[PRIVAPLAN LIVE WEBCAST] Meaningful Use & Audit Survival Guide January 15, 2015 Presented by: David A. Ginsberg, President, PrivaPlan Associates, Inc
AGENDA AUDITS STAGE 2 MU COMMON MISTAKES AREAS OF CONFUSION REVIEWS FOR MU COMPLIANCE & DATA INTEGRITY AUDIT BINDER NECESSARY COMPONENTS SECURITY RISK ANALYSIS IMPORTANT TIDBITS
AUDITS MEDICARE vs. MEDICAID MEDICARE - What are they looking for? MU Measure Data Integrity Proof Screenshots of Y/N measures Screenshots/list of data that supports MU results Completion of appropriate SRA Verification from public health MEDICAID What are they looking for? Eligibility verification proof
AUDIT PREPARATION WHAT YOU SHOULD DO... SELF AUDIT! Periodic review of CORE/MENU set measure data integrity (following MU period Gap Analyses more on that later) Patient Census/Encounter count vs. denominator numbers Question data output with your Vendor Study the vendor s calculation of numerator/denominator Study EHR measure setup procedures-is the correct data being pulled?
WHAT IS A GAP ANALYSIS? GAP ANALYSIS DATA INTEGRITY
GAP ANALYSIS: DASHBOARD VS REPORT DASHBOARD A QUICK AN DIRTY VIEW. Often a dashboard contains graphs or charts and percentages, or a combination of both. Historically, they are NOT as accurate as a report.
GAP ANALYSIS: DASHBOARD VS REPORT REPORT AN IN-DEPTH ANALYSIS. A report is the best source of data. Numerators/denominators are present, and often, data drill down capability. A report is the only source for attesting to MU and what typically an auditor wants!
STAGE 2 - MU GAP ANALYSIS MU CORE OBJECTIVES (Must meet all 17) 1) CPOE (Computerized Provider Order Entry) 2014 Stage 2 Measure Exclusion (if applicable) 3 PART MEASURE! More than 60% of medication orders AND more than 30% of lab AND 30% of radiology orders created by any licensed healthcare professional OR credentialed MA who can enter orders per state, local, and professional guidelines, must be entered using certified EHR technology. (Medical Assistants must be credentialed by an entity other than the employer.) Any EP who writes fewer than 100 medication, radiology, or laboratory orders during the EHR reporting period. 2014 Measure Notes & Addt'l Resources 170.314 (a)(1) (Computerized order entry) http://www.cms.gov/regulati ons-and- Guidance/Legislation/EHRInce ntiveprograms/downloads/sta ge2_epcore_1_cpoe_medicat ionorders.pdf Action Plan/Notes
STAGE 2 - MU GAP ANALYSIS MU CORE OBJECTIVES (Must meet all 17) 2014 Stage 2 Measure Exclusion (if applicable) 2014 Measure Notes & Addt'l Resources 9) Provide patients the ability to 2 PART MEASURE! Any EP who: 170.314 (e)(1) (View, download view online, MU CORE download OBJECTIVES and (1) Neither orders nor creates any and transmit 2014 Measure to 3rd party) Notes & transmit their 2014 Stage 2 Measure Exclusion (if applicable) (Must health meet information all 17) PART 1: of the information listed for Addt'l Resources within 4 business days of the More than 50% of all unique inclusion as part of both FCC Broadband Maps: information being available to the patients seen by the EP during the measures, except for "Patient http://www.fcc.gov/maps/section 1) CPOE (Computerized Provider Order 3 PART MEASURE! Any EP who writes fewer than 170.314 (a)(1) (Computerized EP. EHR reporting period are provided name" and "Provider's name" and -706-fixed-broadbanddeployment-map Entry) 100 medication, radiology, or order entry) timely (available to the patient office contact information, may More than 60% of medication orders AND laboratory orders during the *Replaces the Stage 1 Core within more 4 business than 30% days of lab after AND the 30% of exclude radiology both EHR measures. reporting period. http://www.cms.gov/regulation Objective for EPs of "Provide information orders created is available by any to licensed the EP) healthcare http://www.fcc.gov/maps/unserv s-andpatients with an electronic copy of online professional access to OR their credentialed health MA who (2) Conducts can 50% or more of his or ed-fixed-broadband Guidance/Legislation/EHRIncent their health information (including information. enter orders per state, local, and her patient encounters in a county