Everything HITECH

What is a Licensed Healthcare Professional (for CPOE!)

The final rule states that any licensed professional can qualify for CPOE order entry.  However, there is little guidance as to definition of “licensed professional”.  In our research we found two relevant citations, as follows:

Use CPOE for orders (any type) directly entered by the authorizing provider (for example, MD, DO, RN, PA, NP).

Page 73, Final Rule Draft

We agree with those commenters who recommend allowing any licensed healthcare professional to enter orders using CPOE.  We further refine this recommendation to be that any licensed healthcare professional can enter orders into the medical record per state, local and professional guidelines. 

Page 75, Final Rule Draft

So it appears that MD, DO, RN, PA and NP are valid, as well as any others defined per state, local or professional guidelines, although the regulation is somewhat silent on what specific guidelines may be applicable. 

A further clarification can be found in a FAQ on the CMS website, stating that the individual qualifying for CPOE must be able to exercise clinical judgement, and make a decision before the order is executed.  According to one of our hospital colleagues, this will probably take pharmacists out of play in qualifying as CPOE orderers (for Stimulus purposes, anyway).  Here's the CMS link: https://questions.cms.hhs.gov/app/answers/detail/a_id/10134/~/%5Behr-incentive-program%5D-who-can-enter-medication-orders-in-order-to-meet-the

Make sure your EHR's detail "audit proof" reporting includes an identification of who entered the order! 

How Should Newborns be included in Inpatient Counts for Meaningful Use Measures?

Including or excluding newborn infants in generalized numerator and denominator statistics could make a difference between pass and fail  in some requirements for many hospitals.  The Final Rule addresses this, by generally excluding newborns from such counts.  Be sure and adjust your reporting metrics based on excluding newborns!  The one exception appears to be that newborns should be included in ICU counts, in denominator and where appropriate, in numerator calculations. 

 In excluding nursery days from the count of Medicare inpatient bed days, we are following the precedent of not counting such days for purposes of the direct medical education, indirect medical education, and disproportionate share adjustments under the Medicare IPPS.  As in the case of the term "subsection (d)" hospital, we believe that, in the absence of clear direction from the statute to the contrary, the most appropriate policy is to interpret terms such as "inpatient bed-days" in the light of existing Medicare program policies and precedents. 

 

Under our policies for the direct medical education, indirect medical education and disproportionate share adjustments, a bed must be permanently maintained for lodging inpatients in order to be included in available inpatient bed and inpatient bed day counts.  We exclude the days provided to newborns (except for those in intensive care units of the hospital) because healthy new born infants are not provided with an acute level of hospital care.  (This is not the case with newborns assigned to intensive care units, who are included in the counts for those units.) For these reasons, nursery days are explicitly excluded from:

 

• The counts of Medicare inpatient hospital days and total inpatient hospital days for purposes of direct graduate medical education payments under section 413.75(b) of the regulations, where the definition of Medicare patient load reads: "inpatient days in any distinct part of the hospital are included and nursery days are excluded."
• The counts of bed days for purposes of the Medicare indirect graduate medical education adjustment under section 412.105(b): the "count of available bed days excludes bed days associated with… (5) Beds or bassinets in the healthy newborn nursery…."
• The count of beds for purposes of the Medicare DSH adjustment under section412.106(a)(i) of the regulations: "The number of beds in a hospital is determined in accordance with §412.105(b)."

We note that, in addition to excluding nursery days from the numerator of the Medicare share fraction, these days are excluded for the same reasons from the count of total inpatient bed days in the denominator of the Medicare share fraction.  We therefore do not believe that excluding these days would result in disadvantage to hospitals in determining their Medicare share fractions for purposes of calculating EHR incentive payments. 

 Page 411, Final Rule Draft

Looking for Requirement Detail? Try MUMrequirements.com !

We are excited to promote stimulating conversation at the heart of Meaningful Use, with our new informative site at MUMrequirements.com  

This new site lists each individual EHR usage requirement from the Federal Register, with the comment and response background consolidated, useful interpretations, and an ability to share your thoughts with other professionals via standard blogging tools. 

You can filter on the requirements for hospitals, or EP's, and menu vs core.  What's more, you can use simple search tools to hunt out all the requirments containing a common concept (like "structured data" or "emergency department"). 

Join in the conversation!

Is a provider required to own a Complete EHR? - Not as straight forward as it may appear

Based upon a recent issuance by ONC, we are revising our position on the need to implement software to support all certification criteria to be compliant with the HITECH law of using certified EHR technology. It is necessary to have certified EHR technology that addresses all certification criteria, even those criteria which support meaningful use objectives whihch the provider is not submitting to CMS. See http://healthit.hhs.gov/portal/server.pt/community/onc_regulations_faqs/3163 for the FAQ release. The specific item is number 17# :

Question [9-10-017-1]: Under the Medicare and Medicaid EHR Incentive Programs Final Rule, eligible health care providers are permitted to defer certain meaningful use objectives and measures and still receive an EHR incentive payment. However, it is our understanding that in order for us to have our EHR technology certified, we must implement all of the applicable capabilities specified in the adopted certification criteria regardless of whether we intend to use all of those capabilities to qualify for our EHR incentive payment. Is our understanding correct?

Answer:

Yes, this understanding is correct. The flexibility offered as part of the Medicare and Medicaid EHR Incentive Programs Final Rule is not mirrored in the Initial Set of Standards, Implementation Specifications, and Certification Criteria Final Rule because we believe that it is important to accommodate eligible health care providers’ ability to achieve meaningful use. We recognize that in some circumstances an eligible health care provider may not know which meaningful use measures they will seek to defer until they begin implementation and in others an individual provider (even within a specialty) will want to choose different measures to defer based on their local situation and implementation experience. Thus, in order to possess EHR technology that meets the definition of Certified EHR Technology, it must be tested and certified by an ONC-ATCB to all applicable certification criteria adopted by the Secretary.

Trouble Navigating the Final Rule?

We've done a little work that helps us to find our way through this huge document.  If you've tried to find anything, you notice the lack of a table of contents.   We added a "clickable" table that allows you to easily navigate to sections of the document.  It is big, but I think you'll find it useful.  Here's the link:

Final Rule with Microsoft  Word Table of Contents Added

 

Navigating the Final Rule for Clinical Quality Measures for EP's

We recently had a question on where to find information on Clinical Quality Measures for EP's, so I did  a little digging around. 

