CMS should improve its oversight of its electronic health record incentive program, according to a report by the Office of Inspector General released this month.   The government watchdog agency faults CMS for both inadequate prepayment safeguards and insufficient postpayment monitoring of recipients of federal funding intended to help cover the costs of adoption and implementation of EHR.

As this blog noted earlier this month, some concerns have been raised in a Congressional hearing about how the approximately $7.7 billion in taxpayer funds have been spent to date under the HITECH Act’s incentive program.  In its report, the OIG recommended that CMS:

Obtain and review supporting documentation from selected professionals and hospitals prior to payment to verify the accuracy of their self-reported information;

Issue guidance with specific examples of documentation that professionals and hospitals should maintain to support their compliance; and

Conduct prepayment reviews to improve program oversight.

OIG reported resistance from CMS regarding its recommendation to implement prepayment reviews, which CMS believes would increase the burden on practitioners and hospitals and could delay incentive payments. CMS agreed to take steps to improve program oversight. CMS’s response appears as an exhibit to the OIG report at page 30.

Next, the OIG turned to the Office of the National Coordinator for Health Information Technology (ONC), the government agency that establishes EHR standards and certifies EHR technology. OIG recommended that the ONC:

Require that certified EHR technology be capable of producing reports for yes/no meaningful use measures where possible; and

Improve the certification process for EHR technology to ensure accurate EHR reports.

ONC concurred with both recommendations, as noted in the letter from Dr. Farhad Mostashari appearing at page 32.

The report noted that CMS currently conducts prepayment validation of professionals’ and hospitals’ self-reported meaningful use information to ensure that it meets program requirements, mostly by checking the math in the reports and verifying EHR certification codes.   OIG also noted that CMS plans to audit selected professionals and hospitals after payment using a similar method to select audit targets based on inconsistencies in their reported data. At the time of the OIG review, CMS had not yet completed any postpayment audits.

Among OIG’s findings were:

  • CMS’s prepayment validation functions correctly but does not verify the accuracy of self-reported information.
  • Sufficient data are not available to verify self-reported information through automated system edits.
  • CMS does not collect supporting documentation to verify self-reported information prior to payment.
  • CMS’s planned postpayment audits may not conclusively verify the accuracy of professionals’ and hospitals’ self-reported meaningful use information.
  • Reports from certified EHR technology are not sufficient for CMS to verify self-reported information and may not always be accurate.
  • CMS may not be able to obtain sufficient supporting documentation to verify self-reported information during audits.

Given budgetary pressure and ongoing Congressional oversight, it is likely that CMS and ONC will be looking more closely at how HITECH incentive funds are being applied in the coming year.

The OIG is conducting a survey of hospitals who have certified the meaningful use of Electronic Health Record (EHR) Technology, with an emphasis on safeguards that protect the EHR systems from fraudulent access or alteration. A generous hospital compliance officer who has asked to remain nameless has provided me with a copy of the survey tool which can be accessed here.

Topics addressed in the survey include:


  • Coding capabilities
  • User authentication and access
  • Access to EHR by outside entities
  • Audit log and metadata features
  • Methods for entering physician and nursing notes
  • Capabilities for exporting and transmitting EHR documents
  • Patient access
  • Patient identity management
  • Additional features and safeguards.

The underlying thread of the questionnaire looks to determine what each hospital is doing to ensure the integrity of the EHR data gathered, and to identify the barriers to more effective implementation of electronic records.


Meanwhile, back on Capitol Hill, a hearing was held on November 14, 2012 before the House Subcommittee on Technology and Innovation Committee on Science and Technology. The hearing topic was titled: Is ‘Meaningful Use’ Delivering Meaningful Results? An Examination of Health Information Technology Standards and Interoperability. Witnesses were asked to address in their testimony:


What is the goal for health information interoperability under the HITECH Act?


How are Stage 1 and 2 meaningful use requirements and supporting standards advancing us towards this goal?


How have the lessons learned from the implementation of Stage 1 meaningful use requirements and supporting standards been applied in drafting Stage 2 requirements and Stage 3 proposals?


How does the ONC engage Federal agencies and other stakeholders (National Institute of Standards and Technology (NIST), vendors, and providers) in developing the meaningful use requirements and technical standards?


How does the HIT Standards Committee balance the need for common IT standards with the diversity of the healthcare industry? How does the Committee account for technology development and innovation in its standards recommendations?


How effective have HHS and the ONC been in establishing long-term goals and benchmarks for HIT adoption, interoperability, and provision of care?


