HITECH Act mandates audits of health care providers to determine HIPAA compliance

By William O’Toole
O’Toole Law Group

HIPAA privacy and security audits are not looming out there on the horizon, they are happening now. The Health Information Technology for Economic and Clinical Health Act (HITECH Act) mandates audits of health care providers to investigate and determine if they are in compliance with the HIPAA Privacy Rule (effective in 2003) and Security Rule (effective in 2005). Today these audits are performed by KPMG under an almost $10 million contract with the Office of Civil Rights (OCR). As a reminder, HIPAA regulations require that health care providers perform periodic evaluation and updating of their own policies, procedures and safeguards with regard to the privacy and security of patient health information. Providers should actively review their internal policies and practices, both in preparation for what may come in terms of audits, and because it is a wise and prudent measure for protection of their organization in this ever-litigious society.

Still on the horizon but not here yet is the pending finalization of  HITECH Act regulations that will amend the HIPAA privacy, security and enforcement regulations. The Department of Health and Human Services issued its Notice of Proposed Rule in July 2010, which is the initial step in finalizing regulations that could eventually be published and enacted. With an extensive commentary response the final decision was delayed in 2011 but is expected to occur by the end of 2012. The amendments to HIPAA, if adopted, essentially put real teeth into the enforcement aspect in the event of non-compliance by a health care provider with the already present HIPAA requirements. Perhaps the most important element in the amendments to HIPAA is that mandatory penalties will be imposed for willful neglect on the part of the health care provider (Covered Entity in HIPAA terminology). It is not possible to explain today what “willful neglect” could be interpreted to mean in the future, but sound advice to providers includes once again a careful review of your existing policies and procedures with regard to the protection of patient information.

Although this post is targeted to providers, as a side note, for the Business Associate (HIPAA term referring to entities that provide services to health care providers that entail use of or access to patient information) audience, under certain situations The HITECH Act extends the imposition of both civil and criminal penalties under HIPAA to Business Associates, not just Covered Entities. As a general message of caution, this component of the health care industry should also take on the self-evaluation of existing policies, procedures and safeguards.

Another aspect to the impact of HITECH on HIPAA is that OCR was given the authority to enforce HIPAA Privacy and Security Rules and has been systematically investigating situations involving data breaches by health care providers. Since the enactment of HITECH thousands of breaches in the health care industry have been reported. Although penalties exist under current law, imposition is rare at this point. That said, two significant penalties were assessed in 2011 in excess of $1m and involved large health care organizations; it is expected that the occurrence will only increase in the future.

In summary, HITECH is here. Elements that are in force today require diligence, review, and oversight by all health care providers. Aspects to come if finalized further strengthen the importance of this advice.

The O’Toole Law Group specializes in managing the HIT acquisition process for healthcare CIOs.Contact him at: wfo@otoolelawgroup.com

Jim Tate, Meaningful Use Expert

2014: Stage 1 Meaningful Use and Stage 2? 

I thought as we moved deeper into Stage 1 Meaningful Use (MU) the questions would get easier. This is not always the case. A topic came up this week that drove me all the way back to the Final Rule. That’s right, I had to get a step ladder, pull the Rule down from the top shelf, and dust it off. I felt like Harry Potter in the Hogwarts Library. All roads lead to the Final Rule and this was no exception. The question on its surface was simple: “If a Medicare Eligible Professional’s initial year in the CMS EHR Incentive Program is 2014 what Stage of MU Criteria must they meet to be eligible for the incentives? The answer, surprisingly, is “Stage 1″.

You don’t have to believe me. Go to Table 1 on page 11 of the Final Rule and look for yourself. Table 1 documents that going forward we will have EPs (as well as EHs and CAHs) at different Stages in the same year. Now, of course Stage 2 has been delayed one year since this table was created, but the effect is the same.

