Industry News

Federal Electronic Health Records Incentive Programs

Strategic Management Services, LLC | December 2010
LinkedIn

HITECH Act Update: An Overview of the Medicare and Medicaid EHR Incentive Programs Regulations and What It Means for Compliance Officers

Only two percent of hospitals in the United States currently have adopted electronic health records (EHRs) programs meeting the federal government’s “meaningful use” requirements.[1]  According to a recent study, there was only a moderate increase in the adoption of EHRs between the years of 2008 and 2009.[2]   Despite the slight increase in the use of EHRs; it is likely that the transition to EHRs will be a long and challenging process for hospitals. The new Medicare and Medicaid EHR Incentive Programs are scheduled to commence in January 2011.[3] This article focuses on defining what it mean for hospitals and their compliance officers desiring to participate in the new incentive programs.  In addition, tips and suggestions are offered as to what a compliance officer (CO) needs know in navigating through the Medicare and Medicaid EHR Incentive Program regulations and to ensure compliance.

What are the Medicare and Medicaid EHR Incentive Programs?

Under the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, the federal government has made it a priority to improve the health care outcomes with lower health care expenditures through the use of health information technology.[4]  The HITECH Act is aimed at promoting the establishment of a nationwide system of electronic health records that is efficient, secure, and private.

The Medicare and Medicaid EHR Incentive Programs were created under the HITECH Act.  These programs are designed to promote the adoption and meaningful use of certified EHRs in order to improve the quality, safety, and effectiveness of health care.  More specifically, the Medicare and Medicaid ERH Incentive Programs provide financial incentives for eligible hospitals, health care professionals, and Medicare Advantage Organizations that adopt and demonstrate meaningful use of certified EHR.   Under these incentive programs, hospitals can receive millions of dollars to become a meaningful user of certified EHRs.  In addition, eligible professionals can also receive payments under the programs.   Specifically, eligible professionals can receive as much as $44,000 over a five-year period through Medicare and up to $63,750 over a six-year period through the Medicaid EHR Incentive Program.[5],[6]  Economic analysts estimate that, under the Medicare and Medicaid EHR Incentive Programs, $9.7 billion to $27.4 billion in incentive payments will be expended over the next 10 years.[7]  Thus, the financial benefits derived under the HITECH Act EHR Incentive Programs can assist health care providers and practitioners with their health information technology transitions.

What are the Medicare and Medicaid EHR Incentive Programs regulations?

On July 28, 2010, the Department of Health and Human Services (HHS) issued two final rules related to implementation of the Medicare and Medicaid EHR Incentive Programs.  The final rules address two critical components of the Medicare and Medicaid EHR Incentive Programs. The first rule titled “Medicare and Medicaid Programs; Electronic Health Record Incentive Programs,” defines the meaningful use objectives that eligible participants are required to fulfill to obtain incentive payments.[8]  The second regulation titled “Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology” addresses EHR technology standards and certification.[9]  Notable requirements that COs should be aware of include the following:

Eligibility

In order to receive Medicare EHR Incentive Program benefits, an eligible hospital must be an acute care hospital, critical care hospital, or a Medicare Advantage affiliated eligible hospital.[10]  In the Medicaid EHR Incentive Program, a hospital is eligible to participate if it is an acute care hospital, cancer hospital, critical access hospital, or a children’s hospital.[11]  In addition, all Medicaid participants, with the exception of children’s hospitals, must meet a certain Medicaid patient volume requirement.[12]  Overall, hospitals may be eligible to participate in both programs; however, hospital-based physicians are not permitted to independently participate in the programs.  A hospital-based physician is defined as a physician who furnishes more than 90 percent of his or her services in an inpatient hospital or the emergency room.[13]  It should be noted that although hospital-based physicians are not eligible to participate, other health care professionals who meet the programs’ eligibility requirements may participate in the Medicare and Medicaid EHR Incentive Programs.