What recommendations would you make for Federal policy makers as we consider futureHIT policies?


Dr. Farzad Mostashari, HHS National Coordinator for Health Information Technology, presented prepared remarks which can be found here. Dr. Mostashari was cautiously optimistic about the pace of adoption of EHR and the progress being made toward interoperability.  He noted that as of September 2012, more than 300,000, more than half of the nation’s eligible professionals, as well as over 75 percent of eligible hospitals have registered to participate in the Medicare or Medicaid Incentive Programs.


Summarizing the lessons learned by HHS to date, Dr. Mostashari stated “By creating standards-based methods for the electronic submission, receipt and processing of health IT, Federal agencies can improve the quality of the data they receive while also reducing the number of expensive, one-off solutions for addressing the varied needs of the stakeholders they serve.” He praised his agency’s collaborations with NIST and recognized the over 6,400 comments received from stakeholders regarding the meaningful use process. He emphasized the efforts to provide new flexibility in definitions, exclusions, a shorter reporting period for the first year of Stage 2, and additional quality measures that account for the needs of many medical specialties to measure and improve the care they provide. He also called attention to the Standards and Interoperability Framework, a Wikipedia-style site for EHR developers, which he described as an example of “government as a platform” – enabled by integrated functions, processes, and tools – for the open community of implementers and experts to work together to develop and harmonize health information exchange standards.


Other witnesses appearing before the committee included Dr. Charles H. Romine, Director, Information Technology Laboratory, National Institute of Standards and Technology; Marc Probst, Chief Information Officer and Vice President, Information Systems, Intermountain Healthcare; Ms. Rebecca Little, Senior Vice President, Medicity; and Dr. Willa Fields, DNSc, RN, FHIMSS, Professor, School of Nursing, San Diego State University.


In his introductory remarks, subcommittee chairman Ben Quayle (R-AZ) noted :


Given our current budget situation, it is vital that these taxpayer dollars are spent effectively in ways that lead to reduced costs and better health care down the road. Nearly four years after the HITECH Act, taxpayers should know what we have to show for it.


The recent survey suggests that the OIG intends to supply Rep. Quayle’s subcommittee with a detailed answer to that question.

The Centers for Medicare & Medicaid Services (CMS) recently published proposed rules setting forth the “Stage 2” criteria that eligible providers (EPs), eligible hospitals (EHs), and critical access hospitals (CAHs) (referred to herein collectively as “providers”) would be required to meet in order to qualify for Medicare and/or Medicaid incentive payments for the use of electronic health records (EHRs) (“Stage 2 Proposal”). The Stage 2 Proposal is a small-font, acronym-laden, tediously-detailed 131-page document that modifies and expands upon the criteria included in the “Stage 1” final rule published on July 28, 2010 and is likely to be of interest primarily to providers concerned with receiving or continuing to receive added payments from CMS for adopting and “meaningfully using” EHR. 

The Stage 2 Proposal is not, at first glance, particularly relevant reading for those of us generally interested in issues involving the privacy and security of personal information — or even those of us more specifically interested in the privacy and security of protected health information (PHI). Still, two new provisions caught my attention because they measure the meaningful use required for provider incentive payments based not simply on the providers’ use of EHR, but on their patients’ use of it. 


One provision of the Stage 2 Proposal would require a provider to give at least 50% of its patients the ability to timely "view online, download, and transmit" their health information ("timely" meaning within 4 business days after the provider receives it) (and subject to the provider’s discretion to withhold certain information).  Moreover, it would require that more than 10% of those patients (or their authorized representatives) actually view, download or transmit the information to a third party.  There’s an exception for providers that conduct a majority (more than 50%) of their patient encounters in a county that doesn’t have 50% or more of "its housing units with 4Mbps broadband availability as per the most recent information available from the FCC” (whew!) for the applicable EHR reporting period. 


Another provision would require a provider to use "secure electronic messaging to communicate with patients on relevant health information" and would require the provider to show that more than 10% of the provider’s patients seen during the reporting period actually sent secure messages (presumably, to the provider, though the language is not precise) using the "electronic messaging function of Certified EHR Technology."  According to CMS:


[O]ver 43,000 providers have received $3.1 billion to help make the transition to electronic health records; the number of hospitals using EHRs has more than doubled in the last two years from 16 to 35 percent between 2009 and 2011; and 85 percent of hospitals now report that by 2015 they intend to take advantage of the incentive payments.


