1. Electronic Submission of Medical Documentation (esMD) for Medicare FFS Presentation to HITSC Provenance Workgroup January 16, 2015

2. Improper Payment www.paymentaccuracy.gov  Medicare receives 4.8 M claims per day.  CMS’ Office of Financial Management estimates that each year (based on 2013 audit information) o the Medicare FFS program issues more than $36.0 B in improper payments (error rate: 10.1%). o $21.7 B of improper payment is due inadequate documentation to support payment for services billed o $10.1 B of improper payment is due to services that were not medical necessary based on Medicare coverage policies  1.8 million Medical Documentation Requests are sent annually by: Medicare Administrative Contractors (MACs) Medical Review (MR) Departments Comprehensive Error Rate Testing Contractor (CERT) Payment Error Rate Measurement Contractor (PERM) Medicare Recovery Auditors (formerly called RACs)

3. PCG/esMD Goals  Prevent improper payment through prior-authorization (e.g. PMD) pre-payment review  Minimize provider burden through electronic communication of medical information (esMD) structured data to facilitate review process digital signatures to establish data integrity and provenance  Adopt/promote standards to facilitate information exchange electronic transaction standards Messaging standards Content standards Digital Signature standards

4. esMD Background Phase I of esMD was implemented in September of 2011. It enabled Providers to send Medical Documentation electronically 4 Review Contractor Provider Request Letter Paper Medical Record Phase 1: Doc’n Request Letter electronic Phase 2: Before esMD: Healthcare payers frequently request that providers submit additional medical documentation to support a specific claim(s). Until recently, this has been an entirely paper process and has proven to be burdensome due to the time, resources, and cost to support a paper system. The ONC S&I Framework Electronic Submission of Medical Documentation (esMD) initiative is developing solutions to support an entirely electronic documentation request.

5. CMS esMD Utilizes CONNECT Content Transport Services Structured Electronic Requests for Medical Documentation CONNECT Compatible Medicare Recovery Auditors PERM CMS Private Network ECM xml PDF CERT PDF Medicare Administrative Contractors CONNECT Compatible

6. esMD Process Flow The overall esMD process can be divided into three steps: esMD Phase 2 esMD Phase 1 6

7. S&I Framework esMD Initiative Overview Provider Entity Payer Entity Payer Provider (Individual or Organization) Provider (Individual or Organization) Contractors / Intermediaries Agent Payer Internal System Gateway esMD UC 2: Secure eMDR Transmission esMD UC 1: Provider Registration Digital signatures on transactions esMD AoR Level 1 and Level 2 Digital Signatures on Document Bundles and Individual Documents Certificate Authority Registration Authority Provider Directories User Story All Actors obtain and maintain a non-repudiation digital identity Provider registers for payer services (see UC1) Payer requests documentation (see UC2) Provider submits digitally signed documents and/or document bundles to address request by payer Payer validates the digital credentials, signature artifacts and, where appropriate, delegation of rights

8. AoR -- Phased Scope of Work 8 Level 1 – Completed Level 2 - Completed Level 3 - TBD Digital signature on aggregated documents (bundle) Digital signature to allow traceability of individual contributions Digital signature(s) on an individual document Focus is on signing a bundle of documents prior to transmission Define transaction signature requirements and artifacts in conjunction with for esMD UC 1 and UC 2 Focus is on one or more contributors signing an individual document at the time of document creation Focus is on provenance of information with non-repudiation signatures on information at the point of creation

9. Digital Identities and AoR Workgroups 1.Identity proofing 2.Digital identity management 3.Digital signatures and artifacts 4.Delegation of Rights 5.Author of Record 9

10. General AoR Requirements  Solution must  scale to all providers and payers  minimize the operational impact required to establish, maintain or use a digital identity  provide for non-repudiation without resorting to audit logs or validation of system configuration  Standards – minimum required  Federal Bridge Certification Authority Medium Level  NIST 800-63-2 Level 3 (in-person) /4  NIST 800-57 Part 1 (Revision 3 July 2012)  X.509v3 Digital Certificates

11. HL7 Implementation Guide for CDA® Release 2: Digital Signatures and Delegation of Rights, Release 1 HL7 DSTU Sponsored by: Structured Documentation Work Group Attachments Work Group Security Work Group HL7 CDA Digital Signatures

12. This implementation guide defines a method to imbed digital signatures in a CDA document and provides an optional method of specifying delegation of right assertions that may be included with the digital signatures. This implementation guide will allow health plans, payers, and providers to accurately authenticate the Authorized Signer(s) of a CDA document and trust the validity and authenticity of signed medical documentation. This implementation guide specifies the content of the sdtc:signatureText element when included as part of the legalAuthenticator and/or authenticator participant occurrences. Examples of the sdtc:signatureText are defined in the HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2 (C-CDA) Background

13. This document provides guidance on the use of digital signatures imbedded in a CDA document to: Provide a non-repudiation signature that attests to the role and signature purpose (see Table 4 ‑ 4. Code Sets for role and signature purpose code sets) of each Authorized Signer to the document. Provide for a delegation of rights where the signer is a Delegated Signer and not the Authorized Signer responsible individual or organization (e.g., the signer is acting as an authorized agent). Provide a medical/legal attestation for administrative and clinical purposes such as documenting transfer of clinical care Provide for both digital co-signatures and counter signatures. Purpose

14. esMD Approach to Provenance Current Approach 1.Optional use of Digital Signatures on CDA documents used to provide medical documentation that support the medical necessity and appropriateness of a planned or billed service 2.Should be produced prior to billing to meet current payment policy. 3.The digital signature on the document is an attestation on the part of the provider as to their role and purpose for signing (e.g. author) 4.Use of Author Participation (header, section and entry templates to indicate actual contributions. Future 1.Non-repudiation signature on metadata at time of information creation (and/or review) to attest to circumstances of authorship (who, where, when, why) 2.Preserve content and metadata information (including signature) during assembly and exchange to convey provenance of information and data integrity