Managing risk in your practice AMA Queensland Private Practice and Medico-Legal Conference 2016

Transcription

1 Managing risk in your practice AMA Queensland Private Practice and Medico-Legal Conference 2016 Insurance Advisernet Australia Pty Ltd ABN AFSL Chris Mariani MAppFin, Dip Fin Serv (Brok), CIP, ANZIIF (Assoc) Authorised Representative No : * chris@mgrs.com.au ' (02) ' PO Box 4133 North Curl Curl, NSW 2099

2 Important Information General Advice Warning The information provided in this presentation is of a general nature and does not take into account your objectives, financial situation or need. Please refer to the relevant Product Disclosure Statement before purchasing any insurance product. About MGR Medical and General Risk Solutions is a Corporate Authorised Representative of Insurance Advisernet Australia Pty Limited, Australian Financial Services Licence No , ABN Authorised Representative No Chris Mariani, Authorised Representative No

3 Agenda 1. Implementing a risk management framework in your practice 2. Common risks in a medical practice and the main insurances to consider 3. Case studies what went wrong, tips, comments and wrap up

4 Aim for 3 levels of protection 1. Structure asset protection. 2. Risk framework identify and mitigate, policies & procedures, etc. 3. Insurance or other risk management strategy.

5 Structure & asset protection 1. When setting up your business structure seek advice from Lawyer, Accountant, Financial Planner and Insurance Broker. 2. Draw a structure diagram show me the money (how does it flow through the entities). 3. Ask how does this structure protect me, what are the positives, negatives, implications of using this versus other structures.

6 Structure & asset protection 1) Patient $100 Dr Smith Bills as Sole Trader: Retains $100 No service entity 2) Patient $100 Dr Smith Bills as Sole Trader: Retains $70 Pays $30 to service entity Dr Smith Pty Ltd Receives $30 Runs Practice 3) Patient $100 Dr Smith Pty Ltd Receives $100 Runs Practice - employees, lease Pays Dr wage $70 Dr Smith Receives $70 Queries: Asset protection benefits, tax benefits, workers compensation, other?

7 Risk Management Process - AS/NZS ISO 31000

8 Risk Treatment Options to manage risk include: 'Avoid' the risk' - such as by not entering into a new business venture or contract. 'Reduce the risk' E.g. a formalised induction process for new employees so they are less likely to make mistakes. 'Accept the risk' Do nothing. 'Transfer the risk' E.g. sharing the risk through a joint venture, or transferring the risk to insurance.

9 Annual process example client Actual risk management process implemented by large medical practice this year after almost 50 years in business: 1. Annual Risk workshop identify & agree top 10 risks 2. Practice/Business Manager = Risk Manager 3. Risk Register created and actions agreed 4. Quarterly risk item on Management team meetings 5. Annual training day topics such as privacy 6. Annual insurance review with broker

10 Privacy Risk RISK QUESTION: Dear doctor, can you please provide me a copy of your Privacy Policy, how do you make it accessible to patients and tell me about your processes to protect patient privacy? ANSWER: The answer usually falls into three categories:

11 Privacy Risk A. What s a Privacy Policy and should I have one? B. We have one somewhere, but I have no idea where it is or when we last looked at it. The practice manager is responsible for privacy C. We recently updated our Privacy Policy, it s on our website and also a hard copy at reception. We have detailed processes for privacy. This is a regular item on our management team meetings and it s included in our staff induction and training process. We are all responsible for patient privacy, but Mary takes the lead as the appointed Privacy Officer.

12 Privacy Risk This Privacy management framework (Framework) provides steps the Office of the Australian Information Commissioner (OAIC) expects you to take to meet your ongoing compliance obligations under Australian Privacy Principle (APP) 1.2. Source:

13 Privacy Risk 1. Copies at Reception 2. Link on website

14 Incident Register An incident register is the single source of truth of all incidents, adverse events, claims against the practice. Set up a monthly Survey Monkey style staff survey are you aware of any incidents, claims, near misses.

15 Contracts matter Most contracts contain: Insurance Requirements section/clause Check to see you comply What insurance policies are required Indemnities section/clause Be careful of contractual indemnities are generally excluded from policies. Typical Contractual Liability Exclusion The insurer is not liable for any liability that the insured assumed by contract, waiver, guarantee or warranty, unless liability would have attached in the absence of such contract

16 Contracts matter IT providers - Default position is to contract out of all liability XXX expressly excludes all liability for any loss of data no matter the cause, including the direct or indirect commercial or clinical consequences of data loss. To the extent allowed by law, XXX disclaims all other warranties, express or implied, including, but not limited to, any implied warranty of merchantability or fitness for a particular purpose. XXX is provided "as is" and is not warranted to be error free. You bear the entire risk as to the quality and performance of XXX. You agree to defend, indemnify and hold harmless XXX XXX will not be liable for any indirect or consequential damages howsoever arising.

17 Contracts If the contract is drafted by their lawyers it won t be in your favour!!! Do a search of the contract and look for words including: Indemnity/indemnify waiver subrogation release hold harmless consequential

18 Transfer risks to insurance Buying insurance is just a risk transfer strategy - so when does it make sense to purchase insurance? 1. Legal requirement E.g. registered healthcare professionals must hold professional indemnity (PII Registration Standard) E.g. employers must hold workers compensation (varies by state) 2. Contractual requirement E.g. lease agreement requiring public liability 3. Risk Management E.g. protect the business from significant financial loss a Simpson v Diamond type claim.