First, you should review the portion of the Final Rule that lists the Measures and which are required for each specialty.  The Final Rule document is available from CMS on this web page:

http://healthit.hhs.gov/portal/server.pt?open=512&objID=2996&mode=2

On the right-hand panel, upper corner will be a link to the PDF containing the Final Rule document.  Within the Final Rule Document, there is a general discussion of Clinical Quality Measures starting on page 44380, but the list of specific measures, and which are required under which circumstances, is on pages 44398-44408.  Of course, this section does not give you much insight into the detail specifications of each report, but there is a pretty good PDF on the CMS site containing the specifications for each quality measure.  The Site URL is:

http://www.cms.gov/QualityMeasures/03_ElectronicSpecifications.asp 

Near the bottom of the resulting page is a section for Downloads.  In that section is a PDF titled "EP Measure Specifications".  That document contains the calculations and data fields for each Quality Measure. 

We think it is prudent for each provider to create a matrix, listing for each relevant quality measure, the required data elements, and mapping those elements to their EHR(s), and further determining that the  relevant data elements are being populated by your clinicians sufficiently to meet the data gathering requirements.  Big job!

Jay Fisher

MeaningfulUseMonitor.com

Physician (or hospital) - "Certify" Thyslf?

By now, most of you have read or been exposed to the Final Rule for the Establishment of the Certification Program for Health Information Technology. In essence, this program established the  principles to operationalize the process to "certify" EHR applications so they can help qualify a hospital or Eligible Provider for the EHR Incentive Program contained in the ARRA Stimulus law. At the centerpiece of the process are the ATCB's (Authorized Testing and Certification Bodies) which conduct the actual certification assessment against the published certification criteria (see the Final Rule for Initial Set of Standards, Implementation Specifications and Certification Criteria for Electronic Health Record Technology). The ATCB's will certify complete EHR's or EHR modules ( the individual ATCB that seeks EHR module testing and certification must specify which modules it will test and will be limited to those modules).

But who will be seeking this certification? Certainly software development companies which market and sell complete EHR's and EHR modules will be a prime "user" of this certification process offered by the ATCB's. However, there will also be a portion of the health care system that will decide to seek certification for their particular EHR application "suite". You ask why wouldn't these health care systems rely on the software vendor(s) who they purchased the EHR applications from? There are several factors which will drive these health care systems to "self' certify:

1. Old versions of vendor software - vendor may not be interested in expending resources to get "back versions" certified. Also, the health care system may not want to upgrade to "certified" version due to cost - both out of pocket and personnel time needed to upgrade
2. Incomplete set of applications from one EHR vendor - even if the EHR vendor has a Complete EHR certified, it may not be used by the health care system due to preferences, existing modules already in place etc.
3. Multiple campuses using different applications - due to age of when EHR components were installed, strong likelihood there will be differences between campuses.

Given these reasons, there is a strong likelihood that some health care organizations will explore "self" certification for parts (or all) of their EHR technology. Some will view this alternative as more cost effective, less disruptive and faster to gain certification status. At this point, ATCB's are publishing prices to self certify at prices around $35,000 for a complete EHR, and much lower prices for individual Certification Criteria (Modules, in CMS-speak).  Although there will be work involved in preparing for and assisting in the testing and certification process, this effort may be less than upgrading to a vendor's "certified" version of the software.

Stimulus Payments for Critical Access Hospitals

Over the past week or so, we’ve seen a couple interpretations of the Final Rule on the topic of calculation of Stimulus benefit to Critical Access Hospitals (CAHs).  Even across well-regarded professional organizations, these interpretations are sometimes in conflict, so we engaged Choua Vang, of Godfrey & Khan to help out.  (Godfrey & Kahn is a large, well respected law firm in Milwaukee, WI). 

 

Choua did a rigorous job of scouring the 800+ pages of Final Rule to answer the following key questions:

 

1.  The ARRA provides Medicare incentive payments for “subsection D” hospitals for the meaningful use of certified EHR technology under a base-plus-discharge formula specified in the law.  Are CAHs “subsection D” hospitals, and therefore eligible for Medicare incentive payments under this formula?

Choua: CAHs do not qualify as "subsection (d) hospitals" under the ARRA.  However, CAHs are eligible for Medicare incentive payments for the meaningful use of certified EHR technology under a provision in the ARRA that is specific to CAHs.

Final Rule Reference Pages: 75 Fed. Reg. 44,314 at 44,460- 44,461 (July 28, 2010)

 

 

2.    What formula is used to calculate Medicare incentive payments for CAHs?  Don’t CAHs already get their costs reimbursed? 

Choua: The applicable formula for calculating the Medicare incentive payment for CAHs is the product of (1) the "reasonable cost” incurred for the purchase of certified EHR technology, in that cost reporting period (including any similarly incurred costs from previous cost reporting periods to the extent they have not been fully depreciated as of the cost reporting period involved) and (2) the CAHs Medicare share, which equals the Medicare share as computed for qualifying “subsection (d) hospitals”, plus 20 percentage points.

In establishing this formula, the ARRA amended two provisions in the laws governing general Medicare payments to CAHs.  First is the additional 20 points referred to above.  This is added to the hospital’s Medicare percentage when applying against reasonable cost of EHR, giving the hospital extra reimbursement. Second, the costs associated with qualified EHR expenditures do not need to be capitalized, but can be expensed in the year incurred, effectively accelerating reimbursement.  In fact, hospitals can even include unamortized depreciation for qualified EHR expenditures from prior years, as part of their first year reimbursement.   This ARRA amendment gets CAHs their funding faster, and with an extra 20 percentage points added to their Medicare Patient mix (relative to EHR). 

This formula will be used in place of payment at 101% of reasonable costs typically applied under the cost-based reimbursement principles for CAHs. In other words, no other formula for calculating Medicare incentive payments for the meaningful use of certified EHR technology will apply in the case of a CAH.

