Audit Alert: Are You Prepared? You Have A Good Chance of Being Selected

Transcription

1 Audit Alert: Are You Prepared? You Have A Good Chance of Being Selected HIT Summit July 26, 2014

2 Lee Castonguay Hawaii Pacific Regional Extension Center Or How to keep your incentive payment 2

3 Disclosure HHIE HIT Consultant I have no other relevant financial disclosures 3

4 CMS EHR Incentive Audits Today s Agenda Audit program basics The audit process How to respond to an audit Techniques to stay out of trouble 4

5 Why Audits As Part of the Meaningful Use Incentive Program, an Audit process was mandated. The accounting firm of Figliozzi & Company has been contracted to complete these Audits. These audits are part of the Federal Governments checks and balances to insure the integrity of the Meaningful Use Incentive Program 5

6 Audit Program Basics Two Types of Audits Underway: Pre-payment Audits - 2 to 10% being audited Post-payment Audits 2 to 10% being audited Eligible Professionals (EPs) are audited, not the organization (unless it s an Eligible Hospital) Checks built into the attestation process to detect inaccuracies in eligibility, reporting and payment. Audit Determination Letter pass/fail Any discrepancy uncovered via audit results in full repayment of Stimulus Funds to CMS up to six years after attestation. 6

7 Failed Audits Elizabeth Holland (director CMS Health IT Initiatives Group) and Robert Anthony (deputy director of CMS Health IT Initiatives Group) at the 2014 HIMSS said: The majority of failed audits occur either for lack of having documentation of the MU measures or the Security Risk Analysis. 7

8 What generates the Audit? Random Suspicious data, Problematic EHRs Whistleblowers 8

9 The Audit Process The Audit Letter ( ) The Request for Documentation Response and Request Final Determination Appeal Process 9

10 The Audit Letter First contact will be an from Figliozzi and Company from a CMS address to the address provided during registration for the EHR Incentive Program. This letter is to inform you that you have been selected by CMS for an audit of your meaningful use of certified EHR technology for the attestation period. Attached to this letter is an information request list. Be aware that this list may not be all-inclusive and that we may request additional information necessary to complete the audit. 10

11 Pre-Payment Letter January 22, 2014 RE: HITECH EHR Meaningful Use Prepay Audit Engagement Letter & Information Request Program Year 2013 Payment Year 2 Dear Doctor: The Centers for Medicare and Medicaid Services (CMS) has contracted with Figliozzi & Company, CPAs P.C.1 to conduct meaningful use audits... This letter is to inform you that you have been selected by CMS for a prepayment audit of your meaningful use of certified EHR technology for the attestation period. Since this is a prepayment audit your incentive payment will be held pending the outcome of this audit. Attached to this letter is an information request list. Be aware that this list may not be all-inclusive and that we may request additional information necessary to complete the audit. 11

12 Centers for Medicare and Medicaid Services Document Request List Eligible Professionals Medicare Electronic Health Record (EHR) Incentive Program PART I - GENERAL INFORMATION As proof of use of a Certified Electronic Health Record Technology system, provide a copy of your licensing agreement with the vendor or invoices. Please ensure that the licensing agreements or invoices identify the vendor, product name and product version number of the Certified Electronic Health Record Technology system utilized during your attestation period. If the version number is not present on the invoice/contract, please supply a letter from your vendor attesting to the version number used during your attestation period. PART II - CORE SET OBJECTIVES / MEASURES Core #15- Protect Electronic Health Information: Provide proof that a security risk analysis of the Certified EHR Technology was performed prior to the end of the reporting period (i.e. report which documents the procedures performed during the analysis and the results of the analysis). If deficiencies are identified in this analysis, please supply the implementation plan; this plan should include the completion dates. 12

13 The Audit Letter Per CMS FAQ 7361, providers are required to direct all Meaningful Use audit questions to Peter Figliozzi at (516) x302 or by at Figliozzi and Company s website is Be careful of Phishermen! 13

14 CMS EHR Meaningful Use Audit Team What is the CMS (EHR) Meaningful Use Audit Team? The CMS EHR Meaningful Use Audit Team performs meaningful use audits as part of the CMS EHR Incentive Programs. If selected for a one of these audits, the eligible professional (EP), eligible hospital (EH) or critical access hospital (CAH) will receive a letter with the CMS logo on the letterhead providing instructions on providing supporting documentation and other required information. 14

15 An Audit Letter Can Be: Frightening Disruptive to your current work flow Difficult to respond to Not Prepared Prepared Oh Darn 15

