Everything HITECH

At the Bottom Line, Meaningful Use is about the Bottom Line

Is Meaningful Use easy, or hard?

We work with about a score of different organizations on ARRA HITECH and Meaningful Use Compliance.  Within any organization, opinions vary.  The IT Analyst points out that everything exists in the Certified EHR, and has been there long before Meaningful Use and Certification.  Very little new, here.

But ED physician who does not, track hieght, weight or problem list for the MI case he's treating finds Meaningful Use inappropriate.  So do Hospitalists who need to capture new data on preliminary cause of death. And admitting physicians who can no longer hand a medication order to a unit clerk to input but must actually enter it themselves will let Administration know what they think of Meaningful Use. 

We dig deeper into Meaningful Use to share these experiences.  At the Bottom line, Meaningful Use is more about the Bottom Line, than health care delivery. So, let's focus on compliance mapped against good clinical work we were planning anyway, and get our share of Federal Funds.  And maybe ... the funding can move us more quickly to the right thing.   Our  Meaningful Use Monitor tools go beyond Certified EHR technology in guiding your compliance; we minimize compliance efforts, make your teams knowledgeable and efficient, and preserve your funding with solid defense against CMS audit.  So take a moment - select a webinar date to the right of this post. You'll be sure to pick up good ideas!

 

Observation Services Method Nuances

In September of 2010, CMS issued FAQ 10126 giving providers options on counting patients in numerator and denominator of Meaningful Use Measures.  However, guidance on criteria and processes by which EHR software would be certified were issued in the Federal Register prior to this guidance (January of 2010), and have not been re-issued since. 

So … does your standard EHR automatically know what decision you have made?    

---

Action Item:  Verify that the list of 12 Meaningful Use Reports providing the option for “all ED Patients” or “Observation Services Patients”, and test numerator / denominator for completeness and accuracy.

CMS has stated their desire to include in the denominator visits to the emergency department (ED) of sufficient duration and complexity, that all of the Meaningful Use objectives for which the ED is included would be relevant.   Giving hospitals the option to select between “All ED Patients” and “Observation Services Patients” seems to recognize impracticalities on counting ED patients who may move quickly in and out of the hospital and may not receive a level of services that would qualify the hospital under meaningful use, by limiting numerator and denominators to patients actually receiving ED services.  Although this guidance helps, our subscribers have asked us to research a few additional questions to help stay in compliance.

 

• Question 1: Do we include all inpatients or only inpatients admitted through the ED? 

Choosing Observation Services Method has no impact on defining how Inpatient visits will be measured.  It does define a population of patients (ED patients who have been admitted to IP wards), for whom the provider must include all visits and activities in numerator and denominator.  Since all these patients should be included in inpatient reporting (independently of Observation Services Method) the practical matter here seems to be the requirement (and opportunity) to include documentation of services performed during the ED portion of the encounter for those patients. 

 

• Question 2: For the observation patients, do we include all observation service patients, or only those who present through the ED?

In providing a choice of using Observation Services patients (as a subset of ED Patients), CMS seems to be reacting to some of the practical problems of reporting on a broader, more volatile patient population of everyone who presents to the ED.  We do not think their intent is an across-the-board substitution of Observation Services Patients for ED patients, so the safest option seems to be making sure your reporting correctly identifies those Observation Services Patients who initially presented to the ED, and as in the prior question, accounting in the numerator for all documentation occurring in the ED setting on those patients.  Any Observation Services patients coded with a Place of Service Code other than 21 or 23 (Inpatient or ED) would be excluded from your numerator / denominator (except for those initially presenting through the ED). 

• Question 3: How does the selection of Observation Services Patients impact Clinical Quality Measure calculations?
  • First, the language of FAQ 10126 addresses numerator and denominator of Meaningful Use Objectives explicitly.  In the Final Rule for EHR Incentives, CMS consistently lists those specific Objectives, and identifies Clinical Quality Measures separately. 
  • Secondly, the Clinical Quality Measures contain specific calculations, data elements, and exclusion rules via independently-published HITSP specifications. 
  • Finally, in a separate related FAQ # 10883 issued on December 22, 2011, CMS answers a question  regarding  CQMs ED-1, ED-2, and Stroke-4, on how should hospitals define an Emergency Department patient since the UB-04 data set referred to in the HITSP specifications no longer provides this information?  In this FAQ, CMS recommends that hospitals use the data element 'ED Patient', defined as any patient receiving care or services in the Emergency Department (without comment regarding Observation Services Method). 
  • Therefore, while none of these statements are definitive, we believe the trend is to isolate Observation Services Method calculations to Meaningful Use Measures, independently of Quality Measures. 

 

So, the bottom line is that it is probably prudent to test following 12 reports in your Certified EHR to validate that they are correctly counting ED patients consistently, based on your decision on using Observation Services Method:

• CPOE
• Record Demographics
• Problem List
• Maintain Active Medication List
• Maintain Active Medication Allergies List
• Record Vital Signs
• Record Smoking Status
• Provide patients with an Electronic Copy of their Health Records  Upon Request
• Provide Patients with an Electronic Copy of their Discharge Instructions Upon Request
• Use Certified EHR Technology to Identify Patient-Specific  Education Resources
• Perform Medication Reconciliation
• Provide Summary Care Record for each Transition of Care

All other reports would fall under either Clinical Quality Measures, or require a Yes / No attestation (which would be probably be independent of your ED patients), or explicitly exclude ED patients in their definition. 

Where are your Peers on Meaningful Use Payments?

2011 was the first year for receiving ARRA’s EHR Incentive Payments.  Just how much Meaningful Use money has CMS distributed, and how many providers got paid?    

Action item: Make it a priority to get Meaningful Use Funds in 2012  When Congress approved the appropriations for the EHR Incentive program, they provided for about $32 billion in gross payments, with $2 billion for program administration, leaving $30 billion in cash outflow to providers.  As of the end of November, CMS has paid out a little over $1.8 billion to providers under Medicare and Medicaid.  $1.8 billion down, $28.2 billion to go.  Is this a program success?   The incentive phase of this program is budgeted to pay out stimulus funds through 2016 for Medicare; the Medicaid incentives run a little longer, going through 2021 for Medicaid EP’s, and 2019 for Medicaid Hospitals.  Of course, payments are very front-end-loaded.  The first year is the biggest year for any provider, under any aspect of this program, and payments tend to dwindle down in later years.   It is also important to note that qualifying for payment is not a one-time deal.  Every year, providers must re-apply and re-qualify.  Of course we all get to qualify under the easiest set of Meaningful Use criteria (Stage 1) for at least the first two years, but even that is not a slam-dunk.  Second year qualification is harder if for no other reason that providers must maintain threshold values in each criterion for the entire year, rather than just any 90 day period.  So one of the first questions of interest in the payouts is “how many organizations have qualified as Meaningful Users of EHR Technology”.  The answer is surprisingly, “a small percentage”.   Here’s how the $1.8 billion has been paid out:

But these numbers do not in themselves tell us how many providers have actually been paid under Meaningful Use, as opposed to the Adopting, Implementing or Upgrading (AIU) provision of Medicaid, under which it is not necessary to achieve Meaningful Use.  CMS does not separate out those hospitals receiving AIU payments vs Meaningful Use Payments.  However, there is one interesting statistic that may help us impute this split.  Medicare made payments to 411 hospitals through November of 2011, and Medicaid made payments to 802 hospitals in that same period. 

A little analysis on these numbers leads us to the conclusion that a large percentage of hospitals paid under Medicaid are likely to be AIU alone.  Here’s the logic stream:

1. Of the 802 hospitals receiving Medicaid payments, most would qualify to receive Medicare stimulus payments (if they achieve Meaningful Use);
2. Medicare has no AIU provision, so all 411 hospitals receiving Medicare funds attested to Meaningful Use;
3. Therefore something close to 391 hospitals, or 48% of stimulus recipients (802 – 411 = 391), probably did so under AIU. 

 

So, by digging deeper into the numbers, we see that fewer that fewer than 14 percent of the country’s hospitals have received stimulus funds, and only about half of those have attested to Meaningful Use … after one full year’s program eligibility. 

 I don’t know about you, but I’m not sure I would call that a rousing success in “stimulating” the healthcare industry.  Not yet, anyway. 

 To keep track of CMS progress on EHR Stimulus Payments, click and bookmark: http://www.cms.gov/EHRIncentivePrograms/56_DataAndReports.asp

CMS is Developing an Audit Strategy … Shouldn’t You?

“Congress for the HITECH Act specifically authorized submission of information as to meaningful use through attestation.  CMS is developing an audit strategy to ameliorate and address the risk of fraud and abuse.”  Federal Register, July 2010

 

So how should we be preparing ourselves? 

 

Providers need their own strategies. We suggest patient-level detail reporting.

Bottom line is, no one yet knows the answer to how audits will be conducted. Attestation is deceptively simple,  it requires little documentation, and is complete when you submit your online application. Where we see documentation becoming important is as a response to downstream audits. Here’s what we believe to be a conservative approach to preparing an advance defense.  We see three grades of conservatism in your documentation approach, and a series of additional strategies to add a little additional strength. 

