[PRIVAPLAN LIVE WEBCAST]chcnetwork.org/wp-content/uploads/2015/03/WEBCAST-MU-1-15-2015-FINAL.pdf ·...

[PRIVAPLAN LIVE WEBCAST] Meaningful Use & Audit Survival Guide

January 15, 2015 Presented by: David A. Ginsberg, President, PrivaPlan Associates, Inc Copyright PrivaPlan® Associates, Inc. 2015

AGENDA

• AUDITS

• STAGE 2 MU

• COMMON MISTAKES

• AREAS OF CONFUSION

• REVIEWS FOR MU COMPLIANCE & DATA INTEGRITY

• AUDIT BINDER – NECESSARY COMPONENTS

• SECURITY RISK ANALYSIS

• IMPORTANT TIDBITS

Copyright PrivaPlan® Associates, Inc. 2015

AUDITS MEDICARE vs. MEDICAID • MEDICARE - What are they looking for?

• MU Measure Data Integrity • Proof

• Screenshots of Y/N measures • Screenshots/list of data that supports MU results • Completion of appropriate SRA • Verification from public health

• MEDICAID – What are they looking for? • Eligibility verification proof


AUDIT PREPARATION WHAT YOU SHOULD DO . . . • SELF AUDIT!

• Periodic review of CORE/MENU set measure data integrity (following MU period Gap Analyses – more on that later)

• Patient Census/Encounter count vs. denominator numbers • Question data output with your Vendor • Study the vendor’s calculation of numerator/denominator • Study EHR measure setup procedures-is the correct data being

pulled?


WHAT IS A GAP ANALYSIS?


GAP ANALYSIS

DATA INTEGRITY

GAP ANALYSIS: DASHBOARD VS REPORT

DASHBOARD


A QUICK AN DIRTY VIEW. Often a dashboard contains graphs or charts and percentages, or a combination of both. Historically, they are NOT as accurate as a report.

GAP ANALYSIS: DASHBOARD VS REPORT


REPORT

AN IN-DEPTH ANALYSIS. A report is the best source of data. Numerators/denominators are present, and often, data drill down capability. A report is the only source for attesting to MU and what typically an auditor wants!

STAGE 2 - MU GAP ANALYSIS


MU CORE OBJECTIVES (Must meet all 17) 2014 Stage 2 Measure Exclusion (if applicable) 2014 Measure Notes &

Addt'l Resources Action Plan/Notes

1) CPOE (Computerized Provider Order Entry)

3 PART MEASURE! More than 60% of medication orders AND more than 30% of lab AND 30% of radiology orders created by any licensed healthcare professional OR credentialed MA who can enter orders per state, local, and professional guidelines, must be entered using certified EHR technology. (Medical Assistants must be credentialed by an entity other than the employer.)

Any EP who writes fewer than 100 medication, radiology, or laboratory orders during the EHR reporting period.

170.314 (a)(1) (Computerized order entry) http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/downloads/Stage2_EPCore_1_CPOE_MedicationOrders.pdf










9) Provide patients the ability to view online, download and transmit their health information within 4 business days of the information being available to the EP. *Replaces the Stage 1 Core Objective for EPs of "Provide patients with an electronic copy of their health information (including diagnostic test results, problem list, medication lists, medication allergies) upon request" and the Stage 1 Menu Objective for EPs of "Provide patients with timely electronic access to their health information (including lab results, problem list, medication lists, and allergies) within 4 business days of the information being available to the EP."

2 PART MEASURE! PART 1: More than 50% of all unique patients seen by the EP during the EHR reporting period are provided timely (available to the patient within 4 business days after the information is available to the EP) online access to their health information. PART 2: More than 5% of all unique patients seen by the EP during the EHR reporting period (or their authorized representatives) view, download, or transmit to a third party their health information. *Definitions of Access, View and Transmit can be found here: http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/downloads/Stage2_EPCore_7_PatientElectronicAccess.pdf

Any EP who: (1) Neither orders nor creates any of the information listed for inclusion as part of both measures, except for "Patient name" and "Provider's name" and office contact information, may exclude both measures. (2) Conducts 50% or more of his or her patient encounters in a county that does not have 50% or more of its housing units with 3Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period may exclude only the second measure.