iveprograms/downloads/stage2 diagnostic test results, problem professional guidelines, must be entered that does not have 50% or more of http://www.cms.gov/regulations- _EPCore_1_CPOE_MedicationOr list, medication lists, medication PART using 2: certified EHR technology. its housing units with 3Mbps and-ders.pdf allergies) upon request" and the More than 5% of all unique broadband availability according Guidance/Legislation/EHRIncentiv (Medical Assistants must be credentialed by Stage 1 Menu Objective for EPs of patients seen by the EP during the to the latest information available eprograms/downloads/stage2_ep an entity other than the employer.) "Provide patients with timely EHR reporting period (or their from the FCC on the first day of Core_7_PatientElectronicAccess.p electronic access to their health authorized representatives) view, the EHR reporting period may df information (including lab results, download, or transmit to a third exclude only the second measure. problem list, medication lists, and party their health information. allergies) within 4 business days of the information being available to the EP." *Definitions of Access, View and Transmit can be found here: http://www.cms.gov/regulations- and- Guidance/Legislation/EHRIncentiv eprograms/downloads/stage2_ep Core_7_PatientElectronicAccess.p df Action Plan/Notes Action Plan/Notes
STAGE 2 - MU GAP ANALYSIS MU CORE OBJECTIVES (Must meet all 17) 2014 Stage 2 Measure Exclusion (if applicable) (12) Use clinically relevant NOW A CORE MEASURE Any EP who has had no office 170.314(e)(15) (Ambulatory information MU CORE to identify OBJECTIVES visits in the 24 months before setting 2014 only Measure patient Notes & 2014 Stage 2 Measure Exclusion (if applicable) patients who (Must should meet all receive 17) More than 10% of all unique the EHR reporting period. reminders) Addt'l Resources reminders for patients (no age restriction) 1) preventive/follow-up CPOE (Computerized Provider care Order and who 3 have PART MEASURE! had 2 or more office Any EP who writes fewer than http://www.cms.gov/regulatio 170.314 (a)(1) (Computerized Entry) send these patients the visits with the EP within the 24 100 medication, radiology, or ns-and- order entry) reminders, per patient months More before than 60% the of medication beginning orders AND laboratory orders during the Guidance/Legislation/EHRInce more than 30% of lab AND 30% of radiology EHR reporting period. http://www.cms.gov/regulation preference. of the EHR reporting period ntiveprograms/downloads/sta orders created by any licensed healthcare s-andwere professional sent a reminder, OR credentialed per MA who can ge2_epcore_12_preventivecar Guidance/Legislation/EHRIncent patient enter preference orders per state, when local, and e.pdf iveprograms/downloads/stage2 available. professional guidelines, must be entered _EPCore_1_CPOE_MedicationOr using certified EHR technology. ders.pdf *To (Medical count for Assistants the measure, must be credentialed by reminders an entity for other than the employer.) preventive/follow-up care must be for care that the patient is not already scheduled to receive. Reminders for referrals or to engage in certain activities are also included in this objective and measure. 2014 Measure Notes & Addt'l Resources Action Plan/Notes Action Plan/Notes
OUR MU GAP ANALYSIS MU CORE OBJECTIVES (Must meet all 17) 2014 Stage 2 Measure Exclusion (if applicable) 2014 Measure Notes & Addt'l Resources Action Plan/Notes 1) CPOE (Computerized Provider Order Entry) CLICK HERE TO VIEW 3 PART MEASURE! Any EP who writes fewer than 100 medication, radiology, or More than 60% of medication orders AND laboratory orders during the more than 30% of lab AND 30% of radiology EHR reporting period. orders created by any licensed healthcare professional OR credentialed MA who can enter orders per state, local, and professional guidelines, must be entered using certified EHR technology. 170.314 (a)(1) (Computerized order entry) http://www.cms.gov/regulation s-and- Guidance/Legislation/EHRIncent iveprograms/downloads/stage2 _EPCore_1_CPOE_MedicationOr ders.pdf (Medical Assistants must be credentialed by an entity other than the employer.)