Meaningful Use Objectives and Measures

To qualify for incentive payments, hospitals must be meaningful users of certified EHR.  HHS set forth in the final rule 24 meaningful use objectives, of which hospitals must meet 19.  The meaningful use objectives are divided into two groups: (1) core set and (2) menu set objectives.  The core set contains 14 required objectives that eligible hospitals must fulfill to receive bonus payment.  The menu set has 10 objectives and hospitals must select and meet 5 objectives for payment purposes.  Further, one of the five objectives selected from the menu set must be a designated public health objective.  HHS also has established specific measures for each meaningful use objective.  In order to demonstrate meaningful use, a hospital must comply with the metrics assigned to each meaningful use objective.   See Appendices 1-3.

Certified EHR Technology

Qualified participants may receive incentive payments if they demonstrate meaningful use of certified EHR technology.  The EHR technology must be a complete EHR that meets the statutory definition of “qualified EHR” and has been tested by the HHS Office of the National Coordinator for Health Information Technology Authorized Testing and Certification Bodies (ATCBs). Alternatively, the EHR technology may be a combination of EHR Modules in which each EHR Module meets at least one certification criterion adopted by the Secretary of HHS and has been tested and certified by ONC ATCB.  In addition, the combination of the EHR Modules must meet the statutory definition of “qualified EHR.” Overall, to receive incentive payments, hospitals must ensure that that their EHR technology is certified and this requirement can be fulfilled with a complete EHR or a combination of EHR modules.[14],[15],[16]

Reporting Periods and Reporting Method

To receive incentive payments, a hospital must attest to the Centers for Medicare & Medicaid (CMS) and/or a State Medicaid Agency, that it is a meaningful user of certified EHR.  The reporting period for the first year of participation under the Medicare and Medicaid EHR Incentive Programs is 90 days.  Subsequent to the first year of participation, the reporting period is one year.  The Medicare and Medicaid EHR Incentive Programs will operate on the federal fiscal year (FY).[17]

Why should COs have concerns with the voluntary, not mandated, Medicare and Medicaid EHR Incentive Programs?

There are a number of reasons why COs should be concerned with the Medicare and Medicaid EHR Incentive Programs. First, although the Medicare EHR Incentive Program is voluntary, starting in federal FY 2015, eligible hospitals that are not meaningful users of certified EHR, will begin to see a reduction in their Medicare payments.  Therefore, if a hospital is an eligible hospital, as defined in the Medicare EHR Incentive Program, and receives Medicare payments, the organization may be subject to payment reduction if it does not become a meaningful user of certified EHR.

Further, under the Medicare and Medicaid EHR Incentive Programs, eligible hospitals must attest that they are meaningful users of certified EHR. The commentary in the final rule notes, “attestation is an insufficient means to hold providers accountable for the expenditures of public funds and to protect against fraud and abuse.”[18]   As a result, CMS intends to “[develop] an audit strategy to ameliorate and address the risk of fraud and abuse.”[19]  However, the compliance responsibility ultimately lies with the hospital.  If a hospital attests that it is a meaningful user of certified EHR and the representation is false and the hospital accepts federal funds under Medicare and Medicaid EHR Incentive Programs, the organization has potentially submitted a false claim or representation that may be actionable under the False Claims Act or other federal statutes.

An additional reason why COs should be concerned with the Medicare and Medicaid EHR Incentive Programs is the increase the risk of protected health information (PHI) breaches.  The expansion of EHR technology and electronic exchange raises concerns related to the privacy and security of PHI.  Thus, under the HITECH Act, there are several modifications to the Health Information Portability and Accountability Act (HIPAA) privacy, security, and enforcement rules.  HHS recently issued a proposed notice of rulemaking concerning the modifications to the HIPAA provisions.  Notable highlights in the proposed rule include: extending HIPAA provisions to business associates, restricting the sale of PHI, modifying the rules related PHI and research, revising covered entities Notice of Privacy Practices, and expanding individual’s rights to access and restrict disclosure of his/her PHI.  The proposed regulations can have a significant impact on a hospital’s operations, as well as its relationships with vendors, contractors, and business associates. As a result, COs must be aware of not only the proposed modifications to the HIPAA rules, but the potential privacy and security compliance risks associated with the adoption of EHR.

