Date: June 2017

CMS Urged to Recoup and Audit EHR Incentive Payments

According to a report released by the U.S. Department of Health and Human Services’ Office of Inspector General (OIG) on June 12, 2017, the Centers for Medicare and Medicaid Services (CMS) overpaid an estimated $729 million in Medicare electronic health record (EHR) incentive payments to participating providers. (The full report is available at https://oig.hhs.gov/oas/reports/region5/51400047.asp). The OIG reviewed whether CMS’ oversight of the Medicare EHR incentive program was sufficient and whether eligible professionals (EPs) nationwide met Medicare incentive payment program requirements and received appropriate incentive payments. Alarmingly, the OIG urged CMS to recoup and audit these incentive payments based on its findings. Participating EPs and hospitals should be cognizant of the ramifications of CMS’ recommendations, including the potential for an audit and recoupment.

Background

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009, was designed to improve health care delivery systems through the use of health information technology. To further the HITECH Act’s goal, the incentive payment program at issue was created, which offered incentives to EPs who adopted and demonstrated the meaningful use of EHR technology. A principal goal behind the incentive payment program is improving the quality, safety, and efficiency of health care through the promotion of health information technology.

The HITECH Act defines the types of professionals who may be eligible to receive the Medicare EHR incentive payments. EPs include physicians, dentists, podiatrists, optometrists, and chiropractors. Hospitals are also eligible for EHR incentive payments, however, this OIG report focused only on payments to professionals.

To receive an incentive payment, EPs were required to attest that they met the program requirements by self-reporting data through a CMS-based provider registration verification system. The system can only validate basic information, check for duplicate payments, and store attestations of meaningful use. It is important to note that EPs could not receive payments from both Medicare and Medicaid EHR incentive programs in the same year. The EPs had to choose which program in which it wanted to participate. The EP could, however, switch programs once.

EPs are also required to self-attest to being a “meaningful EHR user” by inputting required data into the CMS database. Federal regulations have established meaningful use measures that are meant to improve healthcare quality and efficiency. Each measure has specified criteria that involve: (1) performing a one-time action (yes/no measure); or (2) performing a certain action for a specified percentage of unique patients, patient visits, or other events. The meaningful use criteria must be met at the time of attestation. In summary, meaningful use criteria measures evolved in three stages from 2011to 2016. The criteria originally focused on data capture and sharing, then it progressed to include advancing clinical processes and improving outcomes.

Beginning in 2011, EPs who qualified for the Medicare incentive program and demonstrate meaningful use could receive incentive payments for up to five years depending on the year in which the EP initially became a meaningful user of certified EHR technology. The EHR payments are not without limit. Incentive payments are subject to an annual limit equal to 75% of the EP’s Medicare-allowed charges submitted no later than two months after the end of the calendar year.

Importantly, as of November 4, 2016, the traditional Medicare EHR incentive program was replaced. Congress enacted the Medicare Access and Children’s Health Insurance Program Reauthorization Act (MACRA) and CMS subsequently issued a final rule implementing the reforms in MACRA. MACRA established, among other things, payment reforms that consolidated several programs into a Merit Based Incentive Payment System (MIPS), including the Medicare EHR incentive payment program. Under MIPS, the incentive program is now named “Advancing Care Information.” The Advancing Care Information element of MIPS replaces the EHR incentive program and modifies the way that Medicare EPs receive payment for being meaningful users.

Review Process

The OIG’s review covered EHR incentive payments totaling $6 billion that Medicare made to approximately 250,000 EPs from May 2011 to June 2014. The OIG reviewed the supporting documentation for a random sample of 100 EPs who had received one or more payments during the audit period. Payments made to EPs who switched between Medicare and Medicaid programs were also reviewed to determine whether Medicare made inappropriate payments during the audit period.

Findings

In its review, the OIG identified 14 EPs who were improperly paid (in an amount totaling $291,222) because the EPs had insufficient attestation support, inappropriate use periods, or insufficiently used the EHR technology. From these errors, the OIG estimated that CMS paid $729,424,395 in unsupported payments at an error rate of 12%.

In regards to the insufficient attestations, the OIG stated that CMS previously conducted “minimal documentation reviews of the self-attestations,” creating a high potential for abuse. For example, stage one of the incentive program required the EP to select five measures on which to show EHR technology meaningful use. The EPs then attested to their compliance with the selected measures. One available measure required the EP to conduct a security risk analysis. Other measures required the EP to utilize the EHR technology to generate various lists or reports. All EPs had to keep supporting documentation for their attestations for six years. When audited, the identified EPs were unable to provide sufficient documentation to support the measures that they attested were completed.

