Only two percent of hospitals in the United States

Transcription

1 Federal Electronic Health Records Incentive Programs: What They Mean for Compliance Officers Tips and Suggestions for Navigating through the Regulations and Ensuring Compliance Camella B. Boateng Camella B. Boateng, MPH, is a compliance consultant for Strategic Management Services. She provides onsite risk assessment analysis, compliance program reviews, policy development, and statistical analysis of health care claims. She also conducts regulatory research for several health care organizations, including hospitals, managed care markets, and pharmaceutical companies. She can be reached at 703/ or by at cboateng@strategicm.com. Only two percent of hospitals in the United States currently have adopted electronic health record (EHR) programs meeting the federal government s meaningful use requirements. 1 According to a recent study, there was only a moderate increase in the adoption on of EHRs between een the years 2008 and Despite the slight increase in the use of EHRs, it is likely that the transition to EHRs will be a long and challeng- ing process for hospitals. The new Medicare and Medicaid EHR incentive programs are scheduled to commence in January This article focuses on defining what it means for hospitals and their compliance officers desiring to participate in the new incentive programs. In addition, tips and suggestions are offered as to what a compliance officer (CO) needs to know in navigating through the Medicare and Medicaid EHR incentive program regulations and to ensure compliance. WHAT ARE THE MEDICARE AND MEDICAID EHR INCENTIVE PROGRAMS? Under the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, the federal government has made it a priority to improve the health care outcomes with lower health care expenditures through the use of health information technology. 4 The HITECH Act is aimed at promoting the establishment of a nationwide system of EHRs that is efficient, secure, and private. Journal of Health Care Compliance November December

2 Meaningful Use Objectives and Measures To qualify for incentive payments, hospitals must be meaningful users of certified EHRs. HHS set forth in the final rule 24 meaningful use objectives, of which hospitals must meet 19. The meaningful use objectives are divided into two groups: (1) core set and (2) menu set objectives. The core set contains 14 required objectives that eligible hospitals must fulfill to receive bonus payments. The menu set has 10 objectives, and hospitals must select and meet five objectives for payment purposes. Further, one of the five objectives selected from the menu set must be a designated public health objective. HHS also has established specific measures for each meaningful use objective. To dem- The Medicare and Medicaid EHR incentive programs were created under the HITECH Act. These programs are designed to promote the adoption and meaningful use of certified EHRs in order to improve the quality, safety, and effectiveness of health care. More specifically, the Medicare and Medicaid EHR incentive programs provide financial incentives for eligible hospitals, health care professionals, and Medicare Advantage organizations that adopt and demonstrate meaningful use of certified EHR. Under these incentive programs, hospitals can receive millions of dollars to become meaningful users of certified EHRs. In addition, eligible professionals can receive payments under the programs. Specifically, eligible professionals can receive as much as $44,000 over a five-year period through Medicare and up to $63,750 over a six-year period through the Medicaid EHR incentive program. 5,6 Economic analysts estimate that, ht under the Medicare and Medicaid EHR incentive i e programs, $9.7 billion to $27.4 billion in incentive ive payments will be expended dover the next 10 years. 7 Thus, the financial benefits derived under the HITECH Act EHR incentive programs can assist health h care providers and practitioners with their health information technology transitions. WHAT ARE THE MEDICARE AND MEDICAID EHR INCENTIVE PROGRAMS REGULATIONS? On July 28, 2010, the Department of Health and Human Services (HHS) issued two final rules related to the implementation of the Medicare and Medicaid EHR incentive programs. The final rules address two critical components of the Medicare and Medicaid EHR incentive programs. The first rule titled Medicare and Medicaid Programs; Electronic Health Record Incentive Programs defines the meaningful use objectives that eligible participants are required to fulfill to obtain incentive payments. 