1. Rely on Certified Software to report correct data at the time of an audit –While this has the merit of little or no up-front work, we steer people away from this “wait and see” approach. Audits can happen up to six years later, and a lot can change over six years in a hospital EHR, or in the composition of the team who remembers the details surrounding interpretations of measures in the “grey area” where CMS could not fully predict all the nuances of clinical operations that you have to follow.   
2. Save copies Certified (Summary level) EHR Reports – some CMS advisories have implied that data in a Certified EHR will be deemed accurate. Most reports we’ve seen from Certified EHR’s are a single page per MU Measure. Content is numerator, denominator, percentage, and date range, for the organization and the Measure.  Saving copies of these reports will certainly give you some audit defense. 
3. Create copies of Patient Level Detail – CMS states no explicit requirement for patient level detail, nor is it required for software to be certified. We recommend it though.  CMS requires you to attest to the “accuracy and completeness” of your data, and each Measure. It seems that you cannot do so, without analyzing patient level detail (i.e., would your CFO accept a bank statement with no more detail than just the balance?). Further, some Measures are based on site-specific variables, such as “observation services” vs “all ED patients” choices.  And patient-level detail will show whether all choices have been correctly represented.  The downside is that you may need to create these reports, if you software has only fulfilled the bare bones requirement of certification. 

Regardless of documentation strategy, here are  techniques to enhance the reliability of your defense against an audit:

• Conduct Explicit Reasonableness Checks – If you know your annual volume is 20,000 patients, and your CPOE report is only reporting on 7,000, maybe you should dig a bit deeper into that report.  If your EHR is showing the same patient volume for metrics requiring “all patients” as for “EHR only” patients, then you should be prepared to show data as to why this should be so.  A skeptical auditor will probably estimate your patient volume from billing or census data, and compare that to your EHR records. 
• Maintain a Measures Checklist - In MUM, we show audit checklist reports summarizing all Measures. The checklist identifies the numerator / denominator and date range values, resulting percentage, (or Yes/No value as appropriate), and show whether a link exists to a PDF of an “audit proof” report. Prior to attestation, internal audit should review this checklist, verify each audit proof report, and make sure it shows the level of detail and proof you deem appropriate. We suggest presenting that signed checklist to the CFO (or other attesting officer), prior to attestation. In our checklist we have placeholders for certification “proof” as well. (i.e., a letter from your vendor, certifying that you have purchased from them all modules included in their certified software).
• PDF your reports – and store them in a dedicated, secure repository, with an explicit retention period of at least equal to the six years.  Tie each PDF to your Measures checklist, too. 
• Supplement Screen Prints – as be part of the documentation for those Measures with yes / no Attestation types (like those requiring you to show that a feature in your EHR is “turned on”).  But even with screen prints, we advise showing supplemental reports with patient level detail, showing that the functionality was in place throughout the reporting period. 
• Document Test results – for Measures requiring you to conduct a test of a given capability, store your test data, scripts, and the entities with which tests have been conducted.  Testing plans and associated results should be a part of your six-year Meaningful Use documentation repository. 
• Document your assumptions – the wording around some Measures leaves room for different interpretations of what specific clinical behaviors would be compliant.  Over time, these “grey areas” may be crystallized by CMS pronouncements.  Until that happens, we recommend that your documentation repository leave room for written interpretations, workflows or policies, associated with each individual measure. 

So ultimately, think like an auditor.  Auditors are trained to “professional skepticism”, and are motivated by finding shortfalls.  They will have work plans based on knowing where and how to look for discrepancies, whether you intended them or not.  Defending against their pre-planned approach should not wait until they ring your doorbell, but a well-constructed documentation defense should be done before attesting.  After all, CMS is developing an audit strategy … shouldn’t you?

Inpatient Self-Certification Trends

In light of GE Healthcare’s recent announcement of potential errors in their certified EHR’s reporting functions, it seems reasonable to expect that more hospitals will be re-evaluating their own EHR’s reports, and in some cases, self-certifying that capability. And we recently had an interesting question from one of our subscriber hospitals that just finished a broader self-certification initiative of their overall EHR technology inventory. This group didn’t build their own, but assembled best-of-breed tools from multiple vendors. By picking and choosing components, they satisfied clinical staff and managed costs, but were unable to take advantage of all the vendor-provided certifications. This forced them into “self” certifying a select number of modules to meet the requirement of using a “complete” certified EHR.

We wondered about how many other hospitals were seeking self-certification, and for what functionality. A little research into the CMS web site (http://onc-chpl.force.com/ehrcert) listing organizations that have certified EHR software, answered some of those questions. Here’s what we found (as of 11/05/11):

1. How Prevalent is Self-Certification?

Only 18 hospitals (or hospital systems) have completed any level of self-certification.

2. What Self-Certification Strategies are Hospitals devising?

Those 18 hospitals have certified 28 unique “product bundles”. Most are certifying “Modular” rather than “Complete” EHR functionality with only 5 of 18 pursuing Complete Certification. Of those 5, we know a couple personally. In several cases, hospitals have their own internally-developed custom EHR’s, but in others, self-certification comes from a strategy of purchasing best-of-breed components. In some of these cases, the hospital has purchased a subset of a Vendor’s certified product, and by purchasing less than the Vendor’s full suite, invalidates the Vendor’s certification.

3. What Functionality is being Self-Certified?

What we expected to see, was a preponderance of hospitals self-certifying reporting functions of Clinical Quality Measures, and Automated Measure Calculation. While there is certainly a significant amount of self-certification of reporting involved, almost every Measure is represented in hospitals seeking modular (partial) self-certification.

4. How Successful are Certification Efforts?

Of those achieving modular certification, some appear to be attempting certification as complete EHR, and accepting partial certification when some components don’t pass … then re-submitting for additional testing at a later date. Of course, we don’t see those who have attempted and failed, but some hospitals show multiple certified versions of the same product, with earlier products containing less certified functionality.

5. What is the ATCB mix (Which certifying bodies)?

16 by CCHIT, 9 by Drummond and 3 by InfoGuard. Percentage-wise, this is almost identical to the mix of ATCB's used by the vendor community. In other words, no single ATCB has emerged as the entity of choice for self-certification activities. CCHIT has two hospitals who appear to have been through multiple iterations to meet their certification goals, and Drummond has one. Based on this limited data, but it appears all ATCB's are equally rigorous. It might be interesting to get some anecdotal or other data to learn a bit more.

So, to summarize there's not been much self-certification yet, there is little "pattern" in what content is self-certified, and it is being done by about the same mix of ATCB's as what is being certified by vendors. If you are considering self-certification, and want to talk to someone who has done it, scan the CHPL site, looking for hospital names and give the CIO a call. There are not many!

Lessons Learned from a Small Ambulatory Practice's Attestation Success

The latest report from the HIT Policy Committee states that 2,246 eligible providers and 100 hospitals have attested to meeting Meaningful Use (MU) criteria. With thousands of dollars at stake, providers and hospitals that have invested in electronic health records (EHR) are trying to figure out the recipe for successfully attesting. 

 

To be fair, there's no silver bullet that can guarantee that you'll successfully attest to MU. However, picking up some tips for success from other physicians and practices that have attested can never hurt. Houston Neal, Director of Marketing at the Austin-based tech firm Software Advice, recently caught up with Dr. Kevin Spencer to find out how his Austin practice was able to attest. Dr. Spencer shared with three keys components that he thought were essential to attesting for Meaningful Use. According to Dr. Spencer, the keys to success were:

• Choosing the right EHR software company;
• Undergoing meaningful use training; and,
• Changing documentation processes to fit meaningful use guidelines.

To get more in-depth advice, check out the blog post summarizing Dr. Spencer's advice at: How to Attest to Meaningful Use (MU): 3 Tips from a Meaningful User.

Derek Singleton
ERP Analyst
Software Advice

CMS's Multiple Choice Quiz - If your Certified EHR generates an inaccurate result, are you liable?

I wish I could come up with the definitive answer to this question.  Inside our firm, and across our subscriber base, we engage in stimulating discussion on the topic.  Based on relevant CMS publications (appended to the end of this article) a reasonable person could come up with either of the following interpretations:

Interpretation 1: It will not be acceptable to rely on the fact you are using a certified EHR.  Accuracy is the responsibility of the provider, not the vendor.

Interpretation 2:  If the Certified EHR generates a number, CMS will deem the number to be accurate. 

Of course, those of us with products or services to sell will try to drive you to Interpretation 1.  That perspective points out that definitions of patient population for numerators and denominators has, in some cases been changed (or at least clarified) by CMS pronouncement after the issuance of NIST testing procedures for certifying EHR software.  And further, those test procedures do not explicitly provide an ATCB with the detail calculations of Meaningful Use Measures and  Quality Measures, under all assumptions and choices a provider might make (i.e., there are some instances of CPOE that should not be counted if entered by an individual inappropriate to the CMS regulations, or our hospital has chosen to count only Observation Services Patients).  Under this interpretation, prudence dictates at least a modest testing program against patient-level detail to validate the completeness and accuracy of each report. 

Under Interpretation 2, comes the reasonable assumption that CMS today relies on their testing processes to certify software.  And that for the next six years (period open for audit), that interpretation will be consistently applied. 