As for the inappropriately reported meaningful use periods, overpayments occurred where EPs utilized incorrect reporting periods or where CMS made payments to EPs for the wrong payment year. For stage two, the measures are supposed to be evaluated based on a calendar year’s worth of data. An error was found where attestations for an EP’s stage two measure was incorrectly based on 90 days’ worth of data (the period for stage one).

Also, the OIG pointed out that CMS lacked controls to ensure that EPs were placed in the correct payment year after switching between the Medicaid and Medicare incentive programs. When an EP switched programs, CMS incorrectly started the EP’s payments back at the stage one payment levels, rather than continuing the EP at the same stage as it would have been had the EP not switched. This resulted in additional and higher payments for the EP than the total allowed.

In addition, payments were made to EPs who had not demonstrated meaningful use of the EHR technology. One noted example involved an EP who had less than 20% of his patient encounters at a location equipped with EHR technology, despite the 50% requirement.

Recommendations to CMS

In light of these findings and identified problem areas, the OIG outlined six recommendations for CMS. The recommendations included a recoupment of the overpayments identified in the OIG’s review. Specific to the participating EPs, the OIG urged CMS to review supporting documentation for payments made to the participating EPs and educate the EPs on proper documentations requirements. As to CMS’s implementation of the program, the OIG recommended fixing the provider reporting system so that EPs would not put in the incorrect year when switching between programs. Finally, while not labeled as a recommendation but an apparent overall critique, the OIG encouraged CMS to include stronger program integrity safeguards in the future.

Notably, CMS concurred with four of OIG’s recommendations but only “partially concurred” with the recommendations urging CMS to audit and review payments made and the supporting documentation. In defense, CMS asserted that it had implemented targeted risk-based audits to strengthen program integrity, which it intended to continue in 2017. OIG reviewed the targeted risk-based audits and, again, concluded the audits were not capturing the errors identified in the OIG’s report.

Recommendations for Providers

For EPs, this report should be viewed as a warning of a potential audit regarding the supporting documentation for EHR technology measures. For an audit in general, an EP should familiarize itself with the process, response timeframes, and appeal timeframes. Timeframes and potential prescriptive periods will be an important consideration in defending any alleged overpayment resulting from an audit. Specific to the OIG’s report, EPs could benefit from an internal audit of their supporting documentation and organization thereof. Providing CMS with all requested supporting documentation drastically reduces the potential for findings of error.

Date: June 2017

CMS Urged to Recoup and Audit EHR Incentive Payments

According to a report released by the U.S. Department of Health and Human Services’ Office of Inspector General (OIG) on June 12, 2017, the Centers for Medicare and Medicaid Services (CMS) overpaid an estimated $729 million in Medicare electronic health record (EHR) incentive payments to participating providers. (The full report is available at https://oig.hhs.gov/oas/reports/region5/51400047.asp). The OIG reviewed whether CMS’ oversight of the Medicare EHR incentive program was sufficient and whether eligible professionals (EPs) nationwide met Medicare incentive payment program requirements and received appropriate incentive payments. Alarmingly, the OIG urged CMS to recoup and audit these incentive payments based on its findings. Participating EPs and hospitals should be cognizant of the ramifications of CMS’ recommendations, including the potential for an audit and recoupment.

Background

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009, was designed to improve health care delivery systems through the use of health information technology. To further the HITECH Act’s goal, the incentive payment program at issue was created, which offered incentives to EPs who adopted and demonstrated the meaningful use of EHR technology. A principal goal behind the incentive payment program is improving the quality, safety, and efficiency of health care through the promotion of health information technology.

The HITECH Act defines the types of professionals who may be eligible to receive the Medicare EHR incentive payments. EPs include physicians, dentists, podiatrists, optometrists, and chiropractors. Hospitals are also eligible for EHR incentive payments, however, this OIG report focused only on payments to professionals.

To receive an incentive payment, EPs were required to attest that they met the program requirements by self-reporting data through a CMS-based provider registration verification system. The system can only validate basic information, check for duplicate payments, and store attestations of meaningful use. It is important to note that EPs could not receive payments from both Medicare and Medicaid EHR incentive programs in the same year. The EPs had to choose which program in which it wanted to participate. The EP could, however, switch programs once.

