HITECH Act mandates audits of health care providers to determine HIPAA compliance

By William O’Toole
O’Toole Law Group

HIPAA privacy and security audits are not looming out there on the horizon, they are happening now. The Health Information Technology for Economic and Clinical Health Act (HITECH Act) mandates audits of health care providers to investigate and determine if they are in compliance with the HIPAA Privacy Rule (effective in 2003) and Security Rule (effective in 2005). Today these audits are performed by KPMG under an almost $10 million contract with the Office of Civil Rights (OCR). As a reminder, HIPAA regulations require that health care providers perform periodic evaluation and updating of their own policies, procedures and safeguards with regard to the privacy and security of patient health information. Providers should actively review their internal policies and practices, both in preparation for what may come in terms of audits, and because it is a wise and prudent measure for protection of their organization in this ever-litigious society.

Still on the horizon but not here yet is the pending finalization of  HITECH Act regulations that will amend the HIPAA privacy, security and enforcement regulations. The Department of Health and Human Services issued its Notice of Proposed Rule in July 2010, which is the initial step in finalizing regulations that could eventually be published and enacted. With an extensive commentary response the final decision was delayed in 2011 but is expected to occur by the end of 2012. The amendments to HIPAA, if adopted, essentially put real teeth into the enforcement aspect in the event of non-compliance by a health care provider with the already present HIPAA requirements. Perhaps the most important element in the amendments to HIPAA is that mandatory penalties will be imposed for willful neglect on the part of the health care provider (Covered Entity in HIPAA terminology). It is not possible to explain today what “willful neglect” could be interpreted to mean in the future, but sound advice to providers includes once again a careful review of your existing policies and procedures with regard to the protection of patient information.

Although this post is targeted to providers, as a side note, for the Business Associate (HIPAA term referring to entities that provide services to health care providers that entail use of or access to patient information) audience, under certain situations The HITECH Act extends the imposition of both civil and criminal penalties under HIPAA to Business Associates, not just Covered Entities. As a general message of caution, this component of the health care industry should also take on the self-evaluation of existing policies, procedures and safeguards.

Another aspect to the impact of HITECH on HIPAA is that OCR was given the authority to enforce HIPAA Privacy and Security Rules and has been systematically investigating situations involving data breaches by health care providers. Since the enactment of HITECH thousands of breaches in the health care industry have been reported. Although penalties exist under current law, imposition is rare at this point. That said, two significant penalties were assessed in 2011 in excess of $1m and involved large health care organizations; it is expected that the occurrence will only increase in the future.

In summary, HITECH is here. Elements that are in force today require diligence, review, and oversight by all health care providers. Aspects to come if finalized further strengthen the importance of this advice.

The O’Toole Law Group specializes in managing the HIT acquisition process for healthcare CIOs.Contact him at: wfo@otoolelawgroup.com

Jim Tate, Meaningful Use Expert

2014: Stage 1 Meaningful Use and Stage 2? 

I thought as we moved deeper into Stage 1 Meaningful Use (MU) the questions would get easier. This is not always the case. A topic came up this week that drove me all the way back to the Final Rule. That’s right, I had to get a step ladder, pull the Rule down from the top shelf, and dust it off. I felt like Harry Potter in the Hogwarts Library. All roads lead to the Final Rule and this was no exception. The question on its surface was simple: “If a Medicare Eligible Professional’s initial year in the CMS EHR Incentive Program is 2014 what Stage of MU Criteria must they meet to be eligible for the incentives? The answer, surprisingly, is “Stage 1″.

You don’t have to believe me. Go to Table 1 on page 11 of the Final Rule and look for yourself. Table 1 documents that going forward we will have EPs (as well as EHs and CAHs) at different Stages in the same year. Now, of course Stage 2 has been delayed one year since this table was created, but the effect is the same.

Based on current rules we are set to have some Medicare EPs at Stage 1 and some at Stage 2 in 2014. It all depends on their initial year in the CMS EHR Incentive Program. Some medical practices will have providers at different Stages of MU, but all will be receiving incentives. At some point down the road every EP will have to be at the same Stage, but we simply don’t know what year that synchronization of Stages will be required. The Final Rule states: “However, due to the many comments on alignment starting in 2015 and our plan to engage in additional more rounds of rulemaking, we are removing discussion of actual alignment between the first payment year of an EP, eligible hospital, or CAH and the Stage of meaningful use they will be expected to meet for all years after 2014. Our policies for 2015 and subsequent years will be determined through future rulemaking.”

