Skip to Main Content

Who has the time or resources to keep tabs on everything that everyone in an organization does? No one. Therefore, you naturally need to trust (at least on a certain level) the actions and motives of various personnel. At the top of your “trust level” are privileged users—such as system and network administrators and developers—who keep vital systems, applications, and hardware up and running.

With the rise of artificial intelligence, most malware programs are starting to think together. Fortinet recently released a report that highlights some terms we need to start paying attention to:

Is your organization a service provider that hosts or supports sensitive customer data, (e.g., personal health information (PHI), personally identifiable information (PII))? 

RANSOMWARE UPDATE: It happened again. Another ransomware attack hit very large corporations around the globe. Much like WannaCry, a worm spread through entire networks, and locked out encryption data and systems.

As the technology we use for work and at home becomes increasingly intertwined, security issues that affect one also affect the other and we must address security risks at both levels.

During my lunch in sunny Florida while traveling for business, enjoying a nice reprieve from another cold Maine winter, I checked my social media account.

People love the idea of being able to conveniently charge their phones without a cable or having to hunt for a plug. Free charging stations are popping up everywhere.

Read this if you are responsible for your company’s income tax provision and disclosures.

In December 2023, the Financial Accounting Standards Board (FASB) issued Accounting Standards Update (ASU) No. 2023-09, Income Taxes (Topic 740): Improvements to Income Tax Disclosures. Although this ASU does not impact the accounting for income taxes, it does impact the disclosures of such and is applicable to all entities subject to income taxes. According to the FASB, “the Board is issuing the amendments…to enhance the transparency and decision usefulness of income tax disclosures. Investors, lenders, creditors, and other allocators of capital indicated that the existing income tax disclosures should be enhanced to provide information to better assess how an entity’s operations and related tax risks and tax planning and operational opportunities affect its tax rate and prospects for future cash flows.”

The main components of the FASB’s ASU can be broken down into three areas, as done so in the ASU itself:

  1. Rate Reconciliation
  2. Income Taxes Paid
  3. Other Disclosures

Rate Reconciliation

This amendment is only for public business entities. Public business entities have always been required to provide a rate reconciliation, reconciling income tax expense at the statutory rate to the entity’s effective tax rate. This rate reconciliation could be displayed in amounts or percentages. ASU No. 2023-09 requires this rate reconciliation be displayed in both amounts and percentages and also identifies the following specific categories that must be disclosed:

  1. State and local income tax, net of federal (national) income tax effect
  2. Foreign tax effects
  3. Effect of changes in tax laws or rates enacted in the current period
  4. Effect of cross-border tax laws
  5. Tax credits
  6. Changes in valuation allowances
  7. Nontaxable or nondeductible items
  8. Changes in unrecognized tax benefits

There is also a requirement that any reconciling item greater than 5% of the statutory income tax expense be separately disclosed, even if not one of the specific categories identified in the ASU. Furthermore, this 5% threshold applies to the cross-border tax laws, tax credits, and nontaxable or nondeductible items categories, meaning that if the reconciling item is within these categories and is above the 5% threshold, the item must be disaggregated by its nature. The 5% threshold also applies to the foreign tax effects category in that this category is required to be disaggregated by jurisdiction (country) and by nature if meeting the 5% threshold.

For example, let’s say an entity has research and development tax credits as well as energy-related tax credits, both of which are in excess of the 5% threshold. These tax credits would be required to be separately disclosed. However, let’s say tax credits in total are below the 5% threshold. In this case, tax credits would still need to be separately disclosed, as they are one of the specific categories identified in the ASU but would not need to be further disaggregated.

For the state and local category, a public business entity is required to provide a qualitative description of the states and local jurisdictions that make up the majority (greater than 50%) of the effect of the state and local income tax category. So, for instance, if the entity’s state and local tax is primarily derived from taxes to the States of Maine and Massachusetts, this fact must be disclosed.

Entities other than public business entities are required to qualitatively disclose specific categories of reconciling items and individual jurisdictions that result in a significant difference between the statutory tax rate and the effective tax rate. Paragraphs 740-10-55-232 and 55-233 provide an illustration of these disclosures.

Income Taxes Paid

All entities now must disclose:

  1. The amount of income taxes paid (net of refunds received) disaggregated by federal (national), state, and foreign taxes
  2. The amount of income taxes paid (net of refunds received) disaggregated by individual jurisdictions in which income taxes paid (net of refunds received) is equal to or greater than 5% of total income taxes paid (net of refunds received).

Other Disclosures

All entities now must disclose on an annual basis:

  1. Income (or loss) from continuing operations before income tax expense (or benefit) disaggregated between domestic and foreign
  2. Income tax expense (or benefit) from continuing operations disaggregated by federal (national), state, and foreign.

