Moving Forward with Meaningful Use Stage 3 and MACRA

A little over a month ago, CMS Acting Administrator Andy Slavitt delivered some unexpected news.   

Now that we effectively have technology into virtually every place care is provided, we are now in the process of ending Meaningful Use and moving to a new regime culminating with the MACRA implementation. 

The Meaningful Use program as it has existed, will now be effectively over and replaced with something better. Since late last year we have been working side by side with physician organizations across many communities — including with great advocacy from the AMA — and have listened to the needs and concerns of many. We will be putting out the details on this next stage over the next few months, but I will give you a themes guiding our implementation.

Andy Slavitt, JP Morgan Annual Health Care Conference, January 11, 2016 (emphasis my own).

The comments left many wondering if they heard him correctly.  After all, the final Stage 2 modification and Stage 3 rule (the “MU Stage 3 Rule”) was just published in October this past year despite criticism and calls from health care providers and other stakeholders to delay Stage 3. Furthermore, the statutory basis of the program would hinder a compelte death toll for Meaningful Use. Others took to their Twitter feeds and blog posts proclaiming MU effectively “dead” as a result of Mr. Slavitt’s comments.

There was more to come from CMS.  Mr. Slavitt, along with Karen DeSalvo, Acting Assistant Secretary for HHS, released a follow up “sorry, not sorry” blog post clarifying next steps for Meaningful Use and stating the following:    

  1. The current law requires that we continue to measure the meaningful use of ONC Certified Health Information Technology under the existing set of standards. While MACRA provides an opportunity to adjust payment incentives associated with EHR incentives in concert with the principles we outlined here, it does not eliminate it, nor will it instantly eliminate all the tensions of the current system. But we will continue to listen and learn and make improvements based on what happens on the front line.
  2. The MACRA legislation only addresses Medicare physician and clinician payment adjustments. The EHR incentive programs for Medicaid and Medicare hospitals have a different set of statutory requirements. We will continue to explore ways to align with principles we outlined above as much as possible for hospitals and the Medicaid program.
  3. The approach to meaningful use under MACRA won’t happen overnight. Our goal in communicating our principles now is to give everyone time to plan for what’s next and to continue to give us input. We encourage you to look for the MACRA regulations this year; in the meantime, our existing regulations – including meaningful use Stage 3 – are still in effect.

To give some background, the Medicare Access and CHIP Reauthorization Act (“MACRA”) was signed into law in early 2015.  Several provisions relate to improvement of health care delivery, including a Merit-based Incentive Payment System (“MIPS”) and Alternative Payment Models (“APMs”).  CMS released a request for information regarding implementation of many of these provisions shortly before news of the MU Stage 3 Rule broke, and detailed MACRA regulations are expected later this year.  A key component of MACRA is meaningful use of CEHRT (i.e., demonstration of the requirements of Meaningful Use). Up to 25% of an EP’s score under the MIPS is tied to successful demonstration of Meaningful Use. 

MACRA did not (and CMS and HHS cannot through rulemaking) repeal the current statutory framework of Meaningful Use.  Furthermore, MACRA only applies to clinicians, leaving hospitals and CAHs out in the cold for now.  Any real change to Meaningful Use would require substantial changes at the statutory and/or regulatory level. 

The Meaningful Use Program has seen its share of changes over the years, as CMS responded to pressure and concerns from various stakeholders (albeit dragging its feet the entire way). This would appear to be just another evolution for Meaningful Use through MACRA, and not a complete end to or replacement of Meaningful Use. Whatever Meaningful Use will look like in the coming months, it is apparent that the focus will turn more to quality outcomes for patients, as opposed to mere use of health technology. Given that the current Stage 3 regulations seek to align reporting between eligible providers and hospitals/CAHs, we can expect to see changes to Meaningful Use not only for clinicians as a result of the MACRA regulations, but also for hospitals. 

We could potentially see the MACRA regulations at the end of March, as has been hinted, or over the summer.  Providers will have to wait until then with bated breath to see what direction CMS and HHS will take moving forward with Meaningful Use. 

CMS Releases Guidance on Stage 2 Summary of Care Measure

CMS release guidance yesterday that it has discontinued the NIST EHR-Randomizer effective today, July 1. Hospitals and providers were previously required to conduct a test with the NIST EHR-Randomizer as part of their demonstration of the Stage 2 Summary of Care Record if they were unable to exchange a summary of care record with another provider with different CEHRT. CMS now permits hospitals and providers to retain documentation if they were not able to interact with a provider with different CEHRT in common practice, and attest "Yes" to this measure nonetheless.  

The text of the FAQ is available below.  For additional guidance on the Stage 2 Summary of Care Record measure, visit the CMS FAQ page.   

Question: When reporting on the Summary of Care objective in the Medicare and Medicaid Electronic Health Records (EHR) Incentive Program, how can eligible professionals and eligible hospitals meet measure 3 if they are unable to complete a test with the CMS designated test EHR (Randomizer)?

Answer: CMS is aware of difficulties related to systems issues that eligible professionals, eligible hospitals, and critical access hospitals (CAHs) are having in use of the CMS Designated Test EHRs (NIST EHR-Randomizer Application) to meet measure 3 of the Stage 2 Summary of Care objective, therefore, we will be discontinuing this option effective July 1, 2015.

Providers may still meet the Stage 2 Summary of Care objective measure #3 by using one of the following actions:

  1. Exchange a summary of care with a provider or third party who has a different CEHRT as the sending provider as part of the 10% threshold for measure #2 (allowing the provider to meet the criteria for measure #3 without the CMS Designated Test EHR). This exchange may be conducted outside of the EHR reporting period timeframe, but must take place no earlier than the start of the year and no later than the end of the EHR reporting year or the attestation date, whichever occurs first.
  2. If providers do not exchange summary of care documents with recipients using a different CEHRT in common practice, they may retain documentation on their circumstances and attest “Yes” to meeting measure #3 if they have and are using a certified EHR which meets the standards required to send a CCDA (§ 170.202).

8 Things to Know about the Next Evolution of Meaningful Use

CMS recently released proposed changes to Stage 2 Meaningful Use as well as a proposed rule for Stage 3 which has been scheduled to begin for all participants in 2018. The comment period for the Stage 3 Notice of Proposed Rulemaking (“Stage 3 NPRM”) closed this past Friday, however, the comment period for the Stage 2 Notice of Proposed Rulemaking (“Stage 2 NPRM”) remains open until June 15.

Unless you've been living without social interaction or the Internet for the past few months (not an option for most of us), you are well aware of the changes CMS has proposed for moving forward with Meaningful Use. Some are drastic and have invited a host of public comment. Others are welcomed changes moving forward in this year and with Meaningful Use in general.  Here is our list of the top 8 changes to be aware of. 