To provide some context for these interpretations, let's consider CPOE.  For Hospital A (or EP A), let's assume the certified EHR reports 32%, which is above the 30% threshold.  Further, CMS states that each provider must to evaluate on a case-by-case basis whether a given situation is entered according to state, local, and professional guidelines, allows for clinical judgment before the medication is given, and is the first time the order becomes part of the patient's medical record.  So one logical extension (relative to EHR reports,then) is that providers should also evaluate the reporting from their EHR as to compliance with the regulatory processes in their environment. 

So, rather than apply more of my interpretations, here's the CMS FAQ defining the issue.  This is also part of the statements you'll agree to during the registration and attestation processes.  Take a look, and share your thoughts ... which interpretation shall drive your efforts?

Published 04/22/2011 01:58 PM   |    Updated 04/26/2011 05:48 PM   |    Answer ID 10589

To what attestation statements must an eligible professional (EP), eligible hospital, or critical access hospital (CAH) agree in order to submit an attestation, successfully demonstrate meaningful use, and receive an incentive payment under the Medicare Electronic Health Record (EHR) Incentive Program?

Currently, the attestation process requires EPs, eligible hospitals, and CAHs to indicate that they agree with the following attestation statements:

• The information submitted for clinical quality measures (CQMs) was generated as output from an identified certified EHR technology.
• The information submitted is accurate to the knowledge and belief of the EP or the person submitting on behalf of the EP, eligible hospital, or CAH.
• The information submitted is accurate and complete for numerators, denominators, exclusions, and measures applicable to the EP, eligible hospital, or CAH.
• The information submitted includes information on all patients to whom the measure applies.

CMS considers information to be accurate and complete for CQMs insofar as it is identical to the output that was generated from certified EHR technology. Numerator, denominator, and exclusion information for CQMs must be reported directly from information generated by certified EHR technology. By agreeing to the above statements, the EP, eligible hospital, or CAH is attesting that the information for CQMs entered into the Registration and Attestation System is identical to the information generated from certified EHR technology.

CMS does not require EPs, eligible hospitals, or CAHs to provide any additional information beyond what is generated from certified EHR technology in order to satisfy the requirement for submitting CQM information.

Please note that quality performance results for CQMs are not being assessed at this time under the EHR Incentive Programs. Complete and accurate information for the remaining meaningful use core and menu set measures does not necessarily have to be entered directly from information generated by certified EHR technology. By definition, for each meaningful use objective with a percentage-based measure, certified EHR technology must include the capability to electronically record the numerator and denominator and generate a report including the numerator, denominator, and resulting percentage for these measures. However, with the exception of CQMs, meaningful use measures do not specify that this capability must be used to calculate the numerators and denominators. EPs, eligible hospitals, and CAHs can use a separate, uncertified system to calculate numerators and denominators and to generate reports on all measures of the core and menu set meaningful use objectives except CQMs.

In order to provide complete and accurate information for certain of these measures, they may also have to include information from paper-based patient records or from records maintained in uncertified EHR technology. By agreeing to the above statements, the EP, eligible hospital, or CAH is attesting to providing all of the information necessary from certified EHR technology, uncertified EHR technology, and/or paper-based records in order to render complete and accurate information for all meaningful use core and menu set measures except CQMs.

When is Certified Software not Really Certified?

Ownership of part of a Certified EHR might hurt you.  EHR's are certified by ATCB’s against a list of ONC-Generated certification criteria.  To become certified, a Vendor will submit a bundle of their own software to an ATCB for testing.  For some vendors, this “bundle” could be a single piece of software.  But more commonly, we find that vendors build and deploy their product by assembling modules from which a customer can pick and choose to compliment other products in the hospital (or EP) software inventory. 

If you are not careful, this practice might actually cause you to have to return your Stimulus Funds to CMS.  Ouch. 

Here’s how it happens

You’re buying an EHR from a vendor with a "complete" or "modular" Certified EHR Product.  As a good negotiator, you manage your costs by only purchasing the EHR Modules  you need.  Perhaps you already own Quality Reporting module, or plan on doing e-MAR next year.  So you save a lot of money by not purchasing capabilities that you won’t use yet. 

The problem is that when your new EHR vendor was certified, they included the modules you did not purchase in their testing bundle.  Since you own less than all of the components included in the Certification bundle, CMS will not recognize the validity of your product’s certification! 

You might not even be aware of this problem.  When you attest, you look up your vendor on the CMS Certified vendor site, get a certification number and include that in your attestation. 

A couple years later, a CMS auditor, reviewing your 2012 attestation, looks for documentation that you owned “certified EHR technology”, finds you short, and may take away your EHR Stimulus funding, along with penalties and interest. 

Here’s the quote from the ONC website addressing this issue:

“Stand-alone, separate components of a certified Complete EHR do not derive their own separate certified status based solely on the fact that they were included as part of the Complete EHR when it was tested and certified. The separate component(s) would no longer meet the definition of a Complete EHR, nor would it have independently demonstrated that it can still properly perform capabilities for which certification is required in the absence of the capabilities with which it was previously certified as part of the Complete EHR. Additionally, the separate component(s) would not satisfy the requirements of 45 CFR 170.450(c) related to the privacy and security testing and certification of EHR Modules.

This concept is similar to our treatment of integrated bundles of EHR Modules. We clarified in the Temporary Certification Program final rule (75 FR 36191) that EHR Modules, once certified as part of a bundle, would not each separately inherit a certification just because they were certified as part of a bundle.”  ONC Question [9-10-005-1]

 

Here’s your protection

Draft a letter to your EHR vendor, and the ATCB where they were tested.  Don’t ask your EHR salesperson – they may not be aware of these nuances in the ONC portion of the CMS regulations.  Ask for a written listing of the vendor’s listing of all modules, components and supporting software that were included in the specific ATCB testing bundle associated with the certification number you are expecting.  Save the vendor’s written response in your Attestation Audit Proof Documentation Library, and match it up with a copy of your contract, showing that you have all the components included in your attestation.  

Now, if your documentation shows that you own all the software necessary, you are in good shape.  If you find shortfalls, your options will include purchasing those shortfall items from your vendor, or considering self-certification of your own bundle, including your EHR vendor’s components. 

Where Certified EHR Reporting Falls Short

We all know that to be Certified, EHR vendors must provide reporting against Meaningful Use  Measures,   based on the Objective and Threshold specified in the Regulations. But when an ATCB tests for Certification, EHR vendors only need to show that they can calculate and display the numerator and denominator, and the date range against which these metrics are calculated.

In at least three areas, vendors must address additional capabilities ... or Hospital and Physician Information Technology staff will need to take up the slack.

Configuring Populations

CMS issues clarifications or elaborations via FAQ's regularly.  And sometimes, in the text of the Federal Register itself are nuances that need to get into your reports.  For example, most reports probably already exclude newborns from the calculation of Measures.  But in order to be sure, you should probably take a look at patient level detail. Similarly, under CPOE, CMS issued a series of FAQ's in November of 2010. These FAQ's defined guidelines on who would be permitted to actually enter the order, and represented clarifications beyond what existed in the Final Rule issued the prior July.  In this case, it seems prudent to validate whether your Certified EHR vendor reporting includes all CPOE orders, or filters based on the licensing status of the individual inputting medications.  There is a risk of "false positive" measurement here, depending on the interpretation position you care to defend, and your medication order clinical policies. And of course, each hospital (not relevant to EP's) must choose whether to include all ED patients in each measure, or Observation Services Patients only.  After that choice, check your MU reporting to make sure it is consistent with your choice. 

Patient-Level Detail

If your personal checking account statement only listed an account balance, might you want to see transactions validating it?  Same story with Meaningful Use.  Certification does not test for all the "transactions" making up the numerator and denominator of each measure.  Some ATCB testers will ask a vendor to change an underlying patient record, to see if the measure re-calculates, but the NIST testing procedures do not require an ATCB to verify that the measure is correct, based on all patients in the database.  Do you really care, since you have Certified Technology?

We think so.  On the CMS Attestation site, your CFO (or who ever is attesting to your Meaningful Use) is required to attest to the "Completeness and Accuracy" of all information.  One (likely) interpretation of this statement is that responding to an auditor with "it must be complete and accurate because the EHR is certified" ... might not be good enough. 

Yes / No Attestations

Some Measures require only a Yes / No Attestation (e.g., Clinical Decision Support Rule, or Generating Lists of Patients by Specific Conditions).  Certainly you will know if you have one turned on.  And you'll be sure to count something other than CPOE, right?  But a skittish Compliance Officer, or CFO might want to see the proof you'll show to an auditor.  Might be a good idea to have some supplimental reporting in your hip pocket on each of these. 

Is Your Security Management Process Comprehensive Enough for ARRA?

ARRA HITECH invokes the HIPAA Administrative Simplification Regulation 45 CFR Part 164.308(a)(1) as a requirement for protecting patient information.  Under this act, each covered entity must implement a security management process that includes policies and procedures to prevent, detect, contain, and correct security violations.  Specifically, the regulation stipulates that there must be a risk analysis, a risk management program, a sanction policy, and an information system activity review.  So how do you know that you are on the right track with your organization’s security management process?  There is some high level guidance in the regulation itself, but it generally does not provide the level of implementation assistance that would provide practical advice.  So for each of the areas of 164.308(a)(1), we have identified examples of what a risk assessor would be looking for to validate the appropriate level of compliance.  

