It has been a busy couple of weeks in the Medicare/Medicaid EHR Incentive Program. While everyone’s focus was on the Centers for Medicare and Medicaid Services’ (CMS) final rule to allow a certain subset of participants to meaningfully use (MU) EHR technology with outdated certification status, as well as on the Office of the National Coordinator for HIT’s (ONC) “Release 2” of the 2014 Edition EHR certification criteria, CMS distributed some clarifications regarding the Stage 1 and Stage 2 MU objective for “view/download/transmit (V/D/T),” also known as the “patient portal” or “PHR” objective. Most of this information was included in the September 2012 “Stage 2” final rule and the “Patient Electronic Access Tipsheet,” but it is worth repeating…
First, patients who choose not to access their health information (“opt out”) can be counted in the numerator of the Stage 1 and 2 “provide patients with ability” measure of the V/D/T objective if they are given all information needed to change their minds and access (or “opt in”) without having to reconnect with the provider. CMS’ example of doing this is when a patient is given a user ID and password combined with instructions about how to access the portal/PHR/patient website and how to create an account. Patients who choose not to access/opt out are required to be included in the denominator regardless.
Second, for the Stage 2-only second measure of “patients viewed, downloaded, or transmitted to a 3rd party” of that objective, patients who access their health information via an online personal health record (PHR) during the reporting period can be counted in the numerator for all eligible providers who contributed information to that PHR. The patient does not have to V/D/T the specific information contributed by an individual provider for it to count.
Third—and this is more obvious—everyone in a group practice is able to share credit for the Stage 2-only second measure of “patients actually viewed, downloaded, or transmitted to a 3rd party” if they each saw the patient during the same reporting period and are using the same certified EHR technology.
From a radiology perspective, I am constantly asked if imaging results need to be included in patient portal/PHR for the V/D/T objective. The answer is simply no—doing so would be beyond the minimum MU compliance requirements. The data elements that must be offered for V/D/T when updated are the “Common MU Data Set” in addition to the provider’s name and office contact information. Therefore, if all radiologists did was provide patients with access to key images and/or reports via the portal and did not include the Common MU Data Set, etc., this would actually not be in MU compliance. However, providing radiology information to the patient in addition to the basic data types required for MU may be desirable or even necessary for non-MU reasons, and it could give the patient a motivation to V/D/T their own health information on the radiologist’s portal for credit towards the second measure of the Stage 2 MU V/D/T objective.
The Office of the National Coordinator for HIT (ONC) published its final rule to promulgate the “2014 Edition Release 2” EHR certification criteria for health IT products used in the Medicare/Medicaid EHR Incentive Program. Importantly, this final rule corresponds with the “2015 Edition” proposed rule released for comment last February. ONC elected to change the version titles of the EHR certification criteria to correspond with the calendar year in which they are finalized, not the year in which they become mandatory for EHR Incentive Program participants. Incremental updates to existing certification criteria will henceforth be called “releases.”
If you think this version title change is confusing now, just wait until the “2015 Edition” EHR certification criteria proposed rule is published for comment later this year (hint: it will not be the same content as last February’s proposed rule). The upcoming rulemaking was previously slated to be called the “2017 Edition,” and will be released simultaneously with the CMS EHR Incentive Program/Meaningful Use (MU) “Stage 3” proposed rule.
Importantly, the “2014 Edition Release 2” is mechanically different than what was proposed for the “2015 Edition.” Instead of being an incomplete and voluntary set of alternative criteria to the 2014 Edition—as the 2015 Edition was proposed to be—all newly added certification criteria in Release 2 will be deemed optional, and any revisions to previous criteria made in Release 2 are considered to be clarifications/additive to what was already required.
While the necessity of this rulemaking has been (rightfully) called into question by many, it does contain several improvements over what was proposed in the 2015 Edition proposed rule. For instance, Release 2 finalizes ONC’s proposal to separate the three unrelated order types (diagnostic imaging, lab-tests, and medications) into three separate certification criteria, which allows specialized CPOE software to achieve certification for only one order type instead of needing to package the functionality to order all three disparate order types. Also, ONC chose to not finalize the “Non-MU certification” and “certification packages” concepts that were in the proposed rule—these concepts, as proposed, promised mass confusion for little practical benefit. ONC also finalized its proposal to eliminate “Complete EHR” certification status (starting with the next edition), which should help clear up any confusion in the specialty IT industry about whether ONC’s HIT certification program is for their products too.
