1. Meaningful Use, MU Audits and Stage 2 Measures – “Is it Worth the Money?” Chris Apgar, CISSP OrHIMA Fall Instutute 2014

2. Overview  Meaningful Use Overview  Who is Being Audited  Consequences of Failing an Audit  Preparing for and Surviving an Audit  Summary and Q&A 3

3. Meaningful Use  The purpose of Meaningful Use was to incentivize adoption of EHR technology  Hospitals and eligible health care professionals (EP) could apply for Medicare or Medicaid incentives  In some cases hospitals can apply for Medicaid and Medicare incentives  In most cases the amount of incentive dollars does not cover all expenses 3

4. Meaningful Use  EHR implementation and Meaningful Use attestation could be expensive  Software and hardware costs  Staff training  Data conversion  Additional data collection  Ongoing maintenance costs  Increasing requirements of Stage 2 4

5. Meaningful Use  Stage 1 and Stage 2 Meaningful Use required hospitals and EPs to attest to having met a set number of core measures and a set number of measures from a list of additional measures  At the time of attestation, hospitals and EPs needed to be able to demonstrate measures were met if asked to prove it 5

6. Meaningful Use  May be able to delay move to MU Stage 2 and attest to Stage 1 instead  If you attested early, you may be stuck with Stage 2 Example:If you attested to MU in 2012, you must attest to Stage 2 in 2014. If you attested to MU in 2013, you can attest to Stage 1 in 2014. 6

7. Who’s Being Audited?  Per CMS if you attested, there’s a 10% chance you will be audited at some point  Audits are provider by provider versus by clinic or hospital  It doesn’t matter the size of the provider  You may be audited more than once 7

8. If You’re Audited…  Short time frame to respond  Documentation must definitively prove you met measures attested to  Documentation needs to be complete, easily accessible and very “black and white”  You may go through multiple rounds of documentation production  Document production requests not necessarily clear 8

9. If You’re Audited…  If you’re unsure, ask before sending  Only provide what is asked for  Assign a point person to respond to attestation audits  Make sure your vendor can support providing needed documentation that is accurate  If non-compliant with HIPAA, auditor may report to OCR 9

10. If You’re Audited…  You may fail the audit the first time – request clarification as to why  Make sure the auditor is specific – saves time in supplying multiple versions of documentation that may not be consistent  Keep all audit related documentation and communication with the auditor handy 10

11. Consequences if You Fail  If you ultimately fail an audit, expect a demand letter to repay Meaningful Use incentive dollars  If you receive a demand letter, you can appeal  For more information from CMS - https://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/A ppeals.html https://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/A ppeals.html 11

12. Consequences if You Fail  You do not have multiple levels of appeal  Failure to pay will likely result in withheld Medicare reimbursement  Audits go back to the first year of attestation – you may be audited for more than one period so may fail an audit for more than one period  No word on Oregon Medicaid audits yet 12

13. How to Prepare  Understand all MU Requirements  Have a Clear Documentation Trail and create it before you attest  You will only have two weeks to respond – don’t start building your documentation trail when you receive the letter 13

14. The Notice Arrives…  First Notice – two options to respond:  Secure Web Portal  Mail  Check your documentation before you send it  Again, ask questions if you don’t understand what’s being requested 14

15. Documentation  Screen shots  Exact dates to match your attestation period  Audit Trail Documentation  EHR generated reports  Make sure they work  Make sure the data generated during the attestation period is preserved  Sample discharge summaries, post-appointment documentation, etc. 15

16. 16

17. Survival Mode  Don’t panic  Work with your EHR and other supporting vendors  Focus specifically on what is requested – no more and no less  Detail is good 17

18. Survival Mode  Dates are critical – make sure you can document what you attested to occurred during the attestation period  It will be fine (if you’re able to demonstrate you met the requirements)  May require multiple iterations  Work with all your EMR Partners –  State Registry  County Health Department  HIT Regional Extension Center 18

19. Pitfalls to Avoid  Reports, screen prints, letters from vendors related to MU, etc. must be dated during the attestation period  If you attested to something you didn’t do (like conduct that risk analysis), you will likely be asked to pay the money back  You can’t respond timely if you don’t know where your documentation is 19