§ 170.314 (e)(1) (View, download and transmit to 3rd party) FCC Broadband Maps: http://www.fcc.gov/maps/section-706-fixed-broadband-deployment-map http://www.fcc.gov/maps/unserved-fixed-broadband http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/downloads/Stage2_EPCore_7_PatientElectronicAccess.pdf











(12) Use clinically relevant information to identify patients who should receive reminders for preventive/follow-up care and send these patients the reminders, per patient preference.

NOW A CORE MEASURE More than 10% of all unique patients (no age restriction) who have had 2 or more office visits with the EP within the 24 months before the beginning of the EHR reporting period were sent a reminder, per patient preference when available. *To count for the measure, reminders for preventive/follow-up care must be for care that the patient is not already scheduled to receive. Reminders for referrals or to engage in certain activities are also included in this objective and measure.

Any EP who has had no office visits in the 24 months before the EHR reporting period.

§ 170.314(e)(15) (Ambulatory setting only – patient reminders) http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/downloads/Stage2_EPCore_12_PreventiveCare.pdf









OUR MU GAP ANALYSIS

CLICK HERE TO VIEW

https://www.dropbox.com/s/qcoym922a9bpqab/2014 Stage 2 Clinic MU Gap Analysis.xls?dl=0

COMMON MISTAKES


AVOID THESE PITFALLS . . . • CQMs (Clinical Quality Measures)

• CDS (Clinical Decision Support)

• Security Risk Analysis – What an OCR or MU auditor expects

• View/Download/Transmit – Patient given access vs. patient access

• Public Health

• Menu Measures – No exclusions

• Summaries & Portal – The data that must be provided per CMS

COMMON MISTAKES (con’t)


AVOID THESE PITFALLS . . . • Data integrity issues such as:

• The data changes each time a report is generated for the same

time frame

• Vendor software CAN HAVE BUGS!!!!!!!

• The data changes after a new version is installed

• Set up was incorrectly done and data is pulled from the wrong template/form/file

CQMs


KEYS TO SUCCESS. . . Selecting your 9 CQMs:

• EPs must report on 9 of the 64 approved CQMs Recommended core CQMs – encouraged but not required

• 9 CQMs for the adult population • 9 CQMs for the pediatric population • NQF 0018 strongly encouraged since controlling blood pressure is

high priority goal in many national health initiatives, including the Million Hearts campaign

• Selected CQMs must cover at least 3 of the National Quality Strategy domains

Take time to carefully select these-and be sure your system set up correctly maps the data!

CDS


KEYS TO SUCCESS . . . Select your CDS rules carefully and ensure they are operational as of the beginning of the reporting period: • For Stage 2, implement 5 clinical decision support interventions related

to four or more clinical quality measures at a relevant point in patient care for the entire EHR reporting period. Absent four clinical quality measures related to an EP’s scope of practice or patient population, the clinical decision support interventions must be related to high-priority health conditions.

• If none of the CQMs are applicable to an EP's scope of practice, the EP should implement CDS interventions that he or she believes will to drive improvements in the delivery of care for the high-priority health conditions relevant to their patient population.

CDS (con’t)


KEYS TO SUCCESS . . .

• Be sure each CDS rule has “referential support”

• The risks of creating your own rules

HIPAA SECURITY RISK ANALYSIS


A MU or HIPAA auditor would expect a formal report to be on hand to prove you have done the Risk Analysis + to show that you are remediating or managing gaps and deficiencies (Risk Management). A checklist is not sufficient for a SRA Administrative, physical, technical and organizational safeguards/compliance must be reviewed If you attest without doing the work, you will be risking fraud by being untruthful on your attestation documents and receiving federal funds.

MU-ONC GUIDANCE


When you attest to Meaningful Use, it is a legal statement that you have met specific standards, including that you protect electronic health information. Providers participating in the EHR Incentive Program can be audited If you attest prior to actually meeting the Meaningful Use security requirement, you could increase your business liability for federal law violations and making a false claim. From this perspective, consider implementing multiple security measures as feasible, prior to attesting. The priority would be mitigating high-impact and high-likelihood risks.

MU-ONC GUIDANCE FOR ATTESTATION


“Implement security updates as necessary and correct identified security deficiencies as part of the provider's risk management process.”

Does this mean that all security deficiencies must be fully corrected prior to attestation?

MU-CMS GUIDANCE FOR ATTESTATION


Thus, it is important to remember two key points: - If you use an EHR, it should be reviewed as part of the HIPAA SRA - Risk Management is the “flip side” or risk analysis

Your risk management timeline is the driver not MU…But you need a risk management plan!

