VITL Summit: Meaningful Use Audit Info September 24, 2013 Heather EJ Kendall, PhDPriscilla Phelps Program & Operations Auditor, eHealth Specialist Lead, Department of VT Health Access VT Information Technology Leaders

2 Heather - Incentive program audit background VT Medicaid EHR Incentive Program audit process VT Medicaid appeals process Priscilla - Medicare EHR Incentive Program Audit process Essential documentation needed Interactive discussion on providing proof

3 Eligible Professional : (EP) payments: 675 A/I/U 232 MU 907 total Eligible Hospital (EH) payments: 10 A/I/U 9 MU 19 total Eligible Professional : (EP) payments: 675 A/I/U 232 MU 907 total Eligible Hospital (EH) payments: 10 A/I/U 9 MU 19 total 2011 A/I/U MU Conversion Rate 354 EPs attested to A/I/U, 208 of these EPs have also attested to Meaningful Use: 58.8% ! 2011 A/I/U MU Conversion Rate 354 EPs attested to A/I/U, 208 of these EPs have also attested to Meaningful Use: 58.8% !

Federal Regulation 42 CFR § of the Health Information Technology for Economic & Clinical Health (HITECH) Act, Combating fraud and abuse (a) General rule (1) The State must comply with Federal requirements to: (i) Ensure the qualifications of the providers who request Medicaid EHR incentive payments; (ii) Detect improper payments; and (iii) In accordance with § and § of this chapter, refer suspected cases of fraud and abuse to the Medicaid Fraud Control Unit. (2) The State must take corrective action in the case of improper EHR payment incentives to Medicaid providers. 4

Department of Vermont Health Access (DVHA) auditors will conduct audits on Medicaid providers: Eligible Professionals (EPs) that attested to adopting, implementing, upgrading (A/I/U). EPs that attested to being a Meaningful User (MU) of certified EHR technology. Medicaid & dually Eligible Hospitals (EHs) that attested to A/I/U. The eligibility portion of Medicaid & dually eligible hospital MU attestations. 5

CMS must approve state audit strategy Pre-payment validation Post payment audits Procedures vary depending upon year and stage in the program Adopt/Implement/Upgrade (A/I/U) Meaningful Use (MU) Patient encounter definition Time frame 6

Risk assessments CMS-approved risk factors Performed on all Eligible Professionals (EPs) & Hospitals (EHs) Random sampling 7

A/I/U stage – primarily desk audits Eligibility requirements MU stages – desk & onsite audits Eligibility requirements MU measure requirements Fraud, waste, or abuse Suspected cases will be referred to the Attorney Generals Medicaid Fraud Unit 8

CMS Guidance for EHR Incentive Program Audits Providers who receive an EHR incentive payment for either the Medicare or Medicaid EHR Incentive Program potentially may be subject to an audit. Retain ALL relevant supporting documentation used in the completion of your attestation, including documentation to support data for meaningful use objectives and clinical quality measures (CQMs), for six years post-attestation. Retain documentation that is in either paper or electronic format, including relevant screenshots. Download and/or print a copy your MU report at the time of attestation for your records.

An audit may include a review of any of the documentation needed to support the information that was entered in the attestation. Maintain copies or have access to: Signed attestations submitted via MAPIR Purchase orders, contracts, etc. related to your certified EHR system Reports or other documentation used to verify patient volume numerator & denominator Reports or other documentation to support meaningful use Hospitals should also maintain documentation that supports their payment calculations, such as cost reports Any other documentation to support the attestation 10

Not all certified EHR systems are capable of tracking compliance for yes/no measures. 11 Meaningful Use Objective Audit ValidationSuggested Documentation Drug Formulary ChecksFunctionality is available, enabled, & active for the duration of the reporting period. One or more screen shots from the certified EHR that are dated during the selected reporting period. ExclusionsDocumentation to support each exclusion to a measure claimed by the provider. Report from the EHR that shows a zero denominator for the measure or otherwise documents that the provider qualifies for the exclusion

If selected for an audit, likely receive a desk audit notification letter Sent by both & certified mail Request for documentation to support attestation, such as: Patient volume data MU report Audit tool questionnaire Due date Use secure portal to submit data Auditor will follow up as necessary 12

If selected for an audit, may receive onsite audit notification letter Sent by both & certified mail Will be contacted to schedule date Documentation may be requested in advance of onsite visit Onsite audit preparation Supporting documents EHR system report, audit logs, system settings Evidence to support submission of data for Public Health Measures Print screens demonstrating functionality Coordinate with personnel knowledgeable of EHR system to be available for interviews & to discuss supporting documentation EHR demonstration may be required during onsite review 13

Sent by certified mail and Includes audit results and any identified discrepancies If EP/EH successfully meets the A/I/U or MU requirements, then they pass the audit If one or more of the requirements is not met, then they fail the audit Must return incentive payment or appeal decision within 30 days of receiving audit results letter EHR incentive program Return Payment form Appeals process details included in letter 14

