ONC: Building Trust in HIE, Changes to HIPAA Privacy/Security Proposed

Blumenthal, ONC; and Verdugo, HHS Office of Civil Rights Release
“Statement on Privacy and Security”
 
Plus New Web site, FAQs, HHS Press Release, Blog Post

Joint ONC/OCR Statement on Privacy and Security
David Blumenthal
, M.D., M.P.P., National Coordinator for Health Information Technology, U.S. Department of Health and Human Services (HHS); and
Georgina Verdugo, Director, Office for Civil Rights, HHS

As the Department of Health and Human Services (HHS or The Department) continues its efforts to improve the health and care of all Americans by promoting the advancement of health information technology (IT), one of the Department’s guiding principles is that the benefits of health IT can only be fully realized if patients and providers are confident that electronic health information is kept private and secure. HHS’s goal, as directed by the 2009 Health Information Technology for Clinical and Economic Health (HITECH) Act, is to improve the nation’s health care system by enabling health information to follow the patient wherever and whenever it is needed. The HHS Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights (OCR) are working jointly on a number of projects to ensure that this electronic exchange of health information is built on a foundation of privacy, and security.

On July 8, 2010, HHS announced proposed regulations under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 that would expand individuals’ rights to access their information and restrict certain disclosures of protected health information to health plans, extend the applicability of certain of the Privacy and Security Rules’ requirements to the business associates of covered entities, establish new limitations on the use and disclosure of protected health information for marketing and fundraising purposes, and prohibit the sale of protected health information without patient authorization. In addition, the proposed rule is designed to strengthen and expand OCR’s ability to enforce HIPAA’s Privacy and Security provisions. This rulemaking will strengthen the privacy and security of health information, and is an integral piece of the Administration’s efforts to broaden the use of health information technology in health care today. We urge consumers, providers, and other stakeholders to read these proposals and offer comments during the 60-day comment period, which will officially open on July 14, 2010. Information about posting comments will be available at http://www.regulations.gov.

Additionally, over the past few months, ONC and OCR have embarked on a number of other initiatives that serve to integrate privacy and security into the nation’s health IT efforts. As directed by HITECH, ONC established a new Chief Privacy Officer (CPO) position to provide critical advice to the National Coordinator in developing and implementing ONC’s privacy and security programs. The new CPO, Joy Pritts, JD, will play a key role in helping ONC design new policies to address privacy and security issues in every phase of health IT development and implementation.

On August 24, 2009, OCR issued an interim final breach notification regulation, which improves transparency and acts as an incentive to the health care industry to improve privacy and security by requiring HIPAA covered entities to promptly notify affected individuals, the HHS Secretary and, in some cases the media, of a breach. This new federal law holds covered entities and business associates accountable to the Department and to individuals for proper safeguarding of the private information entrusted to their care.

ONC is coordinating with the Centers for Medicare & Medicaid Services (CMS) on CMS’s development of a final regulation on the Medicare and Medicaid Electronic Health Record Incentives Programs. The incentives programs promote critical privacy and security measures and business practices. ONC also is developing a final regulation on standards and certification criteria to ensure that electronic health records (EHRs) contain the capabilities to support needed privacy and security requirements.

With respect to security, the Department also embarked on a number of initiatives. OCR coordinated with the National Institute of Standards and Technology to host a conference focused on the HIPAA Security Rule. OCR also issued draft guidance in conducting a HIPAA Security Risk Analysis to assist organizations in identifying and implementing the most effective and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information. Additionally, an advisory committee on HIT standards held hearings to better understand security priorities, the effectiveness of security procedures, and vulnerabilities.

All these activities only serve as a prelude to our ongoing efforts to ensure that electronic health information is private and secure. In addition:

  • ONC and OCR are working together with representatives of consumer and industry groups to promote the adoption of privacy and security safeguards as essential components of implementing health information technology.
  • ONC is ensuring that the technical and policy foundations of the nationwide health information network will demonstrate methods for achieving trust among entities exchanging information while integrating best practices for privacy and security. A privacy and security workgroup (known as a “Tiger Team”) of the Health Information Technology Policy Committee (HITPC) was convened with strong consumer representation to hold public deliberations and make recommendations related to patient choice in how health information is exchanged; consumer access to health information; personal health records (PHRs); segmentation of health information; and transparency about information sharing and protections.
  • ONC staff is working with the President’s cybersecurity initiative and other Federal partners to solicit input from the best security minds in the federal government. Based on these activities, ONC will provide direction on security best practices and standards to technical and policy decision makers for inclusion in health information exchange programs.
  • Finally, the Department is working to provide the private sector with greater resources for improving privacy and security. Regional Extension Centers will educate providers about necessary privacy and security measures. Curriculum Development Centers Programs will incorporate necessary information into standard curricula for Community College Consortia, where a new cadre of HIT professionals will be trained, and for University-Based Training Programs, where health professionals will learn about HIT. State Health Information Exchange Cooperative Agreements and Beacon Communities grants will provide living examples of how privacy and security are successfully implemented and brought to scale.
Our Nation is poised to harness the power of information technology to improve health care. Transforming our health care system into a 21st century model is a bold agenda. As we enter into a new age of electronic health information exchange, it is more important than ever to ensure consumer trust in the privacy and security of their health information and in the industry’s use of new technology.
#                                 #                                  #