The ASU does eliminate the requirement for all entities to (1) disclose the nature and estimate of the range of the reasonably possible change in the unrecognized tax benefits balance in the next 12 months or (2) make a statement that an estimate of the range cannot be made.

This ASU is effective for public business entities for annual periods beginning after December 15, 2024. For entities other than public business entities, the ASU is effective for annual periods beginning after December 15, 2025. Early adoption is permitted. The ASU should be applied on a prospective basis although retrospective application is permitted.

The BerryDunn perspective

On the surface, this ASU may not seem important, as it only impacts disclosure. But the level of disaggregation required could make this ASU a time-consuming one to implement, especially for those entities that operate in many states and foreign jurisdictions. As indicated above, all entities now must disclose income tax expense and income taxes paid by federal, state, and foreign. This may require modifications to existing tax provision procedures to ensure this information is readily available come time to populate the income tax disclosures in your entity’s financial statements.

Conversations with those responsible for preparing the income tax provision should start now so the best process to accumulate the information needed for these new disclosures can be identified proactively, reducing, or possibly eliminating the amount of rework needed when it comes time to adopt this accounting standard. As always, please don’t hesitate to reach out to your BerryDunn team should you have questions.

Article
FASB issues an ASU focused on income tax disclosures

Read this if your organization receives federal grants.

Navigating the ever-evolving landscape of federal grant management just got more manageable, as the Office of Management and Budget (OMB) has issued the latest revision of the Uniform Grants Guidance for 2024. It introduces several significant changes aimed at enhancing clarity, efficiency, and compliance in grant administration. The effective date for these changes is October 1, 2024. Here's a closer look at the most noteworthy updates.

Fixed amount awards and subawards

  • The threshold for fixed-amount subawards requiring prior written approval from federal agencies has been raised from $250,000 to $500,000, providing recipients with increased flexibility.

Equipment-related thresholds

  • The acquisition value threshold for defining equipment has been raised from $5,000 to $10,000, reducing administrative burdens for recipients. Similarly, the threshold for unused supplies has been increased from $5,000 to $10,000.

De minimis indirect cost rates 

  • The de minimis rate for indirect costs has been increased from 10% to 15% of modified total direct costs (MTDC), providing recipients and subrecipients with greater flexibility in cost allocation.
  • Recipients and subrecipients can opt for a lower de minimis rate than 15%.
  • OMB has adjusted the exclusion threshold of subawards from $25,000 to $50,000 for modified total direct costs.

Single audit

  • The threshold for mandatory single audits has been raised from $750,000 to $1 million in federal expenditures, reducing the audit burden on smaller recipients.

Additional updates of note:

Streamlined Notices of Funding Opportunity (NOFO)
The revised guidance is putting more emphasis on streamlining Notices of Funding Opportunity (NOFO). Federal agencies are encouraged to make NOFOs more concise, accessible, and transparent, ensuring that essential information is effectively communicated to potential applicants. By simplifying NOFOs and adopting plain language, agencies aim to reduce administrative burdens and enhance the accessibility of grant opportunities, particularly for underserved communities and organizations with limited capacity.

Enhanced data-driven decision-making
Under the new provisions, federal grant recipients are permitted to allocate a portion of their funding toward data management infrastructure, including the acquisition of software, tools, and technologies for data collection, analysis, and reporting. This investment in data infrastructure enables organizations to establish robust data systems, streamline data collection processes, and enhance data quality, ultimately facilitating evidence-based decision-making and program evaluation.

Conclusion

The Uniform Guidance 2024 changes introduce significant updates aimed at improving accessibility, streamlining processes, and promoting data-driven decision-making in federal grant management. As organizations strive to implement these revisions effectively, partnering with experienced consultants can provide invaluable support. Reach out to BerryDunn today if you have any questions about the new updates of your specific situation. We’re here to help.

Article
Uniform grants guidance 2024: Key updates

Amidst the cycle of public health underfunding, and in the shadows of the COVID-19 pandemic, agencies are trying to find financial stability in a space that has seen volatile and drastic changes in recent years. According to the National Association of County and City Health Officials, “The sustainability of the governmental public health system depends on the financial health of state and local public health agencies.” With this co-dependency of successful and sustainable public health services to financial stability, it is imperative to have a workforce that understands their obligations to effectively manage public funds.

A public health workforce in need of training

According to the 2021 Public Health Workforce Interests and Needs Survey (WINS), 54% of public health employees across the nation identified budget and financial management as a strategic skill that is highly important to their role but their proficiency in the area is low. This category outranked all other training needs assessed including change management, community engagement, and strategic thinking.