(A) Risk Analysis:  A structured and formal review of IT security that includes IT security policies, physical security of data center, infrastructure security, application security, personal computing device security, portable device security, electronic transmission of data/PHI, disaster recovery planning, asset management, and vendor management.

(B) Risk Management Program:  A formal program, strategy, or plan to guide IT security activities that identifies risks and vulnerabilities, along with respective remediation plans.

(C) Sanction Policy:  A formal written policy regarding misuse of PHI, and the consequences of violations, which could include termination.

(D) Information System Activity Review:   Provide documented processes or procedures, along with evidence of the organization’s capability to examine audit logs or system usage databases that are detailed enough to know what level of system access a particular person has, and what data this person has accessed in a time range.

 If your organization can provide evidence of the use of best practices that address each of these major areas of focus, you should be compliant with the regulation. And now with ARRA HITECH, there is actually money at stake.   

Scott Owens, PMP, CBCP, HITRUST Practitioner,  is the Managing Director with BluTinuity LLC, a risk management focused consulting firm, and a guest blogger for Everything HITECH.  For more information, please see http://blutinuity.com. 

Must "Interoperability" be "Interactive" to qualify for Meaningful Use?

Meaningful Use Requirements exist for three or four specific interoperability topics, depending on whether you are a hospital or ambulatory practice. One good question we discuss regularly is around the concept of how "interactive" must these items be. ONC provided a response to one specific requirement (Submission to Immunization Registries), stating that batch transmission would qualify a provider:

The certification criterion at 45 CFR 302(k) does not specify, and is not intended to specify, when submissions should be made or the periodicity of the submissions. Consequently, submitting batch files to an immunization registry, provided that they are formatted according to one or both of the adopted standards, is not prohibited by this certification criterion and would be acceptable. (ONC FAQ 9-10-002-1)

Absent any specific quotations to the contrary, we're relying on this as directionally valid for other interoperability requirements, where appropriate (electronic syndromic surveillance, reportable lab results, capability to exchange key clinical information).  Seems reasonable, doesn't it?

Jay Fisher | @JayRFisher

Show me the Hidden Requirements in Meaningful Use!

Read the list of ARRA HITECH Requirements. You can find them most anywhere these days. And on the surface, they don’t look all that hard. In many cases, what you see is what you get … they are fairly straight forward. And we have good vendor software, certified to do all we ask of it.

But as we’ve worked with MUM Subscribers, we’ve uncovered some cases where extra work pops up … beyond what might be obvious. The last thing any of us want, is to get well into our reporting period, and find that we are not compliant because of some tiny oversight. So we thought that in this article, we would share a couple we’ve seen, and maybe some other folks will chime in with observations of their own.

1. Provide patients with an electronic copy of their health information upon request

Clear part: How hard can it be? Our EHR can do this several ways. We can e-mail a PDF, give a CD, populate Microsoft Health Vault, or give patients access to their own chart online.   Hidden Part: In order to measure compliance, someone has to log the fact that a patient asked for electronic data. Every time they do it. And then, someone needs to log whether we actually provided the data electronically.

 

2. Record and chart changes in vital signs

Clear part: Height, weight and blood pressure. Simple and clinically sound.   Hidden Part: In one of our subscriber ED’s, we found that height and weight didn’t often get tracked for patients with trauma, or true medical emergencies. In another case, a group of EP’s found that they typically don’t track blood pressure until age 3 … but the regulations state this needs doing for all patients age 2 and over.

 

3. Use CPOE for medication orders

Clear part: Everybody’s favorite. 30% of Medication orders must be done via CPOE. Easy to measure.   Hidden Part: CMS requires that the order must be physically entered by a licensed healthcare professional capable of reacting to any real-time alerts and modifying the order as a result. So your pharmacist, unit clerk or even nursing staff probably does not qualify. Gotta be the doc.

 

4. Record demographics

Clear part: I must be kidding, right? Date of birth, gender, preferred language and ethnicity. Simple registration system stuff. Oh … one more thing. Preliminary cause of death in the case of inpatient mortality.   Hidden Part: We found two hidden elements here. One, these data are not always transferred to the EHR from admissions or registration systems. And of course, if it is not in the EHR, it does not count. We also found that in the case of death, hospitalists in a couple of our hospitals simply recorded a code of “expired”. And cause of death often gets measured outside the hospital and never makes it to the chart. Watch your clinical practices here!

 

5. Use certified EHR technology to identify patient-specific education resources and provide those to the patient

Clear part: We do this all day long every day. Our library system for patient education is constantly up to date and discharge staff draws on it for every patient.   Hidden Part: Two hidden gems again. First, the EHR must be aware of the specific education content available. In a lot of our hospitals, this is done electronically, but in stand-alone systems not part of the EHR. When we get Certified EHR technology in place, now we are in the position of populating our EHR (or EHRs) with a list of educational content available, duplicating existing systems … or integrating the library and getting it certified. Ouch. Self Certification.   Second, is the tracking problem. Again. Someone has to log all the cases where patient-specific education materials were provider from EHR content.

 

6. Quality Reporting

Clear part: Certified EHR software does quality reporting, no problem.   Hidden Part: Not all the data to generate these reports always gets into the EHR. Several reports require time and date medications were administered to patients, compared against time and date of procedures, admission or discharge. The hidden requirement here may be electronic Medication Administration capabilities, since manual medication administration data into the EHR as a matter of course may be too much work.   VTE reporting sometimes requires the reason a medication was not administered, which may not make it into your EHR on a regular basis.

 

So, this is half dozen places with hidden requirements. We’re aware of a couple others, and there are certainly some we don’t yet track. Watch for an upcoming article on “Why your Certified Software Might not be as Certified as you thought”, for an example of another hidden requirement. This highlights the importance of having someone on staff with deep knowledge of all of ARRA, keeping an eye on the ball.

 

Let us know what else you see!

What reporting period for Meaningful Use Clinical Quality Measures?

This has been an interesting question in my mind for a while now. CMS has been consistent in referencing back to the published technology specs in the HITSP Guide (HITSP Quality Measures Technical Note ED, VTE, and Stroke Examples for Implementation of the HITSP Quality Interoperability Specification) for Inpatient and a series of NQF specifications for Ambulatory.  Those specifications include requirements for the period over which the CQM is to be calculated, and in most cases that period is a full year.  Oops.  If our EHR Reporting period gives us a break in the first year, and we are only required to attest to Meaningful Use for 90 days, what about CQM’s?   

Well, we can rest easy.  The short answer is that CQM’s should be calculated and reported on over the same 90 day period as the balance of our Meaningful Use calculations.  Here’s the quote from the Federal Register from July 2010, Page 44421, Column 1:

 “We also proposed that to demonstrate an eligible hospital or CAH is a meaningful EHR user, the eligible hospital or CAH would be required to electronically submit information on each clinical quality measures for each patient to whom the clinical quality measure applies, regardless of payer, discharged from the hospital during the EHR reporting period and for whom the clinical quality measure is applicable.” 

If this is not clear enough, I also found a quote on the CMS site for Quality Measures Electronic Specifications elaborating that position. 

 "Reporting Period: The reporting period for the EHR Incentive program using a certified EHR is any continuous 90 day period during the first payment year. Please note that although the measure specifications assume a full calendar year you should only calculate the denominator and numerator from the first day of the 90 day reporting period to the last day of the 90 day reporting period."

http://www.cms.gov/QualityMeasures/03_ElectronicSpecifications.asp#TopOfPage

So now I’m feeling better about those CQM’s. They are sufficiently risky and complex that matching reporting period with ARRA reporting period should take some risk off the table.  Don’t get overly complacent, though.  CMS still expects the results to be “complete and accurate” over your 90 day period.  Here’s the quote taken from the same Federal Register as above, on page 44381:

"we  proposed to require … eligible hospitals use certified EHR technology to capture the data elements and calculate the results for certain clinical quality measures.  …  We also proposed to require that Medicare EPs, eligible hospitals, and CAHs attest to the accuracy and completeness of the numerators and denominators for each of the applicable measures.  Finally…we proposed that EPs, eligible hospitals, and CAHs demonstrate their use of certified EHR technology to capture the data elements and calculate the results for the applicable clinical quality measures by reporting the results to us for all applicable patients. "

So it is still more than just a checkbox.  We have to create CQM’s as if we were to be submitting them “for real”, just against a shorter period, which should help those of us getting new data into our EHR’s for the first time.  Don’t forget the potential of a CMS auditor on your doorstep one day, asking to prove your attestation! 

Jay Fisher | @JayRFisher

CMS view of "Trust, but Verify" = "Attest but Audit"

We have been advising our readers for a while to expect CMS audits. We've even offered some advice on how to do that, within our Meaningful Use Monitoring tools (attend one of the webinars listed on this site to see how). 

But not many other writers have stepped up to the same perspective yet.  Yesterday, I saw an article from a consultant and blogger who we respect, Jim Tate on this topic.  I would encourage you to take a peek at it on HITECH Answers.  Their site offers a number of interesting free services to EP's and EH's that are worth keeping an eye on as well. 

Jim's advice is even stronger than ours, regarding diligence before attestation.  In fact, he regards lack of such diligence as outright fraud - which is the perspective we fear CMS may take as well. 