16 The Request for Documentation Figliozzi and Company uses a secure communication process to receive sensitive information from the provider. Proof of possession of a Certified Electronic Health Record Technology system prior to start of attestation period. Often a sales receipt is not enough unless it specifically indicates that the software was certified for Meaningful Use Supporting documentation (in either paper or electronic format) used in the completion of the Attestation Module responses (i.e. a report from your EHR system that ties to your attestation) for Core and Menu Set Measures. 16

17 The Request for Documentation Proof that a security risk analysis of the certified EHR technology was performed prior to the end of the reporting period (i.e. report which documents the procedures performed during the analysis and the results of the analysis). If deficiencies are identified in this analysis, please supply the implementation plan; this plan should include the completion dates. Yes/No attestation measures: must also be documented via screenshots, documentation from EHR vendor, etc. *Note: reportedly the Security RA is highest reason for failure 17

18 Document Request Centers for Medicare and Medicaid Services Document Request List - Eligible Professionals Organization: EHR Certification Number: EHR Reporting Period Start Date: EHR Reporting Period End Date: Medicare Electronic Health Record (EHR) Incentive Program Please provide all of the documents requested below by the due date. The Eligible Professional (EP) should complete Column C. The auditor will complete Column D. (A) Item Number (B) Requested Documents (C) For Completion by the EP (D) For Completion by Auditor Date Sent to Auditor Method of Delivery Initial (Upload/ /Mai Request Date l) 2nd Request Date Date Received PART I - GENERAL INFORMATION 1 As proof of possession of a certified Electronic Health Record technology system, provide a copy of the Office of the National Coordinator of Health Information Technology (ONC) certification as well as licensing agreements with the vendor or invoices from the time the system was purchased. 18

19 Document Request PART III - MENU SET OBJECTIVES / MEASURES 5 Provide the supporting documentation (in either paper or electronic format) used in the completion of the Attestation Module responses (i.e. a report from your EHR system that ties to your attestation). Please Note: If you are providing a summary report from your EHR system as support for your numerators/ denominators, please ensure that we can identify that the report has actually been generated by your EHR (i.e. your EHR logo is displayed on the report, or step by step screenshots which demonstrate how the report is generated by your EHR are provided.) To support Y/N attestation measures, please supply documentation such as screenshots from your EHR system. 19

20 Response and Request Submitted documentation is reviewed and if necessary there will be a request of additional documentation or clarification 20

21 Final Determination - Good We performed a desk review on your facility s meaningful use attestation for the Program Year 2013 and Payment Year 1. Based on our desk review of the supporting documentation furnished by the facility, we have determined that your practice has met the meaningful use criteria. 21

22 Final Determination - Bad We performed a desk review on your facility s meaningful use attestation for the Program Year 2011 and Payment Year 1. Based on our desk review of the supporting documentation furnished by the facility, we have determined that Provider SoNso has not met the meaningful use criteria, for the following reasons: Failed Eligible Provider Meaningful Use Core Measure X. Since your facility did not meet the meaningful use criteria, the incentive payment will be recouped. You will receive a demand for your total Medicare EHR incentive payment shortly from the EHR HITECH Incentive Payment Center. The demand letter will include all information regarding the repayment process, and will also include your appeal rights. 22

23 Appeals CMS handles the appeal process for EPs, EHs, and CAHS in the Medicare and dual eligible hospitals. States are responsible for appeals related to the Medicaid EHR Incentives. 23

24 Look Back Audits If you went through an 2014 meaningful use audit, and didn t have a Security Risk Assessment, I would think there would be a chance you couldn t provide it for prior attestations either. I m expecting we will see more and more of these look back audits based on what is revealed during an initial audit. Jim Tate 24

25 How to Respond to an Audit Have someone in charge Establish contact with auditor Watch the deadlines Organize your support team Seek counsel if needed Be Prepared 25

26 Organized Your Support Team You want help in responding to these requests, among the resources you will want to tap into are: Your EHR Vendor Your IT Consultants (REC) Your Malpractice Company Your Staff 26

27 Be prepared for an Audit Ensure Validate To ensure you are prepared for a potential audit, save the supporting electronic or paper documentation that support your attestation. Also save the documentation to support your Clinical Quality Measures (CQMs) and exclusions. Upon audit, the documentation will be used to validate that the provider accurately attested and submitted CQMs, as well as to verify that the incentive payment was accurate. 27

28 Know What You Attested To You can log into the same website that you used for attesting which is: /EHRIncentivePrograms/RegistrationandAttestation.html View the Attestation 28

29 And If You Really Did Fail The Audit You will be looking at a prepayment audit for future years, so you really want to make sure you retain all necessary documentation to insure that you pass all future audits. 29