EPs are also required to self-attest to being a “meaningful EHR user” by inputting required data into the CMS database. Federal regulations have established meaningful use measures that are meant to improve healthcare quality and efficiency. Each measure has specified criteria that involve: (1) performing a one-time action (yes/no measure); or (2) performing a certain action for a specified percentage of unique patients, patient visits, or other events. The meaningful use criteria must be met at the time of attestation. In summary, meaningful use criteria measures evolved in three stages from 2011to 2016. The criteria originally focused on data capture and sharing, then it progressed to include advancing clinical processes and improving outcomes.

Beginning in 2011, EPs who qualified for the Medicare incentive program and demonstrate meaningful use could receive incentive payments for up to five years depending on the year in which the EP initially became a meaningful user of certified EHR technology. The EHR payments are not without limit. Incentive payments are subject to an annual limit equal to 75% of the EP’s Medicare-allowed charges submitted no later than two months after the end of the calendar year.

Importantly, as of November 4, 2016, the traditional Medicare EHR incentive program was replaced. Congress enacted the Medicare Access and Children’s Health Insurance Program Reauthorization Act (MACRA) and CMS subsequently issued a final rule implementing the reforms in MACRA. MACRA established, among other things, payment reforms that consolidated several programs into a Merit Based Incentive Payment System (MIPS), including the Medicare EHR incentive payment program. Under MIPS, the incentive program is now named “Advancing Care Information.” The Advancing Care Information element of MIPS replaces the EHR incentive program and modifies the way that Medicare EPs receive payment for being meaningful users.

Review Process

The OIG’s review covered EHR incentive payments totaling $6 billion that Medicare made to approximately 250,000 EPs from May 2011 to June 2014. The OIG reviewed the supporting documentation for a random sample of 100 EPs who had received one or more payments during the audit period. Payments made to EPs who switched between Medicare and Medicaid programs were also reviewed to determine whether Medicare made inappropriate payments during the audit period.

Findings

In its review, the OIG identified 14 EPs who were improperly paid (in an amount totaling $291,222) because the EPs had insufficient attestation support, inappropriate use periods, or insufficiently used the EHR technology. From these errors, the OIG estimated that CMS paid $729,424,395 in unsupported payments at an error rate of 12%.

In regards to the insufficient attestations, the OIG stated that CMS previously conducted “minimal documentation reviews of the self-attestations,” creating a high potential for abuse. For example, stage one of the incentive program required the EP to select five measures on which to show EHR technology meaningful use. The EPs then attested to their compliance with the selected measures. One available measure required the EP to conduct a security risk analysis. Other measures required the EP to utilize the EHR technology to generate various lists or reports. All EPs had to keep supporting documentation for their attestations for six years. When audited, the identified EPs were unable to provide sufficient documentation to support the measures that they attested were completed.

As for the inappropriately reported meaningful use periods, overpayments occurred where EPs utilized incorrect reporting periods or where CMS made payments to EPs for the wrong payment year. For stage two, the measures are supposed to be evaluated based on a calendar year’s worth of data. An error was found where attestations for an EP’s stage two measure was incorrectly based on 90 days’ worth of data (the period for stage one).

Also, the OIG pointed out that CMS lacked controls to ensure that EPs were placed in the correct payment year after switching between the Medicaid and Medicare incentive programs. When an EP switched programs, CMS incorrectly started the EP’s payments back at the stage one payment levels, rather than continuing the EP at the same stage as it would have been had the EP not switched. This resulted in additional and higher payments for the EP than the total allowed.

In addition, payments were made to EPs who had not demonstrated meaningful use of the EHR technology. One noted example involved an EP who had less than 20% of his patient encounters at a location equipped with EHR technology, despite the 50% requirement.

Recommendations to CMS

In light of these findings and identified problem areas, the OIG outlined six recommendations for CMS. The recommendations included a recoupment of the overpayments identified in the OIG’s review. Specific to the participating EPs, the OIG urged CMS to review supporting documentation for payments made to the participating EPs and educate the EPs on proper documentations requirements. As to CMS’s implementation of the program, the OIG recommended fixing the provider reporting system so that EPs would not put in the incorrect year when switching between programs. Finally, while not labeled as a recommendation but an apparent overall critique, the OIG encouraged CMS to include stronger program integrity safeguards in the future.