The Stage 2 Proposal will incentivize providers to continue this trend toward meaningful use of EHRs, but is also likely to result in providers’ efforts to induce to their patients to become EHR users.


Perhaps patients are ready, willing and able to communicate with providers via email and to download and forward their PHI. According to AARP, the aging baby boomer generation appears to be embracing electronic media and social networking at an unprecedented rate, and it is this segment of the population that is most likely to require health care services. 

 We all know how those year-end deadlines sneak up on us and how there never seems to be enough time to get everything done. Well, here’s some welcome news – The feds have decided to play Santa and give us a little more breathing room this season.


HIPAA 5010 Transition

CMS is transitioning its electronic transaction standards from Accredited Standards Committee (ASC) X12 version 4010A1 to ASC X12 version 5010. These standards regulate the transmission of certain health care transactions among covered entities including hospitals, physician practices, health plans and clearinghouses. Although this description may sound like impenetrable technobabble, CMS considers  the upgrade necessary to increase transaction uniformity, support pay-for-performance methods and streamline reimbursement transactions, particularly with the coming exponential expansion of diagnosis codes under ICD-10.  CMS summarizes the improvements as follows:

“Version 5010 of the HIPAA standards includes improvements in structural, front matter, technical, and data content (such as improved eligibility responses and better search options). It is more specific in requiring the data that is needed, collected, and transmitted in a transaction (such as tightened, clear situational rules, and in misunderstood areas such as corrections and reversals, refund processing, and recoupments). Further, the new claims transaction standard contains significant improvements for the reporting of clinical data, enabling the reporting of ICD–10–CM diagnosis codes and ICD–10–PCS procedure codes, and distinguishes between principal diagnosis, admitting diagnosis, external cause of injury and patient reason for visit codes. These distinctions will improve the understanding of clinical data and enable better monitoring of mortality rates for certain illnesses, outcomes for specific treatment options, and hospital length of stay for certain conditions, as well as the clinical reasons for why the patient sought hospital care.

Finally, Version 5010 also addresses a variety of currently unmet business needs, including an indicator on institutional claims for conditions that were “present on admission,” and accommodating the use of the ICD-10 code sets, which are not supported by Version 4010/4010A1.”

Level I Compliance was required by December 31, 2010, meaning that a covered entity can demonstrably create and receive compliant transactions, resulting from the compliance of all design/build activities and internal testing. Level II Compliance is due by: December 31, 2011, and all covered entities must be fully compliant on January 1, 2012. Level II compliance means that a covered entity has completed end-to-end testing with each of its trading partners, and is able to operate in production mode with the new versions of the standards.  

In a notice posted on December 14 on Medicare Learning Network as MLN Matters® Number: SE1137, CMS’ Office of E-Health Standards and Services (OESS) announced that it would not initiate enforcement with respect to any HIPAA covered entity that is not in compliance on January 1, 2012 with the Version 5010 standards until March 31, 2012. Importantly, this is only a 90-day delay on the enforcement of the transition, including fines. Claims not submitted under the 5010 standards on or after January 1, 2012 may not be paid, unless CMS has accepted a transition plan. Modern Healthcare reports that most physician practices are relying on their clearinghouses to convert claims into the new format, or assuming that an updgrade in software will meet all the new standards.

If you don’t know your practice’s status regarding 5010 compliance, contact your clearinghouse or practice management system vendor as soon as possible to avoid an unanticipated interruption in your revenue stream.

Extension of HITECH Meaningful Use Stage 2 Deadline

Physicians who met the Stage 1 Meaningful Use criteria to qualify for the HITECH Act’s subsidies in 2011 will get another year to meet the Stage 2 criteria, according to a HHS notice . Under the current requirements, eligible doctors and hospitals that begin participating in the Medicare EHR (electronic health record) Incentive Programs this year would have to meet new standards for the program in 2013. If they did not participate in the program until 2012, they could wait to meet these new standards until 2014 and still be eligible for the same incentive payment. To encourage faster adoption, HHS Secretary Sebilius announced that HHS intends to allow eligible providers to adopt health IT in 2011, without meeting the new standards until 2014. The final Stage 2 meaningful use criteria will appear in a Notice of Proposed Rulemaking scheduled to be published in February 2012.

The HHS press release also linked to a CDC survey that indicated that physician use of electronic records had doubled in the past two years. The reprt shows that in 2011, 57% of office-based physicians used EMR/EHR systems, ranging from 40% in Louisiana to 84% in North Dakota. Over half intended to apply for the HITECH incentives. In Pennsylvania, CDC reports that  50% of office-based practice use some EHR, and that 47.5% planned to apply for HITECH funds.