RISK ANALYSIS TOOLSET


Implement Security Rule

Choose a Privacy & Security Official

Physical Security (Large & Small Organizations)

PHI Inventory

Risk Analysis (includes Risk, Threat & Criticality Matrix)

SRA SELF-ASSESSMENT OR OUTSIDE SUPPORT


Consider these contributing factors in your decision making: 1. Have you ever had an outside review? If so, was it prior to

implementation of EHR systems and was it more than 2 years ago? 1. Have you had significant IT infrastructure change? 1. Have you had any breaches or security incidents? Have any of these

been “reportable”? 1. Do you have the internal resources?

SRA SELF-ASSESSMENT OR OUTSIDE SUPPORT


Consider these contributing factors in your decision making: 5. Do you need to justify or support enhanced security measures and

controls? 5. Have you updated policies and procedures in the last two years? 5. Other threats and concerns?

VIEW/DOWNLOAD/TRANSMIT - PORTAL


Is your portal and instruction process in place? PART 1: More than 50% of all unique patients seen by the EP during the EHR reporting period are provided timely (available to the patient within 4 business days after the information is available to the EP) online access to their health information. PART 2: More than 5% of all unique patients seen by the EP during the EHR reporting period (or their authorized representatives) view, download, or transmit to a third party their health information.

PUBLIC HEALTH


Be sure to find out what is in place in your State

• State and County Public Health Departments are the typical resource

• Immunization Registry

• Cancer Registry

• Specific Registries

• Syndromic Surveillance

MENU MEASURES


• Must select 3 out of 6 • Can NOT include an exclusion

CLINCAL SUMMARIES + PORTAL DATA


PER CMS, certain data sets MUST be made available to the patient.

CLINICAL SUMMARIES Patient name. Provider's name and office contact information. Date and location of the visit. Reason for the office visit. Current problem list. Current medication list. Current medication allergy list. Procedures performed during the visit. Immunizations or medications administered during the visit. Vital signs taken during the visit (or other recent vital signs). Laboratory test results. List of diagnostic tests pending. Clinical instructions. Future appointments. Referrals to other providers. Future scheduled tests. Demographic information maintained within certified electronic health record technology (CEHRT) (sex, race, ethnicity, date of birth, preferred language). Smoking status. Care plan field(s), including goals and instructions. Recommended patient decision aids (if applicable to the visit).

CLINCAL SUMMARIES + PORTAL DATA (con’t)


PER CMS, certain data sets MUST be made available to the patient.

PATIENT PORTAL Patient name. Provider's name and office contact information. Current and past problem list. Procedures. Laboratory test results. Current medication list and medication history. Current medication allergy list and medication allergy history. Vital signs (height, weight, blood pressure, BMI, growth charts). Smoking status. Demographic information (preferred language, sex, race, ethnicity, date of birth). Care plan field(s), including goals and instructions. Any known care team members including the primary care provider (PCP) of record unless the information is not available in certified EHR technology (CEHRT), is restricted from disclosure due to any federal, state or local law regarding the privacy of a person’s health information, including variations due to the age of the patient or the provider believes that substantial harm may arise from disclosing particular health information in this manner.

AREAS OF CONFUSION LET’S PROVIDE SOME CLARIFICATION….


• CPOE by a “Credentialed Medical Assistant” – Documentation is needed!

• Transitions of Care (for Med Rec and Summary of Care) • Definition:

The movement of a patient from one clinical setting (inpatient, outpatient, physician office, home health, rehab, long-term care facility, etc.) to another or from one EP to another. At a minimum, transitions of care include first encounters with a new patient and encounters with existing patients where a summary of care record (of any type) is provided to the receiving provider.

AREAS OF CONFUSION (con’t)


• DIRECT (For Part 2 of Summary of Care for Transition of Care) • Direct exchange is not the only way that providers can meet the

health information exchange requirements of Stage 2 Meaningful Use, SOAP-based optional transport standard capability is also permitted. However, since all certified EHR technology must enable use of Direct exchange, Direct may be the easiest messaging solution to deploy.

• Direct addresses are available from a variety of sources, including EHR vendors, State Health Information Exchange entities, regional and local Health Information Exchange entities, as well as private service providers offering Direct exchange capabilities called Health Information Service Providers (HISPs).