Notably, CMS concurred with four of OIG’s recommendations but only “partially concurred” with the recommendations urging CMS to audit and review payments made and the supporting documentation. In defense, CMS asserted that it had implemented targeted risk-based audits to strengthen program integrity, which it intended to continue in 2017. OIG reviewed the targeted risk-based audits and, again, concluded the audits were not capturing the errors identified in the OIG’s report.

Recommendations for Providers

For EPs, this report should be viewed as a warning of a potential audit regarding the supporting documentation for EHR technology measures. For an audit in general, an EP should familiarize itself with the process, response timeframes, and appeal timeframes. Timeframes and potential prescriptive periods will be an important consideration in defending any alleged overpayment resulting from an audit. Specific to the OIG’s report, EPs could benefit from an internal audit of their supporting documentation and organization thereof. Providing CMS with all requested supporting documentation drastically reduces the potential for findings of error.

Date: June 2017

CMS Urged to Recoup and Audit EHR Incentive Payments

According to a report released by the U.S. Department of Health and Human Services’ Office of Inspector General (OIG) on June 12, 2017, the Centers for Medicare and Medicaid Services (CMS) overpaid an estimated $729 million in Medicare electronic health record (EHR) incentive payments to participating providers. (The full report is available at https://oig.hhs.gov/oas/reports/region5/51400047.asp). The OIG reviewed whether CMS’ oversight of the Medicare EHR incentive program was sufficient and whether eligible professionals (EPs) nationwide met Medicare incentive payment program requirements and received appropriate incentive payments. Alarmingly, the OIG urged CMS to recoup and audit these incentive payments based on its findings. Participating EPs and hospitals should be cognizant of the ramifications of CMS’ recommendations, including the potential for an audit and recoupment.

Background

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009, was designed to improve health care delivery systems through the use of health information technology. To further the HITECH Act’s goal, the incentive payment program at issue was created, which offered incentives to EPs who adopted and demonstrated the meaningful use of EHR technology. A principal goal behind the incentive payment program is improving the quality, safety, and efficiency of health care through the promotion of health information technology.

The HITECH Act defines the types of professionals who may be eligible to receive the Medicare EHR incentive payments. EPs include physicians, dentists, podiatrists, optometrists, and chiropractors. Hospitals are also eligible for EHR incentive payments, however, this OIG report focused only on payments to professionals.

To receive an incentive payment, EPs were required to attest that they met the program requirements by self-reporting data through a CMS-based provider registration verification system. The system can only validate basic information, check for duplicate payments, and store attestations of meaningful use. It is important to note that EPs could not receive payments from both Medicare and Medicaid EHR incentive programs in the same year. The EPs had to choose which program in which it wanted to participate. The EP could, however, switch programs once.

EPs are also required to self-attest to being a “meaningful EHR user” by inputting required data into the CMS database. Federal regulations have established meaningful use measures that are meant to improve healthcare quality and efficiency. Each measure has specified criteria that involve: (1) performing a one-time action (yes/no measure); or (2) performing a certain action for a specified percentage of unique patients, patient visits, or other events. The meaningful use criteria must be met at the time of attestation. In summary, meaningful use criteria measures evolved in three stages from 2011to 2016. The criteria originally focused on data capture and sharing, then it progressed to include advancing clinical processes and improving outcomes.

Beginning in 2011, EPs who qualified for the Medicare incentive program and demonstrate meaningful use could receive incentive payments for up to five years depending on the year in which the EP initially became a meaningful user of certified EHR technology. The EHR payments are not without limit. Incentive payments are subject to an annual limit equal to 75% of the EP’s Medicare-allowed charges submitted no later than two months after the end of the calendar year.

Importantly, as of November 4, 2016, the traditional Medicare EHR incentive program was replaced. Congress enacted the Medicare Access and Children’s Health Insurance Program Reauthorization Act (MACRA) and CMS subsequently issued a final rule implementing the reforms in MACRA. MACRA established, among other things, payment reforms that consolidated several programs into a Merit Based Incentive Payment System (MIPS), including the Medicare EHR incentive payment program. Under MIPS, the incentive program is now named “Advancing Care Information.” The Advancing Care Information element of MIPS replaces the EHR incentive program and modifies the way that Medicare EPs receive payment for being meaningful users.