Jay Fisher | @JayRFisher 

Comparison of ONC's ATCB organizations for EHR Certification

With the passage of the HITECH Act in 2009, the phrase “meaningful use,” took on a much greater importance for physicians in the US. The ONC Authorized Testing and Certification Body (ONC-ATCB) program was thus created to certify that electronic health record (EHR) software was capable of meeting meaningful use requirements and allow physicians using it to be eligible for government incentives.

So who are the ONC-ATCBs, the groups that certify these EHR software applications? There are currently six groups that are authorized to certify EHRs, and certification from one group means the same as any other’s. So what differentiates the six ONC-ATCBs?

Who are the Six ONC-ATCBs?
The six groups currently authorized to certify EHRs are: Drummond Group, CCHIT, InfoGard, ICSA Labs, SLI Global Solutions, and Surescripts.  All groups will go through similar procedures with EHRs that wish to be certified, including:

(1) Reviewing the EHR application

(2) Pre-testing support

(3) Testing (live and via remote conferencing)

(4) Results reviewed by an internal panel

The ONC-ATCBs must follow the guidelines presented by the NIST, but they are allowed the freedom to present the test guidelines to the EHR vendors as they wish.  This is one of the differentiators that EHR vendors should look into when selecting an ONC-ATCB.

The Six ONC-ATCBs Don’t Cost the Same
Another important differentiating factor between the six groups is the pricing of their services. For reference, the general pricing structure of four of the six groups is listed below:

CCHIT: $34,300 for ambulatory certification, and $32,550 for inpatient certification. Modules are about $7,000 plus $650 to $2,000 based on complexity,

Drumond Group: $19,500 for ambulatory and inpatient certification. Module pricing ranges from $1,000 to $6,000 per module (larger discounts for multiple module testing).

InfoGard: $19,900 for ambulatory certification, and $19,400 for inpatient certification. Module pricing for privacy and security modules plus one additional module is about $5,000.

SLI Global Solutions: $20,000 for ambulatory and inpatient certification. Module pricing ranges $1,000 to $6,000 per module (larger discounts for multiple module testing).

ONC-ATCBs Come From Different Software Testing Backgrounds
The six bodies that certify EHRs come from different backgrounds in software testing. The Drummond Group, for example, has a background in testing software in other fields, and has transitioned to medical electronic health record software. CCHIT, on the other hand, has been testing EHRs for over six years. ICSA Labs has experience testing mostly IT security software, and InfoGard has a similar background—being the first computer security testing group accredited by the NVLAP. SLI Global also has a number of years experience testing software. Surescrips, on the other hand, is the leading ePrescribing network in the US, and has been authorized to test and certify e-prescribing modules.

This guest post is provided by Software Advice, which provides reviews and comparisons of electronic medical record (EMR) software. You can view their website here. For more information on the ONC-ATCBs and the certification process, check out this article: Uncovering the ONC-ATCBs: What’s the Difference?

Michael Koploy, Software Advice

 

CMS Increases Cost of EHR Technology?

Well, here's an interesting observation.  Not particularly decision-quality, but intriguing nonetheless.  I was researching a the Final Rule /Federal Register on a question for one of our subscribers, when I came across the following quote (Federal Register / Vol 75, No 144, July 28, 2010, page 4492, column 1):

"Specifically, since the ONC is establishing new certification criteria for EHR technology, we believe the average cost of certified EHR technology incorporating the new criteria will be higher than the current costs of EHR technology. It is our assumption that making improvements to incorporate the new certification standards into current EHR technology will be costly."

So the cost of the government program alone increases the cost of technology we will be using in our hospitals and physician offices.  If you didn't have sufficient incentive to apply for incentives before ...

I wonder if anyone has actually observed this.

Jay Fisher | @JayRFisher

EP Stimulus Payment Calculations: Is there a minimum amount Medicaid EP’s must pay to receive incentives?

And, must they have paid the full amount in order to qualify for Adopting, Implementing and Upgrading in an initial year?

This should be a simple question, but requires quite a bit of research into the Final Rule and FAQ site to derive an answer.  Here are the sources, followed by our conclusion.  We derive several points en route, in the following extracts. 

1.  Incentive payments are not intended as direct reimbursement for purchase of technology

Source: Federal Register / Vol. 75, No. 144 / Wednesday, July 28, 2010 / Rules and Regulations Page 44482 (Near bottom of column 2)

Section 1903(a)(3)(F)(i) of the Act, as amended by section 4201 of the HITECH Act, establishes 100 percent FFP to States for providing incentive payments to eligible Medicaid providers (described in section 1903(t)(2) of the Act) to adopt, implement, upgrade, and meaningfully use certified EHR technology. The incentive payments are not direct reimbursement for the purchase and acquisition of such technology, but rather are intended to serve as incentives for EPs and eligible hospitals to adopt and meaningfully use certified EHR technology. 

2.  Payment basis is “Net Average Allowable Cost”

Average allowable cost is determined by CMS via literature study to aid in setting their reimbursement ceilings, not the cost a provider will actually bear.  (Note the word “average” throughout the regulation, implying aggregation over a population.)

 Source: Federal Register /Vol. 75, No. 144 /Wednesday, July 28, 2010 /Rules and Regulations Page 44491 (Column 3) 

Payment Methodology for EPs  - General Overview Pursuant to section 1903(t)(1)(A) of the Act, payment for EPs equals 85 percent of ‘‘net average allowable costs.’’ While the Secretary is directed to determine ‘‘average allowable costs’’ based upon studies of the average costs of both purchasing and using EHR technology, the net average allowable costs that set payment are capped by statute. As discussed in more detail further on, generally stated, these caps equal $25,000 in the first year, and $10,000 for each of 5 subsequent years (there is an exception for pediatricians with under 30 percent Medicaid patient volume, whose caps are two-thirds of these amounts). Thus, the maximum incentive payment an EP could receive from Medicaid equals 85 percent of $75,000, or $63,750, over a period of 6 years.

3.  Individual  providers may need to adjust “Average Allowable Cost” by any payments they have received (from anyone other than state or local government) to reimburse their EHR purchase

Source: Federal Register /Vol. 75, No. 144 /Wednesday, July 28, 2010 /Rules and Regulations Pages 44492 (column 3) & 44493 (column 1)

Comment: Several commenters are concerned that States are required to develop a method to determine the payment amount for each provider. Commenters believed that incentive payments should be based on the maximum amount and that individual calculations are cumbersome and a difficult process for both States and eligible professionals.

Response: We would like to clarify the requirements in the statute and the process by which incentive payments will be established. Specifically, the Secretary is directed to study the average costs associated with the purchase, initial implementation, and upgrade of certified EHR technology, including support services, and integral related training. The Secretary is also directed to study the average costs of operating, maintaining, and using certified EHR technology. The statute permits the Secretary to use studies submitted by the States. CMS conducted a literature review of recent studies on EHR technology to determine the average allowable cost of implementing and using such technology. CMS reviewed the results from four recent, comprehensive studies and determined that these costs are $54,000 per professional. We recognize that this cost is variable and since the ONC is establishing certification criteria for EHR technology, we believe this cost is reasonable since we expect that current EHR technology will need to be upgraded in order to meet the new certification criteria.

Next, in accordance with the statute, in order to determine the net average allowable costs for each provider, average allowable costs for each provider must be adjusted in order to subtract any payment that is made to Medicaid eligible professionals and is directly attributable to payment for certified EHR technology or support services of such technology. The only exception to this requirement, as discussed above, is that payments from State, or local governments do not reduce the average allowable costs. The resulting figure is the net average allowable costs.

4.  After arriving at Net Average Allowable Cost, EP’s are responsible for 15% of the balance

Source: Federal Register /Vol. 75, No. 144 /Wednesday, July 28, 2010 /Rules and Regulations Pages 44492 44493 (column 1 continuation from above)

The statute further indicates that Medicaid eligible professionals can receive up to 85 percent of a maximum of the net average allowable cost. In year one the maximum net average allowable cost is $25,000 and in subsequent years is $10,000. Additionally, the statute indicates that Medicaid eligible professionals are responsible for the remaining 15 percent of the net average allowable cost (1903(t)(6)(B)).

We believe the commenters are concerned with the 85 percent of net average allowable cost maximum incentive payment amount and the responsibility of the Medicaid professional for the remaining 15 percent of the net average allowable cost. Since the statute is clear that to get to the net average allowable cost, payments made to the EP that are directly attributable to the payment for certified EHR technology or support services for such technology for each provider have to be subtracted from the average allowable cost, this must be an individual provider calculation. We do not believe we have discretion to change this netting process directed by the Congress. We have provided an example calculation so that in using the average allowable cost established by the Secretary of $54,000 professionals could receive as much as $29,000 in payments from outside sources and still receive 85 percent of the maximum capped net average allowable cost of $25,000.

