United States: CMS And ONC Move Forward With Meaningful Use--Stage 2

On August 23, 2012, the Centers for Medicare & Medicaid Services ("CMS") and the Office of the National Coordinator for Health Information Technology ("ONC"), both agencies of the Department of Health and Human Services ("HHS"), released complementary final rules concerning the continued implementation of the Medicare and Medicaid Electronic Health Record Incentive Programs (the "Programs") and the technological specifications required to achieve "meaningful use" under the Programs to qualify for the respective Program's incentive payments. This newsletter provides a broad and general overview of these rules, promulgated pursuant to the American Recovery and Reinvestment Act of 2009.

The Programs offer incentive payments for eligible professionals, hospitals, and critical access hospitals ("providers") that become "meaningful users" of certified electronic health record technology ("CEHRT"). "Meaningful use" is achieved over the course of three stages. Providers that fail to achieve meaningful use of CEHRT by 2015 are subject to downward Medicare payment adjustments.

With this final rule, CMS delayed the implementation of Stage 2 until 2014 to allow more time for the development of CEHRT. The Stage 1 final rule anticipated that providers would start implementing Stage 2 in 2013. Furthermore, instead of requiring a full twelve-month reporting period to demonstrate meaningful use of CEHRT for providers attesting to Stage 1 or Stage 2 in 2014, those providers will enjoy a three-month reporting period. This will presumably allow more time for effectively implementing Stage 2 while reducing the likelihood of delays in Stage 3's ultimate implementation due to occur by 2016.

In Stage 2, providers must continue to meet the core and menu objectives introduced in the Stage 1 final rule, with some modifications. In Stage 2, eligible professionals must meet seventeen core objectives and three of six menu objectives or qualify for an exclusion. Eligible hospitals and critical access hospitals, on the other hand, must meet sixteen core objectives and three of six menu objectives or qualify for an exclusion. Certain objectives outlined in Stage 1 were reworked, replaced, or combined for Stage 2. For example, the "Provide patients with an electronic copy of their health information" objective is being replaced by the "View online, download, and transmit" objective allowing patients online access via a patient portal or personal health record.

Under the final rule, eligible professionals and hospitals must undertake stronger security protections given the additional risks posed by robust data collection and exchange. The Stage 2 final rule continues to require meaningful users to conduct a risk assessment as required by the HIPAA Security Rule and Stage 1 and to address encryption of electronic health information stored in CEHRT in that risk assessment. The list of Stage 2 objectives and the measures used to gauge compliance with the objectives are found in Table B5.

The Stage 2 final rule also includes electronic reporting requirements for clinical quality measures ("CQMs"). Reporting of CQMs is required to receive incentive payments. Attestation is permissible during the first year of demonstrating meaningful use; thereafter providers must transmit data electronically to CMS. Providers must submit CQMs from at least three of the National Quality Strategy domains. Eligible professionals must submit nine CQMs, while eligible hospitals and critical access hospitals must submit sixteen CQMs. For eligible providers, CMS recommends CQMs for pediatric and adult populations, with a particular emphasis on controlling blood pressure for adult measures. A list of the CQMs for eligible professionals is located in Table 8, and a list of the CQMs for eligible hospitals and critical access hospitals is located in Table 10.

The Stage 2 final rule establishes a process by which the downward Medicare payment adjustments are determined, relying on prior reporting periods. Providers that become meaningful users in 2013 avoid these adjustments, which are set to take effect in 2015. If providers become meaningful users in 2014, they must be able to demonstrate meaningful use at least three months prior to the end of the calendar or fiscal year and must also be able to meet certain registration and attestation requirements during 2014. CMS acknowledged, however, that not all providers may be able to meet the meaningful use requirements by 2015 for reasons beyond their control and therefore finalized four exceptions: 1) lack of internet access or problems obtaining the necessary IT infrastructure, 2) an inability to comply for new providers, 3) case-by-case unforeseen circumstances, and 4) a lack of interaction with patients or lack of control over the availability of CEHRT for eligible physicians who practice at multiple locations.

The final rule also modifies certain requirements in the Medicaid Electronic Health Record Incentive Program to aid providers that found participation difficult due to an inability to meet patient volume requirements. To lessen this burden, CMS provided a more expansive definition of what constitutes a "patient encounter." CMS also allowed participation by twelve children's hospitals that do not have CMS Certification Numbers due to not billing Medicare, but that would otherwise qualify for incentive payments.

In light of the adoption of the Stage 2 criteria for meaningful use, ONC provided a more flexible definition of CEHRT and issued the 2014 Edition EHR certification criteria. For 2014 and beyond, providers' EHR technology must meet these criteria to be considered CEHRT and thus be eligible for incentive payments under the Programs. Providers can begin adopting these criteria immediately and using the resulting technology to demonstrate meaningful use prior to 2014. ONC will continue to allow only Complete EHRs and EHR Modules to meet the definition of CEHRT.

The CEHRT criteria will now include a standard for end-user device encryption capabilities if the device stores electronic health information. CEHRT must either prevent electronic health information from being stored locally or default to encryption capability. CEHRT will need to restrict the ability to disable encryption, and the audit logs required by rule must record whether the devices have been disabled. Thus, the technology standards will support HHS investigations of breaches of unsecured protected health information where encryption was disabled.

Now is the time to consider the information needed to document compliance under meaningful use. From a compliance standpoint, providers are expected to maintain and make available electronic and paper documentation supporting attestations to CMS, specific information supporting each CQM submitted, and documentation to support incentive payment calculations, including calculations for amounts reported on their cost reports. CMS will continue to expect that this documentation will be maintained for at least six years following the date of attestation.

The full text of rules, prior to publication in the Federal Register, can be found at http://ofr.gov/OFRUpload/OFRData/2012-21050_PI.pdf (CMS) and http://www.ofr.gov/OFRUpload/OFRData/2012-20982_PI.pdf (ONC).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.