The ACR Government Relations Department is reviewing the ONC’s final rule and will publish a regulatory summary in the near future. Also, note that Dr. David Hunt from ONC staff will be on hand to discuss the government’s efforts related to nationwide EHR technology adoption at the ACR’s fourth annual Imaging Informatics Summit on October 29-30, 2014 (event/registration information: acrinformatics.org).
On September 4, the Centers for Medicare and Medicaid Services (CMS) and Office of the National Coordinator for HIT (ONC) will publish the final rule to allow 2011 Edition certified EHR technology, coupled with the 2013 version of Stage 1 Meaningful Use (MU) requirements, to comply with the EHR Incentive Program in calendar year (CY) 2014. The rule also includes compliance options for those with combinations of 2011 Edition and 2014 Edition certified HIT products. Prior to these changes, all participants needed to meaningfully use 2014 Edition certified products in CY 2014.
While the latest revision is far too late to be a practical option for most MU participants, it is intended to help previous MUsers who were unable to fully upgrade to 2014 Edition certified products in time for the fourth (and final) special quarterly reporting period in CY 2014 that begins in less than one month. These individuals would have otherwise had to forgo their incentive payments for 2014 and use up a precious significant hardship exception year to avoid the CY 2016 penalties.
Regardless of this last minute flexibility, all MU participants are required to use 2014 Edition certified products beginning in CY 2015, so it is not recommended that physicians (who have a choice) delay implementing the newer 2014 Edition certified products. In fact, those who leverage this new flexibility will need to prove their inability to fully upgrade to 2014 Edition certified EHR technology to auditors.
The pre-publication formatted version of the final rule is currently accessible via the Office of the Federal Register’s public inspection desk. The ACR Government Relations team is reviewing the text and may re-release our CY 2013 educational materials for those seeking to leverage this flexibility.
On August 4, the Department of Health and Human Services (HHS) Office of the Secretary published a final rule to implement the mandated delay of the International Classification of Diseases, 10th Revision (ICD-10) until October 2015.
In April 2014, the Protecting Access to Medicare Act of 2014 (PAMA, the latest “SGR patch”) mandated that ICD-10 could not be adopted under HIPAA prior to the next fiscal year. The August 4 final rule officially moves the ICD-10 adoption deadline up to October 1, 2015, the first possible date allowed under the revised statute. The explanatory preamble of the final rule includes statistics asserting that most stakeholders are ready now, strongly hinting at a reluctant HHS.
On August 4, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) released a report addressing the HHS Office of the National Coordinator for HIT’s (ONC) oversight of the testing and certification of EHR technology. The OIG’s two primary concerns, based on a review of the requirements and processes of the now-defunct Temporary Certification Program (replaced at the end of 2012 by the permanent “ONC HIT Certification Program”), were the lack of periodic review of certified products and insufficient log-in/security within certified products.
Interestingly, the report recommended that ONC work with the National Institute of Standards and Technology (NIST) to enhance the product log-in/security requirements via the test procedures for labs and certification bodies that review HIT products. This recommendation was peculiar, and perhaps a little alarming, in that the test procedures are mere guidance for how the responsible bodies should test products against ONC’s EHR certification criteria regulations. The NIST-developed (and future stakeholder-developed), ONC-approved test procedures are not, themselves, the regulatory requirements. ONC would not be able to use the test tools to implement more stringent security in certified products than what is required by ONC’s EHR certification criteria regulations in 45 CFR Part 170.
The OIG’s recommendation, then, indicates the authors do not fully understand the nuances of ONC’s regulations and processes governing the testing and certification of EHR technology—the very subject of their review. That could be a reflection of the confusing complexity of the program (and, for that matter, all things Meaningful Use), or something else (political pressure, etc.) could have resulted in this rare misfire from OIG.
ONC’s official response to the report described the differences between the old Temporary Certification Program, upon which the OIG report is based, and the current HIT Certification Program. It also mentioned the current program features various pre- and post-certification product evaluation processes. Importantly, ONC correctly recognized that enforcing more stringent log-in/security requirements for HIT products would require a rulemaking to revise the federal regulations before making those changes to the guidance for testing labs and certification bodies.
Several American College of Radiology members have inquired about the Centers for Medicare and Medicaid Services (CMS) and Office of the National Coordinator for HIT (ONC) May 23, 2014 proposed rule to allow continued use of 2011 Edition certified EHR technology to comply with the Medicare EHR Incentive Program in calendar year (CY) 2014. The program’s regulations currently require eligible professionals to use 2014 Edition certified products in CY 2014.