Excerpted from ONC Health IT Buzz Blog on July 8, 2010:
Privacy and Security

Thursday, July 8th, 2010 | Posted by: Joy Pritts, Chief Privacy Officer on Health IT Buzz Blog and republished here by e-Healthcare Marketing.
Privacy and security are the bedrock of building trust in health information exchange. The proposed modifications to the HIPAA Privacy & Security Rules, announced today, are a significant step forward in HHS’s efforts to protect patient privacy rights while encouraging the adoption of electronic health information exchange.  The next phase of this process is just as important—obtaining public feedback and suggestions concerning the proposed rules.   The comment period will begin once the rule is published in the Federal Register on July 14.  You can  submit your comments electronically through http://www.regulations.gov/ or via mail (original and 2 copies) to the Office for Civil Rights at: Office for Civil Rights, Attention: HITECH Privacy Rule Modifications, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue, S.W., Washington, D.C. 20201.  HHS is looking forward to receiving your input.
#                                 #                                  #

HHS Press Release on July 8, 2010:
HHS Strengthens Health Information Privacy and Security through New Rules
New health privacy website launched

HHS Secretary Kathleen Sebelius today announced important new rules and resources to strengthen the privacy of health information and to help all Americans understand their rights and the resources available to safeguard their personal health data.  Led by the Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights (OCR), HHS is working with public and private partners to ensure that, as we expand the use of health information technology to drive improvements in the quality and effectiveness of our nation’s health care system, Americans can trust that their health information is protected and secure.

“To improve the health of individuals and communities, health information must be available to those making critical decisions, including individuals and their caregivers,” said HHS Secretary Kathleen Sebelius. “While health information technology will help America move its health care system forward, the privacy and security of personal health data is at the core of all our work.”

Through the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, current health information privacy and security rules will now include broader individual rights and stronger protections when third parties handle individually identifiable health information.

The proposed rule announced today would strengthen and expand enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Enforcement Rules by:

  • expanding individuals’ rights to access their information and to restrict certain types of disclosures of protected health information to health plans. 
  • requiring business associates of HIPAA-covered entities to be under most of the same rules as the covered entities;
  • setting new limitations on the use and disclosure of protected health information for marketing and fundraising; and
  • prohibiting the sale of protected health information without patient authorization.

“The benefits of health IT can only be fully realized if patients and providers are confident that electronic health information is kept private and secure at all times,” said Georgina Verdugo, OCR director at HHS. “This proposed rule strengthens the privacy and security of health information, and is an integral piece of the administration’s efforts to broaden the use of health information technology in health care today.”

HHS is also looking more closely at entities that are not covered by HIPAA rules to understand better how they handle personal health information and to determine whether additional privacy and security protections are needed for these entities.

“Giving more Americans the ability to access their health information wherever, whenever and in whatever form is a critical first step toward improving our health care system,” said HHS’ national coordinator for health information technology, David Blumenthal, M.D., M.P.P. “Empowering Americans with real-time and secure access to the information they need to live healthier lives is paramount.”

HHS also launched today a privacy website at http://www.hhs.gov/healthprivacy/index.html to help visitors easily access information about existing HHS privacy efforts and the policies supporting them. The site emphasizes HHS’ deep commitment to privacy in the collection, use, and exchange of personally identifiable information. This new resource provides Americans with confidence that their personal information is secure and underscores HHS’ goal of greater openness and transparency in government.

The HITECH Act established the position of Chief Privacy Officer in ONC. Joy Pritts recently assumed the new position and is leading HHS efforts to develop and implement privacy and security programs and polices related to electronic health information.

“HHS strongly believes that an individual’s personal information is to be kept private and confidential and used appropriately by the right people, for the right reasons,” said Pritts.  “Without such assurances, an individual may be hesitant to share relevant health information.”

For more information about the proposed rule announced today visit http://www.ofr.gov/OFRUpload/OFRData/2010-16718_PI.pdf  

For other HHS Recovery Act programs, see
http://www.hhs.gov/recovery/programs/index.html#Health.

#                      #                               #
New HHS Web Site:
Health Data Privacy and Security Resources
http://www.hhs.gov/healthprivacy
The contents of the Health Data Privacy and Security Resources section have been excerpted below on July 8, 2010.
HHS respects the privacy of your personal information, and this page will help you find privacy resources throughout HHS.

This page provides key messages and access to resources emphasizing HHS’ commitment to privacy as a fundamental consideration in its collection, use, and exchange of personally identifiable information. This central resource helps visitors easily access information about existing HHS privacy efforts and the policies supporting them.

In support of HHS’ vision for Open Government and Transparency, this resource is to provide further confidence in the expectations Americans have for the privacy of their personal information and is to inspire added trust in HHS’ efforts to improve our nation’s health through safe and secure health information exchanges. HHS strongly believes that an individual’s personal information is to be kept private, confidential and used appropriately by the right people, for the right reasons. Without such assurances, an individual may be hesitant to share relevant health information.

More information about HHS’ commitment to health data privacy can be found in the notice of proposed rulemaking (NPRM) issued July 8, 2010; in the Frequently Asked Questions (FAQs); and the OCR/ ONC Joint statement on the NPRM.

You can access more information on health data privacy through the links provided below.