I ran across one other interesting fact about the MU timeline while poring over the fine print in the Final Rule: “Please note that nothing in this discussion restricts us from requiring additional stages of meaningful use (beyond stage 3) through future rulemaking.” Did I hear someone say Stage 4?

Jim Tate is a nationally recognized expert on the CMS EHR Incentive Program, certified technology and meaningful use and author of The Incentive Roadmap® The Meaningful Use of Certified Technology: Stage 1.

There is a new dimension, beyond that which is known to physicians. It is a dimension as vast as any medical clinic and as timeless as your patient records. It is the middle ground between implementation and meaningful use. It is an area which we call

Coming in February…the debut of The EHR Zone with Ron Sterling. Be the first to be notified when this online broadcast is launched!

On Thursday, January 5th the Center is holding an Open Door Forum on the Advance Payment Model. You can participate in the forum by teleconference from 2:30-4:00 pm EST and is for physician-based and rural ACOs wanting to learn more about participating in their Medicare Shared Savings Program. Last Fall CMS announced their new Advance Payment Model. ACOs selected to participate will receive upfront payments, recouped from the shared savings they earn.

The teleconferece will review the CMS application process. You can view a template of the application for the Advance Payment ACO Model on the new CMS Innovation website.The updated information on this page explains the application process and how to obtain login credentials for a future CMS web tool. CMS has made it clear that this template is for information purposes only. They will begin accepting applications through their forthcoming web tool.

CMS lists these key dates and deadlines:

• For April 1, 2012 Start Date:  The online application will become available for use on January 3, 2012 with final submitted applications accepted through February 1, 2012.
• For the July 1, 2012 Start Date: The online application will become available for use on March 1, 2012 with final submitted applications accepted through March 30, 2012.

The number and teleconference ID number to join is 1-800-837-1935, ID number of 39623933.

Expect the slideshow presentation for the teleconference to be posted on the CMS Advance Payment Model ACO Application webpage by the 5th.

You can also view all of the Innovation Center’s upcoming events.

As we close out 2011 with a look back at the topics we covered through our HITECH Answers news and update feed, we thought it would be helpful to recap the posts this year that provided much needed clarification on some of  the Stage 1 Meaningful Use objectives and measures.

These 10 posts by no means cover everything we wrote this year on meaningful use; they do, however, address many of the questions raised by our readers.

1. Recording Smoking Status on at least 50% of all unique patients 13 years old or older
2. CMS Update Heart Failure CQM
3. Meaningful Use and Documentation of Vital Signs
4. Do Specialists Have to Meet All Meaningful Use Objectives
5. Certified Software and Meaningful Use Exclusions
6. Meaningful Use and the Patient Portal
7. Meaningful Use and Clinical Summaries
8. Meaningful Use and Exchange of Clinical Information
9. Meaningful Use Measure and HIPAA
10. Meaningful Use and the Patient Encounter 

The healthcare industry is not immune to top lists.  There are so many, in fact, that we had a tough time narrowing the field down to just ten.  Here are our picks:

1. Top Ways Information Technology is Transforming Healthcare
2. Top 10 Healthcare Challenges for 2012 
3. 10 Challenges Healthcare CEOs Can No Longer Ignore
4. Top Health Industry Issues of 2011
5. Top Health Technology Challenges for 2012 
6. Top 10 Trends for Healthcare and Wellness in 2012
7. Top 10 Highest Paying Medical Jobs 
8. Top 10 In Demand Healthcare Occupations 
9. Top ICD-10 Pitfalls
10. Modern Healthcare’s list of lists

Ron Sterling
Sterling Solutions
Author: Keys to EMR/EHR Success

Completing EHR Rollout Before Tackling ICD-10

On October 1, 2013, practices will start submitting claims using the ICD-10 coding system.  Any practice planning on using EHR systems to facilitate the transition to ICD-10 needs to take a close look at the practicality of implementing an EHR in time to support ICD-10 coding.