  1. Stage 3 is the END.  But not Really.  All providers will be responsible for Stage 3 in 2018, regardless of their year of participation. CMS has stated that Stage 3 will be the final “Stage” of Meaningful Use.  However, it acknowledges that changes may be required as the program advances.  From past experience, we all know future rulemaking is a given. 
  2. Reporting Periods have Changed.  For 2015, the Stage 2 NPRM proposed to shorten the reporting period from a full calendar or fiscal year to a 90 day calendar reporting period - this is despite CMS specifically refusing to do so last summer in its 2014 CEHRT delay rule. In 2016, all participants will supposedly be on a full calendar year reporting period, including hospitals and critical access hospitals, except for new Medicaid participants. 
  3. Maxed-out Incentive Payments.  For many hospitals and EPs, 2014 was the last year the hospital or EP received an incentive payment.  That means moving forward, any CEHRT upgrades are solely on the hospital or EP’s dime.  However, failing to continue participation will result, at least for purposes of Medicare, in payment adjustments for each year that a hospital or EP does not successfully participate. Providers will need to each determine whether it is worth the cost to continue to participate in subsequent years.
  4. Vendor Certification Requirements.  The requirements for vendors to get their products certified to 2015 Edition CEHRT pose a significant time and resource burden.  Since we likely won’t see a final version of the Stage 3 NPRM or its accompanying certification rule until the fall, vendors have only a little over two years to develop or retool the necessary software, get it certified, and roll it out in time for the providers to start their own reporting clocks on January 1, 2018. It remains to be seen what impact this timetable will have on smaller CEHRT vendors, and more importantly, whether this is truly enough time to prepare everyone for Stage 3.      
  5. Elimination of Core/Menu Distinctions.  For Stage 3, CMS has proposed a single set of core objectives, with some flexibility options built in.  This means physicians and hospitals are expected to demonstrate measures that previously may not have been applicable to them.  To help move hospital and EPs towards this, similar changes are proposed for Stage 2. Both the Stage 2 and Stage 3 NPRMs also eliminate measures which CMS considers to be redundant, duplicative or “topped out” although data will still need to be collected on certain former objectives, such as Vital Signs or Smoking Status.  CMS states that its goal is to streamline, simplify, and reduce the burden on providers, while at the same time advancing the goals of Meaningful Use.  
  6. API.  The Stage 3 NPRM proposed changes to the former Stage 2 Patient Access and other measures would permit (or potentially require) use of an Application Program Interface.   It’s a set of programming protocols that would allow a third party application access to pull a patient’s health information from the provider.  CMS has requested comment whether providers should be given the option to use either an API or a Portal, both, or just an API to demonstrate this measure. 
  7. Patient-Generated Data.  The Stage 3 NPRM would require incorporation of patient-generated data in some format into a provider’s CEHRT.  This is information not originating with another EP or hospital, but from other sources such as home health and even medical device data.  A lot of questions remain open about how this data would be incorporated, how a provider would obtain such data, and the scope of data that would be covered (i.e., Fitbits?)
  8. Patient Access Modifications.  The Stage 2 NPRM proposes to eliminate the 5% percentage requirement that patients actually view, download or transmit their health information in favor of an “at least 1” requirement.  CMS acknowledges in the Stage 2 NPRM the difficulties providers have due to lack of control over this measure, yet for Stage 3, would nonetheless ramp this percentage up to 25%.  Although additional flexibility is proposed by permitting hospitals and EPs to choose 2 out of 3 to meet the threshold for, they still hinge upon factors which may be difficult for providers to control.

Several prominent industry groups are already calling on CMS to delay Stage 3 finalization, for example, because it is too soon to  overhaul Meaningful Use without fully measuring how the industry has responded to the first two stages. Comments posted to the Stage 3 NPRM up until the close of their acceptance reflected a mixed bag of support for flexibility but concern for implementation and timing.  However, we will almost certainly see material changes in the finalized versions of the rules if CMS's past regulatory history is any measure.  

As a reminder, the deadline for EPs to apply for a Hardship Exception for their inability to successfully participate in 2014 is July 1.  Although any EP who did not successfully participate last year will lose his or her incentive payment, filing for a Hardship Exception can potentially avoid the 2% reduction in Medicare payments which will begin January 2016.  The applications can be found on the CMS Payment Adjustments and Hardship Exceptions page.  There is no payment reduction for Medicaid participants.  

CMS Releases Final Meaningful Use CEHRT Extension Rule

Happy Labor Day and Back-to-School Week! September is here, which means hospitals and EPs participating in Meaningful Use are rapidly approaching deadlines for their respective 2014 reporting periods. Hospitals are in the closing stretch and have until September 30th when their reporting period closes for the 2014 FY. For EPs, October 1 is the last date to begin their reporting period for the 2014 calendar year.  

As a holiday weekend present to us all, CMS finalized regulations this past Friday granting flexibility to certain EPs and hospitals participating in Meaningful Use.  Too little, too late, the final rule comes as hospitals have already finished or are in the last month of their 2014 reporting period, and only a month before the last possible date for EPs to begin their reporting period for the year.

The final rule permits EPs and hospitals having difficulty implementing 2014 Edition CEHRT to demonstrate Stage 1 or Stage 2 of Meaningful Use using 2011 Edition CEHRT, 2014 Edition CEHRT, or a combination thereof, for their 2014 reporting periods.  You can review your participation options in the CMS "Quick Guide". Although the flexibility is welcomed by many, the final rule is still not a get-out-of-jail-free card, as providers need to be able to demonstrate that they were unable to fully implement 2014 Edition CEHRT in order to take advantage of the extension.  

Although this flexibility may buy EPs a few more months to finish working through all the technical and workflow difficulties with implementing the new versions of their 2014 Edition CEHRT, a hospital must be up and running on 2014 Edition CEHRT and begin its 2015 reporting period on October 1, less than thirty days from now. Citing delays to the progress of health IT infrastructure and misalignment with other quality programs, CMS declined to change the requirement that all EPs and hospitals demonstrate Meaningful Use using 2014 Edition CEHRT in 2015, nor the full-year reporting period requirement for Stage 2 in 2015. 

The final rule is scheduled for publication tomorrow, September 4, 2014.  A copy of the full rule is available online at the Federal Register website.  

Reminder: Public Comment Period Open for Meaningful Use NPRM

Last month, CMS and ONC released a Notice of Proposed Rulemaking ("NPRM") which would grant flexibility to providers participating in Meaningful Use who are having trouble implementing 2014 Editions of their CEHRT. The public comment period is open until July 21, at 11:59pm and I encourage you to take a few minutes to submit your comments, concerns and questions online.  All of them. 

The general gist of the NPRM is that CMS and ONC have finally acknowledged the frustration and concern of vendors and providers with having 2014 Edition CEHRT up and running in time to demonstrate Meaningful Use for the 2014 reporting period.  Despite concerns regarding insufficient timing after the Stage 2 rule's publication for vendors to certify to the 2014 requirements and roll-out upgraded products to their consumers (not to mention all the steps taken on the provider side for implementation), CMS plowed ahead with its original timeframes and requirements.  

CMS now seems to be regretting this decision and is offering potential solutions for all providers, regardless of Stage.  Can't implement 2014 Editions in time? Don't worry about it, says CMS, just take your pick from one of the following options:   

  • Stage 1 (2013 Definition) using 2011 Edition CEHRT, or using a combination of 2011 and 2014 Edition CEHRT;
  • Stage 1 (2014+ Definition) using 2014 Edition CEHRT; or
  • Stage 2 (2014+ Definition) using 2014 Edition CEHRT.

This is not entirely a "get-out-of-jail free card" from CMS. A provider would need to be able to demonstrate that it had trouble fully implementing 2014 Edition CEHRT required to demonstrate Meaningful Use in its applicable stage of participation.  

There are plenty of problems with CMS's proposed solution.  First of all, the public comment period is open until July 21 at 11:59pm. That means there won't be any formal action taken by CMS until the end of July at the earliest.  This is an entire month into the last available reporting period for hospitals in FY 2014.  

Secondly, providers that have been working tirelessly to implement the necessary changes for the 2014 Edition CEHRT may not be able to reverse gears at this point and go back to the 2011 Editions where needed. And third, (but certainly not the last of the concerns), even if they can switch gears, all providers still need to be ready to go with 2014 Edition CEHRT for the 2015 reporting period.  For hospitals, this means midnight on October 1, 2014.  

CMS may have had good intentions, but the proposed solution is creating more confusion than alleviating concerns. Let's hope we see some more clarity in the final rule, whatever it may look like.  Until then, keep calm and carry on.    

EHR Vendor Loses Meaningful Use Certification

HHS announced on Thursday that two EHRs have had their Meaningful Use certification revoked.  EHRMagic-Ambulatory and EHRMagic-Inpatient, which are developed by EHRMagic, Inc., were previously certified for the Medicare and Medicaid EHR Incentive Programs.  It is the first time that a certified EHR has had its certification status revoked. 

ONC and InfoGard Laboratories, an ONC authorized certification body for Meaningful Use, both were notified that the EHRs did not provide required functions and shouldn't have passed certification.  After retesting, the EHRs failed. 

ONC has made it clear that certification is an ongoing process. Dr. Mostashari stated,  

We and our certification bodies take complaints and our follow-up seriously.  By revoking the certification of these EHR products, we are making sure that certified EHR products meet the requirements to protect patients and providers."

Eligible professionals and hospitals who purchased the decertified EHRs will have no choice but to implement an alternative EHR in order to continue participating in Meaningful Use. EHRMagic customers now are in a difficult situation, with significant costs, downtime and retraining to transition to a new EHR as well as loss in incentive payments they would have otherwise been potentially eligible for. reports that no one has attested to Meaningful Use using the EHRMagic products yet, according to Peter Ashkenaz, an ONC spokesperson. These means that EHRMagic customers will at least not be faced with potential recoupment of payments.  It remains unclear what liability EHRMagic may have to its customers for failing to retain certification for its EHR products.    