Based on current rules we are set to have some Medicare EPs at Stage 1 and some at Stage 2 in 2014. It all depends on their initial year in the CMS EHR Incentive Program. Some medical practices will have providers at different Stages of MU, but all will be receiving incentives. At some point down the road every EP will have to be at the same Stage, but we simply don’t know what year that synchronization of Stages will be required. The Final Rule states: “However, due to the many comments on alignment starting in 2015 and our plan to engage in additional more rounds of rulemaking, we are removing discussion of actual alignment between the first payment year of an EP, eligible hospital, or CAH and the Stage of meaningful use they will be expected to meet for all years after 2014. Our policies for 2015 and subsequent years will be determined through future rulemaking.”

I ran across one other interesting fact about the MU timeline while poring over the fine print in the Final Rule: “Please note that nothing in this discussion restricts us from requiring additional stages of meaningful use (beyond stage 3) through future rulemaking.” Did I hear someone say Stage 4?

Jim Tate is a nationally recognized expert on the CMS EHR Incentive Program, certified technology and meaningful use and author of The Incentive Roadmap® The Meaningful Use of Certified Technology: Stage 1.

America has a love hate relationship with the Internet. On the one hand we love getting our information right now, on the other we can’t stand the invasion of privacy that comes with it.

If you are paying attention to more than Google’s doodles these days you are aware of major changes to their privacy policy. Beginning in March, they are consolidating the policies across services which means Google will use data across these services. Of course this has to do with advertising and more money. If I sell boutique maternity clothes, getting in front of women of a particular age group or better yet “expecting a child”, will in theory yield better returns on my advertising dollars. And I will pay more for this advertising. Google has confirmed that you can still opt out of the monitoring of user habits and continue to set your preferences.

Health Information Exchanges are experiencing the same love hate relationships with patients. As the exchanges are being formed the patient privacy issues and policy making on opting in or opting out are front and center. Besides consolidating patient records for accessibility, exchanges have the potential to improve the public health and public health activities. The sheer volume of exchange data could be used in physician base diagnoses, diseased-based non-reportable laboratory data, public health surveillances, and population-level quality monitoring.

But what if everyone opts out? We all want the benefits that come from monitoring user habits on Google. We all need the potential benefits that come from the collection of populations of clinical data. When people choose to opt out are they really looking at the bigger picture?

Marilyn Tavenner the current acting administrator for CMS took the podium to continue her predecessor Berwick’s “triple aim” goals of better individual health care, better population health, and reduction of per capita costs. She expressed the urgency of everyone’s job to get things done in the 24 months before most of the Affordable Care Act kicks in. And she states, “that is where the Innovation Center becomes so important.” CMS is depending on the new Innovation Center to utilize its public and private partnerships and transform ideas into action. They have already launched delivery system initiatives which are testing new models.

While Tavenner is forging on as acting CMS Administrator it is still uncertain if she will truly get the job. For an agency that controls over 20% of the national budget you might think it would be a priority to have its head confirmed and in place. Not so as this position has been like temporary housing for the past few years. And it is beginning to look like it won’t change. President Obama nominated Tavenner after Berwick resigned when his recess appointment came to an end last December. Congress is returning and facing pressure to resolve the Medicare physician payment formula or providers will soon find their reimbursements cut. And Travenner’s yet to be scheduled confirmation hearing might be right in the middle of all of that. Obama could have done a repeat for the CMS position this last recess but made bigger news with the appointment of someone that had no chance of confirmation, Richard Cordray to the Consumer Financial Protection Bureau. So will that ultimately be the downfall of Tavenner? Will there be retaliation over Cordray’s appointment on Tavenner’s confirmation? Only time will tell.

Have 30 minutes? Tune in and listen to MU Live!
MU Live! is a 30 minute talk radio style show hosted by our HITECH Answers experts. Our session experts discuss breaking news and issues on meaningful use as well as other health IT topics.

Register to participate and listen in to our next show.