5.  CMS has deferred to the States for a filing and audit process by which EP’s must verify the receipt of third party reimbursement, and verifying that EP’s have paid 15% of the statutory annual amounts

Note that this section also of the regulations identifies relevant types of reimbursement providers might receive from third parties.  See columns 2 & 3 of the cited Federal register for specific examples

Source: Federal Register /Vol. 75, No. 144 /Wednesday, July 28, 2010 /Rules and Regulations Page 44493 (column 1 & 2)

We have also required that States must have a process in place and a methodology for verifying that payment incentives are not paid at amounts higher than 85 percent of the net average allowable cost and a process in place and a methodology for verifying that professionals pay 15 percent of the net average allowable cost of the certified EHR technology. States may wish to establish a process whereby individuals attest to having completed their forms correctly and risk the circumstance of audit in the event the State has reason to believe individuals did not complete the forms appropriately. States could develop a process for providers to attest to having received no other sources of funding from other than State and local governments as payment that is directly attributable to the cost of the technology. States could select a random sample of providers to audit after the incentive payment has been paid. Additionally, States could determine that certain types of providers should be selected for a more extensive review since it may be true that this particular provider group was most likely to have received payment for certified EHR technology from sources other than State, or local governments. This process could eliminate some of the burden.

6.  Bottom line for Year 1: EP’s should expect to be required to prove that they spent $3,750 and received no more than $29,000 from other sources to help defray these costs. 

The $29,000 would need to come from sources other than the clinic in which they are employed, or state / local government.  Also, CMS directs states to consider a wide range of related costs in determining this expenditure by EP’s. 

Source: Federal Register / Vol. 75, No. 144 / Wednesday, July 28, 2010 / Rules and Regulations Page 44494 (Top of Page)

In those cases in which the professional himself must satisfy the responsibility for the 15 percent net average allowable costs, we believe in determining the calculation, States should consider costs  related to the providers’ efforts to address workflow redesign and training to facilitate meaningful use of EHRs as contributing to the providers’ 15 percent share. Considering the costs of training, preparing for, and installing or upgrading EHR technology, we believe the vast majority of EPs will spend, or receive funding from other sources in the amount of 15 percent of the maximum net average allowable cost (or $3,750 in the first year and $1,500 in subsequent years). We also believe that for providers’ first payment for having adopted, implemented or upgraded certified EHR technology, States should take into consideration providers’ verifiable contributions up through the date of attestation. For example, if a provider adopted EHR technology for $100 in January 2010 and then paid for the upgrade to the newly certified version for an additional $100 in December of 2010, the sum of both investments; that is, $200, should be applicable to their 15 percent of the net average allowable cost.

7.  To qualify for Adopting, Implementing and Upgrading, a signed contract will be sufficient

Source: CMS FAQ # 10100 updated 3/24/11

States should make clear to providers when they attest for AIU what documentation they must maintain, and for how long, in case of audit. If States determine that certain provider types are a high risk for potential fraud/abuse for AIU, then they can ask for some verification of adopting, implementation or upgrading but CMS encourages that this be done in a targeted manner, with the most electronic and simple means possible and not in such a way that would be burdensome to providers. For AIU, a provider does not have to have installed certified EHR technology. The definition of AIU in 42 CFR 495.302 allows the provider to demonstrate AIU through any of the following: (a) acquiring, purchasing or securing access to certified EHR technology; (b) installing or commencing utilization of certified EHR technology capable of meeting meaningful use requirements; or (c) expanding the available functionality of certified EHR technology capable of meeting meaningful use requirements at the practice site, including staffing, maintenance, and training, or upgrade from existing EHR technology to certified EHR technology per the EHR certification criteria published by the Office of the National Coordinator of Health Information Technology (ONC). Thus, a signed contract indicating that the provider has adopted or upgraded would be sufficient.

* * * * * * * * * * * * * * * *

Long story made short, EP’s will generally qualify for the full EHR Stimulus funds, as long as they have spent $3,750 of their own money in year 1, and $1,275 in subsequent years. 

Jay Fisher | @JayRFisher

Verify Your Certified Software?

How does Regulatory Compliance map against Clinical Practices Comliance? 

As providers move towards tracking their Meaningful Use Progress, we are starting to see instances where Certified Software does not fulfill all the needs of regulatory compliance.  Actually, it is pretty impressive the degree to which the vendor world has responded to Meaningful Use.  Vendors who have been around for years, building in clinically sound EHR capabililties have had precious little time (in software development terms) to add in Regulatory Tracking functionality. 

Let's face it.  Little (maybe even nothing) in Meaningful Use Regulations creates clinically usable or necessary functionality that the vendors didn't already envision and have in their software.  ARRA didn't create the concept of CPOE, Quality Reporting, Problem List Tracking, or any measure Hospitals or Ambulatory docs are required to track for EHR Stimulus.  But what ARRA does in many cases, is add functionality that is necessary to track ARRA.  Here's a couple examples:

Emergency Department Software: A couple of our hospitals use a certified EHR by a long-time vendor providing successful ED software.  This particular product tracks lab results as structured data for all patients for which the ED receives results.  Of course the results are often delivered a couple days after the patient has left the ED.  Because the volume of these reports is quite high, and the clinical need to retain the specific results is low, the system automatically purges unreferenced data after 30 days retention.  Clinically valid.  ARRA Oops.  (ARRA requires a 90 day reporting period, during which hospitals must aattest to having this data for 40% of all EHR Patients).  Note that the EHR in question is certified, since the test did not "stress" for volume.  Here's a case where a hospital could attest to a requirement, but a subsequent by-the-book auditor could feasibly find the hospital non-compliant.

Tracking patient requests: Two specific measures require that providers give patients electronic copies of EHR data upon request.  One of our hospitals is using certified EHR which does a nice job of selecting out data and providing electronic versions in a couple formats for patients.  But this particular (certified) software product lacks the capability to log those requests from patients!  The measures state that for 50% of the patients who request it, the provider must generate electronic results. Oops again.  Now, this is a first-class vendor, and it is a good bet that they will provide tools to their customers pretty soon.  But until then, users will have to come up with a sub-system to track these requests, and satisfactory responses.  On the other hand, we don't think this kind of request is likely to generate much volume in the near future ...

So here's the point.  ARRA creates the need for vendors to incorporate into their software functionality that is not clinically necessary, but is required for administration of the ARRA program.  And this is the arena where well-intentioned providers might stub their toes without even knowing it.  It seems prudent that providers have a process, and maybe even some third party tools, to help keep track of each individual requirement, and the results of your progress against not only clinical, but also regulatory compliance. 

Jay Fisher |@JayRFisher

Caveat Emptor! Certified EHR might fall short on Reporting

Your Certified EHR will do everything you need, right?  And if it does not, it is the vendor's issue, right? 

Kind of. 

Here's an interesting extract from the criterion by which EHR software is certified for the process of Automated measure calculation (170.302 (n)). The regulations state that this criterion requires 

"For each meaningful use objective with a percentage-based measure, electronically record the numerator and denominator and generate a report including the numerator, denominator, and resulting percentage associated with each applicable meaningful use measure."

Clear enough.  But look at the detail instructions for actually validating that this occurs, and you may be surprised by the minimum requirement:

The Vendor provides the test data for this test procedure.

This test procedure is organized into two sections:

- Record - evaluates the capability to electronically record the numerator and denominator for each meaning use objective with a percentage-based measure
   o If the Vendor indicates that the EHR automatically records the numerator and denominator
for the measure, the Tester proceeds to the Generate Report step below.
   o If the Vendor indicates that the EHR does not automatically record the numerator and/or
denominator, the Tester uses Vendor-identified functions and Vendor-supplied
numerator/denominator values to enter numerator/denominator information into the EHR.

- Generate Report - evaluates the capability to generate a report that includes the numerator,
denominator, and resulting percentage associated with each percentage-based meaningful use
measure
   o The Tester generates a report that includes the numerator, denominator, and resulting
percentage associated with each percentage-based meaningful use measure
   o The Tester validates that the report is generated and is accurate and complete based on
Vendor-supplied data 

Ok let's read between the lines here.  First, the vendor is only required to calcualte and display the numerator, denominator and any associated percentage.  They are not required to provide any detail reporting to support or prove this percentage.  Prudent vendors probably will but certification is not a guarantee. 

Secondly, if the vendor's software does not automatically calcualte the numerator and denominator, they can still pass the test!  All they need do, is have the ability to enter the numerator and denominator into their system, and from there calculate a percentage. 

We derive two action items from this set of observations. 

1. Quickly figure out how your vendor's software works
2. Quickly find the reporting in your vendor's software that shows the details associated with each measure.  If the report does not exist (and it is not required to exist), they you might want to get your Business Intelligence Team on it. 

Jay Fisher | @JayRFisher

 

Guidelines for Attestation with Multiple EHR Technologies

We were chatting recently with a tester from one of the  ATCB's who issue EHR software certifications on behalf of CMS.  As you know, the first step towards compliance with the ARRA laws enabling hospitals to receive EHR stimulus funds is in actually owning certified EHR software.  Our friend there has been involved in testing EHR's for the purpose of "self-certification".  Self certification becomes a necessity more often than you might imagine ... but that's a topic for a different day. 

At this particular ATCB, we heard that a majority of the hospitals presenting themselves for self certification were doing based on a combination of multiple EHR technologies.  What an intriguing set of pragmatic issues this raises!  Let's explore a few, with some ideas on solutions. 