Final Rule Reference Pages: 75 Fed. Reg. at 44,461 – 44,462

 

3.    Are CAHs eligible for Medicaid incentive payments?

Choua: Yes.  The ARRA provides for Medicaid incentive payments for hospitals that qualify as an  “acute care hospital.”  In the proposed rule, the definition of “acute care hospital” excluded CAHs.  In the Final Rule, CMS confirmed that CAHs should also qualify as “acute care hospitals.”  CMS accomplishes this by amending the definition of "acute care hospital" to include hospitals with CCNs in the range of 1300-1399, which are assigned to CAHs.

 

 

4. What formula is used to calculate Medicaid incentive payments to CAHs?

Medicaid incentive payments are calculated using a  “discharge based” formula, based on a $2,000,000 Base amount (with additional $200 for each discharge above 1,150 and up to 23,000), factored against the hospitals Medicaid percentage (which must be 10% or greater), and an annual “transition factor” for each of four years.  The Transition factor gives hospitals 100% of this calculation in year 1, 75% in year 2, 50% in year 3 and 25% in year 4. 

This formula is used for CAHs as well as all other hospitals qualifying as an “acute care hospital” under the Medicaid incentive program.

Final Rule Reference Pages: 75 Fed. Reg. at 44.579 – 44,580

 

5. The ARRA stated that hospitals could be eligible for both Medicare and Medicaid incentive payments.  Is this true for CAHs as well?

Choua: Yes, like other acute care hospitals, CAHs may be eligible for both Medicare and Medicaid incentive payments for the meaningful use of certified EHR technology, provided the CAH meets all of the requirements under each incentive program.  

     Final Rule Reference Pages: 75 Fed. Reg. at 44,484

 

 

 

This should give you a definitive view.  In essence, CAH hospitals could potentially receive two types of reimbursement – a cost-based payment from Medicare, and a “discharge based” payment from Medicaid. 

 

Click this link to download a spreadsheet tool we built that models these predictions for you.  And let us know what you think!

 

 

Choua Vang

Godfrey & Kahn

 

 

Jay Fisher | @JayRFisher

C3 Partners

How much will my State Medicaid requirements differ from Medicare?

The general rule is that Medicare requirements provide a common definition by which hospitals will qualify as Meaningful Users of EHR Technology.  In some cases Medicare would define a "minimum standard", which states could modify for the Medicaid portion.  However, in no case can State mandates exceed functionality beyond that of certified EHR technology (the Medicare technology standard).  Also, the Secretary of DHHS has the authority to approve such functionality, and will not approve any State requirments unless those requirements "promote the use of EHRs and healthcare quality". 

In fact, CMS will only approve additional State level requirements related specifically to public health objectives and data registries.  Under Stage 1, the list of permissable "tailoring" would be under the followng specific requirements:

• Generate lists ofpatients by specific conditions;
• Capability to submit electronic data to immunization registries of Immunization Information Systems;
• Capability to submit electronic data on reportable lab results to public health agencies;
• Capability to submit electronic syndromic surveillance data to public health agencies;

There are specific examples of what is allowed under each of these. 

Having said all the above ... the Rule stipulates that "hospitals eligible for both Medicare and Medicaid incentive payments will be deemed for Medicaid if they have met the meaningful use definition through Medicare, even if a State has an approved State-specific definition of meaningful use.  States cannot withhold a Medicaid EHR incentive payment from dually eligible hospitals if they have met nall the eligibility criteria for Medicaid, and have met the Medicare definition for meaningful use".

As a practical matter, this seems to imply that States can set the interface specifications and data content where the State currently requires this data.  In doing so, hospitals will qualify for these submissions under both Medicare and Medicaid.  Clear, yes? 

Jay Fisher | @JayRFisher

Once You Start, Leave a Gap ... Lose Your Money

Providers can lose money if their Meaningful Use capability lapses for a year, once they have initially qualified.  Page 25 of the July Final Rule begins the discussion which, ultimately states that under Medicare, once a provider (EP or Hospital) initially qualifies and receives payment under HITECH, each subsequent year is a Payment Year.  Medicare Providers whose qualifications slip for any subsequent year, lose the reimbursement for that year!  Ouch. 

Medicaid is different, and allows for a provider to slip their qualification for a given year, and merely have that "missed" year's incentive payment deferred. 

Jay Fisher | @JayRFisher

HITECH will keep your Business Intelligence Team Busy

 

 

One of our Meaningful Use Monitoring (MUM) customers recently commented on the significant amount of work his hospitals will have to do to develop proof of compliance for the HITECH requirements. Much, but not all, of the reporting work may be supported by EHR vendors – however, many hospitals have multiple EHR vendors (especially true with ED and OR) that will require coordination and synchronization.  A large hospital will have to access and organize scores, or even hundreds of reports to analyze and prove Meaningful Use.  These hospitals will have to build reporting across multiple systems (EHRs, ADT, Pharmacy, Registries, Lab, and Radiology).  There is probably no way around this.  Here are a couple examples of this complexity:

  

  

• Determine, for each Quality Report, that all data elements exist in your (relevant) EHR, to support creation of the report (even if it is not necessary to create the report from the EHR in year 1 for Stage 1 requirements, you must attest to the fact that you could have);
• Incorporate clinical lab test results into EHR as structured data – seems straight forward until you realize the need to gather all lab tests ordered (manual, other systems), not just the ones ordered from  your primary EHR system. Then you need to ensure the results are in a positive / negative or numerical format to be countered toward the 50% measure threshold.
• Analyze all "transitions of care", and report on whether a "medication reconciliation" took place;
• Identify, for all unique patients (whether they are in the EHR or not), whether they had problem list coded via ICD-9 or  SNOMED (in the EHR);
• Log each instance of transition of care (between providers), and identify whether a Summary of Care record existed, and was provided (from the EHR).

OK, you get the point.  There are currently 14 Meaningful Use Requirements for hospitals, and 15 Quality Reports.  If you have one EHR only, and you can guarantee that all relevant data is in the EHR, then you will not need to integrate with other hospital systems.  Most of us are not in that position, yet.  The complexity of many hospitals will require that in order to conduct the analysis, department-level reporting will be needed.  And you'll need to create these reports early on, so you can run them regularly, in order to monitor your progress towards compliance.   

