal Regulations. An abridged version of the standards is also available on the AOPA Web site.

Q: Are there special features I must incorporate in my new O&P facility to meet HIPAA Privacy and Security standards?

The HIPAA rules allow a certain amount of flexibility in how your facility meets the Privacy and Security standards.

The Privacy rule states you must implement "reasonable safeguards" to ensure the privacy of your patients' protected health information, but determining what safeguards is up to you.

For example, if you are designing a new facility, you might plan for a reception area that is separated in some manner from the general waiting room—whether by a glass partition or in another part of the building.

If you don't have space for a separate reception area, train your personnel to be discreet in questioning new patients or consider masking the conversation with a white noise machine.

Another privacy consideration is to have a separate location for storing patient records. If space is limited, records may be stored in locked cabinets or in a secure room.

You are not expected to remodel your facility at great expense, as long as you document that you've taken all the "reasonable" measures you can to protect your patients' health information.

The HIPAA Security rule requires you implement physical safeguards, which are measures to physically protect electronic information systems, equipment and the buildings housing them.

You are also required to limit physical access to your computer information systems and to the facilities or locations where they are housed.

As with the Privacy rule, you are allowed a certain amount of flexibility in meeting the physical safeguard standards, since the Department of Health and Human Services recognizes not all patient care facilities house computer information systems in a separate location.

You are also allowed to focus on ensuring the physical security of each individual computer workstation.

If you do have your computer network server or major computer terminals housed in a separate room, you must implement procedures to control and validate access to the area.

Remember to document the steps you take to safeguard patient data and the policies and procedures you use in conjunction with the physical safeguards.