February 7, 2 pm EST: HITECH Answers brings best-selling AMA author and renowned HIPAA expert Carolyn Hartley to our program. With the recent release of the 2nd Edition of EHR Implementation: A Step-by-Step Guide for the Medical Practice we will be talking to Carolyn about the challenges facing providers today in integrating an EHR.

Click Here to Register

Want to be notified by email of upcoming shows and guests? Sign up here and keep up to date on our MU Live! programming in 2012.

CMS EHR Incentive Program Update

Calling 888-734-6433 will connect you to the CMS EHR Information Center Interactive Voice Response System (IVR) System. CMS has announced upgrades and new features to this system to assist you with topics like registration and attestation.

The upgrades will enable EHR Incentive program participants to obtain information on the program easily and more efficiently. From the main menu, press 1 for Hot Topics and press 2 for Information on NPPES and PECOS password resets. There are 8 hot topics and 2 selections the NPPES and PECOS. The service is available 7/24 except during planned system maintenance. The TTY number is 888-734-6563. You can also speak to a specialist through this system also by pressing “0″. The hours of operation for the EHR Information Center are Monday through Friday, 7:30am to 6:30pm CST except federal holidays.

Along with changes to the IVR system, CMS has also updated information on the EHR Incentive Programs on their web site. You can find new information on the Attestation pages about the appeals process for the program. Appeals for Eligible Professionals, Eligible Hospitals, and CAHs have been accepted since last December. The CMS Office of Clinical Standards and Quality (OCSQ) is also providing guidance on how to file an appeal. Their Division of Health Information Technology is tasked with review of appeals. On January 19th the division released the first informal review decision for the EHR Incentive Program. CMS expects informal review and appeal decisions to be posted on their web site by February. And by March, providers will be able to find receive their decisions through an appeals portal.

This week at the Care Innovations Summit, the ONC announced its newest challenge, a discharge follow-up appointment care transitions. The challenge is to use information technology to make transitions of care easier and safer especially patient discharges from hospitals. The thought is to create web applications that could empower patients and caregivers to better manage transitions from inpatient to home.

Announcing the new challenge at the Summit fit right in with its agenda focusing on care transitions, gaps in care coordination, and better care and health at a lower cost. The summit was co-hosted by the ONC, CMS, West Wireless Health Institute and Health Affairs. ONC Farzad Mostashari reinforced the challenges need while making the announcement, “Scheduling post-discharge follow-up appointments is critical, but not easy for patients or providers and we’re excited by the possibilities that will stem from this challenge.” For more information on the Care Innovation Summit visit their web site or read the Twitter feed during the event, #cisummit.

18th Annual Wharton Health Care Business Confernce, February 16-17 in Philadelphia, PA

A leading health care business forum for industry professionals, academics, and students. This year’s theme is “Innovation in a Changing Health Care Environment” hopes to explore the “continuing evolution of health care and the leadership needed in both domestic and international markets”. Keep up to date on the upcoming event and follow them on Twitter.

HIMSS12 Annual Conference & Exhibition, February 20-24 in Las Vegas
Expecting to top their 31,000 attendees from last year, this year it takes place at the Venetian-Palazzo-Sands Expo Center. Pre-conference programs will be held on Monday, Feb. 20, with conference days from Tuesday, Feb. 21-Thursday, Feb. 23. The 2012 Exhibition Hall will be open on Tuesday, Feb. 21 – Thursday, Feb. 23. HIMSS tells us the conference is the “most complete collection of educational sessions, the largest and most extensive technical exhibition, and the strongest networking opportunities in the healthcare IT industry.” Can’t attend this year, check out their Virtual Events.

The 30th Annual Emergencies in Medicine Conference, March 4 – 8, 2012 in Park City, UTThis 5-day conference focuses on virtually every aspect of emergency medicine through case-based lectures and audience interaction. From disaster planning to wound care and pain management, quality mandates, practice management and economics, each of these educational areas is timely and central to the emergency physicians effort to maintain medical excellence while navigating the evolutionary changes taking place throughout the healthcare system. Attendees will include emergency, primary care and critical care physicians, residents emergency nurses, nurse practitioners, hospital administrators, EMT/paramedics, and physician assistants.

