42 CFR Archives

HIPAA

42 CFR Part 2 HIPAA Alignment Update

This article is written by the American Institute of Healthcare Compliance Audit Education Department

By February 16, 2026, all HIPAA-covered entities—including healthcare providers, health plans, and healthcare clearinghouses—that create, receive, or maintain Substance Use Disorder (SUD) records subject to 42 CFR Part 2 must update their Notice of Privacy Practices (NPP). The update requires clearly detailing enhanced protections for SUD records. The information in this AIHC update is not legal or consulting advice, but for educational purposes to prompt compliance.

Does this new rule apply to my organization?

Yes, it can, but this requirement is specifically targeted at those handling Part 2 records. Entities must ensure their websites and privacy policies reflect these changes by February 16, 2026. Covered entities, including health plan sponsors and providers, must align their notices with the new, stricter privacy rules for sensitive SUD information by this date.

Tips to Update Your NPP

The NPP must contain the elements, information and statements specified in 45 CFR 164.520 and must include a specific header, a description of permitted uses/disclosures (treatment, payment, operations), individual rights, covered entity duties, and contact information for complaints.

It must be provided by the first service date and, as of February 16, 2026, align with updated substance use records regulations.

Key elements mandated by 45 CFR 164.520 include:

Required Header: A specific statement regarding how medical information is used and the patient's rights.
- i.e., “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”¹
Permitted Uses and Disclosures: A detailed description of how the covered entity may use or disclose Protected Health Information (PHI) without the patient’s written authorization,² including for treatment, payment, and healthcare operations.
Individual Rights: Information on the right to access, amend, request restrictions, receive confidential communications, and receive an accounting of disclosures.
- A statement that other uses or disclosures will only be made with the individual’s authorization, and that the individual has the right to revoke her/his authorization subject to certain limitations.³
- A summary of certain specified rights the individual has concerning his/her information.⁴
Covered Entity Duties: Statements confirming the entity's responsibility to protect privacy, provide notice of privacy practices, and abide by the terms of the notice.
Complaints Procedure: Instructions on how individuals can file complaints with the covered entity or the Secretary of Health and Human Services (HHS).
Contact Information: A designated person or office to contact for further information.
Effective Date: The NPP’s effective date.⁵
Special Considerations: Specific language regarding the restriction of uses/disclosures for underwriting purposes, the sale of PHI, and marketing, as well as updated, clearer descriptions regarding substance use disorder records.
Posting the Notice: The NPP must be prominently posted on the entity's website and physically at the service location by February 16, 2026 and, for plans without a website, distributed to participants by April 17, 2026 (within 60 days of the change).

Key Considerations:

Update Policies & Retrain Workforce - Organizations should act promptly to review their existing notices and implement the required changes before the deadline. Review and update internal privacy policies, procedures, and training materials to comply with the final rule.

Review your BAAs - Business Associate Agreements should be reviewed to ensure they account for the enhanced protections of SUD information.

For more information, check the updated Fact Sheet 42 CFR Part 2 Final Rule:

https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html.

References:

https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.520

¹ 45 CFR 164.520(b)(1)(i)

² 45 CFR 164.520(b)(1)(ii)

³ 45 CFR 164.520(b)(1)(ii)

⁴ 45 CFR 164.520(b)(1)(iv)-(vii)

⁵ 45 CFR 164.520(b)(1)(viii)

Share 0

Post 0

Share 0

Billing/RCM

Provider Credentialing Verifies Expertise

Written by Angela Chorny, MA, President and CEO of Emerge and See, LLC

Payor Enrollment – An Understated and Overlooked Process

Oh, the all-important question of credentialing! Why do we need to be credentialed and what is it?

Credentialing is the anchor between billing and being PAID. It is one of the most important aspects to healthcare, AND, in many cases, it is REQUIRED!

So, what is credentialing? Credentialing is the process of verifying that a provider’s expertise and qualifications to render care to patients are real and valid, this process is also called Primary Source Verification, or PSV… simply stated.

Many facilities and groups who are accredited by an entity, such as JCAHO, AAAHC, AAAASF (just to name a few), are REQUIRED to complete this process for every provider who is rendering services within the group or facility, especially active, licensed, independent practitioners, or LIPs. The accreditation agency will provide their own list of requirements, but a group or facility may include additional requirements of their own in order to privilege a provider.

The buck doesn’t stop there, though, that’s only about half of the credentialing process. Payor enrollment is an understated and overlooked process. This is where the provider is enrolled into the health plans that they would like to accept from their patients. If the provider is not enrolled in the plan, you will not be able to bill for services rendered, ESPECIALLY with Medicare and Medicaid.