Think you’re a Meaningful User of EHR? Now you can prove it to CMS and cash in. CMS has opened a web link under which entities who have met the meaningful EHR use criteria can attest that they qualify for the HITECH program’s first year incentives of up to $18,000. The first step is to sign up for the program here under the Registration tab, then click on the Attestation tab. Eligible providers and hospitals will need to enter their National Provider Identifier (NPI) number, or obtain one at the NPPES site.  


The Attestation site opened April 18. CMS posted a preview of the site with screenshots of each page in the attestation process. The site will go through a series of questionnaires addressing the criteria required to meet the Meaningful Use standards.


Not sure if you qualify? Use the CMS Meaningful Use Attestation Calculator. It mirrors the questions asked in the attestation process, but there is no need to enter an NPI number, and no information will be saved or transmitted. It is broken down into Core Measures and Menu Measures. For eligible professionals, there are 15 required core objectives and 5 objectives may be chosen from the list of 10 menu set objectives. For eligible hospitals and CAHs, there are 14 required core objectives and the remaining 5 objectives may be chosen from the list of 10 menu set objectives. Note:  the CMS calculator requires you to go through each question in sequence and will not allow you to scroll through and answer questions out of order.

                 Six healthcare advocacy organizations have released an updated 2011 Guide to E-Prescribing, including Meaningful Use criteria under the HITECH Act.   The document is a comprehensive guide for practices covering acquisition, implementation and utilization of e-prescribing technology. The original version was published in 2008, which is now relatively antiquated — technology years being roughly equivalent to dog years. The organizations are the American Academy of Family Physicians, the American College of Physicians, the American Medical Association, the Center for Improving Medication Management, the eHealth Initiative and the Medical Group Management Association.

                In addition to the advent of HITECH, the six organizations cited the continued and dramatic growth in e-prescribing adoption and use, the Drug Enforcement Agency’s rule allowing e-prescribing of controlled substances, and the passage of healthcare reform as the reasons an updated Guide was needed. 

                The Guide outlines the standards which must be met to qualify for HITECH incentive funds, the eligibility requirements for the Medicare Improvements for Patients and Providers Act (MIPPA) incentive payments, and the forthcoming Medicare payment reductions for failure to use e-prescribing that will begin to take effect in 2012. The Guide includes plain-English advice recommendations to help clinicians adopt and implement e-prescribing which will form the foundation of meaningful use of EHR.   Appendices include a Buyers Guide; Frequently Asked Questions; Additional Resources; Meaningful Use Criteria and Vision; and Application Requirements for the Electronic Prescribing of Controlled Substances.

                The six groups have created a practical and highly-readable resource for practices and healthcare entities seeking to start e-prescribing as well as those who are currently using electronic prescribing technology but want to be sure they will qualify for available incentives.


In a detailed, 46-page letter dated February 25, 2011, the American Medical Association and 38 other medical societies raised serious concerns about the proposed set of requirements for Stage 2 of the Medicare/Medicaid Electronic Health Record (EHR) meaningful use incentive programs.


The letter, addressed to Joshua Seidman, PhD of the Office of the National Coordinator for Health Information Technology, warn that some of the proposed Stage 2 criteria depend on interconnectiblity infrastructure and two-way data exchange capabilities between physicians, hospitals and other providers that is currently not available.  


“Physicians look forward to the day when they can securely exchange information with other providers to enhance the quality and efficiency of the care that they provide to their patients. However, asking physicians to do more within an environment that is still not largely interconnected, and in which commercially available products cannot perform the required functions reliably, will simply result in additional financial and administrative burdens, including the use of time-consuming dual processes—paper and electronic.”


A common thread in the comments is the inability of physicians to achieve measures that they cannot unilaterally accomplish without the efforts of others whom they cannot control — patients, software developers, labs, hospitals, or governmental entities.

The medical societies make the following recommendations:


            1.         CMS and ONC should survey physicians who elected to participate and those who elected not to participate during Stage 1 of the incentive program and identify barriers to and solutions for physician participation prior to moving to Stage 2;


            2.         Measures for meeting meaningful use should factor in appropriate use. Physicians should be permitted to opt out of a measure that has little relevance to the physician’s routine practice;


            3.         Prior to moving a measure from the Stage 1 menu set to the core set for Stage 2, or prior to adding new measures, a risk-benefit analysis should be performed, and any proposed new measure should initially be added to the “menu” set of criteria;


            4.         High thresholds should be avoided for objectives that cannot be met due to the lack of available, well-tested tools or bidirectional health information exchanges; and


            5.         Measures that require adherence from a party other than the physician should be removed (e.g., patient’s accessing patient portal, labs reporting test results).