Privacy Policies

HHS Privacy Impact Assessments

The Privacy Act

Your Right to Federal Records: Questions and answers on the Freedom of Information Act and Privacy Act.

Health Information Portability and Accountability Act

Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules

Electronic Health Information Exchange Privacy and Security

Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information

Department Privacy Resources

Privacy Protection for Research Subjects: Certificates of Confidentiality

National Center for Health Statistics

HHS Privacy Committee

#                                #                               #
 
1.  What is the role of the Chief Privacy Office in the Office of the National Coordinator for Health Information Technology (ONC)?
Section 13101 of the HITECH Act (2009) required that a new Chief Privacy Officer (CPO) position be established in ONC.  The CPO will advise the National Coordinator on critical privacy and security policies and will play a key role in the design of new policies to assure that privacy and security is addressed in every phase of health IT development and implementation.  The Chief Privacy Officer will also coordinate with other federal agencies, states and regions, and international efforts.  
2.  What are respective roles of ONC and OCR regarding privacy and security?
The Office for Civil Rights (OCR) within the Department of Health and Human Services has the regulatory authority for the HIPAA Privacy and Security rules.  OCR also issues guidance and interpretations on HIPAA Privacy and Security rules, including how these rules apply to electronic health records, personal health records, and health information technology.  OCR has enforcement authority to ensure compliance with the HIPAA Privacy and Security Rules through investigation and the ability to impose civil monetary penalties. The HITECH Act of 2009 enhanced many of the Privacy Rule provisions, including extending certain requirement to business associates; limiting uses and disclosure of protected health information for marketing; prohibiting the sale of protected health information (PHI) without patient authorization; expanding individuals’ rights to access their information and restrict certain PHI disclosures to health plans; and providing greater enforcement authority to OCR.  The Office of the National Coordinator (ONC) for Health Information Technology is charged with the development of a nationwide health information technology infrastructure that allows for the electronic use and exchange of health information.  This includes examining and recommending policy,  technology, and practices that protect privacy and promote security. In addition, ONC  develops regulations for the certification of electronic medical records, engages public input, and implements grant programs, such as those to initiate state health information exchanges, the Regional Extension Centers that provide technical assistance to provided to reach meaningful use of EHRs, and Beacon Communities grants that will establish and demonstrate best practices for middle and later adopters of HIT.

3.  What are the roles of the HITPC and HITSC in privacy and security?
HITECH (Section 13101) required the establishment of a Health Information Technology Policy Committee (HITPC) to make recommendations on the policies needed to enable the electronic exchange and use of health information.  The HITPC recently formed a privacy and security work group (called a “Tiger Team”) with strong consumer representation to make recommendations on patient choice in health information exchange; consumer access to their health information; personal health records; segmentation of health information; and transparency about information sharing practices.  The Health Information Technology Standards Committee (HITSC) deliberates on the technical HIT standards required for electronic exchange.  HITSC held hearings to better understand security priorities, the effectiveness of security procedures, vulnerabilities, and is currently soliciting information related to data segmentation and privacy.  The Committees submit their recommendations to the National Coordinator. The National Coordinator evaluates the Committees’ recommendations and advises the Secretary of Health and Human Services.

4.  What is ONC doing to promote privacy in health information exchange (HIE)?
ONC is working with the federal Health Information Technology Policy Committee (HITPC) and HIT Standards Committee (HITSC) to explore policy and technical methods for enabling patient choice in health information exchange, including a one-day conference on available technical capabilities to support patient consent.  White papers on patient consent models and state consent laws were issued and a paper on data segmentation is underway.  A study of the privacy and security practices of entities not subject to HIPAA will support a report to Congress in which ONC will, in consultation with the Federal Trade Commission, make recommendations on the privacy and security requirements for non-covered entities, with an emphasis on personal health records.  A Request for Information on the same topic is being released to solicit information from the public.  ONC is organizing a series of listening sessions to engage the public in a national dialogue about health information exchange.  The Office of the Chief Privacy Officer is working with ONC divisions to assure the integration of privacy into all facets of ONC activities and projects.  In addition, ONC is working to ensure that the technical and policy foundations of the nationwide health information network will demonstrate methods for achieving trust among entities exchanging information while integrating best practices for privacy and security.

5.  What ONC activities are targeted to assure sufficient security capabilities in HIE?
ONC federal advisory committees have been active in collecting information, deliberating on key issues, and making recommendations to the National Coordinator on measures related to security of health information exchange.  In addition to the activities of the Health Information Technology Policy Committee (HITPC), the Health Information Technology Standards Committee held hearings to better understand security priorities, the effectiveness of security procedures, and vulnerabilities.  ONC also embarked on a multi-phase cybersecurity program that includes an assessment of HIT risks and threats and the development of a multi-pronged approach to combating them.  ONC also is collaborating with the President’s cybersecurity initiative along with other federal partners to solicit input from the best security minds in the government on security best practices and standards.  Meaningful use requirements for Medicare and Medicaid incentive payments include measures to protect security and privacy, and ONC’s interim final rule certification standards for EHRs includes the technical capabilities required to assure that information is adequately protected.

AHRQ Presents: Sustainable HIEs, Patient Empowerment, Transitions in Care

PDFs of Three Webinars Produced by AHRQ
and Released on Web June 18, 2010
These are all large files and take time to open.