In addition, once the provider is enrolled with the payor/insurance health plan, they are added to the roster of available care in their area… built in marketing! When a patient calls and requests a list of providers that accept their health plan in the area requested, the enrolled provider and/or practice will be on that list provided to the potential new client.

So Why Is Credentialing So Important?

Protecting Patients and Ethics.

Credentialing is undertaken to determine whether a practice or healthcare professional is fully qualified to treat patients. Patient care has always been the core purpose of medical credentialing. The process itself is rather tedious and involves verifying a practitioner’s credentials against various relevant data points.

For instance, a provider is continuously monitored against major publications like the Death Master File, Sex Offender Registries, National Abuse Registry, OFAC, and many other sources. A provider can be denied credentialing if their name shows up in any of the above data points.

Credentialing also monitors sanctions on a provider’s license via the Office of Inspector General (OIG) as well as any possible lawsuits and their outcomes via the National Provider Data Bank, or NPDB. These tools have been put in place and are required to be utilized to help the practice make a determination as to whether the provider should be privileged or employed by the entity. Credentialing can also be denied based on a provider’s license having expired or having defaulted on their student loans.

Credentialing instills confidence among patients and provides added comfort that the organization wants to provide professional and ethical services to a patient. For example, it would be nice to know that a particular provider in charge of providing treatment to a child is not a registered sex offender or that a psychologist has the qualifications necessary to provide you with sound advice.

Competency and performance reviews are a fundamental part of the credentialing process. Organizations who implement this process leave no stone unturned in determining whether a practice or healthcare professional is worthy of being credentialed. As a result, patients can feel safe going for treatment to clinics and hospitals whose staff are all credentialed.
Prevents Lost Revenue.

Insurance carriers do not reimburse for services rendered if the provider and/or entity is not credentialed, or enrolled, with them. It is important to note here, that being enrolled with a payor and being “in network” are two different things. Once the provider is enrolled with the payor, services rendered may then be billed. Becoming “in network” means that the provider now has a contract with the payor and rates are set as per the agreement and cannot be negotiated until the agreement term has expired.

Furthermore, it is illegal for the payor to reimburse anyone prior to having completed their own Primary Source Verification process. Therefore, at all times, a payor will advise you NOT to see their patients until the provider or organization is credentialed with them.

Once enrolled with a payor, you are ready to bill for services rendered and will be reimbursed according to the agreed upon fee schedule. You just opened the door to an entirely new set of patients, thereby increasing your revenue!

In addition, as previously mentioned, the provider will also be added to the roster and registry for patients who call in to request a particular type of provider in their area. So, the payor, is driving more patients through your door.
Mitigate and manage risk.

With the latest increase in lawsuits over lack of appropriate credentialing on behalf of an entity, it’s one of the most basic parts of your practice that you want to protect. As immunity began to lose ground as a viable legal argument, the 1957 case Bing v. Thunig firmly established that hospitals have an ethical responsibility for the medical care received by patients.

A few years later, the 1965 case of Darling v Charleston Community Memorial Hospital—in which a staff provider so severely erred in the setting of a broken leg that it eventually had to be amputated—set the legal precedent that a hospital could be held negligent for failing to assess or monitor the competency of their medical staff.

To limit liability in the aftermath of these cases, hospitals implemented more rigorous credentialing and privileging protocols. Unfortunately, this led to another problem… Providers being denied appointment or privileges by a hospital’s governing body turned to the Sherman Act and state antitrust laws to claim that the practice of credentialing amounted to anti-competitive collusion. Providers claiming injury under the Sherman Act must demonstrate that the denial or revocation decision negatively impedes the availability of medical services within the community.

Stuck between a rock and a hard spot of this legal minefield, hospital and medical staff leadership, in particular those assigned with peer review responsibilities, were reluctant to deny medical staff appointment or privileges. The Health Care Quality Improvement Act (HCQIA) of 1986 provided those physicians involved in peer review activities a layer of protection against lawsuits filed by the physician under review in retaliation for a negative decision by their peers. Improperly used, HCQIA can be seen as a shield inviting abuse by those in a peer review position for decisions that benefit themselves directly or indirectly. As a result, antitrust claims continue.

Over the years, hospitals have recognized that strong and transparent credentialing and privileging processes provide the greatest guarantee of qualified and competent medical staff and the best defense against legal risks. CFR regulations (U.S. Code of Federal Regulations (CFR) have, as a result, become the best standard for due diligence.

Know the Law

As healthcare credentialing becomes increasingly more important, be sure that you know your way around. Hospitals generally follow a basic credentialing and privileging framework established within the section of the U.S. Code of Federal Regulations (CFR) comprising the Public Health Service Act. However, these CFR Title 42 regulations (Conditions of Participation—CoPs) only specify credentialing and privileging requirements for hospitals to gain or maintain accreditation to participate in Medicare and Medicaid.

