United States: Feds Help Pave Way For E-Health Technology

The Centers for Medicare and Medicaid Services ("CMS") and the Office of the Inspector General ("OIG") recently issued final rules (collectively, the "Final Rules") to create two new exceptions to the Stark Law ("Stark") and two new safe harbors to the Anti-Kickback Statute ("AKS") that will permit, under certain circumstances, the donation of health information technology items and services for the purpose of improving electronic prescribing and electronic health records ("EHR") capabilities. The new safe harbors and exceptions are intended to promote the use of health information technology in the interests of quality of care, patient safety, and health care efficiency, while also maintaining security and privacy.

The new regulations are important not only for establishing requirements upon which health care organizations may rely in structuring EHR systems, but also could affect any retrospective analysis for those who have provided health information technology ("HIT") to physicians in the past based on prior guidance from CMS and OIG. Below is a short, practical guide to the Final Rules related to EHR and an identification of important issues raised by the regulations.

Although contained in separate regulations promulgated by different regulatory agencies, the new Stark exceptions and AKS safe harbors establish virtually identical requirements that must be met to gain the protections of the regulations. The regulations governing the provision of EHR are broader in some respects, yet more restrictive in others, when compared to those pertaining to e-prescribing technology. The regulations applicable to EHR likely are more useful for health care organizations desiring to donate HIT to physicians because they address technology beyond the limited application of e-prescribing.

The Safe Harbor/Stark Exception for EHR is designed to further the goal of "open, interconnected, interoperable, electronic health records systems" that can enhance health care delivery. The regulatory requirements are intended to minimize the potential that the donation of EHR technology will induce referral or self-referral of federal health care business, contrary to the Stark and AKS laws, but be broad enough to encourage potential donors and recipients to establish EHR capabilities to enhance safety, quality and efficiency in the health care industry.

The requirements that must be met to obtain protection are:

• The software and/or information technology and training services donated must be necessary and used "predominately" to create, maintain, transmit or receive electronic health records.
• The electronic health record software must be "interoperable," as defined by the regulation.
• The recipient may not make the receipt of the EHR a requirement of doing business with the donor.
• Neither the selection of the recipient nor the amount of the donation may be determined in a manner that directly takes into account the volume or value of referrals or other business generated by the parties.
• The arrangement must be set forth in a written agreement signed by the parties.
• The recipient must pay, up front, at least 15% of the donor’s costs for the HIT donated to the recipient, and the donor cannot finance the recipient’s payments.
• The regulations expire December 31, 2013.
• The donor may not (i) limit the use of the EHR for any patient based on payee status, or (ii) provide staff or any other HIT that is used for the recipient’s personal business or business that is unrelated to clinical practice or operations.
• The recipient may not possess equivalent technology at the time of the donation.

Software may be donated by an individual or entity that directly or through reassignment bills Medicare, or a health plan. Recipients may include any individual or entity engaged in the delivery of health care. However, pharmaceutical, device or DME manufacturers are not eligible donors.

Donated software must be interoperable at the time it is provided to the recipient. The term "interoperable" is defined as "able to communicate and exchange data accurately, effectively, securely and consistently with different information technology systems, software applications, and networks, in various settings, and exchange data such that the clinical or operational purpose and meaning of the data are preserved and unaltered." Software will not be considered interoperable if it is capable of communicating or exchanging data only within a limited health care system or community.

Software will be deemed interoperable if a certifying body recognized by the Secretary of HHS has certified the software within no more than twelve months prior to the date it is provided to the recipient. For software that has not been certified as interoperable, the preamble to the regulations indicates that the appropriate inquiry is whether the software is as interoperable as feasible given the prevailing state of technology at the time the items or services are provided to the recipient. The parties should pass muster under this analysis if they have a reasonable basis for determining that software is interoperable.

The donor may not take any action to limit or restrict the use, compatibility, or interoperability of donated items or services with other electronic prescribing or EHR systems. The donor may not attempt to create closed or limited electronic health records systems by offering technology that effectively locks in business for the donor. Arrangements that seek to induce a physician to change loyalties from other providers or plans to the donor also would not be protected by the new safe harbor or exception. The foregoing, however, does not mean the donor is prohibited from entering into user agreements and similar contracts with its physicians relating to the use of donated systems. For example, the Final Rules do not preclude the donor from requiring appropriate disclaimers, indemnities, and limitations of liability from each physician regarding use of the donor’s software and systems.

