1. The Auditing Process: Lessons Learned Florida’s Medicaid EHR Incentive Program July 23, 2015

2. Outline of Today’s Presentation Audit Process Documentation Request Patient Volume Unique Patient List Meaningful Use Measures Post Payment Audit Preparation Notes of Importance July 23, 20152

3. Medicaid EHR Audit Process Post Payment Audits AHCA conducts post payment audits for eligible professionals attesting to the State’s Medicaid EHR Incentive Program. Selection Using a systematic method, providers are randomly selected for audit. Notification The selected providers are then notified by AHCA of their selection, and sent a list of documents to provide to validate the EHR Incentive Program attestation. Completion The audits are then completed within the following eight (8) months. July 23, 20153

4. Audit Process Timeline Select Auditees from relevant Stages Audit Notification and Information Request Completion of Audits Notification from AHCA of Audit Findings Audit selection occurs approximately seven months after the end of the program year July 23, 20154

5. Documentation Request The documentation request list(s) will ask providers to produce reports and screen shots that support information attested to. Patient Volume Provide a patient-level detail report that supports the numerator and denominator attested to in your application. Meaningful Use Measures Provide documentation that demonstrates each of the Core and Menu Measures attested to were met. July 23, 20155

6. Patient Volume Overview An encounter is defined as services rendered to a single patient on a single day. – Multiple providers seeing the same patient on the same day is one encounter for group volume. The denominator is all patient encounters, regardless of whether the encounter is billed or paid. Medicaid encounters are defined as services rendered on any one day to an individual enrolled in a Medicaid program. Members of a group should attest using the same method (i.e. group volume or individual volume). If attesting using group volume, member of the group should typically use the same: – Group ID – Numerator, denominator, and patient volume threshold – Patient volume reporting period July 23, 20156

7. Patient Volume Reports When attesting, you are asked to provide a patient volume summary report. During an audit, a patient-level detail volume report will be requested. If the patient volume summary report and patient-level detail volume report do not match, provide an explanation why. The template below demonstrates the information necessary for your patient-level detail report: Patient Acct # Patient Name Date of Birth Rendering Provider Billing Provider Date of Service Primary Insurer Billed Secondary Insurer Billed Tertiary Insurer Billed 1234John Smith1/1/1990Provider Name 3/3/2014Insurance 1 Insurance 2 Insurance 3 1234John Smith1/1/1990Provider Name 5/5/2014Insurance 1 Insurance 2 Insurance 3 July 23, 20157

8. Patient Volume Reports The patient-level detail volume report should: – Support volume attested to in the application – Include Medicaid and non-Medicaid encounters – Include patient details for all members of the group if attesting to group volume. No limitations – Include all patient encounters, regardless of whether billed or paid – Provide in excel – Provide a crosswalk list of the Insurers Denote which were counted as Medicaid July 23, 20158

9. Common Patient Volume Audit Issues Correct definition of an encounter – Common errors include: attesting to duplicate encounters in the patient volume count, attesting to the number of unique patients, and attesting to the number of procedures. Correct patient volume reporting period used in the patient volume calculation – Common errors include: including encounters outside of the patient volume reporting period in the patient volume calculation. Sufficient documentation provided to support patient volume – EPs are encouraged to run the patient-level detail volume report at the time of attestation in case of system changes, staff turnover, and inability to run patient- level detail at a later date. – Common errors include: not maintaining documentation to support the attestation or unable to access patient-level detail at a later date. July 23, 20159

10. Meaningful Use Measures For EPs attesting to Meaningful Use, documentation will be requested including a list of unique patients and screenshots. The documentation provided for Meaningful Use should provide the following: Demonstrate system capability to meet Core and Menu Measures attested to in your application Screenshots for specific patients seen during the Meaningful Use time period A report of unique patients seen during the Meaningful Use time period July 23, 201510

11. Unique Patient List Auditees will be required to provide a unique patient list for the EP during the EHR reporting period. – EHR reporting period may be different than the patient volume reporting period – “Unique patients” has a different definition then an encounter The unique patient list should be provided in excel. The unique patient list should contain the following data elements: – Patient Name – Unique Identifier – Date of Service July 23, 201511

12. Common Meaningful Use Audit Issues Conduct or review a security risk analysis (SRA) and implement security updates as necessary, and correct identified security deficiencies as part of the risk management process – Maintain completed, signed, and dated documentation that an SRA was performed during the program year prior to attestation – Document identified deficiencies and mitigation plan Attesting to an exclusion correctly – Understand when it is appropriate to claim exclusions to measures – Supporting documentation (i.e. dashboard) should show an EP qualified for an exclusion. July 23, 201512

13. Common Meaningful Use Audit Issues (continued) Providing sufficient documentation to support the specific requirements within the objective of the measure were met (i.e. clinical summaries) – Documentation should include the required fields specified in the objective for the measure – Preparing documentation at the time of attestation may help to avoid issues retrieving data at a later date Providing sufficient documentation to support Core and Menu Measures – EPs are encouraged to maintain support for all measures for at least two patients in case of system changes, staff turnover, and inability to access information at a later date – Dashboard alone is not enough July 23, 201513

14. Attestation Audit Preparation Prepare reports and screenshots from your EHR that may be requested as part of the audit process before completing your application – Including support for the numbers and measures in your attestation Maintain supporting documentation in a secure location that is accessible in case of staff turnover Read CMS guidelines regarding each measure’s rule and objective Documentation to support attestation data for meaningful use objectives and CQMs should be retained six years post attestation July 23, 201514

15. Notes of Importance Correspond with auditors and provide requested documentation timely Ask the auditor if you have questions Respond by deadlines If selected for audit, applications will be held – Including all members of the group Do not send information through regular email; documentation may be sent by: – Secure flash drive - test the flash drive – Secure email service – for example, AHCA’s Direct Messaging Service Be aware of “dropbox” services Clearly label documentation provided to the auditor July 23, 201515

16. Contacts and Resources Website: www.ahca.myflorida.com/medicaid/ehr Email: MedicaidHIT@AHCA.MyFlorida.com Kim.davis@ahca.myflorida.com Phone: EHR Incentive Program Call Center: (855) 231-5472 July 23, 201516