1. Roll up of Measures - You'll need some way in which to aggregate numerator, denominator and the resulting percentage across multiple EHR's, when it comes time to attest. 
2. Aggregation of "Audit Proof" - as we've discussed elsewhere, attestation is probably a lot easier than providing detail documentation acceptable to a skeptical CMS auditor, who can show up on your doorstep for up to 6 years after attestation.  Depending on CMS' perception of program performance, these auditors may be inclined to merely check that your technology can calculate a percentage - or may be inclined to evaluate detailed lists of unique patients under the circumstances of each unique MU measure.   Risk-adverse organizations will probably create reporting across multiple EHR's to pull the requisite details, with a track-back to the specific EHR in which patients are maintained. 
3. Yes/No Attestations - Counting Core and Menu items, there are 9 measures for which you can attest by merely saying "yes" or "no".  The conservative approach is to make sure that for each of these measures, you should be prepared to defend a "yes" attestation across all EHR's in your inventory.
4. Denominator for Measures that count "All Patients Maintained in Certified EHR technology" - similar to Yes/No attestations, it seems prudent (under a conservative approach) to account for all unique patients across all EHR's rather than just a single core product. 
5. Denominator for Measures that count "All patients", regardless of whether they are maintained in Certified EHR - Patients in your OB ward whose records never make it to the core inpatient EHR system probably are one example - particularly if they are maintained in a standalone EHR that has not been certified.  When calculating this type of measure, and there are several, make sure you isloate these "non-certified EHR" patients and count them appropriately, as you conduct your measure rollups for hospital-wide attestation and audit proof. 
6. EHR Certification Number - This one stumped me at first, but there is a simple answer.  When a provider signs up to attest to Meaningful Use, the attestation site asks if you have a certified EHR.  And it provides a field in which you report yours.  But there is only one field!  Here's how it works.  On the Certified EHR Product List (CHPL) website at http://onc-chpl.force.com/ehrcert ... Select the first EHR in your inventory, and add it to your shopping cart.  Find each of the other certified products, and add them as well. When you check out, CMS will aggregate these products together and give you a single, aggregated certification number usable in your Attestation.  If you've self certified one or more products, they will be on the CHPL site as well, and will simply be one of the selections you make.  

I'll bet there are other practicalites we've not investigated here.  Share your thoughts, and between us, we'll come up with a comprehensive point of view! 

Jay Fisher | @JayRFisher

 

 

Need to register a large number of EP’s for the Medicare or Medicaid EHR Incentive Program in the near future? Better get started – each EP has to register him/herself

At this time there is no method available for a third party to register multiple eligible professionals for the Medicare and Medicaid EHR Incentive Programs. Beginning in May 2011, CMS plans to implement functionality that will allow an eligible professional to designate a third party to register and attest on his or her behalf. Detailed information about that process will be issued when it is available. States will not necessarily offer the same functionality. Eligible professionals should contact their state to see if there is additional information they will need to provide.

Please be aware that eligible professionals currently are not permitted to allow a practice manager or any other person to register in their place. Sharing your National Plan and Provider Enumeration System (NPPES) user ID and password with third parties can place your information at risk. Until CMS implements new functionality in May 2011, each EP should register himself or herself separately for the Medicare and Medicaid EHR Incentive Programs.

 

So – do you need to register hundred(s) of EP’s before May, 2011?  You’ll need some process to ensure that each EP correctly does the registration.  For now, no third party registration is allowed. Let’s hope that the new functionality planned in May 2011 will ease this burden. 

 

Thanks to HIMSS for this update.

 Brian Younger, C3 Partners

How Should Providers React to Potential Repeal of HITECH Funding ?

A new bill before Congress known as H.R. 408, the Spending Reduction Act of 2011 targets reduction or elimination of ARRA HITECH EHR Stimulus funds.  While there are enough Republican votes in the House to pass the bill there, the Senate still lacks Republican majority.  And even if both houses were to pass this bill, a presidential veto seems likely. 

The next question would be whether sufficient votes could be garnered to override and Obama veto.  Given current Congressional makeup, this seems very unlikely. 

So, while this will be an interesting activity to watch, it still seems prudent for providers to stay the course on ARRA HITECH activity.  Since passage seems unlikely until after 2012 elections (at the earliest), funding will be available until then at least.  In fact, moving quickly to qualify and receive funds is probably the most responsible fiscal  action. 

What do you think?

Hospital Stimulus Eligibility Simplified

We’ve received a number of questions lately along the thread of “is my hospital eligible for Stimulus Payments”, with the corollary of “is my hospital subject to penalty for non-compliance”.  As we read the rule, it appears that Medicare and Medicaid have slightly differing rules for inclusion.  In brief, Medicare covered hospitals are Subsection (d) hospitals covered under Prospective Payment, and specifically excludes some classes of hospitals (see table below).  Medicaid Hospitals must fall within a specific range of CCN’s, and specifically include some classes of hospitals.  Here’s how we read it:

Hospital Type	Program Eligibility
	Medicare	Medicaid
Critical Access Hospitals	Yes	Yes
Rehabilitation hospitals	No	No
Cancer hospitals (11 specifically identified)	No	Yes
Psychiatric hospitals	No	No
Children’s hospitals	No	Yes

 

Note that since there are penalties only under Medicare.  If your institution is ineligible for stimulus funds under Medicare, the good news is that you can’t be penalized under Medicare, either! 

Here are the underlying references from the Federal Register containing Final Rule:

Medicare eligibility

 

Section 1886(n) of the Act, as amended by section 4102(a)(1) of the HITECH Act, provides for incentive payments, beginning in FY 2011 (that is, October 1, 2010 through September 30, 2011) for eligible hospitals that are meaningful users of certified EHR technology during the EHR reporting period for the payment year.  In the proposed rule, we proposed a new §495.104 to implement this provision.

 

As we noted in the proposed rule, section 1886(n)(6)(B) of the Act defines "eligible hospitals" for purposes of  the incentive payments provision, as "subsection (d) hospitals," referring to the definition of that term in section 1886(d)(1)(B) of the Act.  Section 1886(d)(1)(B) of the Act generally defines a "subsection (d) hospital" as a "hospital located in one of the fifty States or the District of Columbia." Federal Register Page 44448, column 1&2

 

  The statutory definition of a subsection (d) hospital also does not apply to hospitals and hospital units excluded from the IPPS under section 1886(d)(1)(B) of the Act, such as psychiatric, rehabilitation, long term care, children's, and cancer hospitals.  We also proposed that, for purposes of this provision, we would provide incentive payments to hospitals as they are distinguished by provider number in hospital cost reports.  We proposed that incentive payments for eligible hospitals would be calculated based on the provider number used for cost reporting purposes, which is the CMS Certification Number (CCN) of the main provider (also referred to as OSCAR number).  Payments to eligible hospitals are made to each provider of record.  The criteria for being a meaningful EHR user, and the manner for demonstrating meaningful use, are discussed in section B.2. of this final rule… Response: We appreciate the

commenters’ concerns, but we continue to believe that our proposal represents the best policy approach in determining what constitutes an ‘‘eligible hospital.’’  Federal Register Page 44448, column 2 through Federal Register Page 44449, column 1

 

Medicaid Eligibility

For purposes of Medicaid incentive payments, we proposed to define an “acute care hospital” as a health care facility where the average length of patient stay is 25 days or fewer and with a CCN that has the last four digits in the series 0001 through 0879 (that is, short-term general hospitals and the 11 cancer hospitals in the United States).

 

We excluded from this proposed definition a category of long-term care hospitals, which are defined for Medicare purposes in regulations at §412.23(e).  Specifically §412.23(e)(2)(i) states that the hospital must have an average Medicare inpatient length of stay of greater than 25 days (which includes all covered and non-covered days of stay of Medicare patients).  …

 

Therefore, in the final rule, we are amending the definition of acute care hospital for purposes of the Medicaid EHR incentive payment program as "those hospitals with an average patient length of stay of 25 days or fewer, and with a CCN that falls in the range 0001-0879 or 1300-1399."  This definition will now encompass general short-term hospitals, cancer hospitals, and critical access hospitals that meet the Medicaid patient volume criteria.  Federal Register, Page 44484, Column 1

Medicare Advantage "Informational Only Claims" May benefit your HITECH Case

PPS hospitals have been instructed for the last several years to submit informational only claims to the Medicare program.  Informational only claims (shadow billing) are billed for patients enrolled in a Medicare Advantage Plan and include:

 

• Covered 11X type of bill
• Condition code 04
• Beneficiary’s medicare HICN
• All other required claim elements

 

Effective October 1, 2010, critical access hospitals should submit informational only claims.  The reason that you may want to do so is because the number of Medicare C days billed will go into the calculation of your payment to be received as a meaningful user of certified electronic health records.  If you have not submitted the informational only claims to the Medicare program, you will not be able to use the related Medicare C days in your calculation of reimbursement for electronic medical records.  The information for these claims will print out on a separate PS&R report page and included on the cost report in 2011.

 

If you opt to skip submitting the informational only claims, please be aware that you may receive less than originally anticipated when requesting payment from the government as a meaningful user of certified electronic health records. 

For further information, contact:

Donna Nelson, CPA  |  Manager  |Wipfli  | 715.858.6663  |  DNelson@WIPFLI.com

What is a Licensed Healthcare Professional (for CPOE!)

The final rule states that any licensed professional can qualify for CPOE order entry.  However, there is little guidance as to definition of “licensed professional”.  In our research we found two relevant citations, as follows:

Use CPOE for orders (any type) directly entered by the authorizing provider (for example, MD, DO, RN, PA, NP).