8 The second regulation titled Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology addresses EHR technology standards and certification. 9 Notable requirements that COs should be aware of include the following. Eligibility To receive Medicare EHR incentive program benefits, an eligible hospital must be an acute care hospital, critical care hospital, or a Medicare Advantage affiliated eligible hospital. 10 In the Medicaid EHR incentive program, a hospital is eligible to participate if it is an acute care hospital, cancer hospital, critical access hospital, or a children s hospital. 11 In addition, all Medicaid participants, with the exception of children s hospitals, must meet a certain Medicaid patient volume requirement. 12 Overall, hospitals may be eligible to participate in both programs; however, hospitalbased physicians are not permitted to independently participate in the programs. A hospital-based physician is defined as a physician who furnishes more than 90 percent of his or her services in an inpatient hospital or the emergency room. 13 It should be noted that although hospital-based physicians are not eligible to participate, other health care professionals who meet the programs eligibility requirements may participate in the Medicare and Medicaid EHR incentive programs. 18 Journal of Health Care Compliance November December 2010

3 onstrate meaningful use, a hospital must comply with the metrics assigned to each meaningful use objective. (See Figures 1-3.) Certified EHR Technology Qualified participants may receive incentive payments if they demonstrate meaningful use of certified EHR technology. The EHR technology must be a complete EHR that meets the statutory definition of qualified EHR and has been tested by the HHS Office of the National Coordinator for Health Information Technology (ONC) Authorized Testing and Certification Bodies (ATCBs). Alternatively, the EHR technology may be a combination of EHR modules Figure 1: Meaningful Use: Core Set of Objectives 21,22 Objective Measure Use computerized physician order entry (CPOE) for medication orders directly entered by any licensed health care professional who can enter orders into the medical record per state, local, and professional guidelines. Implement drug-drug and drug-allergy interaction checks. Record patient demographics (sex, race, ethnicity, date of birth, preferred language, and in the case of hospitals, date and preliminary cause of death in the event of mortality). Implement one clinical decision support rule. Maintain-up-to-date in-u problem list of current and active diagnoses. Maintain active medication lists. More than 30 percent of patients with at least one medication in their medication list have at least one medication order through CPOE. Functionality is enabled for these checks for the entire reporting period. More than 50 percent of patients demographic data recorded as structured data. One clinical decision support rule implemented. More than 80 percent of patients have at least one entry recorded d as structured ture data. More than 80 percent of patients have at least one entry recorded as structured data. Maintain active medication allergy list. More than 80 percent of patients have at least one entry recorded as structured data. Record vital signs and chart changes (height, weight, blood pressure, body-mass index, growth charts for children). Record smoking status for patients 13 years or older. Report hospital clinical quality measures to CMS or states.* Provide patients with an electronic copy of their health information, upon request. More than 50 percent of patients two years of age or older have height, weight, and blood pressure recorded as structured data. More than 50 percent of patients 13 years of age or older have smoking status recorded as structured data. For 2011, provide aggregate numerator and denominator through attestation; for 2010, electronically submit measures. More than 50 percent of requesting patients receive electronic copy within three business days. Provide patients with an electronic copy of their discharge instructions at time of discharge, upon request. Maintain capability to exchange key clinical information among providers of care and patient-authorized entities electronically. Implement systems to protect privacy and security of patient data in the EHR. More than 50 percent of all patients who are discharged from inpatient department or emergency department of eligible hospital or critical access hospital and who request an electronic copy of their discharge instructions are provided with it. Perform at least one test of EHR s capacity to electronically exchange information. Conduct or review a security risk analysis, implement security updates as necessary, and correct identified security deficiencies. * See Figure 3 for Meaningful Use Clinical Measures for Hospitals. Journal of Health Care Compliance November December