The ONC’s 2014 Edition EHR certification criteria regulations for HIT products were published in September 2012. A few months later, vendors were able to submit ready products to the testing labs and certification bodies for 2014 Edition certification. Eligible professionals could opt to use 2014 Edition certified products to comply with Meaningful Use (MU) beginning in CY 2013, and the new certification status became mandatory in CY 2014. Most HIT products were not ready to be 2014 Edition certified in time for prior MU participants to take advantage of that flexibility in CY 2013 due to their yearlong reporting period. However, new MU participants only had a 90-day reporting period in CY 2013, and thus were encouraged to implement 2014 Edition certified products instead of implementing 2011 Edition products (to avoid having to upgrade again so soon).
As CY 2013 wore on, it became clear that many vendors who had commercially successful 2011 Edition certified products were not getting new versions of those products updated and submitted for testing/certification in a timely fashion. By the time most vendors were ready, there was an alleged backlog of products in the testing and certification pipeline, which apparently caused more delays.
CMS and ONC soon realized that many prior MU participants were unable to implement 2014 Edition certified versions of the products they used before in time to demonstrate MU in CY 2014. So, in March 2014, CMS announced a new significant hardship exception for prior participants who had experienced vendor issues in 2014. Then, in May 2014, CMS and ONC published the proposed rule to (potentially, if finalized) allow participants to use their old certified software.
The May proposed rule was extremely late; perhaps too late to make a practical difference. The 60-day public comment period for the proposed rule will close on July 21, after which the agencies will need to review the comment submissions, develop the final rule, go through internal and Administration review, and get it published in the Federal Register before the beginning of the fourth quarter of CY 2014 (the last opportunity to begin a special reporting period). This part of the federal rulemaking process usually takes a few months at best, even when prioritized and expedited, and a significant portion of the time prior to a final rule’s publication is in the hands of reviewers in the Department and the Office of Management and Budget—not in the hands of those writing the rule at the agency level.
This promises to be one of the fastest conventional notice-and-comment rulemakings in recent CMS memory, but only time will tell if it will eventually be effective in helping physicians. Essentially, CMS and ONC are relying on MU participants to take a massive business risk and make implementation/participation plans based on a proposed (not final) rule, subject to change. Given the tight timing, it would have been preferable for the agencies to implement this via a Direct Final Rule (although DFRs are risky because they require there to be no substantive adverse comments), or even better, via an Interim Final Rule (IFRs merely require good cause to forgo the NPRM process). The agencies could have also held a minimum 30-day instead of a 60-day public comment period to expedite the rulemaking, considering it is unlikely they will get anything but support from the main stakeholder communities of eligible professionals, eligible hospitals, and vendors.
The question I often get is: if these proposed changes are eventually finalized without modification, would it help? I believe the timing is so short that it will only aid those who have previously participated in MU using 2011 Edition certified products (i.e., those products have already been implemented), and have no alternative compliance options in the fourth quarter of CY 2014 other than to cross their fingers and plan for the final rule’s new flexibility before it exists. That said, it would be risky and imprudent to advise anyone to make compliance plans based on a proposed (not final) rule.
On July 3, the American College of Radiology (ACR) submitted comments to the Food and Drug Administration (FDA), Federal Communications Commission (FCC), and Office of the National Coordinator for HIT (ONC) regarding the agencies’ report on a proposed strategy for a risk-based regulatory framework for health IT. The agencies were mandated by a provision in the FDA Safety and Innovation Act of 2012 (FDASIA) to draft recommendations that appropriately balanced HIT safety with innovation and avoided overlapping jurisdictions.
The report called for a risk-based, three tier categorization scheme for HIT functionality. FDA would continue to regulate the highest risk “medical device” IT functionality as before, and would not expand into new areas of oversight. ONC, in collaboration with the private sector and a future public-private HIT Safety Center, would promote HIT safety through non-regulatory activities for the middle tier “health management” IT functionality. Functionality in the lowest risk “administrative” category (billing systems, etc.) would not be a safety concern.
The ACR participated in several federal efforts leading up to the proposed framework, including the FDA’s mobile medical applications guidance activities in previous years and a FDA-FCC-ONC meeting addressing the FDASIA HIT report in May 2014.