COMMON MISTAKES AVOID THESE PITFALLS... CQMs (Clinical Quality Measures) CDS (Clinical Decision Support) Security Risk Analysis What an OCR or MU auditor expects View/Download/Transmit Patient given access vs. patient access Public Health Menu Measures No exclusions Summaries & Portal The data that must be provided per CMS
COMMON MISTAKES (con t) AVOID THESE PITFALLS... Data integrity issues such as: The data changes each time a report is generated for the same time frame Vendor software CAN HAVE BUGS!!!!!!! The data changes after a new version is installed Set up was incorrectly done and data is pulled from the wrong template/form/file
CQMs KEYS TO SUCCESS... Selecting your 9 CQMs: EPs must report on 9 of the 64 approved CQMs Recommended core CQMs encouraged but not required 9 CQMs for the adult population 9 CQMs for the pediatric population NQF 0018 strongly encouraged since controlling blood pressure is high priority goal in many national health initiatives, including the Million Hearts campaign Selected CQMs must cover at least 3 of the National Quality Strategy domains Take time to carefully select these-and be sure your system set up correctly maps the data!
CDS KEYS TO SUCCESS... Select your CDS rules carefully and ensure they are operational as of the beginning of the reporting period: For Stage 2, implement 5 clinical decision support interventions related to four or more clinical quality measures at a relevant point in patient care for the entire EHR reporting period. Absent four clinical quality measures related to an EP s scope of practice or patient population, the clinical decision support interventions must be related to high-priority health conditions. If none of the CQMs are applicable to an EP's scope of practice, the EP should implement CDS interventions that he or she believes will to drive improvements in the delivery of care for the high-priority health conditions relevant to their patient population.
CDS (con t) KEYS TO SUCCESS... Be sure each CDS rule has referential support The risks of creating your own rules
HIPAA SECURITY RISK ANALYSIS A MU or HIPAA auditor would expect a formal report to be on hand to prove you have done the Risk Analysis + to show that you are remediating or managing gaps and deficiencies (Risk Management). A checklist is not sufficient for a SRA Administrative, physical, technical and organizational safeguards/compliance must be reviewed If you attest without doing the work, you will be risking fraud by being untruthful on your attestation documents and receiving federal funds.
MU-ONC GUIDANCE When you attest to Meaningful Use, it is a legal statement that you have met specific standards, including that you protect electronic health information. Providers participating in the EHR Incentive Program can be audited If you attest prior to actually meeting the Meaningful Use security requirement, you could increase your business liability for federal law violations and making a false claim. From this perspective, consider implementing multiple security measures as feasible, prior to attesting. The priority would be mitigating high-impact and high-likelihood risks.
MU-ONC GUIDANCE FOR ATTESTATION Implement security updates as necessary and correct identified security deficiencies as part of the provider's risk management process. Does this mean that all security deficiencies must be fully corrected prior to attestation?
MU-CMS GUIDANCE FOR ATTESTATION Thus, it is important to remember two key points: - If you use an EHR, it should be reviewed as part of the HIPAA SRA - Risk Management is the flip side or risk analysis Your risk management timeline is the driver not MU But you need a risk management plan!