4 in which each EHR module meets at least one certification criterion adopted by the Secretary of HHS and has been tested and certified by ONC ATCB. In addition, the combination of the EHR modules must meet the statutory definition of qualified EHR. Overall, to receive incentive payments, hospitals must ensure that their EHR technology is certified, and this requirement can be fulfilled with a complete EHR or a combination of EHR modules. 14,15,16 Reporting Periods and Reporting Method To receive incentive payments, a hospital must attest to the Centers for Medicare & Medicaid Services (CMS) and/or a state Medicaid agency that it is a meaningful user of certified EHR. The reporting period for the first year of participation under the Medicare and Medicaid EHR incentive programs is 90 days. Subsequent to the first year of participation, the reporting period is one year. The Medicare and Medicaid EHR incentive programs will operate on the federal fiscal year (FY). 17 WHY SHOULD COS HAVE CONCERNS WITH THE VOLUNTARY, NOT MANDATED, MEDICARE AND MEDICAID EHR INCENTIVE PROGRAMS? There are a number of reasons why COs should be concerned with the Medicare and Medicaid EHR incentive programs. First, although the Medicare EHR incentive program is voluntary, starting in federal FY Figure 2: Meaningful Use: Menu Set of Objectives 23,24 Objective Measure Implement drug-formulary checks. Drug formulary check system is implemented and has access to at least one internal or external drug formulary for the entire reporting period. Record advanced directives for patients 65 More than 50 percent of patients 65 years of age or years or older. older have an indication of an advance directive status recorded. Incorporate clinical cal labtest results s asstructured ured More than 40 percent of clinical laboratory test results data. whose results are in positive/negative or numerical format are incorporated into EHRs as structured data. Generate lists of patients by specific conditions to use for quality improvement, reduction for disparities, research, or outreach. Use certified EHR technology to identify patient-specific education resources and provide to patient if appropriate. Perform medication reconciliation between care settings. Perform summary of care record for patients referred or transitioned to another provider or setting. Submit electronic immunization data to immunization registries or immunization information systems. Submit electronic data on reportable laboratory results to public health agencies. Submit electronic syndromic surveillance data to public health agencies. Indicates a public health objective. Generate at least one listing of patients with a specific condition. More than 10 percent of patients are provided patientspecific education resources. Medication reconciliation is performed for more than 50 percent of transitions of care. Summary of care record is provided for more than 50 percent of patient transition of referrals. Perform at least one test data submission and followup submission (where registries can accept electronic submission). Perform at least one test of data submission and followup submission (where public health agencies can accept electronic data). Perform at least one test of data submission and followup submission (where public health agencies can accept electronic data). 20 Journal of Health Care Compliance November December 2010

5 2015, eligible hospitals that are not meaningful users of certified EHR will begin to see a reduction in their Medicare payments. Therefore, if a hospital is an eligible hospital, as defined in the Medicare EHR incentive program, and receives Medicare payments, the organization may be subject to payment reduction if it does not become a meaningful user of certified EHR. Further, under the Medicare and Medicaid EHR incentive programs, eligible hospitals must attest that they are meaningful users of certified EHR. The commentary in the final rule notes that attestation is an insufficient means to hold providers accountable for the expenditures of public funds and to protect against fraud and abuse. 18 As a result, CMS intends to [develop] an audit strategy to ameliorate and address the risk of fraud and abuse. 