30 Techniques to stay out of trouble Know what you are doing. A knowledge gap during Registration and Attestation is not a valid excuse. Claiming eligibility for incentives without meeting the volume requirements. 30

31 Techniques to stay out of trouble Plan your audit response now who would receive the letter from the auditor who would respond how the response would be formulated and sent know where the documentation is stored respond with only what is requested: no more, no less 31

32 Techniques to stay out of trouble Complete your Security and Risk Analysis Core Measure for EPs and Eligible Hospitals Eligible professionals (EPs) must attest YES to having conducted or reviewed a security risk analysis in accordance with the requirements under 45 CFR (a)(1) and implemented security updates as necessary and corrected identified security deficiencies prior to or during the EHR reporting period to meet this measure. 32

33 Techniques to stay out of trouble Security and Risk Analysis Myths My EHR vendor took care of everything I need to do about security. False. Your EHR vendor may be able to provide information, assistance, and training on the security aspects of the EHR product. However, EHR vendors are not responsible for making their clients compliant with HIPAA Privacy and Security Rules. It is solely your responsibility to have a complete risk analysis conducted. Courtesy of HHS 33

34 Techniques to stay out of trouble Security and Risk Analysis Myths A checklist will suffice for the risk analysis requirement. False. Checklists can be useful tools, especially when starting a risk analysis, but they fall short of performing a systematic security risk analysis or documenting that one has been performed. Courtesy of HHS 34

35 Techniques to stay out of trouble Keep documentation for at least six years after attestation; Hawaii State Medicaid agency requires documentation be kept for seven years. 35

36 Ways to get in trouble Attesting to meeting the percentage based Meaningful Use objectives with non verifiable documentation. Attesting to meeting the non percentage based Meaningful Use objectives when you didn t do them or can t prove you did. Attesting numerators/denominators Generate Lists of Patients by Specific Conditions Clinical Quality Measures must be reported directly from the certified EHR Protect Electronic Health Information 36

37 New Issues for Stage 2 Stage 2 requires 3 of 6 Menu options If one of the three is an exclusion you must document the other 3 as also being excludable. Tracking Numerators and Denominators for information exchanges Be sure to understand how your EHR does its accounting; you may have to manually count your Numerators and Denominators. Keep the documents. Proposed rules for 2014 Attestation Document any alternative you selected 37

38 HHIE Audit Handout EHR Incentive Programs Supporting Documentation for Audits Meaningful Use Objective Audit Validation Suggested Documentation Drug-Drug/Drug-Allergy Interaction Checks and Clinical Decision Support Functionality is available, enabled, and active in the system for the duration of the EHR reporting period. One or more screenshots from the certified EHR system that are dated during the EHR reporting period selected for attestation. Report ambulatory or hospital clinical quality measures Protect Electronic Health Information Clinical quality measure data is reported directly from certified EHR systems. Security risk analysis of the certified EHR technology was performed prior to the end of the reporting period Report from the certified EHR system to validate all clinical quality measure data entered during attestation. Report that documents the procedures performed during the analysis and the results. Report should be dated prior to the end of the reporting period and should include evidence to support that it was generated for that provider s system (e.g., identified by National Provider Identifier (NPI), CMS Certification Number (CCN), provider name, practice name, etc.). Note: The Stage 2 measure for Protect Electronic Health Information also requires providers to address encryption/security of data stored in certified EHR technology. 38

39 Phase 2 OCR HIPAA Audits HHS Office for Civil Rights (OCR) completed the first round of audits Only 11% of the 115 organizations audited had no failures or weaknesses in meeting requirements 58 of 59 healthcare providers had at least one finding or observation in the area of security. OCR found that the most common cause of findings was that the covered entity (CE) was entirely unaware of the requirement. OCR begins the next round of audits in the Fall 2014 pleading ignorance will not be a defense when OCR comes to call. 39

40 Best Practices Be prepared NOW; don t scramble to get documentation in place when audit request arrives Consider saving to PDF to prove a report/ documentation was not modified post attestation Naming convention for electronic files PDF vs Word/Excel Not Core Measure 3 but rather Problem List 2013 castonguay (Measure_Year_EP) 40

41 Best Practices Eligibility Medicare and Medicaid EHR Incentive Program 50% eligibility criterion Medicaid 30% volume threshold Keep documentation for at least six years after attestation; seven years for Hawaii State Medicaid 41

42 Best Practices Print (to PDF) the summary report at the end of attestation!!! Customized reports - should retain all documentation that demonstrates how the data was accumulated and calculated Have a plan for EPs who leave the organization MU files on CD? Stay current with requirements/changes 42

43 Questions? Lee Castonguay Hawaii Pacific Regional Extension Center 43