Review Process

The OIG’s review covered EHR incentive payments totaling $6 billion that Medicare made to approximately 250,000 EPs from May 2011 to June 2014. The OIG reviewed the supporting documentation for a random sample of 100 EPs who had received one or more payments during the audit period. Payments made to EPs who switched between Medicare and Medicaid programs were also reviewed to determine whether Medicare made inappropriate payments during the audit period.

Findings

In its review, the OIG identified 14 EPs who were improperly paid (in an amount totaling $291,222) because the EPs had insufficient attestation support, inappropriate use periods, or insufficiently used the EHR technology. From these errors, the OIG estimated that CMS paid $729,424,395 in unsupported payments at an error rate of 12%.

In regards to the insufficient attestations, the OIG stated that CMS previously conducted “minimal documentation reviews of the self-attestations,” creating a high potential for abuse. For example, stage one of the incentive program required the EP to select five measures on which to show EHR technology meaningful use. The EPs then attested to their compliance with the selected measures. One available measure required the EP to conduct a security risk analysis. Other measures required the EP to utilize the EHR technology to generate various lists or reports. All EPs had to keep supporting documentation for their attestations for six years. When audited, the identified EPs were unable to provide sufficient documentation to support the measures that they attested were completed.

As for the inappropriately reported meaningful use periods, overpayments occurred where EPs utilized incorrect reporting periods or where CMS made payments to EPs for the wrong payment year. For stage two, the measures are supposed to be evaluated based on a calendar year’s worth of data. An error was found where attestations for an EP’s stage two measure was incorrectly based on 90 days’ worth of data (the period for stage one).

Also, the OIG pointed out that CMS lacked controls to ensure that EPs were placed in the correct payment year after switching between the Medicaid and Medicare incentive programs. When an EP switched programs, CMS incorrectly started the EP’s payments back at the stage one payment levels, rather than continuing the EP at the same stage as it would have been had the EP not switched. This resulted in additional and higher payments for the EP than the total allowed.

In addition, payments were made to EPs who had not demonstrated meaningful use of the EHR technology. One noted example involved an EP who had less than 20% of his patient encounters at a location equipped with EHR technology, despite the 50% requirement.

Recommendations to CMS

In light of these findings and identified problem areas, the OIG outlined six recommendations for CMS. The recommendations included a recoupment of the overpayments identified in the OIG’s review. Specific to the participating EPs, the OIG urged CMS to review supporting documentation for payments made to the participating EPs and educate the EPs on proper documentations requirements. As to CMS’s implementation of the program, the OIG recommended fixing the provider reporting system so that EPs would not put in the incorrect year when switching between programs. Finally, while not labeled as a recommendation but an apparent overall critique, the OIG encouraged CMS to include stronger program integrity safeguards in the future.

Notably, CMS concurred with four of OIG’s recommendations but only “partially concurred” with the recommendations urging CMS to audit and review payments made and the supporting documentation. In defense, CMS asserted that it had implemented targeted risk-based audits to strengthen program integrity, which it intended to continue in 2017. OIG reviewed the targeted risk-based audits and, again, concluded the audits were not capturing the errors identified in the OIG’s report.

Recommendations for Providers

For EPs, this report should be viewed as a warning of a potential audit regarding the supporting documentation for EHR technology measures. For an audit in general, an EP should familiarize itself with the process, response timeframes, and appeal timeframes. Timeframes and potential prescriptive periods will be an important consideration in defending any alleged overpayment resulting from an audit. Specific to the OIG’s report, EPs could benefit from an internal audit of their supporting documentation and organization thereof. Providing CMS with all requested supporting documentation drastically reduces the potential for findings of error.

Date: June 2017

CMS Urged to Recoup and Audit EHR Incentive Payments

According to a report released by the U.S. Department of Health and Human Services’ Office of Inspector General (OIG) on June 12, 2017, the Centers for Medicare and Medicaid Services (CMS) overpaid an estimated $729 million in Medicare electronic health record (EHR) incentive payments to participating providers. (The full report is available at https://oig.hhs.gov/oas/reports/region5/51400047.asp). The OIG reviewed whether CMS’ oversight of the Medicare EHR incentive program was sufficient and whether eligible professionals (EPs) nationwide met Medicare incentive payment program requirements and received appropriate incentive payments. Alarmingly, the OIG urged CMS to recoup and audit these incentive payments based on its findings. Participating EPs and hospitals should be cognizant of the ramifications of CMS’ recommendations, including the potential for an audit and recoupment.