19 The compliance responsibility, however, ultimately lies with the hospital. If a hospital attests that it is a meaningful user of certified ed EHR and the representation rese tio is false and the hospital accepts ce federal er funds under Medicare and Medicaid EHR incentive programs, the organization potentially has submitted a false claim or misrepresentation, which may be actionable under the False Claims Act or other federal statutes. An additional reason why COs should be concerned with the Medicare and Medicaid EHR incentive programs is the increase in the risk of protected health information (PHI) breaches. The expansion of EHR technology and electronic exchange raises concerns related to the privacy and security of PHI. Thus, under the HITECH Act, there are several modifications to the Health Information Portability and Accountability Act (HIPAA) privacy, security, and enforcement rules. HHS recently issued a proposed notice of rulemaking concerning the modifications to the HIPAA provisions. Notable highlights in the proposed rule include: extending HIPAA provisions to business associates, restricting the sale of PHI, modifying the rules related to PHI and research, revising covered entities notice of privacy practices, and expanding an individual s rights to access and restrict disclosure of his or her PHI. The proposed regula- Figure 3: Meaningful Use: Clinical Quality Measures for Hospitals 25 Hospitals must report the following 15 clinical quality measures under the Medicare and Medicaid EHR incentive program: 1. Emergency Department Throughput-Admitted Patients: Median time from emergency department arrival to emergency department departure for admitted patients 2. Emergency Department Throughput-Admitted Patients: Decision time to emergency department departure time for admitted patients 3. Ischemic stroke: Discharge on anti-thrombotics 4. Ischemic stroke: Anticoagulation for A-fib/flutter 5. Ischemic stroke: Thrombolytic therapy for patients arriving within two hours of symptom onset 6. Ischemic or hemorrhagic stroke: Antithrombotic therapy by day two 7. Ischemic stroke: Discharge on statins 8. Ischemic or hemorrhagic stroke: Rehabilitation assessment 9. Venous thromboembolism prophylaxis within 24 hours of arrival 10. Intensive care unit venous thromboembolism prophylaxis 11. Anticoagulation overlap therapy 12. Platelet monitoring on unfractionated heparin 13. Venous thromboembolism discharge instructions 14. Venous thromboembolism discharge instructions 15. Incidence of potentially preventable venous thromboembolism Journal of Health Care Compliance November December

6 tions can have a significant impact on a hospital s operations, as well as its relationships with vendors, contractors, and business associates. As a result, COs must be aware of not only the proposed modifications to the HIPAA rules but the potential privacy and security compliance risks associated with the adoption of EHR. m multiple de rt- ly enrolling in COMPLIANCE OFFICER TIPS AND SUGGESTIONS In coming years, the federal government will be allocating a substantial amount of funding to promote the adoption and meaningful use of certified EHR. Thus, participants in the programs must ensure that they comply with all applicable regulations. COs will play a critical role in ensuring that an organization abides by the programs regulations. The following list outlines tips that COs should consider: 1. COs must recognize that the adoption and meaningful use of EHR is an organization initiative. The Medicare and Medicaid Md EHR incentive programs will require collaboration from multiple departments. COs should play a key role in the oversight of this collaboration. COs may wish to consult and work with the chief financial officer, information technology staff, privacy and security officials, legal, internal audits, business associates, and health care professionals to monitor compliance with the Medicare and Medicaid EHR incentive programs. 2. COs should be aware of the potential compliance risks associated with the Medicare and Medicaid EHR incentive programs. As indicated above, some of the risk areas related to the Medicare and Medicaid EHR incentive programs include the submission of false claims and PHI breaches. An additional compliance risk may be with hospital-based physicians. Under the Medicare and Medicaid EHR incentive programs, hospital-based physicians are not eligible to participate in the programs. 