The iMedicine & Mobile Life Sciences World Summit, March 21-22 in Boston MA
Check out Boston post St. Patrick’s Day with this mHealth summit. The key themes this year include eClinical trials, the handheld doctor, therapy area apps, eclinics and telemedicine, smart tablets, integrated multi-channel social media case studies and personalized iMedicine.

iHT2 Health IT Summit, March 27-28, 2012 in San Francisco, CA
C-level, physician, practice management and IT decision-makers from leading provider organizations and physician practices will be in attendance of this event. In its seventh year, the summit will focus on the strategies and tools that are re-defining customer care, collaboration and efficiency in the healthcare provider markets. New this year will be the latest implication of ARRA and what it means for your practice or hospital.

35th Annual Rural Health Conference, April 17-20, 2012 in Denver, CO
The nation’s largest rural health conference, created for all of those with an interest in rural health care, including rural health practitioners, hospital administrators, clinic directors and lay health workers, social workers, state and federal health employees, academics, community members, and all others interested in rural health care. Early registration discounts are before March 26.

Physicians Practice LIVE 2012! April 25th, a Virtual Conference
Enjoy this free conference without any travel. Physicians Practice is a leading practice management resource for physicians and administrators around the world. A full day focused around practice management including today’s hot topics, and the newest products and services. Register now to get your virtual seat.

Ron Sterling
Sterling Solutions
Author: Keys to EMR/EHR Success

Why Are Patient Portals More Important Than You Think?

Patient portals facilitate the exchange of information between patients and physician practices. What was once considered a nice option for your EHR is becoming a necessity. Unfortunately, not all patient portals offer the same features. Failure to acquire an adequate patient portal could limit your EHR benefits and increase your costs.

Patient portals facilitate the exchange of information on clinical and administrative issues. Patient portals can help you get updated patient demographic information, and new insurance information as well as coordinate appointment scheduling, and process payments. Clinical patient portal features include requesting refills, exchanging messages, reminding patients about treatment plan items, and accessing patient exam notes. Patient portals can also collect patient family/social history and even history of present illness as well as monitor patient wellness on a periodic basis. Clinical information may be accepted directly into the patient note for editing by the doctor or staff. Thereby, you save time documenting patient conditions and history.

From a product development standpoint, patient portals have paralleled the EHR industry. Originally, most patient portals were developed as stand-alone products that were painstakingly interfaced with EHR and medical billing systems. Many EHR vendors have now established joint marketing programs with patient portal vendors or purchased patient portal products. In other words, your ability to pick “best of breed” patient portals to work with your EHR is rapidly diminishing.

The lack of patient portal choices is not a trivial issue. Not all patient portal strategies are based on the same principles or support the same features. Indeed, many vendors have patient portal strategies that meet the minimum for Meaningful Use and not necessarily present an efficient or effective way to collaborate with patients. For example, some patient portals only support medical billing exchanges and do not deal with any clinical information.

Patient portal evaluations should consider the following key issues:

Cost
One of the surprise patient portal issues is the pricing model. As EHRs have become very competitive on price, patient portal costs have shot up. Typically, practices look at patient portal add ons after the fact and do not completely consider patient portal costs.
Patient portal costs may include upfront software, installation, annual maintenance, and a per transaction fee. Transaction costs may be assessed for each transaction through the portal. For example, you may pay a transaction fee for each patient reminder, message and released office note. Transaction costs could grow into a significant portion of your computer costs as the patient portal is deployed for use. The patient portal costs need to be effectively projected to understand the full scope of the EHR financial commitment.