Page 73, Final Rule Draft

We agree with those commenters who recommend allowing any licensed healthcare professional to enter orders using CPOE.  We further refine this recommendation to be that any licensed healthcare professional can enter orders into the medical record per state, local and professional guidelines. 

Page 75, Final Rule Draft

So it appears that MD, DO, RN, PA and NP are valid, as well as any others defined per state, local or professional guidelines, although the regulation is somewhat silent on what specific guidelines may be applicable. 

A further clarification can be found in a FAQ on the CMS website, stating that the individual qualifying for CPOE must be able to exercise clinical judgement, and make a decision before the order is executed.  According to one of our hospital colleagues, this will probably take pharmacists out of play in qualifying as CPOE orderers (for Stimulus purposes, anyway).  Here's the CMS link: https://questions.cms.hhs.gov/app/answers/detail/a_id/10134/~/%5Behr-incentive-program%5D-who-can-enter-medication-orders-in-order-to-meet-the

Make sure your EHR's detail "audit proof" reporting includes an identification of who entered the order! 

How Should Newborns be included in Inpatient Counts for Meaningful Use Measures?

Including or excluding newborn infants in generalized numerator and denominator statistics could make a difference between pass and fail  in some requirements for many hospitals.  The Final Rule addresses this, by generally excluding newborns from such counts.  Be sure and adjust your reporting metrics based on excluding newborns!  The one exception appears to be that newborns should be included in ICU counts, in denominator and where appropriate, in numerator calculations. 

 In excluding nursery days from the count of Medicare inpatient bed days, we are following the precedent of not counting such days for purposes of the direct medical education, indirect medical education, and disproportionate share adjustments under the Medicare IPPS.  As in the case of the term "subsection (d)" hospital, we believe that, in the absence of clear direction from the statute to the contrary, the most appropriate policy is to interpret terms such as "inpatient bed-days" in the light of existing Medicare program policies and precedents. 

 

Under our policies for the direct medical education, indirect medical education and disproportionate share adjustments, a bed must be permanently maintained for lodging inpatients in order to be included in available inpatient bed and inpatient bed day counts.  We exclude the days provided to newborns (except for those in intensive care units of the hospital) because healthy new born infants are not provided with an acute level of hospital care.  (This is not the case with newborns assigned to intensive care units, who are included in the counts for those units.) For these reasons, nursery days are explicitly excluded from:

 

• The counts of Medicare inpatient hospital days and total inpatient hospital days for purposes of direct graduate medical education payments under section 413.75(b) of the regulations, where the definition of Medicare patient load reads: "inpatient days in any distinct part of the hospital are included and nursery days are excluded."
• The counts of bed days for purposes of the Medicare indirect graduate medical education adjustment under section 412.105(b): the "count of available bed days excludes bed days associated with… (5) Beds or bassinets in the healthy newborn nursery…."
• The count of beds for purposes of the Medicare DSH adjustment under section412.106(a)(i) of the regulations: "The number of beds in a hospital is determined in accordance with §412.105(b)."

We note that, in addition to excluding nursery days from the numerator of the Medicare share fraction, these days are excluded for the same reasons from the count of total inpatient bed days in the denominator of the Medicare share fraction.  We therefore do not believe that excluding these days would result in disadvantage to hospitals in determining their Medicare share fractions for purposes of calculating EHR incentive payments. 

 Page 411, Final Rule Draft

Looking for Requirement Detail? Try MUMrequirements.com !

We are excited to promote stimulating conversation at the heart of Meaningful Use, with our new informative site at MUMrequirements.com  

This new site lists each individual EHR usage requirement from the Federal Register, with the comment and response background consolidated, useful interpretations, and an ability to share your thoughts with other professionals via standard blogging tools. 

You can filter on the requirements for hospitals, or EP's, and menu vs core.  What's more, you can use simple search tools to hunt out all the requirments containing a common concept (like "structured data" or "emergency department"). 

Join in the conversation!

Is a provider required to own a Complete EHR? - Not as straight forward as it may appear

Based upon a recent issuance by ONC, we are revising our position on the need to implement software to support all certification criteria to be compliant with the HITECH law of using certified EHR technology. It is necessary to have certified EHR technology that addresses all certification criteria, even those criteria which support meaningful use objectives whihch the provider is not submitting to CMS. See http://healthit.hhs.gov/portal/server.pt/community/onc_regulations_faqs/3163 for the FAQ release. The specific item is number 17# :

Question [9-10-017-1]: Under the Medicare and Medicaid EHR Incentive Programs Final Rule, eligible health care providers are permitted to defer certain meaningful use objectives and measures and still receive an EHR incentive payment. However, it is our understanding that in order for us to have our EHR technology certified, we must implement all of the applicable capabilities specified in the adopted certification criteria regardless of whether we intend to use all of those capabilities to qualify for our EHR incentive payment. Is our understanding correct?

Answer:

Yes, this understanding is correct. The flexibility offered as part of the Medicare and Medicaid EHR Incentive Programs Final Rule is not mirrored in the Initial Set of Standards, Implementation Specifications, and Certification Criteria Final Rule because we believe that it is important to accommodate eligible health care providers’ ability to achieve meaningful use. We recognize that in some circumstances an eligible health care provider may not know which meaningful use measures they will seek to defer until they begin implementation and in others an individual provider (even within a specialty) will want to choose different measures to defer based on their local situation and implementation experience. Thus, in order to possess EHR technology that meets the definition of Certified EHR Technology, it must be tested and certified by an ONC-ATCB to all applicable certification criteria adopted by the Secretary.

Trouble Navigating the Final Rule?

We've done a little work that helps us to find our way through this huge document.  If you've tried to find anything, you notice the lack of a table of contents.   We added a "clickable" table that allows you to easily navigate to sections of the document.  It is big, but I think you'll find it useful.  Here's the link:

Final Rule with Microsoft  Word Table of Contents Added

 

Navigating the Final Rule for Clinical Quality Measures for EP's

We recently had a question on where to find information on Clinical Quality Measures for EP's, so I did  a little digging around. 

First, you should review the portion of the Final Rule that lists the Measures and which are required for each specialty.  The Final Rule document is available from CMS on this web page:

http://healthit.hhs.gov/portal/server.pt?open=512&objID=2996&mode=2

On the right-hand panel, upper corner will be a link to the PDF containing the Final Rule document.  Within the Final Rule Document, there is a general discussion of Clinical Quality Measures starting on page 44380, but the list of specific measures, and which are required under which circumstances, is on pages 44398-44408.  Of course, this section does not give you much insight into the detail specifications of each report, but there is a pretty good PDF on the CMS site containing the specifications for each quality measure.  The Site URL is:

http://www.cms.gov/QualityMeasures/03_ElectronicSpecifications.asp 

Near the bottom of the resulting page is a section for Downloads.  In that section is a PDF titled "EP Measure Specifications".  That document contains the calculations and data fields for each Quality Measure. 

We think it is prudent for each provider to create a matrix, listing for each relevant quality measure, the required data elements, and mapping those elements to their EHR(s), and further determining that the  relevant data elements are being populated by your clinicians sufficiently to meet the data gathering requirements.  Big job!

Jay Fisher

MeaningfulUseMonitor.com

Physician (or hospital) - "Certify" Thyslf?

By now, most of you have read or been exposed to the Final Rule for the Establishment of the Certification Program for Health Information Technology. In essence, this program established the  principles to operationalize the process to "certify" EHR applications so they can help qualify a hospital or Eligible Provider for the EHR Incentive Program contained in the ARRA Stimulus law. At the centerpiece of the process are the ATCB's (Authorized Testing and Certification Bodies) which conduct the actual certification assessment against the published certification criteria (see the Final Rule for Initial Set of Standards, Implementation Specifications and Certification Criteria for Electronic Health Record Technology). The ATCB's will certify complete EHR's or EHR modules ( the individual ATCB that seeks EHR module testing and certification must specify which modules it will test and will be limited to those modules).

But who will be seeking this certification? Certainly software development companies which market and sell complete EHR's and EHR modules will be a prime "user" of this certification process offered by the ATCB's. However, there will also be a portion of the health care system that will decide to seek certification for their particular EHR application "suite". You ask why wouldn't these health care systems rely on the software vendor(s) who they purchased the EHR applications from? There are several factors which will drive these health care systems to "self' certify:

1. Old versions of vendor software - vendor may not be interested in expending resources to get "back versions" certified. Also, the health care system may not want to upgrade to "certified" version due to cost - both out of pocket and personnel time needed to upgrade
2. Incomplete set of applications from one EHR vendor - even if the EHR vendor has a Complete EHR certified, it may not be used by the health care system due to preferences, existing modules already in place etc.
3. Multiple campuses using different applications - due to age of when EHR components were installed, strong likelihood there will be differences between campuses.

Given these reasons, there is a strong likelihood that some health care organizations will explore "self" certification for parts (or all) of their EHR technology. Some will view this alternative as more cost effective, less disruptive and faster to gain certification status. At this point, ATCB's are publishing prices to self certify at prices around $35,000 for a complete EHR, and much lower prices for individual Certification Criteria (Modules, in CMS-speak).  Although there will be work involved in preparing for and assisting in the testing and certification process, this effort may be less than upgrading to a vendor's "certified" version of the software.