To help public health state agencies target budget and fiscal management training needs for their workforce, a comprehensive assessment can be utilized to examine four domains of administrative management activities with a focus on financial management. These four domains and topic areas include:

Domain Topics

Planning, execution, and program implementation

Policies, processes, procedures, and practices

Budget and performance monitoring, reporting, and closeout

Communications

Subgrant award and monitoring

Workforce (staffing, roles, responsibilities, onboarding, competencies)

Executive oversight

Data, systems, and information

Program alignment

Risk and priority


Reviewing these areas can help an agency assess its current decision-making and grant management processes to identify challenges that may lead to opportunities. Opportunities highlight what an agency can do with available resources to support equitable services. The opportunities are then used to inform a roadmap for process improvement and identify action items with a focus on training, policy development, monitoring, and communication. The roadmap defines an implementation strategy with measurable benchmarks and outcomes.

Overall, a comprehensive assessment can kickstart a strategic planning cycle developed to encourage fair and impartial administrative practices that adhere to federal regulations and offer opportunities to leverage additional funds in the future.

Using this framework, your public health agency can begin to manage administrative services wisely and fully leverage funding that can have the greatest impact on population health in the regions you serve. Ask “What are we doing to set up administrative routines for our agency that support equitable services?” and “How are we equipping our staff with the tools needed to effectively leverage resources that promote and improve population health?”

BerryDunn is experienced and poised to support cross-agency governance teams to undertake assessment and implementation activities. Through collaboration with agency leaders, BerryDunn’s team can facilitate discovery of opportunities for improvements in governmental budgeting and finance training, process improvement, development of finance tools and resources, and enhance communication and coordination between program and finance staff.

Learn more about how BerryDunn can support your agency in achieving these goals. If you have a specific question or if you'd like to set up an informational meeting with our team, please contact Julie Sullivan, Senior Manager and Practice Lead.

Article
Financial management for public health systems: The path to building sustainable services

Read this if you are an administrator, compliance officer, or health information management/medical records professional at a Medicare skilled nursing facility.

The Office for Civil Rights (OCR) at the US Department of Health and Human Services is responsible for ensuring patients’ rights to timely access to health records. Since the start of 2024, the OCR has issued two settlements with skilled nursing facilities (SNFs) under the OCR Right of Access Initiative. Both settlements were related to potential violations under the Health Insurance Portability and Accountability Act (HIPAA) Right of Access provision, which requires that individuals or their personal representatives have timely access to their health information.

As a HIPAA-covered entity, a SNF must provide access to the individual’s protected health information within 30 days of receiving a request from the patient or the patient’s personal representative, such as a guardian. In both recent SNF right of access cases, the OCR noted that access was not provided to the patients’ personal representative in a timely manner (161 days and 323 days, respectively). 

Both settlements, which were published on the OCR’s website, led to the imposition of significant civil money penalties (CMPs) against the SNFs. In one case, the OCR imposed a CMP of $100,000, which was not contested by the SNF. In the second case, the SNF challenged the imposition of a $75,000 CMP and agreed to a $35,000 settlement.

Other non-financial outcomes of an OCR Right of Access Settlement

In addition to the financial and reputational implications of an OCR Right of Access Settlement, a SNF must also undertake the following actions:

  • Revise and obtain the OCR’s approval of any noncompliant HIPAA policies and procedures (P&P) 
  • Provide the OCR with copies of all training materials that the SNF must use to train its workforce about the revised HIPAA P&P
  • Submit and obtain the OCR’s approval of the training plan outlining the topics to be covered, when the sessions will be held, and the names of the trainers
  • Send a signed attestation to the OCR documenting when the trainings have been completed

Remember

  • A patient or their personal representative may file a complaint directly with the Office for Civil Rights in writing, by email, by fax, or electronically via the OCR’s Complaint Portal
  • Subject to certain exceptions, the Privacy Rule at 45 CFR 164.502(g) requires covered entities to treat an individual’s personal representative as the individual with respect to uses and disclosures of the individual’s protected health information, as well as the individual’s rights under the rule. The personal representative “stands in the shoes” of the individual and can act for the individual and exercise the individual’s rights.

Actionable items to help ensure compliance with the Privacy Rule

  • Periodically (we suggest at least annually) check your SNF’s policies, procedures, and workflows that focus on access to medical records. We recommend you review:
    • Documentation of the turn-around times (TATs) for processing requests
    • The process for informing your patient or the patient’s representative, in writing and within the initial 30-day period if a request for records cannot be accommodated within 30 calendar days (only one extension may be made for an additional 30 days)
    • That the correspondence template provides a written statement of the reasons for the delay and the date when the SNF will complete its action on the request
  • Confirm that your SNF’s access to medical records timelines complies with your state’s requirements, as they may be more restrictive than the federal regulations. For example, California requires a 15-calendar day turnaround time while Texas requires action within 15 business days. Be aware that the OCR issued a Notice of Public Rulemaking on December 10, 2020, proposing that its current 30-day rule be decreased to 15 days. This change in federal rules has not yet gone into effect, but it is still expected and your SNF should be prepared. 
  • Maintain a log of medical records requests, including date received, person requesting, response due date, person responsible for completion of the request, and person assigned to review the record prior to release (such as Director of Nursing, Administrator) for completeness. 
  • We also recommend reviewing BerryDunn’s resource, Best Practices for Responding to Medical Record Requests in Healthcare Compliance Insights.