Meaningful Use
Patient portals are a convenience under Meaningful Use Stage 1, and a necessity under Meaningful Use Stage 2. Stage 1 includes a core measure to provide clinical summaries for office visits. There are a number of clinical summary delivery options including paper summaries, CD, and secure email as well as patient portal. However, looking at the costs and logistical issues of providing summaries, a patient portal provides the most cost effective and patient service oriented strategy to fulfill this MU measure.Stage 2 of Meaningful Use includes patient messaging which will require a patient portal strategy.

EHR Working Strategy
Patient portals have a number of different EHR working strategies. In some cases, the patient portal sends messages which must be manually interpreted and processed by the medical staff. In other cases, the patient portal generates targeted messages that are connected to the relevant EHR information and features. For example, some patient portals will send a message that a patient has requested a refill of a particular drug. The clinician has to locate the drug in the patient chart to issue the refill. Other patient portals will connect the refill to the patient medication record. When you look at the patient summary, you see the refill request message and the highlighted refill drug on the medications list.

Features
Patient portals may dramatically differ in the supported features and interactions. For example, some patient portals only support secure messaging to fulfill Stage 2 Meaningful Use. Other patient portals products support a complete exchange of specific information on patient care issues. For example, some patient portals can present condition specific forms for patients to fill out. The information on the form can be accepted into the patient chart by the doctor or nurse. The patient portal features may affect your implementation strategy and EHR use. For example, patient portals that are limited to messages would frequently be implemented after the EHR was in use for the majority of active patients. However, patient portals that accept information on family and social history as well as history of present illness will be an invaluable tool to help introduce a patient to the EHR.

An expanding list of patient service agendas requires a patient portal strategy and effective workflows between the patient portal and your EHR. Unfortunately, many practices have not carefully examined the patient portal strategy of their EHR vendor and the implications of the patient portal to their EHR strategy and use. EHR buyers should understand the specifics of the companion patient portal to their EHR options and consider the features and costs of such portals in their evaluation as well as their EHR implementation strategy.

Ron Sterling authored the HIMSS Book of the Year Award winning Keys to EMR/EHR Success. He is a nationally recognized EHR expert with the information that you need to improve patient service and performance. He can be contacted at rbsterling@sterling-solutions.com.

Jim Tate, Meaningful Use Expert

Does Meaningful Use require the physician be the one to enter patient data into a certified EHR?

One intriguing Meaningful Use question arrived by email last week. The question boiled down to this: “Does the Eligible Professional have to actually be the one that enters data into their Certified EHR to receive the CMS incentives? Can a designated staff member actually input all the data for the provider?” Well, the answer is that with minor exceptions the provider does not even have to directly interact with the EHR. It is perfectly acceptable for providers to have a staff member function as what has become known as a “scribe” to enter all documentation into a patient’s electronic record. Under the CMS Stage 1 EHR Incentive Programs there is no requirement that the EP who receives the incentives must input the data.

The meaningful use requirements are focused on having a patient’s electronic records used in certified EHR technology, not on who might have entered the data. For Stage 1 there is no requirement for a provider to be the one that enters or signs off on orders, adds problems to the problem list, or updates the med list. All this can be done by what CMS call a “licensed healthcare professional”. From my research it appears that the only action that must absolutely be performed by the provider is e-prescribing which requires them to be the individual actually logged into the system to legally issue the prescription.

CMS has provided clarifying guidance on this issue in their FAQs. Question: “Is the physician the only person who can enter information in the electronic health record (EHR) in order to qualify for the Medicare and Medicaid EHR Incentive Programs? Answer: “No. The Final Rule for the Medicare and Medicaid EHR incentive programs, specifies that in order to meet the meaningful use objective for computerized provider order entry (CPOE) for medication orders, any licensed healthcare professional can enter orders into the medical record per state, local, and professional guidelines. The remaining meaningful use objectives do not specify any requirement for who must enter information.”

Jim Tate is a nationally recognized expert on the CMS EHR Incentive Program, certified technology and meaningful use and author of The Incentive Roadmap® The Meaningful Use of Certified Technology: Stage 1.