Hospitals will need tools and processes to organize and report status against all that work, and a simplified organization and reporting scheme will save a lot of effort on the part of clinical evaluators, Business Intelligence Teams, and internal audit.  One design concept we have adopted, is to create a link within MUM at the level of department and requirement, by which users can identify (and even execute) each unique report that analyzes and proves departmental compliance, for each requirement.  This is a powerful concept!  We also provide the audit proof link, by which these reports are organized along requirement and departmental lines. 

  

 

 

So ... it seems prudent to get your BI Team involved early in the process!  Educate them in each single requirement, so that they can start the process of evaluating how to track progress, and log proof. It will be useful to your clinical leadership to provide data that shows HITECH compliance status.  Anecdotal attestations as to compliance might be useful to determine whether to pursue meaningful use, but won't stand up to CMS audit. 

 

 

Jay Fisher | @JayRFisher

 

 

 

 

Preparing for ARRA HITECH Gap Analysis - Who should be involved?

It seems that ARRA HITECH Gap analysis is not just a quick back of the napkin sketch.  In fact, it
looks like a project.  One of the first questions in any project will be "who is involved?".  Our Straw Man consists of a Core Leadership Team responsible for defining the standards and processes by which a gap assessment is conducted, and a series of supporting roles (the people actually conducting assessment activities).  Here's what we think...  

Core Leadership Team 

Program Manager  

• Overall responsibility for managing the Meaningful Use processes/program in the organization  
• Reports status to Senior Management  
• Sits on the Meaningful Use Steering Committee (see below)  

 

Clinical Content Officer   

• Responsible for determining the impact of the Meaningful Use Requirements on the organization, and determining who needs to be involved in assessing and achieving compliance for each requirement   
• Sits on the Meaningful Use Steering Committee (see below)  

 

IT Liaison  

• Responsible for understanding the certification status of the organization’s EHR(s).   
• Coordinates with EHR Vendor to obtain and validate the technology components that need to be in place to support Meaningful Use
• Sits on the Meaningful Use Steering Committee (see below)
• Responsible for the user management and configuration functions of the MUM software portal (managing passwords/access, monitoring data accuracy, addressing technical issues that may arise)

 

Executive Sponsor

• The executive who is responsible for ensuring the right resources and management attention are allocated to the Meaningful Use efforts of the organization. 
• Signs the attestation documentation that is submitted to CMS and the State (note – this could be a different executive)

 

Supporting Team

 

The following roles will be actively involved in day-to-day analysis of ARRA HITECH requirements compared to current capabilities, and updating status as capabilities continue to mature over the life of the HITECH program. 

 

  

Requirement Owner

The person in the organization who has overall responsibility for compliance with a particular requirement, across all clinical departments involved. In many cases this will be the Clinical Content Officer, but some requirements will be assigned to a separate individual. 

 

  

Department Attester

Individual who will ultimately be accountable for the clinicians under their control using EHR systems to achieve Meaningful Use.  During the assessment phase, this individual will be responsible for evaluating, attesting and proving their clinician’s Meaningful Use status. 

 

  

Business Intelligence Team

Each provider or hospital will be required to provide proof that, for each annual reporting period, they have been compliant with each ARRA HITECH requirement, across every relevant clinical department.  In some cases, EHR vendors will have developed reporting within their systems.  In most cases, however, acceptable proof will include data coming from multiple different systems.  The Business Intelligence Team will be responsible, under direction of the Clinical Content Officer, to analyze the reporting available from the relevant EHR(s), and compare that reporting to HITECH requirements.  Where necessary, they will develop specifications and complete new reporting. In all cases, they will provide information to all Department Attesters as to what report will adequately prove compliance with each requirement. 

 

  

* * * * * * * * * * * *

 

  

That may not cover everyone involved, but we think it is a good start on defining roles and responsibilites.  Please share with us what you think!

 

 

Jay Fisher |@JayRFisher

 

 

Check out our HITECH Hero Series for Summary Concepts

In the Regulatory Quiet Period over the past couple months, we've created a series of vignettes, which illustrate concepts within ARRA HITECH's Meaningful Use regulations that you might enjoy ...

CMS will publish, on their website, all hospitals who are Meaningful Users.  Are there any implications of being on or off that list?

 

What's the difference between having EHR Software, and achieving Meaningful Use? 

 Who has to be involved in your hospital's Meaningful Use efforts?

All we have to do is submit an Attestation to CMS, Right?

 

 

What integration might be required to make Meaningful Use work?

Ok, so these are a bit frivolous, but maybe they help think through a point or two.  Hope you enjoyed!

Jay Fisher | @JayRFisher 

Are Rehabilitation Specialists Eligible for Stimulus?

We recently got asked whether rehabilitation specialists employed by a health system would be eligible to receive Medicare or Medicaid incentive payments for the meaningful use of certified EHR technology.

On April 15, President Obama signed into law the Continuing Extension Act of 2010.  Section 5 of the Act amends the definition of "hospital-based eligible professional" in the HITECH Act to exclude those physicians furnishing services in an outpatient setting.  The definition of "hospital-based eligible professional" is now limited to physicians furnishing "substantially all" of their services in a hospital inpatient or emergency room setting.  Accordingly, physicians furnishing substantially all of their services in a hospital outpatient setting are now eligible for the Medicare or Medicaid incentive payments for the meaningful use of certified EHR technology. Oh, yeah.  This also defines which providers will be subject to penalties for non-compliance after 2015. 

 

With respect to rehabilitation specialists employed by a health system, such individuals would be eligible for the incentive payments if they do not meet the definition of "hospital-based eligible professional".  That is, they do not furnish "substantially all" of their services in a hospital inpatient or emergency room setting.  In addition, the rehabilitation specialists must qualify as an "eligible professional" under the HITECH Act.  The term "eligible professional" is defined as a "physician" and is further defined to mean the following types of physicians: 

 

(1) a doctor of medicine or osteopathy

(2) a doctor of dental surgery or of dental medicine

(3) a doctor of podiatric medicine

(4) a doctor of optometry; or

(5) a chiropractor

 

CMS defines "substantially all" as 90% of all services furnished by the physician.   

  

In summary, rehabilitation specialists employed by a health system should be eligible for Medicare or Medicaid incentive payments if they are physicians and they do not furnish substantially of their services in a hospital inpatient or emergency room setting, provided they meet all other requirements for meaningful use.