Early EHR adopters, mark your calendars:  CMS will begin accepting registration for participation in the Medicare EHR incentive program beginning January 3,  2010.   CMS will post a link to the registration process on its Registration and Attestation page on January 3.  The sooner you apply, the sooner you can begin to qualify for the $44,000 in additional Medicare funds per eligible professional which is being offered for meaningful use of electronic health records.

For the eligible professional incentives, the applications must be submitted on behalf of the professionals themselves, not their employers or practices, but the payments may be reassigned. 

In order to apply, eligible professionals will need:

  • National Provider Identifier (NPI)
  • National Plan and Provider Enumeration System (NPPES) ID and Password
  • Payee Tax Identification Number (if you are reassigning your benefits)
  • Payee National Provider Identifier (NPI)(if you are reassigning your benefits)

Eligible hospitals will need:

  • CMS Identity and Access Management (I&A) User ID and Password
  • CMS Certification Number (CCN)
  • National Provider Identifier (NPI)
  • Hospital Tax Identification Number

Applicants for the Medicare incentive must be enrolled in PECOS.

Of course, you must be using certified EHR technology, but you do not need to disclose which certified EHR system you are using until the attestation process.  The Certified Health IT Product List is available at

Attestation of meaningful use will begin in April, with payments slated to begin in May.   The provider must install and verify meaningful use of the certified software for at least 90 days in 2011 to qualify for the EHR incentive money. The 90 days of  “meaningful use of certified EHR software” must occur before the end of 2011.  February 29, 2012 is the last day for eligible professionals to register and attest to receive an Incentive Payment for 2011.

The Medicaid incentive program also opens on the same day, but CMS cautions that some states may not be ready to register applicants right away.   keep in mind that if your practice or entity qualifies for both programs, you should evaluate which one is more beneficial to your situation since you cannot participate in both.  Medicaid offers up to $63,750 per qualifying practitioner over six years.

Providers are only required to register once for the Medicare and Medicaid EHR Incentive Programs. However, they must successfully demonstrate that they have either adopted, implemented or upgraded (first participation year for Medicaid) or meaningfully used certified EHR technology each year in order to receive an incentive payment for that year.

For more information, see CMS’s Path To Payment site.

The virtual "ink" is barely dry on the July 13, 2010 final rule on Stage 1 Meaningful Use criteria, but the federally chartered Health IT Policy Committee is already beginning to talk about Stage 2.   Modern Healthcare reports in a September 17 article (registration required) that the advisory body met this week to review a schedule for implementing standards that will apply to eligibility for federal funding for users of electronic health records during fiscal years 2012-2013.  The meaningful use work-group’s initial draft of Stage 2 criteria is anticipated to be presented to the full Committee by October 20 and released for public comment shortly afterwards.  The goal is to submit final recommendations to the Office of National Coordinator for Health Information Technology by the end of June,  2011.

While developing Stage 2 criteria, the Committee will also be reviewing provider feedback on the implementation of Stage 1 criteria, prompting Committee member Richard Chapman  to comment: 

"We’re going to have to ride our bike and fix it at the same time here, which is, we’re going to get feedback, but only so much of it we’ll be able to be put into Phase 2.  Some will have to be staged later, even into (Stage) 3 or whenever we get there because I think we’re going to find out there could be a showstopper along the way."

Providers will want to monitor these efforts carefully when selecting EHR vendors and designing systems and policies to ensure that their Stage 1 use can be expanded to include Stage 2 criteria when they kick in.

by Todd Rodriguez, Esquire

In July, the Centers for Medicare and Medicaid Services (CMS) released the much-anticipated final regulations that providers are required to meet in order to receive the Medicare incentives for adoption of a certified electronic health record system. In those regulations, In the final rule, CMS set forth 15 core elements which must be met in order to qualify for “meaningful use” of the EHR system.

Notwithstanding the regulations, the requirements are complex and many physicians and other providers have a host of questions regarding both the regulations and the incentive program. To address some of these questions, CMS has issued a number of Frequently Asked Questions (FAQs) on its website. To review the new EHR FAQs, physicians can click here and type the term “EHR” into the search window.

Crossposted from Fox Rothschild’s Physician Law blog.