Meaningful Use Sees Impressive Payouts since Beginning

CMS recently released the numbers for the Medicare and Medicaid EHR Incentive Programs through February 2013.  About $12.6 billion has been paid out to participants by the program so far. 

Although only 4,299 hospitals are actively registered for Meaningful Use, over 380,000 EPs are registered, with about 234,000 providers combined receiving payments through February 2013.  CMS greatly exceeded the goal it had set for the program for 2012 of 100,000 participants, which had been reached by last summer. 

On the state side, California, Florida, New York, Texas and Pennsylvania lead the way in the amount of payments made to EPs and hospitals, as well as total number of participating providers.  New Jersey has 6,891 participating providers as of February 2013 with $318,261,098 paid out.

Visit the CMS Data and Program Reports page for up-to-date Meaningful Use payment and registration information. 

HHS Rings in 2013 with News of Settlement for Small Breach

We hope all of our readers had a happy and relaxing holiday season, and we wish you all the best for this New Year!

It seems fitting for the first post of the year to revolve around HHS's announcement of its first breach settlement of 2013.  In what may quickly become a "trend" for HHS and OCR, the $50,000 settlement with the Hospice of North Idaho (HONI) is the first of its kind.  Coming after OCR investigated a reported breach involving 441 patients and theft of an unencrypted laptop in the summer of 2010, it is a far cry from the breach tallies we have seen in the past numbering in the hundreds of thousands of affected individuals and over a million dollars in fines.

Yet again OCR has called out a covered entity for failing to conduct a risk analysis as required by the HIPAA Security Rule and cracked down on yet another breach involving an unencrypted device (see, for example, the Alaska DHHS Resolution Agreement which resulted from theft of a flashdrive containing PHI).  Not only did OCR state that HONI had failed to implement policies and procedures to address mobile device security despite regular and routine use of laptops in the field, but that HONI also failed to conduct a risk analysis to safeguard electronic PHI, stating,

´╗┐´╗┐HONI did not conduct an accurate and thorough analysis of the risk to the confidentiality of ePHI on an on-going basis...from the compliance date of the Security Rule to January 17, 2012.  In particular, HONI did not evaluate the likelihood and impact of potential risks to the confidentiaity of electronic PHI maintained in and transmitted using portable devices, implement appropriate security measures to address such potential risks, document the chosen security emasures and the rationale for adopting those measures, and maintain on an on-going basis reasonable and appropriate security measures. (emphasis added)

The risk analysis is too often abandoned to the wind by many covered entities, despite being a "Required" implementation specification for the security management process needed to prevent, detect, contain, and correct security violations.

Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity.  

This breach settlement combined with the fact that the risk analysis is also an independent core measure required for Meaningful Use participants in the Medicare and Medicaid EHR Incentive Programs, suggests all covered entities should make it their New Year's Resolution to be more proactivate about their risk analyses and throw out bad portable device habits, whether they are big or small. If your organization doesn't have policies and procedures regarding use of laptops, flashdrives, and other devices which can store or access ePHI, and a good reason for not encrypting them where their use is necessary, it may be in for a rude awakening in the event of loss, theft or OCR or CMS knocking at the door to conduct an audit. Remember, even though not required per se by the HIPAA Security Rule, encryption of data at rest and in transmission is an implementation specification that must be addressed by all covered entities.    

OCR and ONC have made available several resources and tools to help covered entities of all sizes in conducting and reviewing a risk analysis.  The majority of these are now readily available in one location on the Health IT website under the National Learning Consortium Resources section. The NIST 800-30 Special Publication has also consistently been referred to by OCR as a resource to use in preparing for and conducting risk analyses. In addition, ONC recently released a new initiative aimed at increasing the security of mobile devices, Mobile Devices: Know the RISKS. Take the STEPS. PROTECT and SECURE Health Information.

Whatever the reasons or excuses in the past, make 2013 the year your organization resolves to be more proactive about its risk analysis and security management processes, managing mobile devices and the overall security of ePHI. 

CMS Releases Meaningful Use Changes in Interim Final Rule with Comment

CMS has announced the release of an Interim Final Rule with Comment ("IFC") that makes several changes to the Medicare and Medicaid EHR Incentive Programs and 2014 EHR Certification Criteria. 

Short and sweet, the IFC major changes that are proposed include:

  • Revising regulatory text for the hospital measures for making patient information available online. The measure will base the denominator on all unique patients, not all patients.  CMS inadvertently omitted the word "unique" from previous regulatory text for these measures.   
  • Expanding denominator options for the objective of sending electronic lab results to ambulatory providers. Hospitals may choose between a denominator of all lab orders received from ambulatory providers or all lab orders received electronically from ambulatory providers, in order to account for the difficult hospitals may have where they receive a small percentage of lab orders electronically and to capture performance more adequately. 
  • Moving the CQM minimum denominator threshold effective date from 2014 to 2013.
  • Adoption of new version of the DEC (version 1.1) to ensure EHR technology certified is capable of electronic capturing of all data for CQM calculation and submission. 
  • Adoption of November 2012 balloted version of QRDA III for appropriate creation of data files for transmission of CQM data.
  • Intent to address technical errors in CQM specifications released previously on October 25, 2012. 


The IFC can be found here.  Stay tuned for more information about the comment period!

OIG Finds Fault with CMS Meaningful Use Oversight

In a report released on November 29, the Office of Inspector General (OIG) chastised CMS for not doing a better job of pre and post-payment oversight for the Medicare and Medicaid EHR Incentive Programs (Meaningful Use).  As of September 2012, OIG stated that CMS has paid out approximately $4 billion to eligible professionals (EPs) and hospitals. 

In the report, OIG looked at CMS’s oversight of Meaningful Use, examining self-reported data, CMS auditing planning documentation, guidance, and regulations, as well as conducted interviews with CMS key staff.  It found that CMS failed to implement strong prepayment safeguards, and that postpayment safeguards were also limited, criticizing CMS for its reliance on self-reported data and failure to confirm its accuracy. 

“CMS determines that professionals and hospitals are meaningful users of certified EHR technology, and therefore qualify for incentive payments, based solely on self-reported information. CMS does not verify that self-reported information is accurate prior to payment. Although CMS is not required to verify the accuracy of this information prior to payment, doing so would strengthen its oversight of the anticipated $6.6 billion in incentive payments. Verifying self-reported information prior to payment could also reduce the need to identify and recover erroneous payments after they are made.”

Problems OIG highlighted including failure to assess whether EPs and hospitals were eligible during the certification process for incentive payments, lack of capability for EHR technology to produce reports for all required measures, lack of guidance as to what documentation is needed to support attestation, and failure to review supporting documentation prior to issuing incentive payments.  Furthermore, OIG noted that CMS does not verify that numerators and denominators entered for all percentage-based measures reflect the actual number of given patients for such measures.  

Continue Reading

Last Call for Hospital Attestations

CMS is reminding hospitals that Friday, November 30, is the last day to register and submit their attestations for FY 2012 Meaningful Use incentive payments. Hospitals must attest to having successfully met all Meaningful Use requirements in order to be eligible for incentive payments.  

CMS has made available a 15 minute YouTube video that walks eligible hospitals and CAHs through the registration process. Additional resources are available on the CMS EHR Incentive Program website, including the Hospital Attestation Worksheet, Calculator and User Guide.  CMS has also released an HIT timeline with key deadlines in 2013 and 2014 for EPs and hospitals addressing both Stage 1 and Stage 2.  

State Medicaid deadlines for attestation may vary.  Hospitals participating in the New Jersey Medicaid EHR Incentive Program have until December 31, 2012 to attest for FY 2012, while EPs will have until March 31, 2013. 

Guess What? OIG DOES Care about EHRs and Meaningful Use

Today marks the last day for hospitals to return an 18-page, 54 question survey inquiring about their EHR practices, security, coding and other potential EHR fraud and abuse vulnerabilities.  Hospitals using certified EHR technology who received Meaningful Use incentive payments between January 1, 2011 through March 31, 2012 received the survey from the HHS Office of the Inspector General (OIG) last week/early this week and were asked to return it by the end of today. 

The survey is part of the OIG's 148-page FY2013 Work Plan that summarizes OIG's fraud and abuse focus areas and planned reviews and activities for the year. Whether coincidental or not, the survey's timing comes on the heels of three hotly contested letters surrounding EHRs and the CMS Meaningful Use Incentive Programs. 

