Training

URAC has long required organizations to demonstrate that they train their employees and senior clinical staff members in a variety of areas, including confidentiality, conflict of interest, and the applicable URAC standards.  The current (v. 3.0) Core 27 reads:

The organization has an ongoing training program that includes: (No Weight)
    (a) Initial orientation and/or training for all staff before assuming assigned roles and responsibilities; (2)
    (b) Training in current URAC standards as appropriate to job functions; (2)
    (c) Conflict of interest; (4)
    (d) Confidentiality; (Mandatory)
    (e) Documentation of all training provided for staff; and (2)
    (f) Ongoing training, at a minimum annually, to maintain professional competency. (2)

The question here is "what do I submit on AccreditNet for Desktop Review?"  The Interpretive Information suggests:

• Training program outlines/agendas for all levels of program staff (employee and senior clinical staff person) that include all elements of the standard.
  

• Tools used to document orientation and training activities.

The first bullet is similar to the earlier versions of Core, while the second bullet is new.  What is also new is that URAC reviewers are more rigorously enforcing this documentation requirement.  There was a time when it would have been sufficient for most URAC reviewers to submit, at the Desktop Review phase, a P&P outlining training requirements and a couple of examples of agendas and sign-in sheets of various trainings. 

In recent weeks, however, we've seen evidence that URAC reviewers are taking this submission requirement more literally than in previous years.  So, we recommend that you do exactly as suggested -- submit for Desktop Review a full complement of training program outlines and agendas for all employees across all the required types of training.  

I talk a bit more about this in the following 3-minute video.

For a 7-minute video on URAC training, click here.

In any event, read on:

It is useful to think about the issue of "training" in two compartments -- (1) training required by URAC and (2) training for the onsite review.  I will handle them separately.

1.  Training required by URAC

As you know, URAC has specific requirements for staff training that relate both to the content of staff training and its administration:

Content
Most of the explicit training requirements in the URAC standards are found in the Core and Pharm Core standards: 

• Initial orientation and/or training for all staff before assuming assigned roles and responsibilities; (Core 7(a))
  • Training in the P&Ps that apply to one's job is implied by Core 3(a), too
• Ongoing training, at a minimum annually, to maintain professional competency; (Core 7(b))
• Training in current URAC Standards as appropriate to job functions; (Core 7(c))
• Training in state and regulatory requirements as related to job functions; (Core 7(d))
• Conflict of interest; (Core 7(e))
• Confidentiality (Core 7(f)) and specifically HIPAA (Core 24)
• Training on identification and prevention of fraud and abuse, as appropriate to job functions; (Core 7(g))
• Delegation oversight, if necessary; and (Core 7(h))

In addition, training of employees in how to do their job consistent with company P&Ps and URAC standards  is implied throughout the standards, via Core 3(a), 7(a), and 7(c).

Administration

• There must be documentation of all training provided for staff (Core 7(i))
• There must be a signed document acknowledging training on confidentiality issues (Core 24)

Some of this is company-wide training (e.g., confidentiality); some is department-specific (e.g., P&Ps on how to follow DM P&Ps.)  Company-wide training is typically handled either through:

1. company-wide meetings
2. computer-based training modules required of all employees, or
3. smaller, face-to-face trainings required of all employees. 

Department-specific training is typically handled through

1. modular computer-based training programs or
2. departmental staff meetings

2.  Training for the URAC Review Process

The best preparation for the URAC review is the substantive training described in the previous section.  A staff member who knows his/her job as described by the applicable P&Ps, knows the URAC standards and state/federal regulations that apply to the job, and can retrieve the documents to be sought by the URAC reviewer is unlikely to get tripped up in a URAC review, even if they have no specific preparation for the onsite review process.

Additionally, the mock onsite review we conduct for our clients is valuable for staff members likely to be either interviewed or pulling documents during the onsite review.  We spend a good portion of our time onsite not only conducting document-pulls and interviews as realistically as possible, but also counseling staff members on how to improve their performance for the actual review.

URAC is proposing to do some housekeeping with Core 7, the primary staff training standard.  The proposed revision moves required regulatory training to Core 8, and the requirement for fraud and abuse training to Core 19.  The proposed new version would read as follows:

The organization has an ongoing training program that includes:
(--)
(a) Initial orientation and/or training for all staff before assuming
assigned roles and responsibilities; (Wt = 2)
(b) Ongoing training, at a minimum annually, to maintain
professional competency; (Wt = 2)
(c) Training in current URAC Standards as appropriate to job
functions; (Wt = 2)
(d) Conflict of interest; (Wt = M)
(e) Confidentiality; (Wt = M)
(f) Delegation oversight, if necessary; and (Wt = 3)
(g) Documentation of all training provided for staff. (Wt = 2)

The most significant change that URAC is proposing relates to scoring.  While the requirement for confidentiality and conflict of interest training are primary elements in the current standard, the current standard is not mandatory.  By changing confidentiality and conflict of interest training requirements to mandatory elements, URAC is proposing to elevate their importance by putting the accreditation of an applicant failing in either of these two domains at risk.

Alert the training department! 

This mandatory standard, which in v. 1.0 described the required components of a training program for the employees of covered entities, but not business associates, has been amended to apply all but subsection (d) to all entities.  Therefore, all applicants for HIPAA Privacy must have the full training components of URAC’s required training for employees, with the exception of the disclosure requirements regarding “whistleblower” and “workforce member crime victim” exceptions, which will continue to apply only to covered entities.

The full standard still reads:

The organization has policies and procedures to conduct a training program for all members of its workforce that have access to protected health information as part of their function within the organization.  The training program: (Primary)

(a)        Provides training to all existing workforce members by the date of the application submission for URAC HIPAA Privacy Accreditation; (Primary) (Applies to covered entities and business associates)

(b)        Provides training to all new workforce members within a reasonable time period; (Primary) (Applies to covered entities and business associates)

(c)        Updates training for all affected staff in the event of a material change in the organization’s privacy practices; (Primary) (Applies to covered entities and business associates)

(d)       Explains the limited circumstances under which protected health information may be disclosed under “whistleblower” and “workforce member crime victim” exceptions; and (Primary) (Applies only to covered entities)

(e)        Includes a process to document training provided to workforce members. (Primary) (Applies to covered entities and business associates)

Core 7(c) provides:

The organization has a training program that includes. . . (c) Training in URAC Standards as appropriate to job functions. . . .

Historically, organizations seeking to comply with this subsection have focused their documentation efforts on staff training. Indeed, the Program Guide itself focuses on employees:

• Organizations may keep documentation of ongoing training in personnel files located in the personnel department, or these files may be a part of staff records held within the program’s department.
• In-house training on performance of job functions may be documented in staff meeting minutes, if the presentation occurred at that time. Please use sign-in sheets or record staff participating to document attendance.
• Staff located remotely or off-site, who are unable to participate in orientation provided at the organization’s site may sign a statement that they have read and understand the URAC standards related to their job responsibilities, and the orientation materials provided including policies and procedures and clinical decision support tools used to implement the program.

Yet, a literal reading of the standard would not limit its application to employees, but would have it extend to contractors to whom the accredited company has delegated functions, as well. Conversations that I've had in recent days with URAC-accredited companies that have recently gone through either a full on-site review or a monitoring on-site review reveal that URAC reviewers seem increasingly likely to look for documentation demonstrating that the accredited company's delegates, too, have received training in the applicable accreditation standards.

This training need not be at a URAC seminar. The company being reviewed may design its own training, or hire a consultant to provide that training, so long as it is clear to the URAC reviewer that the training is based on the most recent URAC standards that apply to the functions performed by the contractor.

URAC has long been well ahead of other accreditation organizations in recognizing the prevalence of the use of delegation in managed health care. It should come as no surprise, then, that URAC would make sure that contractors performing functions for URAC-accredited companies be adequately trained in the URAC standards that they are required by contract to uphold (see Core 17(b)).