Building and Maintaining a Sustainable Health Information Exchange: Experience from Diverse Care Settings: [PDF-1.49MB]
May 14, 2010

The Vanderbilt HIE Experience in Memphis
Mark Frisse, Vanderbilt University Medical Center

Health Information Exchange in Small Primary Care Practices: Someone Needs Needs to Say “Do It”
Patricia Fontaine, University of Minnesota

Delaware Health Information Network: Better Communicaation for Better Healthcare
Gina Perez, Advances in Management

A National Web Conference on Patient Empowerment: Leveraging Health IT for Patient Empowerment [PDF-3.73MB]
April 8, 2010

Leveraging Health Information Technology for Patient Empowerment
Christine A. Sinsky, Medical Associates Clinic and Health Plans

A Personalized Portal to Promote Patient-Centered Prevntive Care
Alex Krist, Virginia Commonwealth University

e-Coaching: Interactive Voice Response (IVR)-Enhanced Care Transition Support for Complex Patients
Christine S. Ritchie, University of Alabama at Birmington

A National Web Conference on Transitions in Care [PDF-1.07MB]
February 24, 2010

Transitional Care and Rehospitalization: Information Technology
Stephen Jencks, Independent Consultant In Health Care Safety

Project RED: The ReEngineed Discharge
Brian Jack, Boston University School of Medicine

Transitions in Care
Terry Field, University of Massachusetts Medical School

‘National Progress Report on eHealth’ Shows Significant Progress in Last 3 Years

eHealth Initiative Survey Identifies Challenges with Consumer Outreach and Understanding of Value
eHealth Initiative (eHI) issued the following press release on July 1, 2010.

WASHINGTON, DC – July 1, 2010 -
Today, the eHealth Initiative (eHI) released the “National Progress Report on eHealth,” which tracks the progress of eHealth in the wake of the American Recovery and Reinvestment Act of 2009.

National Progress Report on eHealth 2010

National Progress Report on eHealth 2010

The National Progress Report on eHealth includes a review of progress made over the last three years relative to strategies and actions proposed in a 2007 eHI report. Over one hundred individuals participated on committees charged with assessing progress in five focus areas: Aligning Incentives; Engaging Consumers; Improving Population Health; Managing Privacy, Security & Confidentiality; and, Transforming Care Delivery. The report highlights key trends, actions, and strategies that still need to be addressed.

The report reveals a number of high-level findings including:

  • Significant progress has been made over the last three years as a result of public and private sector initiatives. The American Recovery and Reinvestment Act (ARRA) was the key driver of progress.
  • Many providers are concerned about the lack of coordination across the government health and health information technology (HIT) initiatives.
  • More education and outreach to consumers about HIT and health information exchange (HIE) is required.
  • Knowledge and transparency of privacy and security policies will be the key to building consumer trust of HIT and HIE.

As part of the assessment process, eHI conducted an informal online survey to gauge perceptions of progress. The survey responses offer a snapshot about the eHealth landscape. Some findings include:

  • The majority of respondents believe significant progress has been made: 61 percent of respondents agree or strongly agree with the statement that significant progress has been made in the successful adoption and use of HIT since 2007.
  • The value of HIE is not clearly understood by the majority of respondents: 54.9 percent disagree or strongly disagree with the statement that the value of HIE is clearly understood.
  • The majority of respondents believe outreach to consumers about the value of EHRs and HIE is not effective: 66.6 percent disagree or strongly disagree with the statement that current outreach to consumers about the value of EHRs and HIE is effective.
  • The majority believe Regional Extension Centers and the National Health Information Technology Research Center (HITRC) will be vital to educating providers: 66.1 percent of respondents agree or strongly agree with the view that Regional Extension Centers and the HITRC will be vital to educating providers about adoption and meaningful use of HIT.

“Contributors to the report found that, while considerable progress has been made over the past three years, challenges remain,” noted Jennifer Covich Bordenick, eHealth Initiative’s Chief Executive Officer. “Coordinating public and private sector efforts, and communicating the true value of HIT and HIE to consumers will be critical as we move forward.”

As part of its work, the eHealth Initiative collected information on dozens of existing and new HIT initiatives occurring across the country. An online version of the current activities is available in the report and online.

The National Progress Report on eHealth was supported by the Commonwealth Fund, a private foundation supporting independent research on health policy reform and a high performance health system.

The report is available on the eHI website at: http://www.ehealthinitiative.org/

 ###

About eHealth Initiative
The eHealth Initiative (eHI) is an independent, non-profit, multi-stakeholder organization whose mission is to drive improvements in the quality, safety, and efficiency of healthcare through information and information technology (IT). eHI is the only organization that represents all of the stakeholders in the healthcare industry. eHI advocates for the use of HIT that is practical, sustainable and addresses stakeholder needs, particularly those of patients. For more information, visit http://www.ehealthinitiative.org/
#                         #                       #

Jennifer Lubell, HITS staff writer, reported July 2, 2010 in ModernHealthcare.com on National Progress Report,
“Electronic healthcare initiatives have made headway over the last several years, but health information technology remains an undervalued tool, a new report concludes.”

CHIME Comments on Final Rule of Temporary EHR Certification

CHIME/College of Healthcare Information Management Executives issues Comments
Excerpted from CHIME Press Release July 1, 2010.
ANN ARBOR, MI, July 1, 2010 – The government’s certification program for health information technology will continue to evolve over time, according to a review of the recently released final rule for the temporary certification program, released last week.