Compliance Officer (CO) Tips and Suggestions

In coming years, the federal government will be allocating a substantial amount of funding to promote the adoption and meaningful use of certified EHR.  Thus, participants in the programs must ensure that they comply with all applicable regulations.  Compliance Officers (COs) will play a critical role in ensuring that an organization abides with the programs’ regulations.  The following list outlines tips that COs should consider:

COs must recognize that the adoption and meaningful use of EHR is an organization initiative

The Medicare and Medicaid EHR Incentive Programs will require collaboration from multiple departments.  COs should play a key role in the oversight of this collaboration.  COs may wish to consult and work with the chief financial officer, information technology staff, privacy and security officials, legal, internal audits, business associates, and health care professionals to monitor compliance with the Medicare and Medicaid EHR Incentive Programs.

COs should be aware of the potential compliance risks associated with the Medicare and Medicaid EHR Incentive Programs

As indicated above, some of the risk areas related to the Medicare and Medicaid EHR Incentive Programs include the submission of false claims and PHI breaches.  An additional compliance risk may be with hospital-based physicians.  Under the Medicare and Medicaid EHR Incentive Program, hospital-based physicians are not eligible to participate in the programs.[20]  Therefore, hospitals must ensure that their hospital-based physicians are not separately enrolling in the Medicare and Medicaid EHR Incentive Programs as eligible professionals when more than 90 percent of his/her services are furnished in an inpatient setting or emergency room.

COs need to understand the requirements

A large part of participating in the Medicare and Medicaid EHR Incentive Programs relates to understanding the program requirements.  For example, one of the required meaningful use objectives is to use computerized provider order entry (CPOE) for medication orders that are directly entered by a licensed health care professional. COs must be aware that in order to meet this objective, a licensed health care professional must be the individual who enters the information.  Therefore, COs should consider conducting compliance training on this requirement to appropriate staff in order to ensure that the objective is fully met.  COs also need to be aware of the requirements concerning the certification of EHR technology.  To receive incentive payments, providers must use certified EHR.  This can consist of complete EHR or a combination of EHR modules. COs must understand the difference between complete EHR and EHR modules.  Moreover, COs may wish to take inventory of their EHR technology, to ensure that their health care EHR system meets the certification requirements for the Medicare and Medicaid EHR Programs.

COs may wish to consider performing audits similar to those planned by CMS

CMS intends to develop an audit strategy to address the risk of fraud and abuse in the Medicare and Medicaid EHR Incentive Programs.  COs should consider develop their own auditing and monitoring strategy in assessing risks of non-compliance.  For example, this may include auditing:  (a) PHI privacy and security; (b) compliance with meaningful use objectives and measures, particularly pertaining to health care professional compliance with the CPOE; (c) compliance with the EHR technology and certification requirements; and (d) the hospital’s internal attestation process, specifically, who within the organization is submitting the attestation to CMS and/or the State Agency and how does the organization verify the validity of attestations.

The adoption and meaningful use of EHR in the Medicare and Medicaid EHR Incentive Programs will be a challenge for hospitals.  For proper implementation of EHR technology, it will be necessary for hospitals to stay informed about HHS implementation activities. See Appendix 4.   COs can play a significant role in notifying their organization of the program rules and deadlines, as well as ensuring that the requirements are fully met.  To stay inform about HHS requirements, providers are encouraged to regularly review CMS’ EHR Incentive website for updated guidelines and instructions.   For further information on the EHR Incentive Programs, visit: http://www.cms.gov/EHRIncentiveprograms/.

Appendix Table 1: Meaningful Use: Core Set of Objectives.[21],[22]