The Final Rules apply to items and services in the form of software or information technology and training services. This includes interface and translation software, rights, licenses and intellectual property related to software, connectivity services (including wireless and broadband), clinical support and information services related to patient care, maintenance services, secure messaging, and help desk and similar support. The new safe harbor and exception still do not apply to hardware, staff (e.g., staff to transfer paper records to electronic format), or payment of cash or cash equivalents. This means that a donor may not reimburse a physician for his/her prior investment in EHR technology.

The Final Rules expand the scope of items and services that may be donated by requiring that the creation, maintenance, transmission, or reception of EHR must be the "predominant use," rather than the sole use, of the items and services donated. Unlike the proposed safe harbor and exception, the Final Rules permit arrangements involving software packages that include other functionality related to the care and treatment of patients (e.g., patient administration, scheduling, billing and clinical support). Since such diverse functionality is found in most health information systems, there will likely be much discussion in the coming months as to what constitutes "predominant use."

While donors are precluded from providing duplicate technology to physicians, there is no restriction on upgrades or items or services that would either: (i) enhance the functionality of the items or services; or (ii) standardize the systems among donors and recipients. At this point, there is little guidance as to the scope of this language.

The donor may not place restrictions, contractual or otherwise, on physicians such that interoperability will be impacted or that a closed or limited EHR system is created that effectively locks the physician into doing business with the donor. In addition, the donor may not make receipt or use of its systems by a physician a condition to doing business with the physician or provide inducements to change the physician’s existing loyalties from other providers or plans. On the other hand, intellectual property restrictions customary in software licenses, standard confidentiality protections, warranty disclaimers, indemnities, and limitations of liability should be permissible, provided they do not limit interoperability.

The Final Rules do not require a donor to give the technology to every physician. As long as the donor does not select physicians based directly on the volume or value of referrals, the regulations allow a donor to pick and choose whomever it wants (i.e., a donor is permitted to establish criteria that are based indirectly on the volume or value of referrals). The regulations provide several criteria that, if used, will be deemed to not directly take into account the volume or value of referrals:

• Number of prescriptions. The total number of prescriptions written by the physician (but not the volume or value of the prescriptions dispensed or paid by the donor or billed to the Medicare or Medicaid programs);
• Size of practice. The size of the physician’s medical practice (e.g., total patients, total patient encounters, or total relative value units);
• Total hours. The total number of hours that the physician practices medicine;
• Use of technology. The overall use of automated technology in the medical practice (but not the use of technology in connection with referrals made to the donor);
• Medical staff membership. Whether the physician is a member of the donor’s medical staff;
• Level of uncompensated care. The level of uncompensated care provided by the physician; or
• Any reasonable manner. Any reasonable and verifiable manner that does not directly take into account the volume or value of referrals or other business generated between the parties.

A donor may want to consider implementing clear guidelines based on some combination of the above in order to have a basis for providing the technology to some physicians but not others.

Under the Final Rules, the physician must pay 15 percent of the donor’s costs for the donated items and services before receiving such items and services, and the donor is not permitted to finance the physician’s payment or loan the physician the money. The Final Rules do not state explicitly whether the physicians’ 15 percent contribution is a minimum (i.e., they can be required to pay more than 15 percent of the donor’s costs) or an absolute benchmark, that may not be lowered or raised. However, since the Final Rules were published, the OIG and CMS have indicated informally that the 15 percent is intended as a floor.

The regulations do not specify how to calculate the cost of technology and whether the donor’s expensive infrastructure costs must be included, although presumably one may take the position that these items are not being "provided" to physicians. This is likely to be an area of future guidance.

The Medicare Prescription Drug Improvement and Modernization Act of 2003 required a separate Safe Harbor/Stark Exception for HIT limited to e-prescribing. The Final Rule therefore provides separate protections for the provision of technology that may be used only for e-prescribing purposes. These regulations require:

• The donated HIT may include hardware as well as software and other information technology and training services but the donated technology may only be used for e-prescribing.
• The donor may not (i) restrict the compatibility of the e-prescribing technology with other EHR systems, (ii) limit the physicians’ right to use the donated technology for any patient based on payer status, or (iii) provide the technology to a physician who already possesses technology equivalent to that provided by the donor.
• The eligibility to receive the e-prescribing technology may not be determined in a manner that takes into account, either indirectly or directly, the volume or value of referrals or other business generated between the parties.
• The physician may not make the receipt of e-prescribing technology a condition of doing business with the donor.
• The arrangement must be set forth in a written agreement.

Unlike the Safe Harbor/Stark Exception applicable to EHR, the Safe Harbor/Stark Exception for e-prescribing technology applies only to technology "necessary and used solely" for electronic prescribing purposes. This means that the protections provided to the donation of e-prescribing technology do not extend to the provision of HIT that might have a purpose other than prescribing. For example, a handheld device that does more than e-prescribing would not qualify for protection under this Safe Harbor/ Stark Exception. Nevertheless, the provision of information technology incidental to prescribing medications, such as tools identifying drug interactions, would be considered part of an e-prescribing purpose and therefore would be covered.

Although the use of the HIT under the e-prescribing rules is limited, the HIT that may be provided includes hardware, as well as software and information technology training.

Protected donors and recipients, respectively, include hospitals donating to their medical staff; group practices donating to their physician members; and prescription drug plan ("PDP") sponsors and Medicare Advantage organizations donating to network pharmacies and pharmacists, and to prescribing health professionals. Clinical laboratories are not covered by the safe harbor/ exception and do not qualify as permissible donors. Pharmacy benefit managers are also excluded.

Many of the conditions applicable to the EHR Safe Harbor/Stark Exception also apply to the e-prescribing Safe Harbor/Stark Exception, but there are a number of important differences. First, there is no limit on the value of the technology donated, and no cost sharing to be paid by the receiving physician. This means that a donor can subsidize 100% of the costs to develop and implement e-prescribing technology for its medical staff. Second, unlike the EHR Safe Harbor/Stark Exception, the e-prescribing Safe Harbor/Stark Exception will not expire on December 31, 2013 so that recipients of e-prescribing HIT will not have to take over funding the cost of maintaining, supporting or upgrading the HIT in the future. Third, the requirement that the donor select recipients without regard to the volume or value referrals or other business generated between the parties is narrower than the similar requirements in the EHR safe harbor/ exception and precludes selection criteria that either directly or indirectly take into account the volume or value of referrals or other business generated by the parties. Nevertheless, the Final Rules do permit selection criteria based on the number of prescriptions written by the recipient.

There are a number of laws that could be implicated by the implementation of EHR or e-prescribing technology (e.g., antitrust laws, HIPAA privacy rules, and IRS taxexempt rules, to name a few). At this time, there is little guidance regarding how these other laws will interact with the new regulations. In fact, the commentary to the AKS safe harbor addressed the issue of whether giving technology and services to physicians could impact an organization’s tax-exempt status, and the OIG commented that the IRS requirements are outside the scope of its rule making authority. A tax exempt donor should assure that any donation program is consistent with its exempt purposes. Donees should also consider the tax impact of the receipt of the technology. In addition the HIPAA privacy and security regulations also must be considered as health care organizations implement any new technology.

It is too early to know whether the new Safe Harbor/Stark Exceptions will be widely used, or whether the adoption of EHR or e-prescribing technology will be effective to improve the quality and efficiency of heath care delivery. A number of commentators suggest that, while these regulations are helpful, they do not go far enough to effectively move forward HIT adoption by the health care industry. Without addressing multi-functional systems or health information network participation, efforts to electronically share health information will continue to be less than optimal. Time will tell whether this concern can perhaps be addressed in a later set of safe harbors. Proposed federal legislation (H.R. 4157) may further expand the protections for the rollout of EHR and e-prescribing technology.

Finally, it is not altogether clear how these new regulations impact the regulatory view of prior initiatives undertaken by health care organizations to allow physicians electronic access to medical records, such as laboratory systems, PACS, electronic signature technology, etc. Many of these systems do not meet the definitions of either EHR and e-prescribing technology, yet some or all of regulatory requirements (for example, written agreements or cost sharing requirements)arguably could apply, if prior arrangements were to be judged by the new standards.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.