Background

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009, was designed to improve health care delivery systems through the use of health information technology. To further the HITECH Act’s goal, the incentive payment program at issue was created, which offered incentives to EPs who adopted and demonstrated the meaningful use of EHR technology. A principal goal behind the incentive payment program is improving the quality, safety, and efficiency of health care through the promotion of health information technology.

The HITECH Act defines the types of professionals who may be eligible to receive the Medicare EHR incentive payments. EPs include physicians, dentists, podiatrists, optometrists, and chiropractors. Hospitals are also eligible for EHR incentive payments, however, this OIG report focused only on payments to professionals.

To receive an incentive payment, EPs were required to attest that they met the program requirements by self-reporting data through a CMS-based provider registration verification system. The system can only validate basic information, check for duplicate payments, and store attestations of meaningful use. It is important to note that EPs could not receive payments from both Medicare and Medicaid EHR incentive programs in the same year. The EPs had to choose which program in which it wanted to participate. The EP could, however, switch programs once.

EPs are also required to self-attest to being a “meaningful EHR user” by inputting required data into the CMS database. Federal regulations have established meaningful use measures that are meant to improve healthcare quality and efficiency. Each measure has specified criteria that involve: (1) performing a one-time action (yes/no measure); or (2) performing a certain action for a specified percentage of unique patients, patient visits, or other events. The meaningful use criteria must be met at the time of attestation. In summary, meaningful use criteria measures evolved in three stages from 2011to 2016. The criteria originally focused on data capture and sharing, then it progressed to include advancing clinical processes and improving outcomes.

Beginning in 2011, EPs who qualified for the Medicare incentive program and demonstrate meaningful use could receive incentive payments for up to five years depending on the year in which the EP initially became a meaningful user of certified EHR technology. The EHR payments are not without limit. Incentive payments are subject to an annual limit equal to 75% of the EP’s Medicare-allowed charges submitted no later than two months after the end of the calendar year.

Importantly, as of November 4, 2016, the traditional Medicare EHR incentive program was replaced. Congress enacted the Medicare Access and Children’s Health Insurance Program Reauthorization Act (MACRA) and CMS subsequently issued a final rule implementing the reforms in MACRA. MACRA established, among other things, payment reforms that consolidated several programs into a Merit Based Incentive Payment System (MIPS), including the Medicare EHR incentive payment program. Under MIPS, the incentive program is now named “Advancing Care Information.” The Advancing Care Information element of MIPS replaces the EHR incentive program and modifies the way that Medicare EPs receive payment for being meaningful users.

Review Process

The OIG’s review covered EHR incentive payments totaling $6 billion that Medicare made to approximately 250,000 EPs from May 2011 to June 2014. The OIG reviewed the supporting documentation for a random sample of 100 EPs who had received one or more payments during the audit period. Payments made to EPs who switched between Medicare and Medicaid programs were also reviewed to determine whether Medicare made inappropriate payments during the audit period.

Findings

In its review, the OIG identified 14 EPs who were improperly paid (in an amount totaling $291,222) because the EPs had insufficient attestation support, inappropriate use periods, or insufficiently used the EHR technology. From these errors, the OIG estimated that CMS paid $729,424,395 in unsupported payments at an error rate of 12%.

In regards to the insufficient attestations, the OIG stated that CMS previously conducted “minimal documentation reviews of the self-attestations,” creating a high potential for abuse. For example, stage one of the incentive program required the EP to select five measures on which to show EHR technology meaningful use. The EPs then attested to their compliance with the selected measures. One available measure required the EP to conduct a security risk analysis. Other measures required the EP to utilize the EHR technology to generate various lists or reports. All EPs had to keep supporting documentation for their attestations for six years. When audited, the identified EPs were unable to provide sufficient documentation to support the measures that they attested were completed.

As for the inappropriately reported meaningful use periods, overpayments occurred where EPs utilized incorrect reporting periods or where CMS made payments to EPs for the wrong payment year. For stage two, the measures are supposed to be evaluated based on a calendar year’s worth of data. An error was found where attestations for an EP’s stage two measure was incorrectly based on 90 days’ worth of data (the period for stage one).

Also, the OIG pointed out that CMS lacked controls to ensure that EPs were placed in the correct payment year after switching between the Medicaid and Medicare incentive programs. When an EP switched programs, CMS incorrectly started the EP’s payments back at the stage one payment levels, rather than continuing the EP at the same stage as it would have been had the EP not switched. This resulted in additional and higher payments for the EP than the total allowed.