  

Choua Vang | Godfrey & Kahn

Privacy and Security Revisited

Over the past couple weeks, we’ve been head-scratching over one of the HITECH Requirements, related to Privacy and Security.  Here’s the language from the Federal Register:

“Conduct or review a security risk analysis per 45 CFR 164.308 (a)(1) and implement security updates as necessary.”

 

  

So, here’s the question.  Is this a slam-dunk (all you have to do is conduct an assessment), or an impossibility (implement security updates as necessary)?  Thanks mainly to Kirsten Wilde, an independent HIPAA Security Consultant, and Nancy Davis of Ministry Healthcare in Wisconsin, we’ve come to a simplified conclusion.  I don’t suppose our conclusion is definitive in the eyes of CMS, but bears the value of some practical experience of these professionals, as well as a handful of others.  In fact, we've had a panel of experts from hospital, consulting and software vendor firms that really helped make sure we covered the bases.  Just to provide a sense of the different perspectives we've incorporated, major contributors to this included Penny Zeller, of New West Consulting, Phil Deleel of Claxton-Hepburn Medical Center, Colin Fletcher from Sun Microsystems. 

  

 

First of all, everyone knows that this is not a new requirement, right?  It has been around for quite a while.  Our first research path was to the 45 CFR 164.308 (a)(1) referenced in the HITECH rule.  That was disappointing.  After reading half a dozen pages, we came down to a paragraph, which really pointed to the details of a “security risk assessment”.  What we found, was that the answers are not actually in the CFR manual, but are referred out to a NIST document.  Here we struck gold!  The NICS material is concise, definitive and easy to follow.  Details of the security risk assessment can be found at:

http://csrc.nist.gov/publications/nistpubs/800-66-Rev1/SP-800-66-Revision1.pdf 

  

See pages 17-19 of the actual document (pages 25-27 of the PDF) and appendix E.   Following this, you can clearly figure out a reasonable work plan for conducting the assessment.  Ok, having conducted this type of assessment, what do you do with the results?  Most hospitals have an approach already, and very few have been audited. 

  

 The notable “first” was in March of 2007, when Atlanta's Piedmont Hospital became the first institution in the country to be audited for compliance with the security rules of the Health Insurance Portability and Accountability Act (HIPAA).  Just Google “Piedmont” and “HIPAA” and in 10 minutes you’ll understand that history pretty well.  As a result, CMS / OCR (Office of Civil Rights) developed a list of 42 questions that consultants have been using ever since.

  

After reviewing these questions, following up with some internet searches, and discussions with Nancy, Kirsten and our other HITECH Advisory Panel members, we came away with a couple observations related to what is prudent to do with the results of a risk assessment:

  

1.   Absolute Security Compliance is not a reasonable standard.  Probably, no organization can ever achieve it, because of human factors and the potential for simple operational errors.

2.   Providers need to show diligence.  Strong evidence of diligence might be having a committee of senior level staff meeting regularly to discuss their activities related to open items identified as a part of the risk assessment.  Stronger yet, would be to have an individual dedicated to this task (rather than part of a job description covered under “other duties as assigned”).  Here’s the results of what we have posted to our subscribers:
 

ADVISORY PANEL INTERPRETATION

Lower risk Interpretation:   Security risk assessment has been completed. Plan for addressing identified gaps is regularly (e.g. quarterly) updated based upon results of updated security risk assessment. Mitigation of gaps is an active process. Security risk management activities are documented. Attestation is required for Stage 1 at least once prior to the end of the reporting period. Low risk recommendation to complete test again.

  

Higher risk Interpretation: Security risk assessment has been completed. Plan for addressing identified gaps is developed once based upon results of security risk assessment. Implementation of security updates  has begun.

  

TECHNOLOGY

Third-party software likely to be required to assist with the security risk assessment.

POLICY/PROCEDURE

Policy / Procedures define contents of security analysis to include: risk assessment methodology, risk management, security and sanction policy and information review. Policy / Procedure provides audit trail on a regular basis.

  

COMPLIANCE REVIEW DOCUMENTATION

Risk analysis and risk management policy and procedures, audit trail, gap analysis, security risk test results and additional documentation.  

Green:

Fully compliant with current risk assessment review completed, risk management procedures completely documented and any identified security gaps have been resolved or are being actively worked.

Yellow:

Risk assessment review conducted/current and Technical components to support HIPAA security rule are in place however, not all risk management procedures are documented, or gaps in security processes have not all been addressed and are not being actively worked.

Red:

Either risk assessment review not current or technology gaps have not been addressed

  

What do you think?  Are we on target?

Jay Fisher | @JayRFisher

ARRA Meaningful Use Guidelines as an Implementation Planning Aid

ARRA HITECH represents important financial and regulatory compliance content for most hospitals and medical groups for the next several years.  But we believe that Meaningful Use, Quality Measure Management, and EHR Interoperability guidelines established by CMS also represent a body of work in defining reasonable goals for most EHR Implementations – quite apart from the regulatory implications. 

For hospitals embarking on new EHR journeys, or re-evaluating their EHR priorities, one of the most difficult and time-consuming tasks is to define operational and clinical EHR goals that are easily communicated to medical staff, and where progress can be easily measured.  In some cases, your vision becomes a competitive physician recruitment and retention weapon, showing that you are a state-of-the-art Medical Facility.  We have observed cases where developing this vision takes months.  Getting the message to all relevant stakeholders, and getting obtaining commitment is time consuming and critical to successful implementations.  Clinician buy-in may be the single most important factor in determining the timing, and cost of getting your EHR up and running. 

Adopting the CMS HITECH requirements, as the starting point for a clear, relevant set of goals makes a lot of sense.  Your institution may choose to go farther than these requirements suggest, or you may choose to phase them in over multiple future periods.  HITECH cuts through the amount of time it takes to get organized, develop a clear and convincing vision, communicate expectations and progress, and keeps your entire organization clearly focused on your EHR goals … and does so over the life of your programs. 

I've always been a Project Manager and Program Manager.  My principal tracking and communication tools have been workplans in Microsoft Project, or Open Workbench, or something similar.  And, while I loved the order and predictability these  plans give, we were always missing something.  That missing element was an ability for the business (or clincial) stakeholders to clearly evaluate and communicate their progress. 