First came the warning letter issued by Secretary of the Department of Health and Human Services, Kathleen Sebelius, and U.S. Attorney General, Eric Holder, to hospital associations warning them of EHR fraud and abuse through cloning medial records and upcoding.  This was quickly followed by a letter from House Representatives calling for the suspension of the Meaningful Use program, and then a second letter from four Senators requesting a meeting, by no later than today, to discuss Stage 2 of Meaningful Use. 

CMS has explicitly made it clear from the beginning that false claims associated with Meaningful Use will be subject to recoupment of any incentive payments received and may result in further liability. Now, not only will CMS or state Medicaid agencies audit providers to identify payments which were improperly made, but OIG may not be far behind. 

The majority of the survey questions focus on areas that could potentially implicate inappropriate EHR practices, including "copy and paste" functions and policies, diagnoses and procedure coding, physician and nursing progress notes, as well as security practices, such as user authorization and access controls, third-party accesses to EHRs and patient EHR access.  However, it is clear from OIG's Work Plan that it is carefully examining both Meaningful Use payments received by providers and CMS safeguards in place to identify erroneous payments. Likewise, the Work Plan states OIG plans on reviewing OCR oversight activities of HIPAA and HITECH. 

The American Hospital Association is asking all hospitals to copy it on their answers by email at 

August Goes Out with a Bang: Stage 2 Final Rule & HIPAA Arrest

August ended in a whirlwind of federal activity, with CMS and OCR publishing the long-awaited Meaningful Use Stage 2 Final Rule and its accompanying Standards & Certification Criteria.  And, as if Stage 2 wasn't enough excitement, the FBI arrested a former hospital employee for a solicitation scheme involving improper access to and sale of emergency department patient records.

Much dissected since their release on August 22 by CMS and OCR, the Meaningful Use Stage 2 Rules brought few surprises to those familiar with the Notices of Proposed Rulemakings (NPRMs) released back in March. In addition to formally delaying Stage 2 to 2014, the Final Stage 2 Rule limits the reporting period to 90-days for 2014 for ALL providers REGARDLESS of the Stage they are in.

While CMS took into consideration, and incorporated some revisions as a result of, public comment, the majority of the NPRMs carried over into the Final Rules (see my previous post on the Stage 2 NPRMs).  EPs now must report on 17 core and 3 out of 6 menu objectives, while hospitals and CAHs must report on 16 core and 3 out of 6 menu objectives.  Likewise, EPs must report on 9 out of 64 CQMs, and hospitals and CAHs report on 16 out of 29 CQMs.   The majority of Stage 1 menu objectives and measures became core, and several Stage 1 core objectives and measures were consolidated into a single objective and measure(s), or eliminated (for example, "exchange of key clinical information" eliminated in favor of a new and more robust "transitions of care summaries" objective). 

Public comments highlighted the concerns many providers had with new Stage 2 patient engagement requirements: those requiring patients utilize secure messaging with their providers (EPs) and online access to, viewing, and downloading of health information (EPs, hospitals and CAHs).  Although the requirements were not eliminated, CMS reduced the associated measure thresholds from 10% to 5%.  In addition, CMS reduced the measure thresholds of certain other objectives, including for electronic exchange of summary care records.  Another area of concern reflected in the public comments, the electronic exchange of summary care records objective was also modified by CMS in response to such concerns to require at least one successful electronic exchange to a different EHR technology or a successful test with a CMS designated test EHR during the applicable EHR reporting period. 

CMS has released several tipsheets and guidance documents to help EPs, hospitals and CAHs participating in the Medicare and Medicaid EHR Incentive Programs in understanding the new requirements for Stage 2, as well as those amendments to certain Stage 1 requirements. Additional information regarding Stage 2 can be found on CMS' new Stage 2 webpage.   

To add to August's excitement, a former employee at Florida Hospital's Celebration Health was arrested by the FBI for accessing patient emergency department records and selling those related to motor vehicle accidents.  According to the FBI criminal complaint, the former employee was fired back in July 2011, but for an unrelated incident involving accessing without authorization the medical records of a physician who had been shot and killed in a Florida Hospital parking garage.

However, prior to his termination with Celebration Health, the former employee, Dale Munroe (along with his wife and a co-worker) improperly accessed over 750,000 patient emergency department records at the various Florida Hospital locations, allegedly then selling those records that related to a car accident to an entity, S.K.  In turn, S.K. would sell the information to an entity or entities that solicited and referred patients for chiropractors and attorneys.  Patients whose information was allegedly sold would receive a phone call shortly after their emergency department visit. 

After Munroe was terminated, his wife and co-worker continued to access patient records.  After the hospital was notified by an employee who had received a solicitation call, the wife and co-worker were also fired, and a breach reported in 2011.  While the hospital was conducting audits in response to the breach, it discovered the depth of Munroe's actions prior to his termination.  Since then, the actions of these three individuals have been under investigation. 

Munroe is the only one who has been arrested so far. The complaint alleges violations of the criminal provisions of HIPAA at 1320d-6(a) and 1320d-6(b)(3) for intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, which carries with it a fine of not more than $250,000, imprisonment of not more than 10 years, or both.  While over 750,000 records were improperly accessed, only approximately 12,000 records are believed to have been viewed in depth and sold. 

CMS Meaningful Use Audits Begin; Stage 2 Rule Sent to OMB for Review

HITECH Answers reports that CMS has begun audits of providers participating in the Medicare EHR Incentive Program.  With little fanfare and no official introduction of CMS' chosen auditor, health care providers have already received letters from Figliozzi and Company seeking documentation on their Stage 1 meaningful use attestation. 

A two-week timeframe to respond was provided to all letter recipients. Although identifiable or detailed patient records are not being requested at this time, information requested by the audit letters includes;

  • A copy of their certification for the certified EHR technology used to meet Meaningful Use requirements;
  • Documentation showing method used to account for ED admissions; and
  • Documentation supporting attestation for core and menu measures and objectives. 

Several states have already begun audits under the Medicaid EHR Incentive Program, which are separate from those being conducted by CMS.  New Jersey, for example, has already begun audits for Adoption/Implementation/Upgrade payments. 

CMS confirmed last week to BNA that it had indeed begun Meaningful Use audits, as well as posted a FAQ to this effect (#7361).  An insurance specialist at CMS's Office of eHealth Standards & Service has stated CMS will not issue guidance on what providers should expect from the audits as it would defeat the overall purpose of conducting them.

The final regulations for Meaningful Use Stage 2 were sent July 16 to the Office of Management and Budget (OMB) for review. Although this would mean publication is expected in mid-October, as we know from the painstaking delay of the HITECH Omnibus Rule (sent for review in March, but with an extension announced by the OMB on June 22), HHS or the OMB can request extension of the 90-day timeframe for review.  The official kickoff for Stage 2 remains 2014, a one-year delay from the original start-date of 2013.    

CMS Releases Additional Meaningful Use Guidance for EPs; Stage 3 Recommendations Underway

CMS released last week a new comprehensive guide for eligible professionals (EPs) participating in the Medicaid EHR Incentive Program.  The guide covers:

  • Program basics, such as an explanation of the Medicaid EHR Incentive Program and what requirements must be met;
  • Eligibility and registration; 
  • Meaningful use, including first year adoption/implementation/upgrade payments, as well as clinical quality measures (CQMs), core and menu objectives;
  • Steps for attestation; and
  • Resources for EPs

This Medicaid guide compliments the Medicare version which was previously made available for EPs by CMS and can be found on the Educational Materials section on CMS' EHR website. CMS urges EPs, as well as hospitals, to register early to avoid any issues during attestation.  This is the last year for Medicare EPs to begin their participation in the EHR Incentive Program in order to receive full Medicare incentive payments.

While the Stage 2 requirements have not yet been finalized, the HIT Policy Committee Meaningful Use Work Group is hard at work to meet its deadline for initial recommendations for Stage 3 by August 1.  According to Healthcare Informatics, a Request for Comment would be issued in November and final recommendations published by May 2013. 

The committee is considering proposing that solutions for meeting Stage 3 criteria would include those that track individual care goals, the team members involved in an individual's care, and their roles across care settings, track tasks and responsible parties, facilitate population health management, medication reconciliation and problem list reconciliation, and allow for input and access to care information by all team members, the individual and their caregivers.  

