United States: The New Federal Role In Funding And Regulating Health Care Information Technologies Under The HITECH Act

When President Obama signed the American Recovery and Reinvestment Act, he took an important initial step toward fulfilling campaign promises to reform the American health care system.¹ During his campaign and in his inaugural address, President Obama pledged to improve quality and reduce inefficiencies in the health care system by investing significant amounts in health information technologies. The President proposed a $10 billion investment in health care IT over five years, but Congress upped the ante significantly, nearly doubling that amount in the final legislation.

Two separate sections of the Recovery Act comprise what is referred to collectively as the "HITECH Act"; they authorize an investment in health care IT that is expected to top $20 billion. The bulk of that funding is allocated to direct financial incentives intended to encourage hospitals and other health care providers to invest in IT infrastructure, training and electronic health records.

Other provisions in the HITECH Act fund a greatly expanded Federal role in regulating health care information technology. The legislation also provides funds for programs run by states, state contractors and academic institutions to promote the use and exchange of electronic health information. The Federal government's express (and extremely ambitious) goal is to establish an electronic health record for every US resident by 2014 -- an effort that will cost far more than the $20 billion currently allocated for the task.

In brief, the HITECH Act provides funding for the following:

• The development of uniform standards for creating, exchanging and storing electronic health information;
• The collection and analysis of data obtained from electronic health records;
• Direct subsidies paid over several years to physicians, hospitals and certain other health care providers that participate in the Medicare and Medicaid programs;
• Training programs and technical support resources;
• Infrastructure and tools supporting telemedicine technologies; and
• Competitive grants to the states and to Indian tribes for the purchase and development of health information technologies.

More specifically, providers that participate in the Medicare and Medicaid program stand to receive between $43,000 and $64,000 (for individuals) and up to $11 million (for hospitals) in cash incentives over four to six years. Those incentives come -- not surprisingly -- with strings attached. Providers must agree to purchase and implement "certified" systems with the capacity for the electronic exchange of health information. The government intends to use those systems to expand existing health care data reporting requirements. The HITECH Act's economic incentives phase out over time, and become penalties beginning in 2015. Providers that cannot demonstrate "meaningful use" of an electronic health record by 2015 will see their reimbursement reduced by a percentage that begins at 1% and increases in subsequent years.

The HITECH Act also solidifies the role of the federal government in determining health care IT technical standards. To receive incentives, providers must invest in systems that are certified to meet government standards. The Act codifies the role of the Office of the National Coordinator for Health Information Technology (ONCHIT), which was created by executive order during the Bush administration. That Office is now a statutorily established unit of the Department of Health and Human Services, and is tasked with a wide range of responsibilities relating to the development and use of health care IT. ONCHIT's primary duties fall into four general categories:

• Policy: updating the HHS strategic plan for developing health care IT, and coordinating HHS policies with those being developed at other federal agencies;
• Standards: making recommendations to HHS leadership regarding the adoption of implementation specifications and certification criteria for the use and exchange of electronic health information;
• Certification: maintaining existing programs and/or recognizing new ones for certifying that technologies comply with federal standards; and
• Governance: developing a governance mechanism for the nationwide health information network.

Because health care privacy concerns are viewed as a significant obstacle to widespread use of electronic health care records, the legislation also strengthens existing federal privacy requirements under the Health Insurance Portability and Accountability Act (HIPAA).

• The HITECH Act expands not only the application of HIPAA privacy and security requirements, but also the universe of entities subject to civil and criminal penalties under HIPAA.
• Organizations that handle individually identifiable health information under contracts with providers, health plans, and health care clearinghouses will be subject to new notification requirements and will have increased exposure to liability under the new privacy provisions.
• State attorneys general will also have new authority to prosecute alleged HIPAA violations, and they can pursue injunctive relief, damages and penalties.

This expanded enforcement authority is likely to generate a significant increase in enforcement activity, especially in jurisdictions that engage in aggressive consumer protection litigation. Moreover, federal enforcement of HIPAA was already on the rise: a major retail pharmacy chain recently agreed to pay $2.25 million to settle allegations that it was throwing labeled prescription bottles into unsecured, open dumpsters.

As a result, organizations that handle individually identifiable health information must be even more vigilant about protecting the privacy and security of that information. This should include a thorough review and audit of existing programs to assure that policies and procedures are being followed. Compliance staff should be monitoring proposed regulations from the Federal Trade Commission and HHS on breach notification requirements, and take advantage, if necessary, of the right to comment on draft regulations. Under the HITECH Act, breach notification rules are to be published by both agencies by August 16, 2009. Existing policies and procedures will requiring revision and updating to reflect the new obligations imposed under HITECH. If an organization handles significant amounts of individually identifiable health information, enhancements to the compliance budget and staff may be necessary.

Funding provisions in the HITECH Act are summarized briefly in the attached Annex A.

* * * * * *

ANNEX A

The HITECH Act

Set forth below is a detailed summary of the HITECH Act.