The ARRA Meaningful Use (well, 23 Meaningful Use requirements and another 40 or so Quality Measures) define one possible vision that has value beyond merely getting money from CMS.  If we can figure out good ways to communicate those standards across all our clinicians, and communicate our progress against them, the government may have done us all a favor!   Take a look at a tool we have developed for our clients' use.  It organizes and interprets the requirements in a way to drastically improve communication.  It gives clinical departments a simple, ongoing way to show their progress.  From a project management point of view, you should really consider using the HITECH requirements to measure accomplishments in a  way that makes sense to your business and clinicians ... not just to your project managers. 

Jay Fisher | @JayRFisher

Our Pharmacy System does drug-drug, drug-allergy and drug-formulary checks. Are we covered?

The Federal Register never quite comes out to say yes or no explicitly to this question.  However, the context of the discussion on the requirements to conduct these checks certainly implies quite strongly that whether or not it exists in your Pharmacy, the EHR also needs to conduct real-time checks, assumably at order entry time.  Consider the following text from page 1860:

The capability of conducting automated drug-drug, drug-allergy, and drug-formulary checks is included in the certification criteria for certified EHR technology (to be determined by ONC in its upcoming interim final rule). This automated check provides information to advise the EP or eligible hospital’s decisions in prescribing drugs to a patient. The only action taken by the EP or eligible hospital is to consider this information. Many current EHR technologies have the option to disable these checks and the certification process does not require the removal of this option. Therefore, in order to meet this objective, an EP or eligible hospital would be required to enable this functionality. While this does not ensure that an EP or an eligible hospital is considering the information provided, it does ensure that the information is available.

It rather makes sense this way, if you consider the direction of EHR Meaningful Use to facilitate clinical decision support.

Jay Fisher | @JayRFisher

For Physicians ... must all locations be automated to qualify for incentives?

We received a question recently regarding physician practices, and how to count “denominator” portions of several measures, such as CPOE.  The situation we covered was that of a given physician seeing patients in multiple locations, where not all locations are yet “up and running” on EHR.  On page 1859 of the Federal Register we found language that gives these providers the benefit of being  able to count only the patients seen in the “automated” location:

We are concerned about the application of this denominator for EPs who see patients in multiple practices or multiple locations. If an EP does not have certified EHR technology available at each location/practice where they see patients it could become impossible to reach the thresholds set for measuring the objectives. We do not seek to exclude EPs who meaningfully use certified EHR technology when it is available because they also provide care in another practice where certified EHR technology is not available. Therefore we are proposing all measures be limited to actions taken at practices/ locations equipped with certified EHR technology. A practice is equipped if certified EHR technology is available at the beginning of the EHR reporting period for a given location.

Of course, for multi-location physicians, there need to be some guidelines on which locations are “relevant”.  It seems that seeing only a small percentage of patients does not help … the doctor must have half or more of his patients seen at an EHR enabled location (also page 1859):

We believe that an EP would have the greatest control of whether certified EHR technology is available in the practice in which they see the greatest proportion of their patients. We are proposing that to be a meaningful EHR user an EP must have 50 percent or more of their patient encounters during the EHR reporting period at a practice/location or practices/locations equipped with certified EHR technology. An EP for who does not conduct 50 percent of their patient encounters in any one practice/location would have to meet the 50 percent threshold through a combination of practices/locations. While control is less assured in this situation, CMS still needs to advance the health care priorities of the definition of meaningful use and provide some level of equity.

So it seems necessary to keep track of patient volume by location, for all your  physicians to be able to qualify …

Jay Fisher | @JayRFisher

What Role do States Have in Incentive Programs?

As Medicaid intermediaries, each State has a series of decisions they may make related the ARRA HITECH incentive programs. 

• Incentive amounts are not within a State's control, but the period of time over which a provider's payments could be disbursed are. (The formula is statutory, and identical to the Medicare formula, substituting "Medicaid" for "Medicare" where appropriate).  On page 1937 of the Federal Register, we see that a state may pay hospitals over a period ranging from three to six years, with some constraints. 
• Medicaid incentives can begin for initial payment years starting as late as 2016 (as opposed to 2013 for Medicare Incentives).  See column 1 on page 1938 of the Federal Register for this citation. 
• Medicaid has no statutory implementation date for making EHR incentive payments.  This means that states who are prepared to move quickly could begin making payments as soon as the final rule has been published, in 2010 (page 1939, Federal Register).  And, recall that to qualify for Medicaid, in its first year, a provider need not have fully achieved Meaningful Use, but only be in the process of adopting, implementing or upgrading Certified EHR Technology.  CMS makes it clear that this is intended to offer Medicaid providers an early opportunity for capital to "get started". 

States may vary from CMS / Medicare guidelines in these ways, only after having first obtained approval from CMS.  Providers in markets serving patients from multiple States, must choose one and only one State to administer their incentive program ... but it appears to be the right of the provider to make that choice (Paragraph g on page 1941 of the Federal Register)

Jay Fisher | @JayRFisher

What are the Definitive Sources for HITECH Stuff?

There's a lot of data about the ARRA HITECH law, Meaningful Use, Vendor Certification, blog sites, online magazines, websites ... and so forth!  We read some of that second hand data for useful analysis, a sense of what the industry is thinking and how it appears the laws and regulations might be adopted. 

But in the end, what really matters is the source material.  We thought it might be useful to provide a quick reference to the underlying sources.  Or at least a single place you can go when trying to organize which document contains which data for which audiences.  The following table might help:

Document Title	Content and Meaning	Link	Pages
42 CFR Parts 412, et al. Medicare and Medicaid Programs; Electronic Health Record  Incentive Program; Proposed Rule	Definitions, for providers, on how to achieve Meaningful Use of EHR.  Published in Federal Register	http://tinyurl.com/ygfrt8b	169
Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Interim Final Rule	Draft of Criteria by which EHR Vendors will be certified.  Published in Federal Register	http://tinyurl.com/yc5orpd	34
45 CFR Part 170 Proposed Establishment of Certification Programs for Health Information Technology; Proposed Rule	Draft of temporary and permanent rules by which Certification processes and criteria will be administered, and processes by which certifying organizations will be selected and managed.	http://tinyurl.com/yhzxz2b	47
H.R.1 American Recovery and Reinvestment Act of 2009 (Title XIII subsection titled HITECH is the relevant portion for Healthcare IT)	The bill passed by house and senate, and signed into law in February of 2009.  This is the source by which regulations are interpreted.	http://tinyurl.com/bpg4vl	220

Of course, there is the period of public comment that has passed for the provider side meaningful use materials, and for others, public comment is still in play.  In a conversation yesterday, we learned an interesting observation:

Federal Regulations, once published as Interim Final Rule, or Proposed Rule, cannot be increased.  In other words, public comment may lessen the rigor or impact of these documents, but cannot result in requirements more stringent than what was originally published. 