The appeals process aligns with that of the VT Medicaid program, which is detailed in Section 1.26 of the Green Mountain Care Provider Manual. First Level: Reconsideration by DVHA Provider has 30 days to file for reconsideration from the date of receipt of the audit results letter Review is performed by member of EHR audit team Must submit documentation that would affect audit findings Second Level: DVHA Commissioner Third Level: Vermont Superior Court 15

Very similar to Medicaid audits CMS contracted with Figliozzi and Company Conduct post-payment audits throughout the life of the program January, 2013 attestations and beyond open to pre- payment audits Medicare EPs and EHs Medicare & Medicaid dually eligible EH MU attestations Eligible Professionals (EPs) are audited, not the organization Except Eligible Hospitals/Critical Access Hospitals

Selected for an audit – Initial request letter sent via to the address provided during registration Review of documentation – desk audit Potential for on-site audit May require a demonstration of the EHR Secure communications for "sensitive" info Primary documentation will be source documents used during attestation

Audit Determination Letter – pass/fail All or nothing… Incentive recouped if EP is ineligible or fails This still counts as a year in the program Demand letter is sent to the Taxpayer Identification Number (TIN) to which the incentive was dispersed What if the associated TIN paid the incentive to the EP?

Providers are to direct audit questions to Figliozzi and Company at: Phone: (516) x302 Website: Appeals process: Call EHR Information Center at

CMS will not make the risk profile public 1 What may make an EP at risk for an audit? Differences in unique patient denominators that should all be the same Odd denominators – office visits less than unique patients; medication reconciliation and/or summary of care greater than office visits Previously audited EHRs with known issues/problems What else? 1. CMS Audit Presentation for the RECs

Keep supporting documents... for 6 years! Post-attestation What do you need? Proof certified EHR was utilized/in place MU reports from your EHR Reporting period dates – must match attestation! Numerators and denominators Evidence to support it was generated for that EP – NPI/name Documentation to support yes/no measures Proof to support each exclusion Security Risk Analysis (SRA) report and plan Documentation for 50% encounters on EHR

Screen shots may be used to: Indicate your patient list was generated from your certified EHR Prove functionality was enabled Document yes attestations Need to have dates from the reporting period Indicate EPs name and date of screen shot Auditors may request multiple screenshots to prove functionality was activated throughout the reporting period How do you manage multiple screen shots?

No percentage that must be met, but May be asked to prove: Reported what was captured by the EHR Evidence that the report was generated for the EP Cannot meet any other CQM, if you reported zeros What issues may arise? Some EHRs do not have all CQMs available Recommend capturing more CQMs than required Pick and choose which to report during attestation

Better not be a checklist!! Identify: EHR and version, certification ID from CHPL Initial and subsequent dates of review BEFORE the end of the reporting period! Name and NPI numbers of EPs involved CMS Certification Number – for hospitals Mitigation plan in place for deficiencies Security updates implemented before attesting Copies of policies/procedures as support

…to be a meaningful EHR user an EP must have 50 percent or more of their patient encounters during the EHR reporting period at a practice/location or practices/locations equipped with Certified EHR technology (Stage 1 MU Final Rule p ) EPs must be prepared to provide documentation Reports Practice Management System Billing from all practices Other ways?

Drug-drug, drug-allergy, clinical decision support, and drug formulary: Screenshots of the drug interaction checks/alerts firing on the first and last day of reporting period A letter from the vendor stating that: Functionality was enabled during the entire reporting and cannot be turned off There is no mechanism to prove the functionality was in place and uninterrupted for the entire reporting period Additional ideas?

Fewer than 100 Rx during reporting period Believes no relevance to scope of practice No requests for electronic copy of records Order no lab tests with +/- or numeric result Not the recipient of a transition of care Neither transfers nor refers to another provider Administer no (zero) immunizations Immunization registry doesnt have the capacity to receive information electronically Thoughts?

Do you know the steps to request the immunization registry interface? Have you requested this interface? 29

May need to prove: Eligibility to take the exclusion(s) Test of certified EHRs ability to submit Have proactively requested the interface required The registry is/was unable to accept information VT Immunization Registry live as of 2/20/13 VITL has many requests logged On-boarding process will take time Submit a MyVITL ticket to request the interface After 10/1/13 – VDH will have a process Form for registration of intent

31

Need to keep in electronic or paper format Or both! Compile at or before attestation Do not try to recreate after the fact Suggestions: Establish a binder or folder Electronic or paper Copy, scan or otherwise assemble ALL documents Include reports, screen shots, any EHR upgrade info If electronic, back up to a flash drive Store flash drive in safe, secure place

Have a plan in place for EPs who leave Stay current with requirements and changes Print the summary report at the end of attestation (PDF) Customized reports – Retain documentation of how data is reported For all reports/documentation consider – Screen shots of the generation of these reports Saving report to a PDF to prove modifications havent been done post-attestation Naming convention – Problem List Dr. Smith 2012 Develop an EP tracking tool and file system

Contact Information: 36