In addition, payments were made to EPs who had not demonstrated meaningful use of the EHR technology. One noted example involved an EP who had less than 20% of his patient encounters at a location equipped with EHR technology, despite the 50% requirement.

Recommendations to CMS

In light of these findings and identified problem areas, the OIG outlined six recommendations for CMS. The recommendations included a recoupment of the overpayments identified in the OIG’s review. Specific to the participating EPs, the OIG urged CMS to review supporting documentation for payments made to the participating EPs and educate the EPs on proper documentations requirements. As to CMS’s implementation of the program, the OIG recommended fixing the provider reporting system so that EPs would not put in the incorrect year when switching between programs. Finally, while not labeled as a recommendation but an apparent overall critique, the OIG encouraged CMS to include stronger program integrity safeguards in the future.

Notably, CMS concurred with four of OIG’s recommendations but only “partially concurred” with the recommendations urging CMS to audit and review payments made and the supporting documentation. In defense, CMS asserted that it had implemented targeted risk-based audits to strengthen program integrity, which it intended to continue in 2017. OIG reviewed the targeted risk-based audits and, again, concluded the audits were not capturing the errors identified in the OIG’s report.

Recommendations for Providers

For EPs, this report should be viewed as a warning of a potential audit regarding the supporting documentation for EHR technology measures. For an audit in general, an EP should familiarize itself with the process, response timeframes, and appeal timeframes. Timeframes and potential prescriptive periods will be an important consideration in defending any alleged overpayment resulting from an audit. Specific to the OIG’s report, EPs could benefit from an internal audit of their supporting documentation and organization thereof. Providing CMS with all requested supporting documentation drastically reduces the potential for findings of error.

Date: June 2017

CMS Urged to Recoup and Audit EHR Incentive Payments

According to a report released by the U.S. Department of Health and Human Services’ Office of Inspector General (OIG) on June 12, 2017, the Centers for Medicare and Medicaid Services (CMS) overpaid an estimated $729 million in Medicare electronic health record (EHR) incentive payments to participating providers. (The full report is available at https://oig.hhs.gov/oas/reports/region5/51400047.asp). The OIG reviewed whether CMS’ oversight of the Medicare EHR incentive program was sufficient and whether eligible professionals (EPs) nationwide met Medicare incentive payment program requirements and received appropriate incentive payments. Alarmingly, the OIG urged CMS to recoup and audit these incentive payments based on its findings. Participating EPs and hospitals should be cognizant of the ramifications of CMS’ recommendations, including the potential for an audit and recoupment.

Background

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009, was designed to improve health care delivery systems through the use of health information technology. To further the HITECH Act’s goal, the incentive payment program at issue was created, which offered incentives to EPs who adopted and demonstrated the meaningful use of EHR technology. A principal goal behind the incentive payment program is improving the quality, safety, and efficiency of health care through the promotion of health information technology.

The HITECH Act defines the types of professionals who may be eligible to receive the Medicare EHR incentive payments. EPs include physicians, dentists, podiatrists, optometrists, and chiropractors. Hospitals are also eligible for EHR incentive payments, however, this OIG report focused only on payments to professionals.

To receive an incentive payment, EPs were required to attest that they met the program requirements by self-reporting data through a CMS-based provider registration verification system. The system can only validate basic information, check for duplicate payments, and store attestations of meaningful use. It is important to note that EPs could not receive payments from both Medicare and Medicaid EHR incentive programs in the same year. The EPs had to choose which program in which it wanted to participate. The EP could, however, switch programs once.

EPs are also required to self-attest to being a “meaningful EHR user” by inputting required data into the CMS database. Federal regulations have established meaningful use measures that are meant to improve healthcare quality and efficiency. Each measure has specified criteria that involve: (1) performing a one-time action (yes/no measure); or (2) performing a certain action for a specified percentage of unique patients, patient visits, or other events. The meaningful use criteria must be met at the time of attestation. In summary, meaningful use criteria measures evolved in three stages from 2011to 2016. The criteria originally focused on data capture and sharing, then it progressed to include advancing clinical processes and improving outcomes.

Beginning in 2011, EPs who qualified for the Medicare incentive program and demonstrate meaningful use could receive incentive payments for up to five years depending on the year in which the EP initially became a meaningful user of certified EHR technology. The EHR payments are not without limit. Incentive payments are subject to an annual limit equal to 75% of the EP’s Medicare-allowed charges submitted no later than two months after the end of the calendar year.