**Individuals may be asked to provide information confirming their identity to ensure sensitive patient health information is sent from and to is protected.

IMPORTANCE OF REVIEWING MU REPORTS


ITS EASIER TO STAY AHEAD THAN CATCH UP! • Periodic reviews

• By provider

IMPORTANCE OF DATA INTEGRITY REVIEWS


SANITY CHECK! • PULL PATIENT DATA FOR BOTH NUMERATORS AND DENOMINATORS

• SCREENSHOTS

AUDIT PREP BINDER


MU Audit Binder – An electronic binder (folder) all documents you used to support your attestation and prepare you for an audit. Two things to remember: 1. Always be sure the date stamp is somewhere on the documentation. 2. Always be sure the vendor’s name and/or the software name and version are on the documentation.

*When not available, take a series of screenshots while generating the documentation as proof that the documentation generation originated from the EMR

AUDIT PREP BINDER (con’t)


Items to Include: • MU Report Generated by your EMR (includes Core, Menu and CQMs

and displays numerators and denominators for each) • Needs to identify the following:

- Provider Name and/or Identifier (NPI) - MU Report Date Range - Date Report was Ran

**MU Dashboards and MU Reports are NOT the same thing! • HIPAA Security Risk Analysis

• Initial findings • PHI Inventory • Remediation Plan • Documentation of Remediation



Items to Include (continued): • MU Gap Analysis

• System Settings Screenshots for YES/NO Measures

• Drug formulary checks • Drug-drug and drug allergy interaction checks • CDS rule(s) (1 for Stage 1, 5 for Stage 2)

- Systems settings “in action” screenshots meaning showing these are functional in test patient or live patient’s chart

• Patient Listing by diagnosis

**All of the screenshots need to show a date prior to or on the START of the reporting period



Items to Include (continued): • Public Health Attestation Support (emails or letters from public health

registries to which you’re attesting or claiming exclusions for) dated within the reporting period

• Post Attestation Documentation • Receipt or screenshot of successful attestation (and attestation

confirmation number if attesting to Medicare) • PDF Summary of Attestation (offered by Medicare after

successfully attestation submission)



Items to Include (continued): • HIPAA SRA – This is NOT a checklist! Know what an OCR or MU audit will

require of your SRA. • MUST be completed prior to the end of the reporting period • MUST be specific to the EMR version you are attesting with

MORE ON MU


WHAT ELSE FOR 2014, 2015 AND BEYOND? • You need to be on the 2014 Certified Version for your ENTIRE

reporting period!

• For any EP outside of their first year of MU, you must attest for a full calendar year!

• KEEP ALL AUDIT BINDER INFORMATION SECURE! Often it contains PHI! Ensure the binder location is known by several individuals!

• Be sure to retain all documentation of attestations.

• Retain ALL attestation and audit documentation during staff transitions.

AUDITS


NOTIFICATIONS and KEYS TO SUCCESS • Recognizing a notification

• Response times

• Key steps

• Understanding what the “issue” is • Request clarification if necessary • Assemble documentation • Prepare your response • Seeking outside assistance?

• Audit Failure

APPEALS


• Initial request for an appeal

• Response times-within 30 days

• Key steps

• Understanding what the “issue” is • Determine what if anything was missing in your response to the

audit • Assemble documentation focusing on making your case • Reiterate and reinforce that you achieved MU (if indeed you did!) • Seeking outside assistance?

• Appeal denials---they are final

PrivaPlan Associates are also MU experts!

OUR SERVICES INCLUDE • EHR selection and implementation management • MU attestation prep, MU gap analysis, registration and attestation

support • MU audit preparation and fulfillment • Negative MU audit determination reversals consulting • Security Risk Analysis • Policy & Procedure Customization • Outsourced Compliance Official service OUR CLIENTS INCLUDE • CO-REC (the leading REC in the nation) • Hundreds of hospitals and eligible professionals across the nation David Ginsberg [email protected] (877)218-7707

[PRIVAPLAN LIVE WEBCAST]chcnetwork.org/wp-content/uploads/2015/03/WEBCAST-MU-1-15-2015-FINAL.pdf ·...

Documents

Transcript of [PRIVAPLAN LIVE WEBCAST]chcnetwork.org/wp-content/uploads/2015/03/WEBCAST-MU-1-15-2015-FINAL.pdf ·...