CMS Releases New Meaningful Use FAQ for EPs using Hospital EHRs

CMS released a new FAQ on June 27 to help clarify to what extent an eligible professional (EP) can use a hospital EHR to meet Meaningful Use objectives and measures. The FAQ makes it clear that an EP can use both a certified ambulatory EHR and a certified inpatient EHR to demonstrate Meaningful Use.  Therefore, provided that the ambulatory EHR is used to meet those measures for which the inpatient EHR is not designed for (e.g., EP clinical quality measures, e-prescribing), a physician can use both to successfully attest.

ONC specifically lists the following measures as being flexible enough to use either inpatient or ambulatory EHRs:

  • 170.304(a) which is the same as 170.306(a); (CPOE)
  • 170.304(e) which is the same as 170.306(c); (clinical decision support rule)
  • 170.306(b) which is more comprehensive than 170.304(c); (demographics recorded as structured data)
  • 170.306(d) which is more comprehensive than 170.304(f); (electronic copy of health information) and
  • 170.306(f) which is more comprehensive than 170.304(i). (exchange key clinical information)

This and other CMS FAQs can be found on the CMS FAQ page and the ONC FAQs are available on the ONC Regulations FAQ pageAs a reminder, Tuesday, July 3, is the last day for hospitals and critical access hospitals to begin their 90-day reporting period for the fiscal year. 

CMS FAQ 6421

Question: Can an EP use EHR technology certified for an inpatient setting to meet a meaningful use objective and measure?

Answer: Yes. For objectives and measures where the capabilities and standards of EHR technology designed and certified for an inpatient setting are equivalent to or require more information than EHR technology designed and certified for an ambulatory setting, an EP can use the EHR technology designed and certified for an inpatient setting to meet an objective and measure.  There are some EP objectives, however, that have no corollary on the inpatient side. As a result, an EP must possess Certified EHR Technology designed for an ambulatory setting for such objectives.  Please reference ONC FAQ 12-10-021-1 and 9-10-017-2 and CMS FAQ 10162 for discussions on what it means to possess Certified EHR Technology, ONC FAQ 6-12-025-1 for a list of affected capabilities and standards, and how that relates to the exclusion and deferral options of meaningful use.

Legal and Practical Implications of Meaningful Use Attestation

With over $4 billion paid out to eligible professionals (EPs) and hospitals under the Medicare and Medicaid EHR Incentive Programs as of March 2012 according to CMS, many hospitals are gearing up for or have recently completed successful Meaningful Use attestation for their first Stage 1 90-day reporting period.  The online attestation process itself, as experience shows, is fairly straightforward and can be completed in a short amount of time.  But making sure you have everything to support that you were a “meaningful user” during the applicable reporting period requires careful planning and documentation.  

Know what you are attesting to.  The federal False Claims Act imposes liability on any person submitting a claim to the federal government that he or she knows, or should know, is false.  No proof of specific intent to fraud is required and “knowledge” includes (1) actual knowledge of the information; (2) deliberate ignorance of the truth or falsity of the information; or (3) acting in reckless disregard for the truth or falsity of the information.  State laws may also result in civil or criminal penalties for false claims.

By attesting, the hospital or EP is submitting a claim for payment from the government.  As such, any misrepresentations, material omissions, false claims, statements or documents are subject to prosecution under Federal or State criminal laws and potentially civil penalties.  With all hospitals and EPs on the hook for visits from both CMS and the respective State Medicaid auditors, they must be prepared to show proof that they accurately attested to the best of their knowledge to all measures and objectives and other meaningful use requirements having been met.

It is therefore critical, that, before attestation, the hospital or EP reasonably have the knowledge to attest that it was a meaningful user during the applicable EHR reporting period and that all data is (1) accurate and complete to the best of his or her knowledge; (2) includes information on all patients to whom the measure applies; and (3) for CQMs, that the numerators and denominators were generated as output from certified EHR technology. 

At an absolute minimum, the hospital or EP must ensure that all measure thresholds were appropriately met, all patients to whom a measure applied were included in the denominator (or properly excluded), and interpretations of any “grey areas” are clearly documented.  The hospital or EP should be familiar with any clarifying language in the Preamble to the EHR Incentive Programs Final Rule as well as any relevant and available CMS Frequently Asked Questions.    

Other practical considerations to support attestation and defend against potential audit by CMS or the State include:

  • Have all data readily available that must be entered during the attestation process (e.g., CMS EHR Certification Number, method for calculating ED visits, all applicable numerators and denominators).  CMS has made available an Attestation Worksheet for assistance with the online attestation process.
  • Document all certified EHR technology reports and supplemental data reports, as well as measure checklists, screenshots, test results and any assumptions or processes concerning workflows or interpretations for any given individual measure that support meaningful use during the applicable EHR reporting period.  Be prepared to show documentation to support all “yes/no” attestations.  For example, documentation for “exchange key clinical information” could include potentially screenshots of the test information that was sent to the third party health care provider and the testing “script” showing the date and success or failure of the exchange.   
  • When using multiple certified EHR systems, CMS as of April 20, 2012 will permit those numerators and denominators generated by the respective certified EHR systems reports to be added together, rather than requiring the hospital or EP to reconcile the reports to account for unique patients as CMS required in the past.  If a hospital or EP has already attested and reconciled for unique patients, keep all reports used to aggregate the data and that support the numerators and denominators attested to.
  • Keep all documentation to support your meaningful use, including to support patient volume thresholds, and incentive payment calculations for the Medicare and/or Medicaid EHR Incentive Programs, for a period of six years from the date of your attestation (three years to support Medicaid Adoption/Implementation/Upgrade payments).

Remember that for hospitals, July 3, 2012 is the last day to begin your 90-day reporting period for Stage 1.  Be sure also to keep an eye on both the CMS and your State’s EHR Incentive Program websites for additional information regarding audits or updates to the respective Meaningful Use programs.  Subscribing to the CMS EHR Incentive Program Listserv will ensure that you receive any new or updated FAQs from CMS as well as other important information about the EHR Incentive Programs. 

Oscislawski LLC and Blass Affiliates have teamed up to help a number of hospitals successfully attest for Meaningful Use Stage 1.  The experienced consultants at Blass provide hands-on guidance and software compliance management support to help clients succeed with Meaningful Use through ComplyAssistant, its web-based compliance management tool, and the knowledgeable attorneys at Oscislawski LLC keep on top of Meaningful Use regulatory developments and offer legal interpretation and guidance to clients.  

Public Comments for Meaningful Use Stage 2 NPRM Due May 7

The clock is ticking for interested parties to submit comments in response to the CMS and ONC Meaningful Use Stage 2 Notices of Proposed Rulemaking (NPRM).  The deadline for submission of comments is 5pm on Monday, May 7.  CMS has requested public comment on a variety of specific Stage 2 proposed requirements, such as for CQM reporting, transport standards, and the active role of patients proposed for certain objectives and measures. ONC likewise has requested public comment on proposed new and revised standards, implementation specifications and certification criteria. Public comments may also be submitted in general on any of the proposed new or revised Stage 1 and Stage 2 requirements.   

For a summary of the changes proposed by the CMS NPRM, check out my previous posts, Proposed Rule for Meaningful Use Stage 2 Released and Meaningful Use Stage 2 Ramps up HIE.  Formal comments can be submitted directly online through the respective CMS and ONC NPRM websites. Entities currently participating in or considering participating in the Medicare or Medicaid EHR Incentive Programs are strongly encouraged to submit comments on the NPRMs as feedback is critical for improvement of the EHR Incentive Programs and accomplishing the goals of Meaningful Use. 

CMS Updates Meaningful Use FAQs for Multiple Certified EHRs

Coming a little too late for hospitals and eligible professionals who have already attested or begun to attest for 2012, CMS has kindly taken a step back on Meaningful Use requirements for accounting for unique patients in calculating numerators and denominators during attestation in the release of an updated FAQ on April 20.  Retracting its previous requirement that any hospital attesting with multiple certified EHR technology, or any eligible professional seeing patients at multiple locations with certified EHR technology, reconcile the various reports generated by the certified EHR technology to ensure only "unique patients" were counted in the numerators/denominators, CMS now permits hospitals and eligible professionals to simply add the numerators and denominators from the reports generated by the certified EHR technology.  