ObjectiveMeasure
1. Use computerized physician order entry (CPOE) for medication orders directly entered by any licensed healthcare professional who can enter orders into the medical record per state, local, and professional guidelines.More than 30 percent of patients with at least one medication in their medication list have at least one medication order through CPOE.
2. Implement drug-drug and drug-allergy interaction checks.Functionality is enabled for these checks for the entire reporting period.
3. Record patient demographics (sex, race, ethnicity, date of birth, preferred language, and in the case of hospitals, date and preliminary cause of death in the event of mortality).More than 50 percent of patients’ demographic data recorded as structured data.
4. Implement one clinical decision support rule.One clinical decision support rule implemented.
5. Maintain-up-to-date problem list of current and active diagnoses.More than 80 percent of patients have at least one entry recorded as structured data.
6. Maintain active medication lists.More than 80 percent of patients have at least one entry recorded as structured data.
7. Maintain active medication allergy list.More than 80 percent of patients have at least one entry recorded as structured data.
8. Record vital signs and chart changes (height, weight, blood pressure, body-mass index, growth charts for children).More than 50 percent of patients 2 years of age or older have height, weight, and blood pressure recorded as structured data.
9. Record smoking status for patients 13 years or older.More than 50 percent of patients 13 years of age or older have smoking status recorded as structured data.
10. Report hospital clinical quality measures to CMS or States.[1]For 2011, provide aggregate numerator and denominator through attestation; for 2010, electronically submit measures.
11. Provide patients with an electronic copy of their health information, upon request.More than 50 percent of all patients who are discharged from inpatient department or emergency department of eligible hospital or critical access hospital and who request an electronic copy of their discharge instructions are provided with it.
12. Provide patients with an electronic copy of their discharge instructions at time of discharge, upon request.More than 50 percent of requesting patients receive electronic copy within 3 business days.
13. Capability to exchange key clinical information among providers of care and patient-authorized entities electronically.Perform at least one test of EHR’s capacity to electronically exchange information.
14. Implement systems to protect privacy and security of patient data in the EHR.Conduct or review a security risk analysis, implement security updates as necessary, and correct identified security deficiencies.

Appendix Table 2: Meaningful Use: Menu Set of Objectives.[23],[24]

ObjectiveMeasure
1. Implement drug-formulary checks.Drug formulary check system is implemented and has access to at least one internal or external drug formulary for the entire reporting period.
2. Record advanced directives for patients 65 years or older.More than 50 percent of patients 65 years of age or older have an indication of an advance directive status recorded.
3. Incorporate clinical lab test results as structured data.More than 40 percent of clinical laboratory test results whose results are in positive/negative or numerical format are incorporated into EHRs as structured data.
4. Generate lists of patients by specific conditions to use for quality improvement, reduction for disparities, research, or outreach.Generate at least one listing of patients with a specific condition.
5.  Use certified EHR technology to identify patient-specific education resources and provide to patient if appropriate.More than 10 percent of patients are provided patient-specific education resources.
6. Perform medication reconciliation between care settings.Medication reconciliation is performed for more than 50 percent of transitions of care.
7. Perform summary of care record for patients referred or transitioned to another provider or settingSummary of care record is provided for more than 50 percent of patient transition of referrals.
8. Submit electronic immunization data to immunization registries or immunization information systems.†Perform at least one test data submission and follow-up submission (where registries can accept electronic submission).
9. Submit electronic data on reportable laboratory results to public health agencies.†Perform at least one test of data submission and follow-up submission (where public health agencies can accept electronic data).
10. Submit electronic syndromic surveillance data to public health agencies.†Perform at least one test of data submission and follow-up submission (where public health agencies can accept electronic data).

† Indicates a public health objective.

Appendix 3: Meaningful Use Clinical Quality Measures for Hospitals.[25]

Hospitals must report the following 15 clinical quality measures under the Medicare and Medicaid EHR incentive program:

  1. Emergency Department Throughput-Admitted Patients: Median time from emergency department arrival to emergency department departure for admitted patients;
  2. Emergency Department Throughput-Admitted Patients: Decision time to emergency department departure time for admitted patients;
  3. Ischemic stroke: discharge on anti-thrombotics;
  4. Ischemic stroke: anticoagulation for A-fib/flutter;
  5. Ischemic stroke: Thrombolytic therapy for patients arriving within two hours of symptom onset
  6. Ischemic or hemorrhagic stroke: antithrombotic therapy by day two;
  7. Ischemic stroke: discharge on statins;
  8. Ischemic or hemorrhagic stroke: rehabilitation assessment;
  9. Venous thromboembolism prophylaxis within 24 hours of arrival;
  10. Intensive care unit venous thromboembolism prophylaxis;
  11. Anticoagulation overlap therapy;
  12. Platelet monitoring on unfractionated heparin;
  13. Venous thromboembolism discharge instructions;
  14. Venous thromboembolism discharge instructions; and
  15. Incidence of potentially preventable venous thromboembolism.