The temporary program to certify electronic health record technology went into effect on June 24, and it will be replaced by the permanent certification program as soon as Dec. 31, 2011. However, the analysis by the College of Health Information Management Executives (CHIME) indicates that certification criteria will change, necessitating the ongoing need to certify HIT products for the foreseeable future.

CHIME found that the recently released final rule suggests that electronic health records (EHR) will need to be certified on an ongoing basis, and that meaningful use criteria are likely to evolve over time.

To receive stimulus funds, eligible hospitals and providers that implement electronic health records must demonstrate that they are using them to improve care delivery and clinical results. The plan originally proposed by the Centers for Medicare & Medicaid Services (CMS) would require providers to give evidence that their systems are achieving certain standards to show they’re using EHRs in meaningful ways. The original plan anticipated that the measures for demonstrating meaningful use would get tougher every two years over the three stages of the program. Providers can enter the program at any time over the next four years by meeting Stage 1 meaningful use criteria.

While the industry is uncertain about the final shape of the meaningful use objectives that CMS will choose, the temporary certification final rule suggests that Stage 1 criteria could become tougher over time.

“Regardless of the year and meaningful use stage at which an eligible professional or eligible hospital enters the Medicare or Medicaid EHR Incentive Program, the certified EHR technology that they would need to use would have to include the capabilities necessary to meet the most current certification criteria,” the temporary certification rule notes.

CHIME’s reading of the rule suggests that, although Stage 1 criteria will be finalized soon, it is possible future rule-making could include updates to the Stage 1 criteria, said Pamela McNutt, FCHIME, senior vice president and CIO at Dallas-based Methodist Health System and chair of CHIME’s Policy Steering Committee.

However, the final rules for temporary certification do provide some relief because they don’t require recertification for HIT product updates and “fixes” that don’t adversely affect meaningful use criteria. However, a product may be certified if there are any concerns about changes in an application that could affect its ability to achieve meaningful use objectives.

Additionally, the authorized testing and certification bodies recognized by the Office of the National Coordinator for Healthcare IT (ONC-ATCBs) can not require that integrated bundled EHRs or EHR modules be certified to a higher set of standards than the certification criteria set by the ONC. CHIME views this clarification as a positive result of the commenting process that caused ONC to re-evaluate the proposed rule.

CHIME also positively views provisions in the final regulation that call for ONC-ATCBs to provide remote testing of applications.

Additionally, the regulations don’t require that an application must be live at a customer’s site before it is tested, opening the way for testing of applications at vendors’ facilities.

While the final regulations reflected resolutions of many of CHIME’s concerns and clarifies certain issues, the organization still is concerned that a product’s certification can be revoked for some “Type 1” violations by an ONC-ATCB that would prompt questions about the integrity of the certification of those products. If a product loses certification, a healthcare organization would have 120 days to secure a certified product, either by the vendor having its product re-certified by a different ATCB or installing another certified product.

While the loss of a product’s certification is unlikely, any such occurrence will probably affect hundreds of provider organizations and could place them under extreme stress to resolve the issue quickly, CHIME said.

About CHIME
The College of Healthcare Information Management Executives (CHIME) is an executive organization dedicated to serving chief information officers and other senior healthcare IT leaders. With more than 1,400 CIO members and over 70 healthcare IT vendors and professional services firms, CHIME provides a highly interactive, trusted environment enabling senior professional and industry leaders to collaborate; exchange best practices; address professional development needs; and advocate the effective use of information management to improve the health and healthcare in the communities they serve. For more information, please visit http://www.cio-chime.org/

ONC Health IT Stories from the EHR Road: Update

New “Journey Stories” on Implementing EHRs
Excerpts from stories collected by Office of National Coordinator (ONC) for Health IT based on physician practices around the country.  Earlier stories repeated from a previous post on e-Healthcare Marketing.com . All carry a map and a quote from the practice.

The Heart of Texas Community Health Center considers their implementation of health IT a success. Their leadership states that the effort towards EHR implementation had the right people on the leadership team, the right product/vendor, and the good fortune to obtain a significant amount of funding at a critical time in the project. A map shows the geographical location of McLennan County, TX.

Dr. Lisa Moreno
Queens pediatric allergist and immunology specialist starts her practice from the cutting edge of HIT.
Queens, New York
Posted June 28, 2010

Cooley Dickinson Hospital
EHR adoption marks a time of rebirth for Massachusetts hospital. Northampton, Massachussetts
Posted June 28, 2010

Heart of Texas Community Health Center
McLennan County, Texas
Posted June 28, 2010

White River Rural Health Center
High standards for care and safety are met with the implementation of EHRs.
Augusta, Arkansas
Posted June 10, 2010

Thayer County Health Services
Five rural health centers and a 19 bed critical access hospital implement EHRs and HIE to benefit county residents.
Hebron, Nebraska
Posted June 10, 2010

Dr. Russell Kohl, Green Country Family Medicine
A two-doctor practice in rural Oklahoma creatively funds the practice’s journey to health IT implementation.
Vinita, Oklahoma
May 27, 2010

Urban Health Plan
The implementation of EHRs improves access to care and reduces health disparities for the urban underserved in the South Bronx.
South Bronx, NY
May 27, 2010

ONC: Informational Calls on Temporary Certification Program + FAQs, Fact Sheet

June 30-July 2: Overview of Temporary Certification for Electronic Health Records
for Potential Applicants (ONC-ATCB), Health IT Developers/Vendors, Provider/Developers and Interested Provider
Notice emailed June 26, 2010, and excerpted below.
The Office of the National Coordinator for Health Information Technology (ONC) within the Department of Health and Human Services is hosting a series of informational calls the purpose of which is to provide an overview of the recently released final rule to establish a temporary certification program for electronic health record (EHR) technology.  The temporary rule establishes processes that organizations will need to follow in order to be authorized by the National Coordinator to test and certify EHR technology.