20. Pitfalls to Avoid  Keep your EHR vendor honest – just because they were certified doesn’t mean everything works, especially if you customize  If your EHR vendor can’t produce the exact data from the attestation period, you may be asked to return the incentive payment  Make sure you can produce proof if something changed and why 20

21. Example of Vendor Failure  EHR miscounted number of encounters – cancelled appointments were tallied  Data stored in EHR was cumulative – the data from the attestation period wasn’t preserved  Manual count of encounters did not match EHR reports  All measures were met but due to EHR issues, the provider was asked to return the incentive 21

22. Pitfalls to Avoid  If using multiple vendors for MU, make sure you can consolidate the data  Make sure all dates and data from each vendor matches  Specialty practices beware – modifications to meet needs may make proving you did the right thing difficult  Make sure you have the right EHR version – some vendors offer certified and non-certified EHRs 22

23. Pitfalls to Avoid  If you’re just starting, do plenty of research  Make sure what you’re buying is the certified version (not the basic and after install the vendor asks for more money)  Auditors are black and white but have been reasonable thus far  Train you staff – what to say and not to say to an auditor 23

24. How to Prepare  Before the auditor arrives:  Run through a mock audit  Talk to your colleagues who have been audited  Talk to your vendors  Preserve data just in case your vendor fails you 24

25. How to Prepare  Take a close look at each measure you attested to and generate proof you met the measure  Save that documentation centrally  Don’t forget it’s more than conducting a risk analysis – remember the risk mitigation and management part  Make sure that patient portal is up, operable and used (available to 50% of patients and 5% are using) 25

26. How to Prepare  Can your patients communicate with you securely and are they doing so?  Omnibus Rule permits unencrypted communication with patients but MU does not  When sending or providing required information like summaries of care, make sure it’s documented somewhere (paper and electronic) 26

27. How to Prepare  If you use an HIE to exchange data that needs to be counted, such as a summary of care, make sure it can be tracked  Don’t lose sight of other privacy and security requirements – lack of attention may result in an OCR letter  Don’t trust vendors – make them prove it 27

28. Reasons Not to Attest  Not all health care professionals are eligible  It doesn’t pencil out  Low or no Medicare patient count  Cost and burden are considered excessive  You don’t think you can meet measures during attestation period 28

29. In The End…  You need to be able to prove it  CMS will ask for its money back  States and Medicaid incentive program audits still a mystery  Most auditors don’t have a sense of humor  If you have it, make sure you can find it and quickly 29

30. Resources  CMS: http://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/i ndex.htmlhttp://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/i ndex.html  eHealth Programs Interactive Timeline: http://cms.gov/apps/interactive-timeline http://cms.gov/apps/interactive-timeline  CMS Stage 1 Attestation Worksheet (EP): http://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/ downloads/EP_Attestation_Worksheet.pdf http://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/ downloads/EP_Attestation_Worksheet.pdf 30

31. Resources  CMS Stage 1 Attestation Worksheet (hospitals): http://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/d ownloads/Hospital_Attestation_Worksheet.pdf http://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/d ownloads/Hospital_Attestation_Worksheet.pdf  CMS Meaningful Use for Specialists Tips: http://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/D ownloads/Meaningful_Use_Specialists_Tipshee t_1_7_2013.pdf http://www.cms.gov/Regulations-and- Guidance/Legislation/EHRIncentivePrograms/D ownloads/Meaningful_Use_Specialists_Tipshee t_1_7_2013.pdf 31

32. Resources  CMS Meaningful Use Rule Change – 2014: http://www.cms.gov/Newsroom/MediaRelease Database/Press-releases/2014-Press- releases-items/2014-08-29.html http://www.cms.gov/Newsroom/MediaRelease Database/Press-releases/2014-Press- releases-items/2014-08-29.html  NJ-HITECH “Become Audit Proof”: http://www.njhitec.org/files/6113/6803/539 4/Become_Audit_Proof.pdf http://www.njhitec.org/files/6113/6803/539 4/Become_Audit_Proof.pdf 31

33. Chris Apgar, CISSP CEO & President