A. The Federal Regulatory Role

• Creation of ONCHIT: The bill codifies the establishment of the Office of the National Coordinator for Health Information Technology (ONCHIT) in the Department of Health and Human Services (HHS). It also appropriates $2 billion to ONCHIT to carry out the provisions of the HITECH Act. ONCHIT's mission is to promote and develop a nationwide health care IT infrastructure that, among other things, allows for the electronic exchange of information, protects privacy, improves the quality of health care, reduces health care costs, improves coordination between health care providers, and improves competition in the marketplace.
• Specific Appropriations: The bill earmarks $300 million for regional and sub-regional efforts toward health information exchange. It also provides $20 million to the National Institute for Standards and Technology (NIST) for work on advancing health care information enterprise integration, through activities such as technical standards analysis and establishment of conformance testing infrastructure.
• Use of Appropriated Funds: There are a number of provisions under which ONCHIT can spend appropriated funds. These include:
• • Immediate Funding for Health Care IT Infrastructure: ONCHIT is required to invest funds to support the following:
  • • health care IT architecture to support the electronic exchange of health information
    • adoption of certified electronic health records (EHRs)
    • EHRs for providers not eligible for such funding under Medicare and Medicaid
    • training on best practices for integrating health care IT
    • infrastructure and tools for telemedicine
    • promoting interoperability of clinical data repositories
    • promoting technologies and best practices to ensure the protection of health information
    • improving the use of health care IT by public health departments.
  • Health Care IT Implementation Assistance: HHS is required to create a health care IT research center to provide technical assistance (including assistance to medically underserved communities) and develop best practices.
  • Regional Health Care IT Extension Centers: HHS is also required to assist in the development of regional centers providing technical assistance promoting health care IT. These centers will be affiliated with U.S.-based nonprofits.
  • State Grants to Promote Health Information Technology: ONCHIT may make planning and implementation grants to a State or "qualified State-designated entity" to promote the exchange of electronic health information (EHI). The state must provide matching funds.
  • Competitive Grants to States and Indian Tribes: The HITECH Act authorizes ONCHIT to award competitive grants to states or Indian tribes to establish loan programs to health care providers to:
  • • facilitate the purchase of certified EHR technology
    • enhance the utilization of certified EHR technology
    • train personnel in the use of such technology, or
    • improve security for the exchange of EHI.
  • Demonstration Program to Integrate Information Technology into Clinical Education: The Secretary may award grants to fund demonstration projects to develop academic curricula integrating certified EHR technology in clinical education programs. These grants may be given to medical, osteopathic, nursing, dentistry, or pharmacy schools, or any graduate health program. The grants cannot be used to purchase hardware, software, or services.
  • Information Technology Professionals in Health Care: The Secretary must provide assistance to institutions of higher education to expand medical health informatics education programs. Activities eligible for support include, curriculum development, student recruiting, and equipment acquisitions.
  • Federal Agencies Required to Meet Health Care IT Standards: Any Federal agency that implements, acquires, or upgrades health care IT systems for the exchange of EHI must use systems and products that meet the standards adopted under the HITECH Act.
  • Pilot Testing of Standards and Implementation Specifications: The HIT Standards Committee and NIST will coordinate to test standards and implementation specifications developed by the Committee.
  • Voluntary Testing Program: The HIT Standards Committee and NIST are required to establish a voluntary conformance testing infrastructure. This may include a program to accredit independent, non-Federal laboratories to perform testing.
  • Health Care Information Enterprise Integration Research Centers: The National Institute of Standards and Technology and the National Science Foundation are required to establish a program to assist institutions of higher education to establish multidisciplinary Centers for Health Care Information Enterprise Integration.
  • National Information Technology Research and Development Program: The ongoing work being performed by the National High-Performance Computing Program must include Federal research development programs related to the development and deployment of HIT.

B. Medicare Incentives

1. Incentives For Eligible Professionals

• Incentive Payments: The Social Security Act is amended to provide incentive payments for "eligible professionals" for the adoption and "meaningful use" of certified electronic health records technology, which includes an ambulatory electronic health record (for office-based physicians) or an inpatient hospital electronic health record (for hospitals).
• Eligible Professionals who may qualify for Medicare incentives are those who participate in Medicare and fall within the definition of a "physician" in Section 1861(r) of the Social Security Act. This generally includes (with some limitations) medical doctors, doctors of osteopathy, dentists, podiatrists, optometrists and chiropractors. (In contrast, the Medicaid incentives described below apply to a broader range of health care professionals, including nurse practitioners and physician assistants.)
• Caps: The amount of the incentive payment an eligible professional may receive in a payment year is capped, based on the amount of Medicare-covered professional services furnished during the year, and is not to exceed the following amounts:
• • $15,000 for the first payment year (or $18,000 if the first payment year is 2011 or 2012)
  • $12,000 for the second payment year
  • $ 8,000 for the third payment year
  • $ 4,000 for the fourth payment year
  • $ 2,000 for the fifth payment year
  • No payments may be made for subsequent payment years.
• Eligibility Cut Offs and Phase Downs: No incentive payments will be made after 2016. No incentive payments will be made to eligible professionals who first adopt an EHR in 2015 or subsequent years.
• Bonus Incentive for Eligible Professionals in Underserved Areas: Incentive payments will be increased by 10% for eligible physicians who serve Medicare beneficiaries in any area designated as a health professional shortage area.
• Hospital-Based Eligible Professionals: No incentive payments will be made to hospital-based eligible professionals, defined as a professional who furnishes substantially all of his or her services in a hospital setting and through the use of the facilities and equipment of the hospital. This includes, for example, pathologists, anesthesiologists, or emergency physicians, who are generally expected to use the hospital's EHR system.