Participants will hear an overview of the final rule, and be able to ask questions.

Four informational calls are planned, targeting the information needs of specific audiences who may be impacted by the final rule:

1.      For Potential Applicants Who Wish to Pursue Becoming an ONC-Authorized Testing and Certification Body (ONC-ATCB)

Date and Time: Wednesday, June 30, 2010, 4:00 p.m. – 5:00 p.m. EDT

Call-in Information:

Phone Number: 800-857-9600

Participant Passcode: 3533556

2.      For Health IT Developers/Vendors

Date and Time: Thursday, July 1, 2010, 4:00 p.m. – 5:00 p.m. EDT

Call-in Information:

Phone Number: 800-619-0361

Participant Passcode: 3533556

3.      For Providers Who are Also Health IT Developers (who may seek certification of systems developed in-house)

Date and Time: Friday, July 2, 2010, 10:00 a.m. – 11:00 a.m. EDT

Call-in Information:

Phone Number: 800-857-9600

Participant Passcode: 4129010

4.      For Providers,  Including Clinicians, Hospitals and Other Provider Organizations Interested in the Details of the Temporary Certification Program

Date and Time: Friday, July 2, 2010, 11:00 a.m. – 12:00 p.m. EDT

Call-in Information:

Phone Number: 800-769-9420

Participant Passcode: 3533556

Transcripts of each phone call will be made available on the ONC web site, within 48 hours of each call.

For more information about the temporary certification program and the final rule, please visit http://healthit.hhs.gov/certification.
#                                  #                           #

ONC Fact Sheet: HITECH Temporary Certification Program for EHR Technology
Excerpted from ONC site on 6/28/2010.
The Health Information Technology for Economic and Clinical Health (HITECH) Act provides HHS with the authority to establish programs to improve health care quality, safety, and efficiency through the promotion of health information technology (HIT), including electronic health records (EHRs) and private and secure electronic health information exchange.

The HITECH legislation directs the Office of the National Coordinator for Health Information Technology (ONC) to support and promote meaningful use of certified electronic health record (EHR) technology nationwide through the adoption of standards, implementation specifications, and certification criteria as well as the establishment of certification programs for HIT, such as EHR  technology.
 
About the Temporary Certification Program and ONC-ATCBs
To provide assurance to eligible professionals, eligible hospitals and critical access hospitals (CAHs) that the EHR technology they adopt will assist their achievement of meaningful use, the Department of Health and Human Services (HHS) issued a final rule to establish a temporary certification program for EHR technology on June 18, 2010. The rule outlines how organizations can become ONC-Authorized Testing and Certification Bodies (ONC-ATCBs). Authorized by the National Coordinator, ONC-ATCBs are required to test and certify that certain types of EHR technology (Complete EHRs and EHR Modules) are compliant with the standards, implementation specifications, and certification criteria adopted by the HHS Secretary and meet the definition of “certified EHR technology”.

About the Standards, Implementation Specifications, and Certification Criteria
On January 13, 2010, the Secretary published in the Federal Register an interim final rule that adopted standards, implementation specifications, and certification criteria for HIT. A final rule, which will realign with the Medicare and Medicaid EHR Incentive Programs final rule, is expected to be released in the near future.

What Certification Means for Health Care Providers
EHR technology, certified by an ONC-ATCB must be used in order to qualify for incentive payments. The temporary certification program provides assurance that the EHR technology health care providers adopt is technically capable of supporting their efforts to achieve meaningful use.

What Certification Means for Developers of EHR Technology
The temporary certification program provides a way for developers of EHR technology to have their HIT tested and certified so that it can be subsequently adopted by eligible professionals, eligible hospitals and CAHs who seek to achieve meaningful use.

For other questions related to the Temporary Certification program, please email ONC.Certification@hhs.gov.

•    Temporary Certification Program, visit http://healthit.hhs.gov/tempcert
•    Medicare and Medicaid EHR incentive programs, visit http://www.cms.gov/EHRIncentivePrograms/
#                    #            #

Frequently Asked Questions:
Temporary Certification Program Final Rule

Excerpted from ONC site 6/28/2010.
A.    Background/General

Key Messages

Health Care Providers: Key Points
In order to qualify for Medicare and Medicaid EHR incentive payments, providers must use EHR technology that has been certified by an Office of the National Coordinator for Health Information Technology-Authorized Testing and Certification Body (ONC-ATCB, or ATCB).  The temporary certification program provides assurances that the EHR technology adopted by health care providers is technically capable of supporting their efforts to achieve meaningful use.

Developers of EHR Technology: Key Points

The temporary certification program provides a way for developers of EHR Technology to have their EHR technology tested and certified so that it can be subsequently adopted by health care providers who seek to achieve meaningful use.