Importantly, as of November 4, 2016, the traditional Medicare EHR incentive program was replaced. Congress enacted the Medicare Access and Children’s Health Insurance Program Reauthorization Act (MACRA) and CMS subsequently issued a final rule implementing the reforms in MACRA. MACRA established, among other things, payment reforms that consolidated several programs into a Merit Based Incentive Payment System (MIPS), including the Medicare EHR incentive payment program. Under MIPS, the incentive program is now named “Advancing Care Information.” The Advancing Care Information element of MIPS replaces the EHR incentive program and modifies the way that Medicare EPs receive payment for being meaningful users.

Review Process

The OIG’s review covered EHR incentive payments totaling $6 billion that Medicare made to approximately 250,000 EPs from May 2011 to June 2014. The OIG reviewed the supporting documentation for a random sample of 100 EPs who had received one or more payments during the audit period. Payments made to EPs who switched between Medicare and Medicaid programs were also reviewed to determine whether Medicare made inappropriate payments during the audit period.

Findings

In its review, the OIG identified 14 EPs who were improperly paid (in an amount totaling $291,222) because the EPs had insufficient attestation support, inappropriate use periods, or insufficiently used the EHR technology. From these errors, the OIG estimated that CMS paid $729,424,395 in unsupported payments at an error rate of 12%.

In regards to the insufficient attestations, the OIG stated that CMS previously conducted “minimal documentation reviews of the self-attestations,” creating a high potential for abuse. For example, stage one of the incentive program required the EP to select five measures on which to show EHR technology meaningful use. The EPs then attested to their compliance with the selected measures. One available measure required the EP to conduct a security risk analysis. Other measures required the EP to utilize the EHR technology to generate various lists or reports. All EPs had to keep supporting documentation for their attestations for six years. When audited, the identified EPs were unable to provide sufficient documentation to support the measures that they attested were completed.

As for the inappropriately reported meaningful use periods, overpayments occurred where EPs utilized incorrect reporting periods or where CMS made payments to EPs for the wrong payment year. For stage two, the measures are supposed to be evaluated based on a calendar year’s worth of data. An error was found where attestations for an EP’s stage two measure was incorrectly based on 90 days’ worth of data (the period for stage one).

Also, the OIG pointed out that CMS lacked controls to ensure that EPs were placed in the correct payment year after switching between the Medicaid and Medicare incentive programs. When an EP switched programs, CMS incorrectly started the EP’s payments back at the stage one payment levels, rather than continuing the EP at the same stage as it would have been had the EP not switched. This resulted in additional and higher payments for the EP than the total allowed.

In addition, payments were made to EPs who had not demonstrated meaningful use of the EHR technology. One noted example involved an EP who had less than 20% of his patient encounters at a location equipped with EHR technology, despite the 50% requirement.

Recommendations to CMS

In light of these findings and identified problem areas, the OIG outlined six recommendations for CMS. The recommendations included a recoupment of the overpayments identified in the OIG’s review. Specific to the participating EPs, the OIG urged CMS to review supporting documentation for payments made to the participating EPs and educate the EPs on proper documentations requirements. As to CMS’s implementation of the program, the OIG recommended fixing the provider reporting system so that EPs would not put in the incorrect year when switching between programs. Finally, while not labeled as a recommendation but an apparent overall critique, the OIG encouraged CMS to include stronger program integrity safeguards in the future.

Notably, CMS concurred with four of OIG’s recommendations but only “partially concurred” with the recommendations urging CMS to audit and review payments made and the supporting documentation. In defense, CMS asserted that it had implemented targeted risk-based audits to strengthen program integrity, which it intended to continue in 2017. OIG reviewed the targeted risk-based audits and, again, concluded the audits were not capturing the errors identified in the OIG’s report.

Recommendations for Providers

For EPs, this report should be viewed as a warning of a potential audit regarding the supporting documentation for EHR technology measures. For an audit in general, an EP should familiarize itself with the process, response timeframes, and appeal timeframes. Timeframes and potential prescriptive periods will be an important consideration in defending any alleged overpayment resulting from an audit. Specific to the OIG’s report, EPs could benefit from an internal audit of their supporting documentation and organization thereof. Providing CMS with all requested supporting documentation drastically reduces the potential for findings of error.