Of course, we can't say for a while yet what "lesser" rules might exist.  But it is useful to know that the contents of the above table define a "most rigorous case" scenario!

Jay Fisher | @JayRFisher

Measuring ED Throughput Might be Hard for Measuring Meaningful Use

When we first started reading about Quality Reporting, our first thought was, why bother making this a HITECH Requirement?  Most of us do it already, right?  Then came the observation that all the requisite data needed to be part of a Certified EHR.  Then we started looking at some of the data.  Here's one interesting item.  Quality Report

 "ED-2NQF 0497: Emergency Department Throughput – admitted patients.  Admission decision time to ED departure time for admitted patients"

This item has at least one tricky element.  The admission decision is made by someone outside the ED!  This means that the time of the decision is not likely to reside in the ED's EHR (unless, of course, the hospital has one common EHR that includes ED). 

Jay Fisher | @JayRFisher

How do Hospital Medicaid Requirements differ from Medicare ?

Good news, is that there are no penalties under Medicaid for non-compliance!  Take a look ... it is on page 1983 of the Federal Register.  As to flow of funds, Medicaid payments may begin as late as 2016 and are not reduced for starting after 2013 like Medicare payments are (Medicaid pays full amount regardless of start year)…also, they may be paid to hospitals over a 3-6 year period.

Now, to qualification requirements.  First of all, to qualify for Medicaid, a hospital needs to show that 10% of their patient volume in any 90 day period of the payment year is attributable to Medicaid (Federal Register Page 2002).  That's the door opener.  Next come the detail requirements. 

In reviewing pages 1851 and 1852 of the Federal Register, we conclude that it is CMS' intention to establish Medicare requirements as the minimum standard for Medicaid as well.  States may submit to CMS requests for additional requirements, as long as those requirements:

• Do not exceed the capabilities of certified EHR systems; and
• Promote further use of EHR's

However, States must first obtain CMS approval to create additional requirements ... which the tone of the Federal Register text implies will be met with rigorous scrutiny.  So the bottom line seems to be that there will be some, but not much "extra" effort to qualify under Meaningful Use (and related) guidelines. 

There is one paragraph that is a bit confusing, though:

"Furthermore, if a State has CMS approved additional meaningful use requirements, hospitals deemed as meaningful users by Medicare would not have to meet the State-specific additional meaningful use requirements in order to qualify for the Medicaid incentive payment."

It seems that the word "Medicaid" in the last line may be a typo?  Did they mean to say Medicare?  Else the meaning would be that States can create all the requirements they want, but that Medicaid reimbursement would be based on Medicare requirements.  If so, why would States bother with an approval process?

There is one other piece of Medicaid that we are trying to understand more fully, though.  In the Federal Register, Table 21, pages 1899-1900,  lists eight Alternative Quality Reports For Medicaid Hospitals.  I'm struggling with this one.  Three of the  reports are for pediatrics, which makes sense for children's hospitals, which could not fulfill some of the measures in Table 20 (those measures unique to adult care).   Others simply seem to represent additional measures.  I tried to tie table 21 measures to table 20, to try and identify the "Alternative" component, but the exercise produced no benefit for me.  As for those 5 items not pediatric related ... they may simply be extra quality reports required under Medicaid. 

Perhaps someone reading this blog entry might help to resolve the couple questions raised under Medicaid. 

Jay Fisher | @JayRFisher

Do Multi-EHR Hospitals fulfil Meaningful Use Compliance more Easily?

As we review requirements, we find that for hospitals with multiple EHR systems in place, compliance changes, just a little. Click on the image to the left, here for a thoughtful, simplified illustration.  And have a little fun.

Seriously, though ... it seems that for Quality Reporting (if not many Meaningful Use Requirements) that multiple departmental EHR's might be involved in gathering the data for an individual requirement.    HITECH requires this data be drawn from your Certified EHR's.  Consider, for example the need to calculate an all-hospital 30 day re-admission rate.  Or (a possible scenario) you have an EHR in your OR that is not Certified, but have a general acute care EHR product which is Certified.  You might need to move data to qualify.  And to satisfy the need to do drug-drug or drug-allergy checks, you'll probably need to do it in each place in your clinical environment ... regardless of what vendor's product is being used. 

Bottom line - we think you've got to inventory all your EHR assets, and plan accordingly.

Jay Fisher | @JayRFisher

PHR, Portal, Patient Web ... What does HITECH Require?

I'll bet most of our hospital and physician clients are hearing a lot these days from vendors promising to make them HITECH Compliant.  And among those vendors will inevitably be purveyors of portal software, Electronic Personal Health Records and a whole raft of consultants promising to deliver Patient interaction nirvana.  Many EHR vendors have portals attached to their products, allowing patients access to their health record data in your hospital.  It might be useful to study the Proposed Rule’s language on PHR and Portal, and other Web Stuff. 

So, here we go … hospitals have two specific requirements. 

Requirement 1:

Hospitals must provide patients with an electronic copy of their health information (including diagnostic test results, problem list, medication lists, allergies, discharge summary, procedures), upon request.  The relevant measurement specifies that at least 80% of all patients who request an electronic copy of their health information must be provided it within 48 hours.

 

Requirement 2:

Hospitals must provide patients with an electronic copy of their discharge instructions and procedures at time of discharge, upon request, for at least 80% of all patients who request an electronic copy of their discharge instructions and procedures are provided it.

 

In both cases, the ruling identifies that electronic copies may be provided through a number of secure electronic methods (for example, personal health record (PHR), patient portal, CD, USB drive).  Relative to the format and content of these requirements, the Proposed Rule is generally silent.  (For a useful background on PHR, click here). 