A1. What is the temporary certification program final rule?
The Secretary of Health and Human Services (the Secretary) issued the temporary certification program final rule to establish a process through which organizations may become ONC-ATCBs. An ONC-ATCB is authorized by the National Coordinator to test and certify EHR technology (Complete EHRs and/or EHR Modules).

A2. What is the purpose of the temporary certification program?

The temporary certification program is the first part of ONC’s two-part approach to establish a transparent and objective certification process. The temporary certification program was established to ensure that “Certified EHR Technology” will be available for adoption by health care providers who seek to qualify for the Medicare and Medicaid EHR incentive payments beginning in 2011. ONC-ATCBs will be required to test and certify EHR technology (Complete EHRs and/or EHR Modules) as being in compliance with the standards, implementation specifications, and certification criteria to be adopted by the Secretary in a forthcoming final rule.

A3. When will the temporary certification program end?

The temporary certification program will be in effect until the permanent certification program is in place. We anticipate that certifications issued under the permanent certification program will occur no earlier than January 1, 2012.

A4. How will ONC work with the National Institute of Standards and Technology (NIST) in regard to certification and standards?

ONC will work with NIST to ensure the availability of relevant test methods and other resources for the temporary certification program.  ONC will continue to work with NIST in developing the permanent certification program.

B.    Application Process

B1. How does an organization become an ONC-ATCB?
An organization must submit an application to the National Coordinator to demonstrate its competency and ability to test and certify EHR technology (Complete EHRs and/or EHR Modules). Once authorized, ONC-ATCBs are required to comply with the principles and conditions applicable to the testing and certification of EHR technology as specified in the temporary certification program final rule.  

B2. Can you provide an overview of the application process?

Applicants are required to request, in writing, an application for ONC-ATCB status from the National Coordinator at ATCBapplication@hhs.gov. The application has two parts:

Part I: Provide general identifying and contact information; complete and submit the results of self-audits to all sections of ISO/IEC Guide 65:1996 (Guide 65) and ISO/IEC 17025:2005 (ISO 17025); submit additional documentation related to Guide 65 and ISO 17025; and agree to adhere to the Principles of Proper Conduct for ONC-ATCBs.

Part II: Successfully complete a proficiency examination.

Applicants are required to complete and submit both parts of the application to the National Coordinator for the application to be considered complete. Please review Section III of the final rule for more details about the application and application review processes.

B3. When will ONC begin accepting applications, and when will applicants be informed if they have received ONC-ATCB status?

The National Coordinator will begin accepting applications on July 1st and any time thereafter while the temporary certification program is operating.  Because the final rule is effective immediately, the National Coordinator will review, process, and make determinations regarding submitted applications as soon as possible.

B4. Will ONC limit the number applicants who apply for ONC-ATCB status?

ONC will not restrict the number of applicants who may apply for ONC-ATCB status. Having available more organizations with ONC-ATCB status will give developers of EHR technology more options for testing and certification.  

C.    Certification Process

C1. I have an EHR technology ready for market. Is there anything I can do to get the technology certified now so that I can start marketing to hospitals and physicians?
Until organizations are authorized by the National Coordinator to perform testing and certification, EHR technology cannot be tested and certified in accordance with the temporary certification program final rule.  At this time, no organizations are currently authorized to test and certify EHR technology under the temporary certification program established by HHS, but when organizations attain ONC-ATCB status ONC will make it publicly known and post their names on our website.  ONC will work with ATCBs to encourage them to begin certifying EHR technology as soon as possible after they are authorized to do so.

C2. When will ONC-ATCBs be up and running?

ONC-ATCBs are permitted to start testing and certifying EHR technology consistent with the scope of their authorization as soon as it is received. Some ONC-ATCBs may need more time to establish their processes than others; however, we anticipate that ONC-ATCBs would be ready to test and certify EHR technology within a few weeks of attaining their authorization.
    
C3. How long will it take for an EHR technology to be certified?

This will vary according to the process used by the ONC-ATCB.

C4. What does a developer of EHR technology need to do to get its EHR technology tested and certified?

A developer of EHR technology will need to (1) select an ONC-ATCB that is authorized to test and certify its EHR technology (Complete EHR or EHR Module), and (2) demonstrate in accordance with the ONC-ATCB’s processes that the EHR technology provides the capabilities required by all applicable certification criteria adopted by the Secretary.

C5. Where can I find out information about EHR technology that has been certified?

ONC will maintain on its website a Certified HIT Products List (CHPL) as a single, aggregate source of all certified Complete EHRs and EHR Modules reported by ONC-ATCBs to the National Coordinator.  The CHPL will comprise all of the certified Complete EHRs and EHR Modules that could be used to meet the definition of Certified EHR Technology.  It will also include the other pertinent information we require ONC-ATCBs to report to the National Coordinator, such as a certified Complete EHR’s version number.  Eligible professionals and eligible hospitals that elect to use a combination of certified EHR Modules may also use the CHPL webpage to validate whether the EHR Modules they have selected satisfy all of the applicable certification criteria that are necessary to meet the definition of Certified EHR Technology.  

C6. Will EHR technology previously certified under any other programs or organizations automatically be certified by this new process?