20 Therefore, hospitals must ensure that their hospital-based physicians are not separately enrolling in the Medicare and Medicaid Figure 4: Medicare and Medicaid EHR Incentive Programs Key Implementation Dates June 24, 2010 This is the effective date for the Temporary Certification Program. July 1, 2010 ONC accepting applications from entities that are seeking ONC-authorized Testing Certification Body (ONC-ATCB) approval. August 27, 2010 This is the effective date for EHR technology standards and certification requirements. September 27, 2010 This is the effective date for the Medicare and Medicaid EHR incentive program final rule. Fall 2010 ONC anticipates that eligible hospitals will be able to purchase certified EHR software. January 2011 Eligible hospitals can begin to register for the EHR incentive programs. CMS will inform eligible participants that registration for the Medicare and Medicaid EHR incentive programs will be available on the registration Web page on cms.gov/ EHRIncentivePrograms. Further, the registration will be managed by CMS. April 2011 Eligible hospitals can begin to make attestations for the Medicare EHR incentive program. Mid May 2011 CMS will begin to issue Medicare EHR incentive payments. November 30, 2011 This is the last day for eligible hospitals to register and attest to meaningful use in order to receive a Medicare EHR incentive payment for federal FY Federal FY 2015 Medicare payment adjustments will begin for eligible hospitals that are not meaningful users of EHR technology. Federal FY 2016 This is the last year to initiate participation in the Medicaid EHR incentive program. Federal FY 2021 This is the last year to receive payment under the Medicaid EHR incentive program. 22 Journal of Health Care Compliance November December 2010

7 EHR incentive programs as eligible professionals when more than 90 percent of their services are furnished in an inpatient setting or emergency room. 3. COs need to understand the requirements. A large part of participating in the Medicare and Medicaid EHR incentive programs relates to understanding the program requirements. For example, one of the required meaningful use objectives is to use computerized provider order entry (CPOE) for medication orders that are directly entered by a licensed health care professional. COs must be aware that in order to meet this objective, a licensed health care professional must be the individual who enters the information. Therefore, COs should consider conducting compliance training on this requirement to appropriate staff to ensure that the objective is fully met. COs also need to be aware of the requirements concerning the certification of EHR technology. To receive incentive payments, providers must use certi- fied EHRs. This can consist st of complete EHR or a combination of EHR modules. COs must understand the difference between complete EHR and EHR modules. Moreover, COs may wish to take inventory of their EHR technology to ensure that their health care EHR system meets the certification requirements for the Medicare and Medicaid EHR programs. 4. COs may wish to consider performing audits similar to those planned by CMS. CMS intends to develop an audit strategy to address the risk of fraud and abuse in the Medicare and Medicaid EHR incentive programs. COs should consider developing their own auditing and monitoring strategy in assessing risks of noncompliance. For example, this may include auditing (a) PHI privacy and security; (b) compliance with meaningful use objectives and measures, particularly pertaining to health care professional compliance with the CPOE; (c) compliance with the EHR technology and certification requirements; and (d) the hospital s internal attestation process, specifically, who within the organization is submitting the attestation to CMS and/or the state agency and how does the organization verify the validity of attestations. The adoption and meaningful use of EHR in the Medicare and Medicaid EHR incentive programs will be a challenge for hospitals. For proper implementation of EHR technology, it will be necessary for hospitals to stay informed about HHS implementation activities. (See Figure 4.) COs can play a significant role in notifying their organization of the program rules and deadlines, as well as ensuring that the requirements are fully met. To stay informed about HHS requirements, providers are encouraged to regularly review CMS EHR incentive Web site for updated guidelines and Figure 5: Definitions 1. Federal Fiscal Year (FY): starts October 1 and ends September 30 of the next calendar year. For example, federal FY 2011 begins October 1, 2010 and end September 30, te 2. Medicaid d acute care hospital: a health care facility with an average length of stay of 25 days or less. In addition, the hospital must have a Centers for Medicare & Medicaid Services Certification Number in which the last four digits fall in the series or Medicare acute care hospital: a subsection (d) hospital as outlined in the Social Security Act 1886(d)(1)(B). 4. Qualified EHR: an electronic record of health-related information on an individual that (1) includes patient demographic and clinical health information, such as medical history and problem lists; and (2) has the capacity (i) to provide clinical decision support; (ii) to support physician order entry; (iii) to capture and query information relevant to health care quality; and (iv) to exchange electronic health information with, and integrate such information from, other sources. Journal of Health Care Compliance November December