CMS states,

For objectives that require an action to be taken on behalf of a percentage of "unique patients" (e.g., the objectives of "Record demographics", "Record vital signs", etc.), EPs, eligible hospitals, and CAHs may also add the numerators and denominators calculated by each certified EHR system in order to arrive at an accurate total for the numerator and denominator of the measure. Previously CMS had advised providers to reconcile information so that they only reported unique patients. However, because it is not possible for providers to increase their overall percentage of actions taken by adding numerators and denominators from multiple systems, we now permit simple addition for all meaningful use objectives.

This therefore removes one step from the attestation process, eliminating the need to reconcile various reports to ensure patients aren't counted twice. However, hospitals and eligible professionals still must count any patients whose records are not maintained in certified EHR technology where applicable in order to provide accurate numbers.  All of the CMS FAQs are available on the newly designed CMS Frequently Asked Questions page by clicking on the topic "Electronic Health Records Incentive Programs."

Meaningful Use EP Eligibility Appeals Extended to April 30, 2012

As a reminder to eligible professionals (EPs) participating in the Medicare EHR Incentive Program, CMS has extended the deadline within which an EP may file an eligibility appeal to Monday, April 30, 2012.  In general, there are three types of appeals afforded to EPs:  eligibility appeals, meaningful use appeals, and incentive payment appeals. 

Eligibility appeals provide an EP with the chance to show that he or she should have receive an incentive payment as all meaningful use requirements were met, but could not because of circumstances outside of the EP's control.  There are two levels of review afforded under the Medicare EHR Incentive Program appeals process:

  • Informal review;
  • Request for reconsideration if the EP does not win in the informal review.  

EPs should be aware that all relevant issues must be presented in the initial appeal as any issues raised at a later time will not be considered absent special circumstances. When filing an appeal, EPs should be prepared to provide any additional documentation requested within seven (7) calendar days from a request.

CMS strongly encourages EPs and other providers to communicate with OCSQ, the designated appeals coordinator, about any questions on specific issues or providing documentation in order to avoid having an appeal dismissed. Additional guidance on the appeals process is available here.  Appeals may be filed through OCSQ.

Meaningful Use Stage 2 NPRM Ramps Up HIE

With electronic health information exchange ("HIE") leaping out of the 132-page Meaningful Use Stage 2 Notice of Proposed Rulemaking ("Stage 2 NPRM), it is clear that while Stage 2 will continue to afford flexibility to eligible professionals ("EP"), hospitals and critical access hospitals ("CAH"), CMS is not shy about heightening its expectations for HIE.  The Stage 2 NPRM proposes several changes to existing Stage 1 objectives as well as proposes additional objectives for Stage 2 which would officially begin in 2014.

For starters, only one of the Stage 1 hospital core objectives involves HIE with "capacity to exchange key clinical information" satisfied by a test or even a failed test of exchange of clinical information with an outside health care provider.  And although four of the ten Stage 1 menu set objectives applicable to hospitals require HIE, at a minimum only one of these objectives would need to be satified out of the menu set objectives hospitals could choose from. Hospitals and EPs are required by Meaningful Use to meet all core objectives, whereas they have the option to choose from available menu set objectives (five of ten for hospitals in Stage 1, with two of four proposed in Stage 2), only one of which must be a population/public heath objective. 

The Stage 2 NPRM would move these Stage 1 public health/population menu set objectives to the core objectives for hospitals and EPs, with syndromic surveillance remaining a menu set measure for EPs.  Ongoing transmission of data to immunization registries as well as submission of data on reportable lab results and syndromic surveillance data to public agencies would also be required with testing no longer sufficient.

The Stage 1 core objective "capacity to submit key clinical information" would be removed effective in 2013 (with CMS welcoming comment on this and its replacement).  For Stage 2, hospitals and EPs would move instead to the now-core objective of "provide summary of care document" with 10% required to be provided electronically through HIE to other health care providers.  Likewise, new objectives and measures proposed for Stage 2 would also require HIE.  For EPs, new menu set objectives would require ongoing submission of data to cancer and specialized registries.  And for hospitals and EPs alike, although not proposed in the Stage 2 NPRM, CMS specifically requested comment on whether imaging results, which would have to be accessible through certified EHR technology as a new menu objective, should also be exchanged through HIE. 

Another area clearly marked on CMS's agenda is stronger patient engagement through HIE, with patient utilization actually required in order to meet certain objective measures. In Stage 1, for example, EPs and hospitals were required to provide patients with an electronic copy of their health information upon request.  The Stage 2 NPRM would propose to change this to requiring the ability of the patient to print, view, and download their health information online, but also to actually having a percentage of patients utilize this resource (10%).  If 10% of all patients did not choose to access their health information this way, an EP or hospital would fail to meet meaningful use.  EPs would also be required under the Stage 2 NPRM to use electronic messaging to communicate with at least 10% of their patients about their health information.  Only messages sent by a patient would count for numerator calculation. 

A public comment period will remain open for sixty days from the date of publication in the Federal Register (March 7 - May 7, 5pm) for both the Stage 2 NPRM and the Standards, Implementation Specifications and Certification Criteria NPRM.  EPs and hospitals are strongly urged to submit comments, whether in general to proposed Stage 2 NPRM requirements as well as in response to specific questions posed by CMS.  

Proposed Rule for Meaningful Use Stage 2 Released

Yesterday, the Meaningful Use Stage 2 Proposed Rule was made available on the Office of the Federal Register Electronic Public Inspection Desk.  The Proposed Rule will be published March 7 and will be open for public comment for sixty days.

With a focus on data exchange, the Proposed Rule addresses the Stage 2 meaningful use criteria that eligible professionals and hospitals must meet as well as proposes certain changes to existing Stage 1 criteria.  Nearly all Stage 1 core and menu objectives would remain in place for Stage 2, and eligible hospitals would be required to meet 16 core objectives and 2 out of 4 menu objectives.  Eligible professionals would be required to meet 17 core objectives and 3 out of 5 menu objectives. 

CMS has specifically requested public comment regarding processes for electronic clinical quality measure (CQM) reporting.  Eligible hospitals would be required to report on 24 CQMs with eligible professionals reporting on 12.  The Proposed Rule would also include clinical quality reporting within the definition of "meaningful EHR user" and remove it as a separate objective beginning in 2013. 

Another significant area made more robust by the Proposed Rule is the ability of patients to have electronic access to their health information (e.g., view, download), rather than access to only electronic copies of their information and discharge instructions as originally required by Stage 1.  Additionally, hospitals and eligible professionals are also required in connection with the HIPAA risk assessment that must be performed to specifically address encryption/security of EHR data at rest.  While the Proposed Rule would not require actual implementation of encryption mechanisms, it would require each hospital and eligible professional to assess the reasonableness and appropriateness of encrypting electronic PHI, and, if not reasonable, adopting alternative equivalents. 

Other proposed changes, although by far not an exhaustive list, include:

  • A more "robust" "transitions of care" core objective instead of the core objective of Stage 1 "exchange of key clinical information", requiring exchange of summary of care records for each transition or referral of care;
  • Requiring utilization of clinical decision support intervention for improving performance on high priority health conditions to relate to 5 or more CQMs which the EP or hospital would be required to report on (proof of actual improvement not required);
  • Consolidation of certain Stage 1 objectives within Stage 2 objectives:
    • "Use clinical decision support to improve performance on high-priority health conditions" would include Stage 1 drug-to-drug and drug-allergy checks
    • "Summary of care record for each transition or referral of care" would include Stage 1 active medication, allergy and problem lists
    • eRX objectives for eligible professionals and hospitals would include Stage 1 drug formulary checks
  • Expansion of CPOE to medication, laboratory and radiology orders, clarification on how and when CPOE must occur, and increase of measure from 30% to 60% of orders created;
  • Secure e-mail protocols
  • Expansion of the definition of a Medicaid patient encounter;
  • Process for Medicare payment adjustment beginning in 2015; and
  • Official delay of Stage 2 until 2014.

The ONC Standards and Certification Proposed Rule with additional guidance and standards for certified EHR technology is also expected to be released today so stay tuned.  

HITECH Omnibus and AOD Rules Set for OMB Review

Health Data Management reports that the long-awaited HITECH Omnibus Rule as well as the Accounting of Disclosures (AOD) Rule are set for OMB review.  Expected also are proposed regulations for Meaningful Use Stage 2.  HHS released its semi-annual regulatory agenda in January to the Office of Management and Budget (OMB).  As with other agencies, the agenda identifies key regulatory priorities over the next months.