 

Under a different topic, “Capability to exchange key clinical information”, the Proposed Rule provides and example of using a personal health record as a vehicle by which a patient could authorize a third party (i.e., insurance company) access to their data.  In that context the regulation provides for structured electronic format, or free text or scanned image when structured data is not available. 

Bottom line … this should be a fairly easy requirement from a technology standpoint, but with some interesting operational implications, standards definition, and a healthy dose of privacy and security guidelines. 

 

Jay Fisher | @JayRFisher

Monitoring Meaningful Use - Protect Your HITECH Compliance Officer!

MPS Partners. a business partner of C3 Healthcare Partners has developed a set of Microsoft Share Point Extensions around our Meaningful Use Monitor (MUM).  MUM was built to organize the processes of compliance with measuring, achieving and documenting compliance with every single HITECH Requirement. 

Click on the image to the right to look at this short video to get a sense of what we think is a great example of some of the tools, processes and organizational tasks most institutions will need to objectively and easily keep track of where they really stand relative to HITECH.  And once you are compliant ... MUM contains the tools to organize that proof for as long as you need to retain it for those prospective HHS Auditors!   

Jay Fisher | @JayRFisher

Who Creates Meaningful Use?

Sometime in the near future, hospital executives will start to sign Attestation statements to HHS, asserting their compliance with a relevant set of detail requirements on Meaningful Use of EHR in their institution.  It may be your Compliance Officer.  Perhaps your CFO, or even CEO.  Regardless, they will want some process by which they can be certain that all the relevant people have documented their commitment to compliance, too! 

Achieving Meaningful Use starts with your IT department installing a certified EHR software product.  In a lot of cases, hospitals will have multiple EHR's, some (or all) of which will need to be interfaced with relevant data passing between them.  But MU certainly does not end with installed product!  Physician practices need to incorporate CPOE.  Nursing notes are required for some criteria.  And Quality Reporting will have to be made from data residing in your EHR(s) ... much of which you probably don't capture there yet. 

More interfaces.  Additional Clinical Processes.  Sometimes, additional staffing to help get data into the right places.  Some type of monitoring, to make sure data really exists in the places where your policies say it will be. 

Sounds like a lot of people need to be involved. 

Jay Fisher | @JayRFisher

Via YouTube.

Because of Quality Reporting, you may need eMAR to Qualify for Meaningful Use

In one of our Advisory Panel discussions recently, we uncovered a need that may be quite advanced for Stage 1 hospitals.  Consider the following text from Quality Measure NQF 0374 on Page 1897 of the Federal Register:

"This measure assesses the number of patients diagnosed with confirmed VTE who received intravenous (IV) UFH therapy dosages AND had their platelet counts monitored using defined parameters such as a nomogram or protocol."

Since  each data element for your quality reports needs to reside in your EHR (The Two-Headed Beast of Quality Reporting), the above referenced quality report would need to store data on patients who "received intravenous UFH therapy dosages".   Once we state a need to track patients who received medications, we move from the realm of Order Entry, to Medication Administration.  Regardless of whether our EHR has this capability internally, or your hospital uses a separate sytem, you need to get that Medication Administration data into your EHR! 

A similar requirement for Medication Administration data exists in Quality Reports NQF 0437, NQF 0438, NQF 0371, NQF 0372, NQF 0373, NQF 0374, NQF 0376, NQF 0163, NQF 0148, NQF 0528, NQF 0151, NQF 0356, NQF 0527, NQF 0529. 

This is a high bar indeed!  According to the HIMSS EMR Adoption model's 2009 data, only 6.1% of hospitals have reached this far.  Regardless of your EHR Vendor's capabilities, this set of requirements implies implementation of practices (and possibly add-on tools) that will take many hospitals a while to get in place. 

Action Suggested: HHS has invited comment on which of the proposed qualilty measures should be deferred to 2012, and why. We think this set of measures should be deferred, based on HIMSS Adoption Model data, indicating that it is a bar too high in the short term.  If you are considering a filing of comment, perhaps this should be in your report to HHS!

Jay Fisher | @JayRFisher 

 

 

What kind of HITECH compliance documentation must providers maintain?

Once a provider has asserted compliance with all the HITECH rules and filed their attestation statement with CMS, what else is prudent to do?  We think that it is necessary to match up documentary proof for each individual requirement ... and possibly for each hospital department where that requirement is fulfilled! Here's our thinking:

1. You have to meet all the requirements and even if CMS relaxes this rule, most organizations will still need to be able to prove which ones were and were not met;

2. CMS retains the right to audit your compliance for up to 10 years after you've received funds. 

3. Some requirements may be met only through the coordinated effort of multiple EHR?s (in some hospitals), and the mix of technology, practices and requirements existing at some point in the past will change. 

4. You have to comply each year, individually, and based on the requirements active in that specific year.

5. Hospital management will want to know that what they are attesting to (compliance to the HITECH requirements) is backed by credible evidence. 

All together  we think it is necessary to document your proof for each requirement, for each year!  Now, click the green button, and enjoy our HITECH adventure!

via YouTube  

Meaningful Use Requires Meaningful Leadership

We ran across this post today by Edward Marx, CIO of Texas Health Resources. His opinion on the standards represented by the interim final rule and Stage 1 requirements is insightful. Very valuable information for hospital leadership.

How does Meaningful Use rule define CPOE?

With CPOE as a core (and perhaps difficult) requirement for both hospitals and physicians, some of our discussions have questioned the scope of the term.  Here's the language frompage 49 of the proposed rule (pages 1854 and 1855 in the federal register):

"We propose to define CPOE as entailing the provider's use of computer assistance to directly enter medical orders (for example, medications, consultations with other providers, laboratory services, imaging studies, and other auxiliary services) from a computer or mobile device.  The order is also documented or captured in a digital, strucuted and computable format for use in improving safety and organization.  For Stage 1 criteria, we propose that it willnot include the electonic transmittal of that order to the pharmacy, laboratory, ordiagnostic imaging center."

As to who can enter the order, see our post at http://www.everythinghitech.com/everything-hitech/2010/10/what-is-a-licensed-healthcare-professional-for-cpoe.html 

Any one have other thoughts?

Jay Fisher | @JayRFisher