Appendix 4: Key Implementation Dates.

Appendix Table 3: Medicare and Medicaid EHR Incentive Programs Key Implementation Dates.

June 24, 2010This is the effective date for the Temporary Certification Program.
July 1, 2010ONC accepting applications from entities that are seeking ONC-Authorized Testing Certification Body (ONC-ATCB) approval.
August 27, 2010This is the effective date for EHR technology standards and certification requirements.
September 27, 2010This is the effective date for the Medicare and Medicaid EHR Incentive Program Final Rule.
Fall 2010ONC anticipates that eligible hospitals will be able to purchase certified EHR software.
January 2011Eligible hospitals can begin to register for the EHR Incentive Programs.   CMS will inform eligible participants that registration for the Medicare and Medicaid EHR Incentive Programs will be available on the Registration web page on http://cms.gov/EHRIncentivePrograms/.  Further, the registration will be managed by CMS.
April 2011Eligible hospitals can begin to make attestations for the Medicare EHR Incentive Program.
Mid May 2011CMS will begin to issue Medicare EHR incentive payments.
November 30, 2011This is the last day for eligible hospitals to register and attest to meaningful use in order to receive a Medicare EHR incentive payment for federal FY 2011.
Federal FY 2015Medicare payment adjustments will begin for eligible hospitals that are not meaningful users of EHR technology.
Federal FY 2016This is the last year to initiate participation in the Medicaid EHR Incentive Program.
Federal FY 2021This is the last year to receive payment under the Medicaid EHR Incentive Program.

Appendix 5: Definitions

  1. Federal Fiscal Year (FY): starts October 1 and ends September 30 of the next calendar year.   For example, federal FY 2011 begins October 1, 2010 and end September 30, 2011.
  2. Medicaid acute care hospital: a health care facility with an average length of stay of 25 days or less. In addition, the hospital must have a Centers for Medicare & Medicaid Services Certification Number in which the last four digits fall in the series 0001-0879 or 1300-1399.
  3. Medicare acute care hospital: a subsection (d) hospital as outlined in the Social Security Act § 1886(d)(1)(B).
  4. Qualified EHR: an electronic record of health-related information on an individual that: (1) Includes patient demographic and clinical health information, such as medical history and problem lists; and (2) has the capacity: (i) to provide clinical decision support; (ii) to support physician order entry; (iii) to capture and query information relevant to health care quality; and (iv) to exchange electronic health information with, and integrate such information from other sources.

Endnotes:

[1] See Appendix 3 for Meaningful Use Clinical Measures for hospitals.

[1] Jha AK, DeRoches CM, Kralovec PD, Joshi MS.  A Progress Report on Electronic Health Records in US Hospitals.  Health Affairs.  2010; 29(10): 1-7.

[2] Id. 8.7 percent and 11.9 percent of hospitals have adopted basic or comprehensive EHR in 2008 and 2009 respectively.

[3]  “Medicare & Medicaid EHR Incentive Program Specifics for Hospitals.”  2010.  Department of Health and Human Services Centers for Medicare & Medicaid Services.  Accessed on 8 Sept. 2010.<https://www.cms.gov/EHRIncentivePrograms/Downloads/EHR_Incentive_Program_Hospital_Training_FINAL.pdf>.

[4] American and Recovery and Reinvestment Act of 2009, Pub. L. No. 111-005, 123 Stat. 226.

[5] “CMS Finalizes Requirements for the Medicare Electronic Health Record (EHR) Technology. Centers for Medicare & Medicaid Services: Fact Sheet. 16 Jul. 2010.

[6] “EHR Incentive Program: Medicaid Eligible Professional” 2010. Department of Health and Human Services Centers for Medicare & Medicaid Services.  Accessed on 8 Sept. 2010.  <http://www.cms.gov/EHRIncentivePrograms/65_Medicaid_Eligible_Professional.asp#TopOfPage>.