The HITECH Omnibus Rule is expected for publication in March of this year with the AOD Rule not until June.  The proposed regulations for Meaningful Use Stage 2 are still expected this month, February.  While OMB review could hypothetically take a matter of weeks, the OMB may take up to ninety (90) days to review regulations before publication, as well as potentially extend the deadline. 

CMS Provides Guidance on Meaningful Use Appeals Process

CMS has released additional guidance for hospitals and eligible professionals on the Medicare EHR Incentive Program appeals process.  The CMS Office of Clinical Standards and Quality (OCSQ), together with Provider Resources, Inc., the CMS appeals support contractor, will accept and review appeals filed by eligible professionals and hospitals. For those individuals and organizations participating in the Medicaid EHR Incentive Program, each state will have its own process for Medicaid appeals. 

CMS began accepting appeals December 1, 2011.  Appeals may be filed by eligible professionals and hospitals through an online web portal.  In addition to eligibility determinations, eligible professionals and hospitals may appeal denials of status as a meaningful user as well as incentive payment calculations.

For hospitals, the deadline to appeal eligibility determinations has been extended to January 30, 2012.  In general, a hospital or eligible professional has sixty (60) days after the issuance of an incentive payment to appeal the amount of the payment made.  Additionally, hospitals and eligible professionals have thirty (30) days to appeal denials of their status as a meaningful user after receipt of a letter with the results of a meaningful use audit conducted by CMS.  Limited extensions will be granted on a case-by-case basis under extenuating circumstances.

The first OCSQ informal review determination was released on January 19, 2012.  CMS plans on making this and other OCSQ appeals opinions available in February on its EHR Incentive Program Appeals website.  These opinions may provide additional guidance to eligible professionals and hosptials seeking to attest in 2012 for their first payment year.

Over $2 billion paid in Meaningful Use Incentive Payments and Counting

In a report submitted to the Health Information Technology Policy Committee on January 10th, CMS highlighted progress in the Medicare and Medicaid EHR Incentive Programs ("Meaningful Use") and registration and attestation numbers for eligible hospitals and eligible professionals ("EPs"). For 2011, the two programs paid out over $2.5 billion in Meaningful Use incentive payments to EPs and hospitals who attested to Meaningful Use for 2011.

In 2011, 124,089 EPs registered for Medicare, 39, 503 EPs registered for Medicaid, and 2,834 hospitals registered for both programs.  Out of the 842 hospitals that attested to Meaningful Use for FY 2011, 100% were succesful, with 99% of EPs that attested for 2011 also succesful.

CMS has made available additional information on a state-by-state basis which can be viewed on its EHR Data and Reports page.  You'll notice also that CMS has "modernized" the look and feel of its webpages, not only for Meaningful Use, but in general for Medicare, Medicaid and other web resources.   

Hospitals in their second payment year will generally need to meet Stage 1 Meaningful Use requirements for the full 12-month period in FY 2012.  Due to concerns about the ability of EHR vendors to certify their products in compliance with Stage 2 requirements, once finalized, HHS has proposed to delay Stage 2 Meaningful Use, which was originally set to begin in 2013 for those who attested in 2011. 

Input from the vendor community and the provider community makes clear that the current schedule for compliance with Stage 2 meaningful use objectives in 2013 poses a challenge for those who are attesting to meaningful use in 2011.  The current timetable would require EHR vendors to design, develop, and release new functionality, and for providers to upgrade, implement, and begin using the new functionality as early as October 2012.

HHS has indicated that those hospitals and EPs that attested in 2011 would be able to attest to Stage 1 requirements for an additional year, giving them the benefit of attesting to the more lenient Stage 1 requirements again in their third payment year (FY 2013 for hospitals).

The delay is not expected to affect hospitals and EPs who attest to Meaningful Use for their first payment year in 2012.  It would also not affect any hospitals or EPs who attested under Medicaid for "Adoption, Implementation and Upgrade" incentive payments for their first payment year in 2011. 

CMS is expected to formalize this delay in the proposed rule for Stage 2 which is expected to be released this month or in February.  For more information about the Medicare/Medicaid EHR Incentive Programs, visit the CMS EHR Meaningful Use webpage

HITPC Releases Tiger Team EHR Amendment/Correction Recommendations

The ONC Health Information Technology Policy Committee (HITPC) released the Privacy & Security Tiger Team (Tiger Team) recommendations concerning amendments and corrections to electronic medical records (EMRs) in a letter to HHS on July 25, 2011 (HITPC Letter).  The Tiger Team's two recommendations are:

  • Certified electronic health record (EHR) technology for Meaningful Use Stage 2 should have the capability to support amendments to health information as well as support compliance with HIPAA obligations to respond to patient requests for amendments, specifically (i) to make it technologically possible for providers to make amendments consistent with their obligations with respect to the legal medical record (e.g., access/view the original data and identify changes made); and (ii) attach any information from the patient and any rebuttal from the entity regarding disputed data.
  • Certified EHR technology for Meaningful Use Stage 2 should have the ability to transmit amendments, updates or appended information to other providers to whom data in question had previously been transmitted. 

The recommendations address the concerns of stakeholders regarding technological capabilities of EHR systems to assist covered entities in complying with HIPAA amendment and correction procedures for their EMRs.  They also address issues concerning data integrity and quality when correcting errors in patient information not at the request of the patient or communicating updates in patient information. 

HIPAA requires covered entities to comply with specific procedures for correcting or amending protected health information (PHI) within their records where a patient requests such correction or amendment.  In addition, the principle of "correction" was adopted by the Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information, which requires timely means provided to individuals to dispute the accuracy or integrity of their health information.  

The Tiger Team recommends that the HIT Standards Committee develop standards, specifications and criteria for the certified EHR technology, and that any technological capabilities be kept as simple as possible to start.  Capabilities could evolve over time and become more complex, including "potentially greater standarization and automation."  Most notably, the Tiger Team rejected placing affirmative obligations on providers to inform other providers and entities about errors which were not identified in response to a patient's request, citing the "range of different errors that could occur" and the potential difficulty in distinguishing between what was a difference in medical opinion and an actual error, deciding,

...Providers' existing ethical and legal obligations were sufficient to motivate them to use appropriate professional judgment regarding when to inform any known or potential recipients of amendments to health data.

Finally, the HITPC letter notes that the Tiger Team considered whether health information exchange organizations (HIOs) should be obligated to correct errors and transmit amendments or updates to affected providers where they may be responsible for such errors.  The Tiger Team has specifically sought input from the HITPC and will continue to research existing HIO policies prior to developing future recommendations on this issue. 

The full HITPC letter may be found here: HITPC Privacy & Security Tiger Team Amendment Recommendations

Meaningful Use Missing for Behavioral/Mental Health

As Meaningful Use participation kicks off this year, eligible health care providers and facilities are scrambling to make sure they will qualify for the incentive payments being shelled out by the Medicare and Medicai EHR Incentive Programs ("EHR Incentive Programs") established by the American Recovery and Reinvestment Act as part of HITECH.  Yet, key sets of providers and facilities are glaringly missing from the list of those eligible for the EHR Incentive Programs.

The need to incorporate substance abuse, behavioral and mental health treatment professionals and facilities into a cohesive network of treatment along with the rest of an individual's medical treatment has long been recognized nation-wide.  However, these crucial health care providers and facilities are not currently eligible standing alone to receive incentive payments for incorporating meaningful use of EHR technology into their practices and facilities.

The Current Payment Structure

As currently provided for by HITECH and ONC's regulations, certain providers and facilities are eligible for incentive payments where they demonstrate "meaningful use" of certified EHR technology.  The EHR Incentive Programs exclude:

  • Clinical psychologists
  • Psychiatric hospitals
  • Clinical social workers
  • Mental health and substance abuse treatment facilities

For example, a community behavioral health organization ("CBHOs") would not be eligible for incentive payments even though providing the same or additional services that a hospital (eligible for facility incentive payments) might provide.  Likewise, while a psychiatrist, primary care physician or nurse practitioner affiliated with a CBHO could potentially receive incentive payments as "eligible professionals", the facility itself along with other health care providers, such as psychologists and clinical social workers providing services there, would not. 