RISK ANALYSIS TOOLSET Implement Security Rule Choose a Privacy & Security Official Physical Security (Large & Small Organizations) PHI Inventory Risk Analysis (includes Risk, Threat & Criticality Matrix)
SRA SELF-ASSESSMENT OR OUTSIDE SUPPORT Consider these contributing factors in your decision making: 1. Have you ever had an outside review? If so, was it prior to implementation of EHR systems and was it more than 2 years ago? 1. Have you had significant IT infrastructure change? 1. Have you had any breaches or security incidents? Have any of these been reportable? 1. Do you have the internal resources?
SRA SELF-ASSESSMENT OR OUTSIDE SUPPORT Consider these contributing factors in your decision making: 5. Do you need to justify or support enhanced security measures and controls? 5. Have you updated policies and procedures in the last two years? 5. Other threats and concerns?
VIEW/DOWNLOAD/T RANSMIT - PORTAL Is your portal and instruction process in place? PART 1: More than 50% of all unique patients seen by the EP during the EHR reporting period are provided timely (available to the patient within 4 business days after the information is available to the EP) online access to their health information. PART 2: More than 5% of all unique patients seen by the EP during the EHR reporting period (or their authorized representatives) view, download, or transmit to a third party their health information.
PUBLIC HEALTH Be sure to find out what is in place in your State State and County Public Health Departments are the typical resource Immunization Registry Cancer Registry Specific Registries Syndromic Surveillance
MENU MEASURES Must select 3 out of 6 Can NOT include an exclusion
CLINCAL SUMMARIES + PORTAL DATA PER CMS, certain data sets MUST be made available to the patient. CLINICAL SUMMARIES Patient name. Provider's name and office contact information. Date and location of the visit. Reason for the office visit. Current problem list. Current medication list. Current medication allergy list. Procedures performed during the visit. Immunizations or medications administered during the visit. Vital signs taken during the visit (or other recent vital signs). Laboratory test results. List of diagnostic tests pending. Clinical instructions. Future appointments. Referrals to other providers. Future scheduled tests. Demographic information maintained within certified electronic health record technology (CEHRT) (sex, race, ethnicity, date of birth, preferred language). Smoking status. Care plan field(s), including goals and instructions. Recommended patient decision aids (if applicable to the visit).
CLINCAL SUMMARIES + PORTAL DATA (con t) PER CMS, certain data sets MUST be made available to the patient. PATIENT PORTAL Patient name. Provider's name and office contact information. Current and past problem list. Procedures. Laboratory test results. Current medication list and medication history. Current medication allergy list and medication allergy history. Vital signs (height, weight, blood pressure, BMI, growth charts). Smoking status. Demographic information (preferred language, sex, race, ethnicity, date of birth). Care plan field(s), including goals and instructions. Any known care team members including the primary care provider (PCP) of record unless the information is not available in certified EHR technology (CEHRT), is restricted from disclosure due to any federal, state or local law regarding the privacy of a person s health information, including variations due to the age of the patient or the provider believes that substantial harm may arise from disclosing particular health information in this manner.
AREAS OF CONFUSION LET S PROVIDE SOME CLARIFICATION. CPOE by a Credentialed Medical Assistant Documentation is needed! Transitions of Care (for Med Rec and Summary of Care) Definition: The movement of a patient from one clinical setting (inpatient, outpatient, physician office, home health, rehab, long-term care facility, etc.) to another or from one EP to another. At a minimum, transitions of care include first encounters with a new patient and encounters with existing patients where a summary of care record (of any type) is provided to the receiving provider.
AREAS OF CONFUSION (con t) DIRECT (For Part 2 of Summary of Care for Transition of Care) Direct exchange is not the only way that providers can meet the health information exchange requirements of Stage 2 Meaningful Use, SOAP-based optional transport standard capability is also permitted. However, since all certified EHR technology must enable use of Direct exchange, Direct may be the easiest messaging solution to deploy. Direct addresses are available from a variety of sources, including EHR vendors, State Health Information Exchange entities, regional and local Health Information Exchange entities, as well as private service providers offering Direct exchange capabilities called Health Information Service Providers (HISPs). **Individuals may be asked to provide information confirming their identity to ensure sensitive patient health information is sent from and to is protected.