“This interim final rule with comment period revises the regulations implementing medical loss ratio (MLR) requirements for health insurance issuers under the Public Health Service Act in order to establish rules governing the distribution of rebates by issuers in group markets for non-Federal governmental plans.”

The effective date for the rule is January 3, 2012. Comment period end no later than 5 p.m. on February 6, 2012. The amendments to Part 158 generally apply beginning January 1, 2012, to health insurance issuers offering group health insurance coverage.

Related Rule:  Medical Loss Ratio Requirements Under the Patient Protection and Affordable Care Act

Check out Kaiser Health News, they have compiled a variety of articles on the rules.

Jim Tate, Meaningful Use Expert

2011: Unsung Hero of the CMS EHR Incentive Programs

I would like to raise a glass of thanks and praise to one of the groups in the background that are rarely acknowledged for their work in spurring HIT adoption. Someone had to step up and take on the difficult task of assuring that EHRs are tested and certified to make sure the technology meets the technical functionality outlined in the Standards & Certification Criteria Final Rule. That group is the ONC-Authorized Testing and Certification Bodies (ONC-ATCB).

These organizations submitted to an extremely rigorous due diligence process to be selected to spearhead the Temporary Certification Program. Many who applied did not make the cut. I can tell you from personal experience that the ones that did are good. Very good. In my work supporting the certification efforts of over 150 HIT vendors I have worked numerous times with  every ONC-ATCB that has been authorized to test and certify Complete EHRs and EHR Modules. I have been with my clients through the certification process with ICSA Labs, SLI Global Solutions, InfoGard Laboratories, CCHIT, and the Drummond Group. Whoever selected these entities should be congratulated. Without exception I have found every one of the ONC-ATCBs more than willing to provide the necessary clarification and guidance to assist vendors. They all respond timely to requests. They all provide flexibility to the scheduling needs of vendors.

Perhaps the most striking thing to me is that the 5 ONC-ATCBs who test and certify Complete EHRs (not including Surescripts as they are only authorized to test and certify EHR Modules: E-Prescribing, Privacy and Security) is the consistent level of testing they have achieved. Sometimes a potential vendor client will ask me, “Who is the easiest to test with”? My answer is always the same. “There is no difference in the actual testing”. To me that is a giant accomplishment and brings credibility to the process. Other things may differentiate one ONC-ATCB from another but it is not in support or testing.

So again, I raise a glass to the ONC-ATCBs. Thank you. I know what you accomplished in the past year. You were handed a mission shackled with regulations and you delivered.

Jim Tate is a nationally recognized expert on the CMS EHR Incentive Program, certified technology and meaningful use and author of The Incentive Roadmap® The Meaningful Use of Certified Technology: Stage 1.

In our recovery room posts we highlight events and news that have happened and didn’t report but still think are interesting.

Will Medicare’s Demonstration Project program help us decide how physician’s get paid in the future? Three new projects will launch in January targeting factors leading to improper payments. Here is a summary of the projects from Nurse.com. The AMA gave us some history and statistic on Medicare Demonstration Projects. Are they “well-suited to the payment reform issue”? Here is what they say.

InformationWeek is reporting Health insurance provider Capital District Physicians Health Plan (CDPHP), a NY health insurer, is offering $1 million to help 800 of their network specialist to implement EHRs and connect to the NY HIE (HIXNY). The company has already invested $10 million helping their providers with electronic medical records and interoperability. Read the article, Insurer’s Dollars Push Specialists Onto EHR Highway.

There has been a lot of buzz around the resignation of CMS Administrator Don Berwick. His last day was on Thursday and the NY Times reported on his interview and parting words. Most noted was his comment on how he sees the future. “We are a nation headed for justice, for fairness and justice in access to care. We are a nation headed for much more healing and much safer care. There is a moon shot here. But somehow we have not put together that story in a way that’s compelling.” Hailing from Boston, Berwick’s home town paper the Globe thinks their city and academics are getting a raw deal. Read this recent editorial, Senate GOP scapegoats another local academic. And in his short 17 months on the job what did he do? Kaiser Health News weighs in on his Top Five Accomplishments.

Have a good week.