Although the availability of funding may have played a large part of this omission, the exclusion of substance abuse and behavioral and mental health from the EHR Incentive Programs runs contrary to the very ideology and goals of the Programs.  By far, the populations served by these providers and facilities are in greatest need for the improved efficiency, quality, coordination and integration of health care that EHR technology facilitates.

The Need for Increased Eligiblity: The Behavioral Health Information Technology Act of 2011

Extending the EHR Incentive Programs to these key providers and facilities would provide much needed assistance in the adoption and implementation of EHR technology.  It would help substance abuse, mental and behavioral health professionals access recent and up-to-date patient medical histories and would improve the accuracy of diagnoses, the quality of care received by patients and bridge gaps in the provision of mental and substance abuse treatment services.  With access to EHR technology, physicians and substance abuse or mental and behavioral health professionals would be better able to coordinate adn integrate mental or behavioral health care into the rest of a patient's medical care, especially for patients admitted through hospital Emergency Departments who may be involved in care at multiple facilities.

Last week, legislation was introduced into the Senate with the aim of rectifying this oversight. The Behavioral Health Information Technology Act of 2011 ("BHITA" for short), S. 539, was sponsored by Senator Sheldon Whitehouse and seeks to expand eligibility for Meaningful Use participation to substance abuse and behavioral and mental health providers and facilities. Sen. Whitehouse stated,

"Mental health care is a critical component of a health care safety net and allowing these providers access to cost-saving, quality-enhancing advances in health information technology will improve the care that millions of Americans receive." 

Previous efforts to amend HITECH have unfortunately already failed, as a similar bill, the Health Information Technology Extension for Behavioral Health Services Act, H.R. 5040, died in the House last year.  However, the similar BHITA introduced this year into the Senate shows that the need to include these vital providers and facilities continues to be recognized by policymakers.

The BHITA would:

  • Extend Medicare and Medicaid eligible professional incentive payments to clinical psychologists and social workers
  • Extend Medicare incentive payment eligibility to community mental health centers, private and public psychiatric hospitals, residential/outpatient mental health and substance abuse treatment facilities
  • Clarify eligibility for community health centers, psychiatric hospitals, substance abuse and behavioral and mental health professionals, residential/outpatient mental health/substance abuse treatment facilities as Health Information Technology Regional Extension Centers

If passed (and it has only made its way to the Senate Finance Committee so far), the BHITA would be one big step towards treatment of the individual as a whole through better integration and coordination of medical care with substance abuse and mental and behavioral health care.  Yet even if passed, additional efforts will likely still be needed to achieve complete efficiency, integration and coordination of care for other populations.

An amendment or similar program for long term care facilities may also be necessary in the future, as individuals in need of long term care comprise yet another population desperately in need of efficient and coordinated systems. Although the Patient Protection and Affordable Care Act provides grants for long term care facilities, the grants are nothing like the aggressive EHR incentive payments and program created by HITECH.  To achieve the goals sought after by the EHR Incentive Programs of efficiency, coordination and improved quality of care for patients, these facilities, along with the providers of substance abuse, mental health and behavioral health treatment and services, need to be folded into the EHR development and implementation process.     

ONC Open Casting Calls

Prepared by Krystyna Nowik, Esq.

Last week, ONC opened a thirty-day window for organizations to apply to become the sole accrediting entity to oversee certifying organizations under the Permanent Certification Program for Health Information Technology (“Certification Program”). The Certification Program ensures certain electronic health record ("EHR") technology includes required capabilities for participation in the Medicare and Medicaid EHR Incentive Programs, which provide incentive payments to certain eligible health care professionals, hospitals and critical access hospitals that demonstrate meaningful use of certified EHR technology to adopt and utilize EHRs (“Meaningful Use”).

Currently, EHR vendors must be tested and certified by one of six ONC-approved entities (ONC-Authorized Testing and Certification Body or ONC-ATCB) under a temporary certification program implemented to ensure certified EHR technology was available for incentive payments beginning this year. Vendors who seek ONC-ATCB certification of their EHR technology as either a “Complete EHR" or an “EHR Module” must demonstrate compliance with certain capabilities, standards, implementation specifications and certification criteria. Once EHR technology has been ONC-ATCB certified, it can be used by health providers and hospitals to meet applicable meaningful use requirements. Complete EHRs provide all applicable certification criteria and the minimum capabilities a participant needs to comply with Meaningful Use. They may also include additional functions. EHR Modules, on the other hand, meet at least one, but not all, of the required certification criteria, and a combination of EHR Modules may be used to comply with Meaningful Use.

With the Final Rule for the Certification Program issued this January, accreditation and oversight is placed in the hands of the ONC Approved Accreditor or ONC-AA, which will be selected competitively every three years. The ONC-AA will be responsible for overseeing the ONC-ATCB entities and accrediting the Authorized Certified Bodies (ONC-ACB) under the Certification Program. Competing organizations for the ONC-AA will have to show what their proposed requirements would be for accrediting the ONC-ACBs, how surveillance of certified EHR technology would be conducted, their requirements for key personnel conducting the accreditation, and investigation and responding to complaints about ONC-ACBs. They also must show how they would adhere to ISO/IEC17011:2004 and experience with ISO/IEC Guide 65:1996, standards developed by the International Standardization Organization that specify general requirements for approving conformity assessment organizations and for product certifying organizations.

The ONC-ACBs replace the ONC-ATCBs created by the temporary certification program. Although ONC-ATCB status ends upon the sunset of the temporary certification program, certifications issued by ONC-ATCBs through the 2011/2012 payment years do not need to be re-certified for those years until ONC-ACB certification processes are in place.

The Notice for submission of requests for ONC-AA status may be found here.

The 800-Pound HIE Gorilla Tiger in "Meaningful Use"

There has been a lot of discussion around the Meaningful Use (MU) criteria. CMS has an entire website dedicated to the subject, as does ONC. Although the clinical criteria of MU may garner much of the attention, the privacy and security components are also significant.  In particular, the MU criteria pertaining to Health Information Exchange (HIE) raise certain fundamental privacy questions.

In short, the HIE requirements for MU include the ability to: (1) exchange “key” clinical information among providers of care and patient authorized entities electronically, and (2) perform at least 1 test of exchanging information. The crucial question, then, is what exactly does "and patient authorized entities" suggest?  In listening to the privacy discussion taking place in various ONC Workgroups, including the newly-established Privacy & Security Tiger Team, one could reasonably conclude that this requirement might evolve to mean that a HIE will need to be able to capture and implement patients' specific and granular preferences (e.g., patient is "ok” with releasing info to Provider B, but not to Provider C) -- at least if you want to meet MU criteria

This interpretation, however, could throw a wrench into HIE networks across the nation that have implemented an Opt-Out consent model in part in reliance on a legitimate belief that when HHS adopted the final version of the HIPAA Privacy Rule it also vetted and already decided the question of whether a patient's prior written authorization should be required before general health information can be shared between treating providers for treatment purposes -- and it affirmatively decided to create the "Treatment Exception".  In fact, many states have laws that contain a similar exception. New Jersey, for example, specifically permits two treating doctors to share pertinent information about a common patient and expressly states that the prior consent is not required in such instances if it is in the best interest of the patient (see N.J.A.C. 13:35-6.5(d)3).

Links to the full legislative history related to the promulgation of the HIPAA Privacy Rule can be found on HHS’s website, but, a closer look at the August 14, 2002 “Modification to the HIPAA Privacy Rule –Final Rule" are worth a second read in particular.  For those who wish to review it in full, I have posted a full exerpt of the relevant sections under the “Continue Reading” window below, but in sum HHS removed the requirement of obtaining prior patient authorization after reviewing numerous public comments on the issue and concluding that:

As a result of the large number of treatment-related obstacles raised by various types of health care providers that would have been required to obtain consent, the Department became concerned that individual fixes would be too complex and could possibly overlook important problems. Instead, the Department proposed an approach designed to protect privacy interests by affording patients the opportunity to engage in important discussions regarding the use and disclosure of their health information through the strengthened notice requirement, while allowing activities that are essential to quality health care to occur unimpeded ...

The Final HIPAA Privacy Rule was adopted after HHS released multiple proposed versions, considered significant public comment, and followed administrative rule-making procedures -- all over the course of almost 3 years. Thus, as policies are recommended and developed for the HIE context, prior debate and dialogue is relevant and should not be forgotten or dismissed.

Continue Reading