2. Incentives For Eligible Hospitals

• Incentive Payments: Beginning in 2011, "subsection (d) hospitals" that are meaningful EHR users may receive incentive payments. Under the Social Security Act, a subsection (d) hospital is "a hospital located in one of the 50 States or the District of Columbia," but this definition generally excludes facilities such as the following:
• • psychiatric hospitals
  • rehabilitation hospitals
  • children's' hospitals
  • cancer centers and
  • long-term care facilities.
• Payment Amount: Each eligible hospital will receive a base incentive payment calculated by adding a $2 million base payment to an amount determined by the total number of discharges, and then multiplying this figure by the hospital's Medicare share. The Medicare share is determined by a formula set forth in the legislation, and takes into account the hospital's charity care charge data.
• Transition Factor: Incentive payments gradually decrease over a four-year period and are determined by a "transition factor," such that an eligible hospital will receive the full amount in the first year, 75% in the second, 50% in the third, 25% in the fourth, and no payments thereafter. Hospitals that become meaningful EHR users after 2015 will not receive incentive payments.
• Payments to Critical Access Hospitals (CAHs) that are Meaningful EHR Users: Bonus payments are provided for CAHs that are meaningful users of EHR technology. The bonus payments are capped at an enhanced Medicare share of 101% of those reasonable costs that are normally subject to depreciation and that are for the purchase of certified EHR.
• Application of Hospital Incentive Payments to Certain Medicare Advantage Plans: For the most part, Medicare incentives for hospitals are not available to Medicare Advantage plans, but incentive payments and penalties are established for certain qualifying MA organizations. The Secretary is required to determine incentive payment amounts that are similar to the estimated aggregate amount that would be paid if these hospitals were eligible under Medicare Part A.

C. Medicaid Incentives

• Federal Match for Adoption of EHR: This section of the HITECH Act authorizes a 100% Federal match for a portion of payments made by the States to encourage the adoption of certified EHR technology to qualifying Medicaid providers. Allowable costs that qualify for this 100% Federal match include EHR support services, such as training and maintenance. Funds provided under this Section are to be used to pay "eligible professionals" 85% of the providers' net allowable technology costs.
• Incentive Payments to Eligible Professionals: Eligible professionals (other than eligible pediatricians) can receive a payment equal to 85% of their net average allowable costs, subject to the following limitations:
• • The costs for purchase and initial implementation cannot exceed $25,000.
  • Annual net average allowable costs not associated with the initial implementation or purchase of the EHR technology cannot exceed $10,000 per year or be made over a period of more than five years.
  • The Federal contribution towards net average allowable costs, after application of the 85% adjustment, cannot exceed $63,750.
  • Eligible pediatricians can receive payment equal to 2/3 of the dollar amounts that apply to other eligible professionals, or up to approximately $42,500, over a period of six years.
• Eligible Professionals" who may qualify for Medicaid incentives include:
• • physicians
  • dentists
  • certified nurse mid-wives
  • nurse practitioners, and
  • physician assistants who are practicing in a rural health clinic led by a physician assistant (PA) or in a Federally qualified health center led by a PA.
• Incentive Payments to Federally Qualified Health Centers (FQHCs) and Rural Health Clinics (RHCs): Payments to FQHCs and RHCs will be proportional to the number of eligible professionals practicing predominantly in such settings, and will be based on the payment amounts determined by other eligible professionals (usually up to $63,750 in Federal payments over six years).
• Incentive Payments to Hospitals: Payments for aggregate allowable costs to hospitals that demonstrate meaningful use of certified EHRs cannot exceed amounts based on the Medicare incentive payment formula, with some adjustments.

Footnote

1. Other health care-related funding in the Recovery Act includes more than $87 billion for state Medicaid programs, $39 billion for COBRA subsidies, $1 billion for comparative effectiveness research and $1 billion for prevention and wellness efforts. For a broader overview of the Obama agenda for health care reform, see the Fried Frank Client Memorandum "The Obama Administration's Plan for Health Care Reform: Potential Ramifications for Employers, Investors, and the Health Care Sector".

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.