[7] 75 Fed. Reg. 144, 44545 (July 28, 2010).

[8] Department of Health and Human Services Centers for Medicare & Medicaid Services 42 CFR Parts 412, 413, 422 et al. Medicare and Medicaid Programs; Electronic Health Record Incentive Program; Final Rule; 75 Fed. Reg. 144, 4413, 44588 (28 Jul. 2010).

[9] Department of Health and Human Services 45 Part 170 Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Final Rule, 75 Fed. Reg. 144, 44590, 11321 (28 Jul. 2010).

[10] American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-005, 123 Stat. 467.

[11] American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-005, 123 Stat. 489.

[12] “EHR Incentive Program Final Rule: Medicaid Provisions.”  Department of Health and Human Services Centers for Medicare & Medicaid Services.  2010.  Accessed on 8 Sept. 2010. <http://www.cms.gov/MLNProducts/downloads/EHR_Final_Rule-Medicaid.pdf>.

[13] “EHR Incentive Program: Eligibility.” Department of Health and Human Services Centers for Medicare & Medicaid Services. 2010.  Accessed on 8 Sept. 2010. <http://www.cms.gov/EHRIncentivePrograms/20_Eligibility.asp#TopOfPage>

[14] Department of Health and Human Services 45 Part 170 Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Final Rule, 75 Fed. Reg. 144, 44590, 11321 (28 Jul. 2010).

[15] Department of Health and Human Services 45 CFR Part 170 Establishment of the Temporary Certification Program for Health Information Technology; Final Rule, 75 Fed. Reg. 121, 36157, 36209 (24 Jun. 2010).

[16] Initial EHR Certification Bodies Name.”  Department of Health and Human Services: Press Release.  30 Aug. 2010.

[17] Department of Health and Human Services 45 Part 170 Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Final Rule, 75 Fed. Reg. 144, 44590, 11321 (28 Jul. 2010).

[18] 75 Fed. Reg. 144, 44324 (July 28, 2010).

[19] Id.

[20] “EHR Incentive Program: Eligibility.” Department of Health and Human Services Centers for Medicare & Medicaid Services. 2010.  Accessed on 8 Sept. 2010. <http://www.cms.gov/EHRIncentivePrograms/20_Eligibility.asp#TopOfPage>

[21] Blumenthal, D, Tavenner, M. The “Meaningful Use Regulations for Electronic Health Records.”  New England Journal of Medicine Health Policy and Reform Remaking Health Care.  2010. Accessed on 8 Sept. 2010.

[22] Department of Health and Human Services Centers for Medicare & Medicaid Services 42 CFR Parts 412, 413, 422 et al. Medicare and Medicaid Programs; Electronic Health Record Incentive Program; Final Rule; 75 Fed. Reg. 144, 4413, 44588 (28 Jul. 2010).

[23] Blumenthal, D, Tavenner, M. The “Meaningful Use Regulations for Electronic Health Records.”  New England Journal of Medicine Health Policy and Reform Remaking Health Care.  2010. Accessed on 8 Sept. 2010. < http://healthpolicyandreform.nejm.org/?p=3732>

[24] Department of Health and Human Services Centers for Medicare & Medicaid Services 42 CFR Parts 412, 413, 422 et al. Medicare and Medicaid Programs; Electronic Health Record Incentive Program; Final Rule; 75 Fed. Reg. 144, 4413, 44588 (28 Jul. 2010).

[25] “Medicare & Medicaid EHR Incentive Program Specifics for Hospitals.”  2010.  Department of Health and Human Services Centers for Medicare & Medicaid Services.  Accessed on 8 Sept. 2010.<https://www.cms.gov/EHRIncentivePrograms/Downloads/EHR_Incentive_Program_Hospital_Training_FINAL.pdf>.

Reprinted from Journal of Health Care Compliance, Volume 12, Number 6, November-December 2010, pages 17-24, with permission from CCH and Aspen Publishers, Wolters Kluwer businesses. For permission to reprint, e-mail [email protected].

Speak with a consultant about: