1

Preparing for and Surviving

Meaningful Use Audits

Presented by: Mark Norris CEO Medical Records Services, LLC

www.medrecserv.com

2

Here is what you Attest to:

I certify that the foregoing information is true, accurate, and complete. I understand that the Medicare EHR Incentive Program payment requested will be paid from Federal funds, and that the use of any false claims, statements, or documents, or the concealment of material fact used to obtain Medicare EHR Incentive Program payment, may be prosecuted under applicable Federal or State criminal laws and may be subject to civil penalties. 

3

MU Payments to date

• Active registrations of those completed totaled 535,567 breaking down with 353,350 Medicare EPs, 177,406 Medicaid EPs, and 4,811 hospitals.

• 50 States and 5 territories have open Medicaid registration.• A total of 447,842 unique providers have been paid with breakdown of 290,304 Medicare EPs, 139,110 

Medicaid EPs, 4,793 eligible hospitals, and 13,635 Medicare Advantage Organizations for EPs.• 90,722 EPs have received a HPSA bonus payment for program years 2011, 2012 and 2013.• A total of $30,017,754,584 has been paid out in the program to date.• Medicare EPs have been paid $7,667,386,370 with the majority of those, Doctors of Medicine or 

Osteopathy receiving $6,912,659,214.• Medicaid EPs have been paid $3,628,795,175 with the majority of those, Physicians receiving 

$2,523,306,734.• Eligible hospitals have been paid $18,314,819,332 with Medicare only $698,718,775 Medicaid only 

$387,777,877, and Medicare/Medicaid $17,228,322,681.• Medicare Advantage Organizations For Eligible Professionals have been paid $406,753,707.• Medicaid EHR Incentive payments began in January 2011 and Medicare EHR Incentive payments 

began in May 2011.

4

Nationwide Adoption – it’s not going away

5

Ohio Adoption

66

PA Adoption

• Insert slide text • Insert slide text

77

EHR Incentive Programs Supporting Documentation For Audits

Providers who receive an EHR incentive payment for either the Medicare or Medicaid EHR Incentive Program potentially may be subject to an audit. Eligible professionals (EPs), eligible hospitals, and critical access hospitals (CAHs) should retain ALL relevant supporting documentation (in either paper or electronic format) used in the completion of the Attestation Module responses. 

Documentation to support attestation data for meaningful use objectives and clinical quality measures should be retained for six years post‐attestation. Documentation to support payment calculations (such as cost report data) should continue to follow the current documentation retention processes. 

88

Medicare or Medicaid?

Figliozzi and Company is the designated contractor performing audits on behalf of the Centers for Medicare & Medicaid Services (CMS), and will perform audits on Medicare EPs and eligible hospitals, as well as on hospitals that are dually‐eligible for both the Medicare and Medicaid EHR Incentive Programs. If you are selected for an audit you will receive a letter from Figliozzi and Company with the CMS and EHR Incentive Program logos on the letterhead 

States and their contractors will perform audits on Medicaid providers. Please contact your State Medicaid Agency for more information about audits for Medicaid EHR Incentive Program payments. 

99

Pre- and Post-Payment Audits

There are numerous pre‐payment edit checks built into the EHR Incentive Programs' systems to detect inaccuracies in eligibility, reporting, and payment. Beginning with attestations submitted during and after January 2013, Medicare providers may also be subject to pre‐payment audits. These pre‐payment audits will include random audits, as well as audits that target suspicious or anomalous data. For those providers selected for pre‐payment audits, CMS and its contractor, Figliozzi and Company, will request supporting documentation to validate submitted attestation data before releasing payment. CMS and Figliozzi and Company will also continue to conduct post‐payment audits during the course of the EHR Incentive Programs. Providers selected for post‐payment audits will also be required to submit supporting documentation to validate their submitted attestation data. 

1010

Random Selection???…% chance

When providers are selected for an audit, they will receive an initial request letter from the auditor. The request letter will be sent electronically from a CMS email address and will include the audit contractor’s contact information. The email address provided during registration for the EHR Incentive Programs will be used for the initial request letter. 

The initial review process will be conducted at the audit contractor’s location, using the information received as a result of the initial request letter. Additional information might be needed during or after this initial review process, and in some cases an onsite review at the provider’s location could follow. A demonstration of the certified EHR system could be requested during the on-site review. A secure communication process has been established by the contractor, which will assist the provider to send any information that could be considered sensitive.

1111

Final Determination Round 1

Once the audit is concluded, the provider will receive an Audit Determination Letter from the audit contractor. This letter will inform the provider whether they were successful in meeting meaningful use of electronic health records. If, based on the audit, a provider is found not to be eligible for an EHR incentive payment, the payment will be recouped. 

CMS may also pursue additional measures against providers who attest fraudulently to receive an EHR incentive payment. It is a crime to defraud the Federal Government and its programs. Punishment may involve imprisonment, significant fines, or both. Criminal penalties for health care fraud reflect the serious harms associated with health care fraud and the need for aggressive and appropriate fraud prevention. In some states, providers and health care organizations may lose their licenses. Convictions also may result in exclusion from Medicare participation for a specified length of time. Medicare fraud may also result in civil liability. 

1212

Meaningful Use Audits 2.0

Now we have been hearing about a wave of MU audits that has recently been launched by the Office of the Inspector General (OIG). Why another layer of audits? That answer can be found in the OIG’s Work Plan for Fiscal Year 2015.We will review Medicare incentive payments to eligible health care professionals and hospitals for adopting EHRs and the Centers for Medicare & Medicaid Services (CMS) safeguards to prevent erroneous incentive payments. We will review Medicare incentive payment data from 2011 to identify payments to providers that should not have received incentive payments (e.g., those not meeting elected meaningful use criteria). We will also assess CMS’s plans to oversee incentive payments for the duration of the program and corrective actions taken regarding erroneous incentive payments.

13

Round 2 The OIG

• The OIG is therefore conducting oversight audits of providers to make sure that CMS is doing a good job handing out the EHR incentives. We have seen the OIG audit engagement documentation and while there are similarities with the Figliozzi audits, there are also significant differences. Here are a few items taken directly from the OIG requests.

• The audit period covers all EHR incentive payments from January 1, 2011, through June 30, 2014.

• The OIG audit covers a period that could conceivably cover 4 attestations. The stakes have gotten higher and more than ever you want to make sure your “Book of Evidence” is intact and validated. As Bob Dylan said it clearly, “You don’t need a weatherman to know which way the wind blows”.

1414

In the News – The ever-changing MU

1515

Preparing and Maintaining Documentation

It is the provider’s responsibility to maintain documentation that fully supports the meaningful use and clinical quality measure data submitted during attestation. To ensure you are prepared for a potential audit, save any electronic or paper documentation that supports your attestation. Also save the documentation that supports the values you entered in the Attestation Module for clinical quality measures. Hospitals should also maintain documentation that supports their payment calculations. 

An audit may include a review of any of the documentation needed to support the information that was entered in the attestation. The level of the audit review may depend on a number of factors, and it is not possible to detail all supporting documents that may be requested as part of the audit. However, the following will outline the minimum supporting documentation that providers should maintain: 

1616

Source document(s)

The primary documentation that will be requested in all reviews is the source document(s) that the provider used when completing the attestation. This document should provide a summary of the data that supports the information entered during attestation. Ideally, this would be a report from the certified EHR system, but other documentation may be used if a report is not available or the information entered differs from the report.  Your MU dashboard

Providers should retain a report from the certified EHR system to validate all clinical quality measure data entered during attestation, since all clinical quality measure data must be reported directly from the certified EHR system.  Your CQM report

Providers who use a source document other than a report from the certified EHR system to attest to meaningful use data (e.g., non‐clinical quality measure data) should retain all documentation that demonstrates how the data was accumulated and calculated. 

1717

Documentation for Non-Percentage-Based Objectives

In addition, not all certified EHR systems currently track compliance for non‐percentage‐based meaningful use objectives. These objectives typically require a “Yes” attestation in order for a provider to be successful in meeting meaningful use. To validate provider attestation for these objectives, CMS and its contractor may request additional supporting documentation. 

A few examples of suggested documentation are listed below. Please note that the suggested documentation does not preclude CMS or its contractor from requesting additional information to validate attestation data. 

1818

Some Examples

1919

Examples continued

2020

And more examples…

2121

Lessons from the field - the REC’s

a) Figliozzi & Company will double‐check to ensure that the dates on the reports match the reporting period dates during the attestation.

b) Figliozzi & Company will ensure that the numerators and denominators from the reports match the numbers that were entered during attestation.

c) Fizliozzi & Company is giving the following guidance: “Please Note:  If you are providing a summary report from your EHR system as support for your numerators/denominators, please ensure that we can identify that the report has actually been generated by your EHR (i.e. your EHR logo is displayed on the report, or step‐by‐step screenshots which demonstrate how the reports generated by your EHR are provided.)

2222

Manual Reconciliation

The Meaningful Use Burning Issues Group at HITRC recognized that this guidance from the auditor under (c) is not consistent with CMS FAQ 3209 which reads: "EPs, eligible hospitals, and Critical Access Hospitals (CAHs) can use a separate, uncertified system to calculate numerators and denominators and to generate reports on all measures of the core and menu set meaningful use objectives except CQMs.“

Need to have supporting documentation in order

2323

Dear Dr…….Dear Dr. :

You have been selected by CMS for a HITECH EHR Meaningful Use Prepayment Audit for payment year 1. Since this is a prepayment audit your incentive payment will be held pending the outcome of this audit. We are the CMS Contractor authorized toperform the audit.

Please confirm your receipt of this e-mail. Also, please confirm whether you will be the contact person for this audit. If you will be the contact person, please supply your preferred contact information for future correspondence. If you are not the contact person for this audit, please advise us who at your facility is the correct contact person and furnish their e-mail address.

The auditor assigned to this audit is Chris Corace. You may contact Mr. Corace with any questions. He can be reached via email at christopher.corace@cms.hhs.gov.

Please see the attached documents and submit all requested information by 3/24/2015. You may submit documentation by mail or byuploading via our secure file sharing utility. Please clearly identify the Eligible Professional's NPI on each document uploaded. Please click on the link labelled 'Click Here' at the bottom of this email to begin the upload process. Our auditors will beautomatically notified when your upload has been completed. As such, there is no need to contact the auditor for confirmation that they received your documentation.

Thank you,

Peter J. Figliozzi, CPA, CFF, FCPA

Figliozzi & Co.100 Garden City PlazaSuite 225Garden City, NY 11530

2424

Attachments to the e mail

2525

Document Request List

2626

Document Request List

2727

One practices response…Based on our review of the submitted documentation to date, we have determined that you have not supplied sufficient documentation for the following:

Core Measure #13‐ Protect Electronic Health Information‐ A security risk analysis was supplied. However, the document does not contain the EP or EP's practice name. Documentation is needed to verify that it was performed for the EP or EP's practice. What were the conclusions/results made based off of the analysis? Were any risks noted?

Please submit the requested information by 5/25/15. Please be aware that if the aforementioned meaningful use criteria are notmet, you will not receive an incentive payment for this payment year.

Please let me know if you have any questions.

2828

Proof of Certified EHR

For audit purposes, a license agreement with or purchase order from the Certified EHR vendor may suffice to prove the use of a Certified EHR. However, any such license agreements or purchase orders may have confidentiality provisions that prohibit them from being shared with others, even auditors. Review any agreements with or documentation from the Certified EHR vendor prior to sharing with auditors and consult with legal counsel if necessary.

2929

Red FlagsAuditors have questioned reports from Certified EHRs that do not specificallyidentify the provider on each page. Auditors have also questioned reports that donot include the Certified EHR logo, the version number, and the date on eachpage. Review the reports generated by your Certified EHR and contact yourCertified EHR vendor with any questions.o Clinical quality measures must be reported from the Certified EHR, so maintain areport to validate the clinical quality measures reported.o Determine whether the Certified EHR you are using can generate reports for priortime periods. If not, a report must be generated for the EHR reporting period andmaintained in a reproducible format.o Anomalous data will be scrutinized. For example, not all percentage‐basedmeasures use the same denominator, so attesting with the same denominator in allpercentage‐based measures may result in an audit. Similarly, differentdenominators in the percentage‐based measures that do use the same denominatormay result in an audit as well. Attesting to 100% for each percentage‐basedmeasure is also problematic. If all physicians in a practice attest with the samepercentages, payments to those physicians are likely to be questioned.Scrutinize the numbers before attesting.

3030

Documentation of Yes/No Measures

Screen shots must be from the Certified EHR and must be from the reportingperiod. Take screen shots before the end of the reporting period and maintainthem in case of an audit.o Screen shots should show date, provider, and name and vendor of the CertifiedEHR and the version number. To the extent possible, redact patient‐specificinformation before providing to auditors. We note, however, that certain auditors(especially those auditing under the Medicaid EHR Incentive Program) mayrequest certain types of patient‐specific information.o If screen shots were not obtained during the reporting period, work with yourCertified EHR vendor to determine how to obtain documentation showing that theyes/no measures were met during the reporting period. Can the information beobtained from audit logs? Does the vendor have any information demonstratingwhen a particular functionality was turned on or off?o Some Certified EHR vendors have implemented contractual restrictions on theprovision of screen shots to auditors. Review the relevant license agreements,purchase orders, etc. to determine whether any contractual restrictions exist andconsult legal counsel if necessary.

3131

Security Risk Analysis – your greatest RISKMeaningful use requires a provider to conduct or review a security risk analysis asrequired by the HIPAA security rule.

o The security risk analysis must factor in the version of the Certified EHR that isbeing used for meaningful use purposes but must address other security issues aswell, not just the Certified EHR.

o CMS and OCR have provided guidance on the security risk analysis requirementCMS and OCR have confirmed that a security risk analysis must be conductedduring each Stage 1 and Stage 2 reporting period. A change in Stage 2requirements means that the security risk analysis must address the encryptionand security of data at rest.

o What is required? Are you sure you understand it?

3232

Documentation of Exclusions

o A report from the Certified EHR showing a zero denominator for specificmeasures may suffice as documentation of an exclusion. For example, ifimmunizations are not part of an Eligible Provider’s practice, a report showing azero denominator could satisfy an auditor’s request. However, it may also help todocument the reason that the Eligible Provider does not provide anyimmunizations.

o Some exclusions are not dependent on denominators. For example, if the relevanthealth department did not accept electronic submissions of reportable lab resultsduring the reporting period, an auditor may request documentation that electronicsubmission was not available. Many health departments have included thisinformation on their websites or otherwise provided confirmation regarding theirability or inability to accept electronic transmissions.

3333

Documentation of Transmissions

Dated screenshots from the Certified EHR system that document a test submission to an immunization registry or public health agency and show the result (i.e., successful or unsuccessful). The documentation should include evidence to support that it was generated for that specific provider’s system.o A dated record of successful or unsuccessful electronic transmission (e.g.,screenshot from another system, etc.). This record should include evidenceto support that it was generated for that specific provider.o A letter or email from an immunization registry or public health agencyconfirming the receipt or failure of receipt of the data submittedelectronically. The letter or email should include the date of thesubmission, the name of the provider and the registry or agency, and theresult of the test (i.e., successful or unsuccessful).o If you plan to use an intermediary (like a health information exchange) to submitpublic health data, ensure that the use of the intermediary will still allow you tomeet the meaningful use objectives.

3434

Attestation

o Along with all the other types of documentation discussed here, maintain a copy of the actual attestation that was submitted.

o Also, make sure that whatever contact information provided during attestation (for example, an email address) is in working order and is being monitored. We have experienced several instances in which an email address is not being monitored and auditor communications are not read in a timely manner.

3535

Medicaid Considerations

o Audits under the Medicaid EHR Incentive Program vary by state. Here is statecontact information: https://www.cms.gov/apps/files/statecontacts.pdf

o Audits under the Medicaid EHR Incentive Program may focus on patient volumecalculations. One representative of a state Medicaid program has said thatmultiple attempts to identify a 90‐day period to establish patient volume may leadto an audit.

o Those providers with no history of providing services to Medicaid beneficiariesprior to the Medicaid EHR Incentive Program are also more likely to be audited.

o Based on our experience, documentation sufficient to demonstrate Adoption,Implementation, or Upgrade varies by state

3636

Documentation is the Key

3737

Failure by the numbers

The number of audits is on the rise,". "[The Centers for Medicare & Medicaid Services] says they project their audit rate around 5 percent for facilities that have attested, and Figliozzi and Co. says that there's a 4.7 percent failure rate for first time audits

About 22 percent of eligible professionals have failed the audits, a much higher failure rate than that for hospitals. Meaningful Use audits can be particularly daunting because CMS has issued little guidance about the audit appeals process. To make matters worse, the Office of Inspector General has separately begun to Meaningful Use audits of providers.

3838

Shedding light on the audit data

•3,820 pre‐payment MU audits were completed from 2013 to 2014 with 21.5% audit failures•~93% of pre‐payment MU audit failures were due not meeting “MU objectives and associated measures”•~7% of pre‐payment failures were from not using an MU certified EHR•4,601 post‐payment audits were completed with 24% failures, almost all due to not meeting “MU objectives and associated measures”•The average proposed returned EP incentive payment (pre‐appeal) is $16,862.81

It is unclear what not meeting “MU objectives and associated measures” means, but experts assisting EPs and practices with audits and appeals think the most common audit failure results from not adequately performing a Security Risk Analysis (SRA) and not documenting actions taken to mitigate identified risks.

3939

Audit survival strategies

Assume you will be audited. You must retain MU supporting documents for 6 years.Handle the audit properly. Don’t get mad at the auditors; expect to be audited and be prepared.Physicians must be engaged in the MU process.Work with your Practice Manager to make sure all data is correct and documents are maintained.Avoid discrepancies. Documentary evidence you retain must match the documents you submit to the auditors.Ensure that your version of the EHR is MU certified. This information is provided by your EHR vendor or can be viewed on the ONCHIT website.Documentation is key. All data including data that confirms that denominators are accurate and numerators meet a threshold must be available. Yes/no objectives can be met by date/time stamped screen snaps that show an EHR functionality is available for us or is “turned on” during the reporting period.Must have complete Security Risk Assessment (SRA) documentation. This is likely the most common MU audit failure point.

4040

What Not To Do

Forget to de‐identify ePHI on any documents being submitted.

Don’t submit information that was not asked for.

Be disorganized, and make the auditors job harder.

Don’t miss deadlines and ask for extensions if needed.

Don’t miss the opportunity to appeal the decision if you fail first time round. It is a one time option, with specific limitations, but worth pursuit.

4141

The Failed Audit ….appeal, but your last chance

4242

Stories from the field

Dermatology practice in Concord, Mass pays 150,000 inFines ( no to mention their legal fee’s) to avoid ongoing legal costs. There ware ultimately four charges against them:

- Unencrypted data in transit- No SRA was performed- No breach notification policies and procedures in place- Failure to report the breach in a timely fashion

Non compliance nearly cost them their practice. Had they gone through MU and completed an SRA they would have avoided all this.

4343

QUESTIONS AND ANSWERS

MEDICAL RECORDS SERVICES, LLCWWW.MEDRECSERV.COM