19 Professional Indemnity Practice Indemnity Workers Compensation Business Package Management Liability Cyber risks Some common key risks faced: 1. Professional negligence practitioner/practice/staff Civil claims against the practitioner Medico risks i.e. Registration board investigations, medicare audits etc. 2. Cyber risks Loss of revenue, investigation costs Costs to fix IT system and third party liability. 3. Practice Premises risks Patient & visitor slips/trips (public liability) Physical loss or damage to premises, fit-out, equipment, glass etc. Machinery/Electronic breakdown and spoilage Business interruption (loss of revenue & increased costs following physical loss) 4. Management & Employment issues Responsibilities as a Director / Officer of the company Employment practices liability (discrimination, unfair dismissal etc) Crime (employee theft) Statutory fines and penalties (e.g. OH&S fine) Tax Audits 5. Workers Compensation (required by law) Injury to workers at work NSW, VIC, WA, SA, Tas - additional Journey insurance cover to/from work Also consider: - Business travel - Keyman, life, income protection And the 5 insurance policies which cover these risks the 5 Pillars: 5 Pillars IMPORTANT: This is not a comprehensive list of risks or insurance policies available, but provides an overview of some of the major risks and policies.

20 The right program = overlapping covers Medical Indemnity - doctor Cyber Risks Medical Indemnitypractice Management Liability

21 Typical first year insurance program Profile: 2 x physicians joint entity Lease rooms, $50k employee wages Maintain public appointments and first year private billings $400k entity fee 40% Low risk as minimal staff, not overly reliant on rooms or equipment. Cloud IT (does not include personal risks/insurances life, TPD, IP, Keyman etc) General Insurance Program: - Doctor Medical Indemnity - Entity Medical Indemnity - Business Package - Cyber & Privacy risks - Workers Compensation - Management Liability Purchased $5,000 each $1,767 $ 968 $1,100 $ 250 $1,100 Cover $20million $5 million $50k Contents, Glass, $20m liability $250k Statute Self-insured yr1

22 Case Studies

23 Case study exposed to rooms Medical centre Significant water damage - storm water drain blockage Closure for 2 months Insurance claim total ~$700k: 1. Damage to property (section 1) ~$100, Loss of revenue and Additional Increased Cost of Working: ~$600, Wages + overtime + contracted GP payments 2. Extra costs to get IT system recovered and data 3. Claim preparation costs, managing patients, etc. A Business Continuity Plan helps determine Business Interruption needs: Would we rent temp premises & aim to be back trading within months? Would we close and await re-build?

24 Case Study Privacy Breach physical records City Contractor dumped The North West Star Sep 21, The records found dumped at the household waste area of the tip belonged to the practice... On 12 March 2014, the Privacy Act was amended. It is now possible for a $340,000 fine against individuals and $1.7m for the entity.

25 The Miami Family Medical Centre will continue to operate, even though Mr Wood admits it is "very, very, very difficult" without patient records. Mr Wood warns other businesses to "check your IT security and don't leave backups connected to servers ". Case Study Privacy Breach - cyber Russian hackers hold Gold Coast doctors to ransom, Tue 11 Dec The hackers are demanding a ransom of $4,000 to decrypt the sensitive information held on a server at the Miami Family Medical Centre. IT security expert Nigel Phair says this latest attack is a "wake-up call" with businesses around Australia hacked five to 10 times a week.

26 Case Study My business owner hat Healthcare giant must pay $300,000 in HIV test mix-up May 21, THE corporate healthcare giant founded by Australia's richest GP has been ordered to pay almost $300,000 in damages to a man who was infected with HIV after his former partner was wrongly given the all-clear by a doctor at its Bondi Junction medical centre. The man would not have contracted the virus if the centre's administration staff had updated his then-partner's contact details and sent a recall letter to her current address, Justice Megan Latham said in the NSW Supreme Court yesterday. Justice Latham ruled yesterday that Idameneo should pay 40 per cent, finding both the reception and in-house pathology staff failed to follow the company's policy and procedures manual, and check the patient's address and phone number.

27 Fraud is more common than you think The Asia-Pacific CEO took to the stage to spell out how an employee siphoned off $17m, offering a warning that it could happen to any business. The trauma that DUAL has been through in the last three months is something I d never want any business to go through. On 30 June, news broke that former employee Josie Gonzalez and her husband had allegedly misappropriated $17m in insurer funds, via false invoices to a fictitious law firm, JAAG.we had a very strong vendor approval process before we appoint any lawyer to our panel. Coates says the problem was DUAL s processes hadn t kept up with its growth. When I first set up DUAL I was approving every invoice. I wanted to know where every dollar went. As the business had grown our two bank signatories were signing 800 invoices a month, he says.

28 Doctor contracts Are they an employee or independent medical practitioner? Beware Fair Work Commission contracts need careful drafting Use accountant and lawyer with expertise AMAQ template but seek legal advice to make sure it suits you Bringing in other doctors creates multiple new risks. You need to get the best contracts in place to protect you: Termination clauses Restraint Indemnities

29 Wrap up, comments and tips 3 levels of protection structure then risk management then insurance Use the resources of your associations can they provide you templates, HR manuals etc Do a risk review privacy, IT, financial controls, Review contracts! get legal and insurance advice Insurance program do you have the right insurance program? Use a specialist medical insurance broker

30 . Questions? Contact details: Chris Mariani Ph E: W: