Websites for payers like UnitedHealthcare, Anthem and Cigna are used for revenue cycle processes—preauthorization requests, claims submissions and payments—and therefore pose a potential risk to patient and financial information. They may not have adequate controls and are ripe for audit, said Kelly Rollins, manager of IT audit at Ochsner Health in New Orleans.[1] Below are the types of payer websites and the level of risk they pose. Contact Rollins at kelly.rollins@ochsner.org.
Auditing Payer Websites: Understanding Your Results
|
Website Type |
Risk Level |
Description |
|---|---|---|
|
Could Not Create an Account |
Low |
Websites in which an account could not be created. |
|
Created Account (Did not receive authorization) |
Low |
Websites in which an account could be created but authorization to view data in the website was not received. |
|
Created Account (Needed additional information to view data) |
Medium |
Websites in which an account could be created and authorization was received but more information (e.g., billing details, patient information) was needed to see data on the website. The information needed to view data on the website would not likely be available to individuals outside of the organization. |
|
No Account Needed (Need additional information to view data) |
Medium/High |
Websites in which no user account was needed, but a user would need additional information (e.g., billing details, patient information) to search/view data on the website. |
|
Created Account (Access to data without additional information) |
High |
Websites in which an account could be created without organization authorization and a user can access electronic personal health information without needing additional information. These websites allow users to search without entering information such as patient ID, claim number, etc. |
|
Created Account (Access to financial information and/or electronic funds transfer [EFT] or electronic remittance advice [ERA] functionality) |
High |
Websites in which an account could be created and a user can access financial information and/or sign up for EFT/ERA in the portal without authorization from the organization. |