IMPORTANCE OF REVIEWING MU REPORTS ITS EASIER TO STAY AHEAD THAN CATCH UP! Periodic reviews By provider
IMPORTANCE OF DATA INTEGRITY REVIEWS SANITY CHECK! PULL PATIENT DATA FOR BOTH NUMERATORS AND DENOMINATORS SCREENSHOTS
AUDIT PREP BINDER MU Audit Binder An electronic binder (folder) all documents you used to support your attestation and prepare you for an audit. Two things to remember: 1. Always be sure the date stamp is somewhere on the documentation. 2. Always be sure the vendor s name and/or the software name and version are on the documentation. *When not available, take a series of screenshots while generating the documentation as proof that the documentation generation originated from the EMR
AUDIT PREP BINDER (con t) Items to Include: MU Report Generated by your EMR (includes Core, Menu and CQMs and displays numerators and denominators for each) Needs to identify the following: - Provider Name and/or Identifier (NPI) - MU Report Date Range - Date Report was Ran **MU Dashboards and MU Reports are NOT the same thing! HIPAA Security Risk Analysis Initial findings PHI Inventory Remediation Plan Documentation of Remediation
AUDIT PREP BINDER (con t) Items to Include (continued): MU Gap Analysis System Settings Screenshots for YES/NO Measures Drug formulary checks Drug-drug and drug allergy interaction checks CDS rule(s) (1 for Stage 1, 5 for Stage 2) - Systems settings in action screenshots meaning showing these are functional in test patient or live patient s chart Patient Listing by diagnosis **All of the screenshots need to show a date prior to or on the START of the reporting period
AUDIT PREP BINDER (con t) Items to Include (continued): Public Health Attestation Support (emails or letters from public health registries to which you re attesting or claiming exclusions for) dated within the reporting period Post Attestation Documentation Receipt or screenshot of successful attestation (and attestation confirmation number if attesting to Medicare) PDF Summary of Attestation (offered by Medicare after successfully attestation submission)
AUDIT PREP BINDER (con t) Items to Include (continued): HIPAA SRA This is NOT a checklist! Know what an OCR or MU audit will require of your SRA. MUST be completed prior to the end of the reporting period MUST be specific to the EMR version you are attesting with
MORE ON MU WHAT ELSE FOR 2014, 2015 AND BEYOND? You need to be on the 2014 Certified Version for your ENTIRE reporting period! For any EP outside of their first year of MU, you must attest for a full calendar year! KEEP ALL AUDIT BINDER INFORMATION SECURE! Often it contains PHI! Ensure the binder location is known by several individuals! Be sure to retain all documentation of attestations. Retain ALL attestation and audit documentation during staff transitions.
AUDITS NOTIFICATIONS and KEYS TO SUCCESS Recognizing a notification Response times Key steps Understanding what the issue is Request clarification if necessary Assemble documentation Prepare your response Seeking outside assistance? Audit Failure
APPEALS Initial request for an appeal Response times-within 30 days Key steps Understanding what the issue is Determine what if anything was missing in your response to the audit Assemble documentation focusing on making your case Reiterate and reinforce that you achieved MU (if indeed you did!) Seeking outside assistance? Appeal denials---they are final
PrivaPlan Associates are also MU experts! OUR SERVICES INCLUDE EHR selection and implementation management MU attestation prep, MU gap analysis, registration and attestation support MU audit preparation and fulfillment Negative MU audit determination reversals consulting Security Risk Analysis Policy & Procedure Customization Outsourced Compliance Official service OUR CLIENTS INCLUDE CO-REC (the leading REC in the nation) Hundreds of hospitals and eligible professionals across the nation David Ginsberg dginsberg@privaplan.com (877)218-7707