Even though Title 42 CoPs do not directly affect hospitals outside of Centers for Medicaid and Medicare Services (CMS) jurisdiction, they are still important to an unregulated health sector operating in a patchwork of federal, state, and civil legal landscape.

Create a Credentialing Process

Be clear on what you expect your providers to present to you for all background checks and scans as well as for payor enrollment purposes. That way, you will be able to streamline. Be sure to assign a person to the task. It can be a very tedious and time-consuming process, so it’s usually best if you have help that can handle all tracking of enrollment applications as well as any expirables that may be coming up.

Don’t miss the reappointment dates! If reappointment dates are missed you are back to square one in the credentialing process of payor enrollment, and if you miss any within your organization, you are no longer in compliance with your accrediting agency and neither is the provider!

If you choose to outsource, which is becoming exceedingly more popular now, be sure to choose a reputable organization. Many organizations are popping up nowadays, so it is definitely important that your Credentials Verification Processor (CVO) knows what they’re doing as regulations absolutely need to be followed.

About My Company

There are also enrollment companies and one stop shops available, such as Emerge and See, LLC where we handle the entire process for you. Emerge and See is based on a solid foundation of seasoned Credentialing Specialists. We become your full-service Credentialing Department while saving you an enormous amount of money on payroll. Please feel free to visit our website at www.emergeandsee.com, it would be our pleasure to be at your service!

As we say in the credentialing world… Happy Credentialing!

General Compliance

Medicare Bad Debt: Don’t Leave Money on the Table With Your Cost Report

Written by: Thomas "Trent" Jackson, BS, CCRS

Medicare bad debts present Medicare Part A providers an opportunity to recover reimbursement dollars they otherwise would have missed. Provided that a proper log is kept, total uncollected Medicare co-insurance and/or deductibles can be claimed on the cost report for 65% reimbursement.

Under 42 Code of Federal Regulation (CFR) §413.89 and the Provider Reimbursement Manual (PRM) 15-1 § 308, a bad debt is allowable when it results from deductible and coinsurance amounts for covered services that are uncollectible from Medicare beneficiaries. The Middle-Class Tax Relief and Job Creation Act of 2012 established the current reimbursement rate at 65%.

What is allowable bad debt?

An allowable Medicare bad debt must meet four criteria to be claimed by a facility:

The debt must be related to covered services and derived from deductible and coinsurance amounts.
The provider must be able to establish that reasonable collection efforts were made.
The debt was actually uncollectible when claimed as worthless.
Sound business judgment established that there was no likelihood of recovery at any time in the future.

Undertaking and documenting reasonable collection efforts will satisfy the second requirement, and the completion of those efforts will satisfy the fourth. Then, as long as the amount in question is a deductible or coinsurance amount that was appropriately written off during the period for which the cost report is filed, it is allowed to be claimed.

Reasonable collection efforts required

What constitutes a reasonable collection effort? First and foremost, collection efforts for Medicare beneficiaries must be similar to efforts to collect comparable amounts from non-Medicare patients. Beyond that, the collection policy must include the issuance of a bill on or shortly after discharge of the beneficiary as well as genuine collection efforts such as subsequent billings, collection letters, and phone calls. The regulations also allow for the use of a collection agency in addition to or in lieu of those efforts.

As with many areas of healthcare, the saying “if it was not documented, it did not happen” certainly applies. Any facility looking to claim Medicare bad debt reimbursement will need to maintain supporting documentation for each line on its Medicare bad debt log.

There are a couple of alternate methods to satisfy the second and fourth criteria:

If a patient is deemed indigent by provider standards, their debt can be deemed uncollectable without going through reasonable collection efforts. However, the provider must have a codified internal policy to analyze assets, liabilities, expenses, and income of the patient. It must also seek to determine that no other source than the patient would be legally responsible for their debt. Documentation supporting these factors must be contained within the patient’s file.
For patients who have Medicare as a primary payer and Medicaid as a secondary payer (commonly referred to as a “crossover”), billing the state Medicaid program for the unpaid amount and documenting its response will satisfy the reasonable collection effort procedures. The account can be added to the Medicare bad debt log upon receipt of the Medicaid program’s remittance advice.

Medicare bad debt is money lost for many Part A Providers, so taking time to explore the cost report reimbursement option could be a valuable decision.

_________________________________________________________

Thomas “Trent” Jackson is a senior associate within Kraft Healthcare Consulting’s Advisory Department. Kraft Healthcare Consulting is an affiliate of KraftCPAs. Trent is also a Certified Cost Reporting Specialist (CCRS) and received his BS in Accounting from Dalton State College.

Page 1 of 8

First

Last