Need help assessing your SNF’s HIPAA program? BerryDunn can help.

BerryDunn’s SNF operations, compliance, and HIPAA privacy experts can answer your questions and provide an external review of policies, procedures, workflows, and training tools. Please contact Trisha Lee, Robyn Hoffmann, or Olga Gross-Balzano

Resources

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html 
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#newlyreleasedfaqs 
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html#maximumflatfee 
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/hackensack-meridian-health-west-caldwell-care-center/index.html#nfd 
https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/phoenix-healthcare/index.html

Article
SNFs and HIPAA Right of Access: Understand the requirements and avoid costly penalties

At first glance, the healthcare patient check-in process seems straightforward. But when examined through the lens of your revenue cycle and patient experience, it’s one of the most important interactions for your team to get right.

Several key elements must be taken into consideration to create a smooth and simple patient check-in. Patient satisfaction is the tip of the iceberg. You want your patients to have a great experience that is efficient, easy-to-understand, and doesn’t create billing headaches for them later on. The good news is that the same techniques that give your patients a good experience also form the basis for an optimal revenue cycle. Developing this process starts with the undersurface elements that patients never see.

Scripting for patient access teams

Communicating clearly, consistently, and positively is important to put patients at ease, and to make sure that you collect the most accurate and up-to-date information from patients. Doing this correctly up front will save time and will prevent denials and associated workload and revenue loss. The best practice is to establish scripting for your patient access staff and provide training to make sure they are confident in the scripting provided. Here are some examples:

When confirming that patient information is up to date:

Say this: “To ensure your account is as accurate as possible, we require all patients to present a minimum amount of information.”

Not that: “Have there been any changes in your information since the last time you were here?”

Or when connecting a self-pay patient with a financial counselor:

Say this: “Before scheduling your appointment, I will connect with a financial counselor who can determine if you qualify for assistance and will help you understand your financial obligations.”

Not that: “We can’t schedule you until you speak with someone in Finance.”

Developing clear and efficient scripting will give your team the tools to communicate effectively and will help your patients feel like they are well taken care of.

Schegistration: What is it? 

What is “schegistration” anyway? Schegistration is the process of scheduling a patient appointment while also pre-registering the patient at the same time. By gathering and confirming information at the time of scheduling, the in-person check-in process will have fewer steps and will be quicker and easier for both the patient and your team.

Technology: Align your EHR with patient access workflows

Technology, specifically your Electronic Health Record (EHR), can either make your workflows more efficient, or can hinder your patient access staff. It’s important to align your technology platforms with your operational workflows, so it is seamless for your staff to enter and pull up information. It’s also important to have your staff trained regularly on your technology systems so they feel confident that they are using the system correctly and most efficiently.

Documentation: Write it down! 

When you develop new workflows to increase efficiency and the patient experience, it can be challenging for staff to make the change. In a busy office environment, it can also be difficult to train new staff effectively. To make it easy and to create consistency and continuity, it’s important to develop standard operating procedures and to document them thoroughly. Providing easy to understand instructions, including visuals of workflows, will reduce errors, promote standardization, and improve accountability.

Leadership: Reinforce best practice workflows

Keeping workflows optimized takes the whole team, beginning with leadership. The leaders of your patient access team should act as reinforcement when team members learn and complete best practice check-in workflows. Having documentation readily available and providing support and encouragement to team members will help keep your processes running smoothly.

Patient access team collaboration

Establish clear expectations to foster a supportive team environment and facilitate problem-solving and quick assistance. When scripting, workflows, and documentation are consistent, it’s easy for team members to help each other out and support each other when challenges arise.

The healthcare revenue cycle is an intricate system involving interdependent functions. Like an ecosystem, each component plays an important role in the system. The patient access process is just one piece of the puzzle. Optimizing your revenue cycle also includes looking at these areas: coding and compliance, billing, and denial management.

BerryDunn's audit, tax, clinical, and consulting professionals, focused on specific healthcare industry areas, understand the biggest challenges facing healthcare leaders, and are committed to helping you meet and exceed regulatory requirements, maximize your revenue, minimize your risk, improve your operations—and most importantly—facilitate positive outcomes. Learn more about our healthcare consulting team

Article
Optimizing revenue cycle processes: Patient check-in