8 instructions. For further information on the EHR incentive programs, visit EHRIncentiveprograms. Endnotes: 1. Jha AK, DeRoches CM, Kralovec PD, Joshi MS. A Progress Report on Electronic Health Records in US Hospitals. Health Affairs. 2010; 29(10): Id. 8.7 percent and 11.9 percent of hospitals have adopted basic or comprehensive EHR in 2008 and 2009 respectively. 3. Medicare & Medicaid EHR Incentive Program Specifics for Hospitals Department of Health and Human Services Centers for Medicare & Medicaid Services. Accessed on 8 Sept < EHRIncentivePrograms/Downloads/EHR_Incentive_ Program_Hospital_Training_FINAL.pdf>. 4. American and Recovery and Reinvestment Act of 2009, Pub. L. No , 123 Stat CMS Finalizes Requirements for the Medicare Electronic Health Record (EHR) Technology. Centers for Medicare & Medicaid Services: Fact Sheet. 16 Jul EHR Incentive Program: Medicaid Eligible Professional Department of Health and Human Services Centers for Medicare & Medicaid Services. Accessed on 8 Sept < Medicaid_Eligible_Professional.asp#TopOfPage>. d Fed. Reg. 144, (July 28, 2010). 8. Department of Health and Human Services Centers for Medicare & Medicaid Services 42 CFR Parts 412, 413, 422 etal. Medicare and Medicaid Programs; Electronic Health Record Incentive Program; Final Rule, 75 Fed.Reg.144, 44314, (28 Jul. l.2010). 9. Department of Health and Human Services 45 Part 170 Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Final Rule, 75 Fed. Reg. 144, 44590, (28 Jul. 2010). 10. American Recovery and Reinvestment Act of 2009, Pub. L. No , 123 Stat American Recovery and Reinvestment Act of 2009, Pub. L. No , 123 Stat EHR Incentive Program Final Rule: Medicaid Provisions. Department of Health and Human Services Centers for Medicare & Medicaid Services Accessed on 8 Sept < EHR_Final_Rule-Medicaid.pdf>. 13. EHR Incentive Program: Eligibility. Department of Health and Human Services Centers for Medicare & Medicaid Services Accessed on 8 Sept < asp#topofpage>. 14. Department of Health and Human Services 45 Part 170 Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Final Rule, 75 Fed. Reg. 144, 44590, (28 Jul. 2010). 15. Department of Health and Human Services 45 CFR Part 170 Establishment of the Temporary Certification Program for Health Information Technology; Final Rule, 75 Fed. Reg. 121, 36157, (24 Jun. 2010). 16. Initial EHR Certification Bodies Name. Department of Health and Human Services: Press Release. 30 Aug Department of Health and Human Services 45 Part 170 Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Final Rule, 75 Fed. Reg. 144, 44590, (28 Jul. 2010) Fed. Reg. 144, (July 28, 2010). 19. Id. 20. EHR Incentive Program: Eligibility. Department of Health and Human Services Centers for Medicare & Medicaid Services Accessed on 8 Sept < asp#topofpage>. 21. Blumenthal, D. Tavenner, M. The Meaningful Use Regulations for Electronic Health Records. New England Journal of Medicine Health Policy and Reform Remaking Health Care Accessed on 8 Sept < healthpolicyandreform.nejm.org/?p=3732>. 22. Department ent of Health and Human Services Centers for Medicare &Medicaid Services 42 CFR Parts 412, 413, 422 et al. Medicare and Medicaid Programs; Electronic Health Record Incentive Program; Final Rule, 75 Fed. Reg. 144, 44314, (28 Jul. 2010). 23. Blumenthal, D. Tavenner, M. The Meaningful Use Regulations for Electronic Health Records. New England Journal of Medicine Health Policy and Reform Remaking Health Care Accessed on 8 Sept < healthpolicyandreform.nejm.org/?p=3732>. 24. Department of Health and Human Services Centers for Medicare & Medicaid Services 42 CFR Parts 412, 413, 422 et al. Medicare and Medicaid Programs; Electronic Health Record Incentive Program, Final Rule; 75 Fed. Reg. 144, 44314, (28 Jul. 2010). 25. Medicare & Medicaid EHR Incentive Program Specifics for Hospitals Department of Health and Human Services Centers for Medicare & Medicaid Services. Accessed on 8 Sept < EHRIncentivePrograms/Downloads/EHR_Incentive_ Program_Hospital_Training_FINAL.pdf>. Reprinted from Journal of Health Care Compliance, Volume 12, Number 6, November-December 2010, pages 17-24, with permission from CCH and Aspen Publishers, Wolters Kluwer businesses. For permission to reprint, permissions@cch.com. 24 Journal of Health Care Compliance November December 2010