No. In order to meet regulatory requirements implementing the HITECH Act, including the definition of “Certified EHR Technology,” EHR technology (Complete EHRs and/or EHR Modules) must be tested and certified by an ONC-ATCB. Any other certifications issued by an organization that is not an ONC-ATCB at the time of issuance will be invalid for purposes of meeting the definition of Certified EHR Technology and cannot be used to qualify for incentive payments under the Medicare and Medicaid EHR Incentive Programs. Unless reissued in accordance with the requirements of the temporary certification program, certifications previously issued by an organization that has subsequently become an ONC-ATCB will also be invalid for purposes of satisfying the definition of “Certified EHR Technology,” because such certifications were issued prior to the organization achieving ONC-ATCB status.

Certification by an ONC-ATCB means that EHR technology meets the specific standards, implementation specifications, and certification criteria established for the temporary certification program. (HHS issued an interim final rule outlining specific standards and certification criteria on December 30, 2009, and a final rule is expected to be issued in the near future.)

EHR technology must be tested and certified by an organization authorized by ONC as an ONC-ATCB, using currently adopted standards and certification criteria. Once ONC has authorized testing and certification organizations as ONC-ATCBs, the follow actions are appropriate:

  • Developers of EHR technology who wish to have their EHR technology tested and certified should contact an ONC-ATCB
  • Health care providers who are eligible under the Medicare and Medicaid EHR Incentive Programs should contact their vendors to ensure their EHR technology is tested and certified by an ONC-ATCB under the temporary certification program requirements

C7. Will EHR technology certified under the temporary certification program be automatically certified under the permanent certification program?
EHR technology tested and certified by an ONC-ATCB under the temporary certification program will remain certified once the permanent certification program replaces the temporary certification program.  The change in certification programs will not affect the certified status of EHR technology at the time of change.  However, we anticipate that new or modified certification criteria will be adopted by the Secretary to support future stages of meaningful use, and as a result, certifications issued by ONC-ATCBs will presumably no longer indicate or represent that a Complete EHR or EHR Module can provide all of the capabilities necessary for an eligible professional or eligible hospital to achieve a future stage of meaningful use.

C8. Whose responsibility is it to make sure that EHR technology gets tested and certified as required to meet the certification criteria adopted to support meaningful use?
In most cases it will be the responsibility of developers of EHR technology that sell EHR technology.  However, a health care provider that has developed its own EHR technology and is eligible under Medicare and Medicaid EHR Incentive Programs likely will be responsible for getting it tested and certified.

C9. If I buy an EHR technology that is tested and certified, does that qualify me for the Medicare or Medicaid EHR incentive payments?
Having EHR technology that is certified by an ONC-ATCB is an essential part of qualifying for the EHR incentive payments. For details on the Medicare and Medicaid EHR Incentive Programs, please visit http://www.cms.gov/Recovery/11_HealthIT.asp.

C10. I already use EHR technology. If it gets certified, will I qualify for the Medicare or Medicaid EHR incentive payments?
If the EHR technology you currently use is certified in the HHS temporary certification program, you may be eligible for incentive payments. For details on the Medicare and Medicaid EHR Incentive Programs, please visit http://www.cms.gov/Recovery/11_HealthIT.asp.

D. Comments on Proposed Rule

D1. Where can I learn about how my comments on the proposed rule on the Establishment of Certification Programs for Health Information Technology issued in March were addressed in the temporary certification program final rule?
ONC staff carefully reviewed and considered each comment received on the proposed rule. Section III of the temporary certification program final rule includes a discussion of how the comments were incorporated into the temporary certification program final rule.

E. Related Rules

E1. How does this final rule relate to the Medicare and Medicaid EHR Incentive Programs Proposed Rule?
The National Coordinator will use the temporary certification program to authorize organizations to test and certify EHR technology (Complete EHRs and/or EHR Modules). Once tested and certified, these types of HIT may be used to meet the regulatory definition of “Certified EHR Technology.” Health care providers who are eligible to qualify for incentive payments under the Medicare and Medicaid EHR Incentive Programs are required to use Certified EHR Technology, as promulgated in the CMS final rule.
HHS expects to issue final rules related to the initial set of standards, implementation specifications, and certification criteria and to the Medicare and Medicaid EHR Incentive Programs in the near future.

E2. When will the permanent certification program final rule be published?

We anticipate that a final rule for the permanent certification program will be issued by fall 2010 and that the permanent program will be in place in 2012.

For other questions related to the Temporary Certification program, please email ONC.Certification@hhs.gov.

###

George Washington Awarded $1 Mil to Study Health IT Quality Care Improvement

Study and Report to: Identify Methods to Create Efficient Reimbursement Incentives to Improve Health Care Quality and Understand the Impact of Health IT in Underserved Communities and those with Health Disparities
George Washington University was awarded $1 million to cover two research projects which will examine efficient reimbursement incentives and  the impact of Health IT on delivering health care in underserved areas. Awards were made on July 17, and published July 21, 2010. They will be overseen by the Office of the National Coordinator (ONC) for Health IT.

“The purpose of this contract is to conduct two projects required under the American Reinvestment and Recovery Act of 2009. This statute includes The Health Information Technology for Economic and Clinical Health Act of 2009 (the HITECH Act) that sets forth a plan for advancing the appropriate use of health information technology to improve quality of care and establish a foundation for health care reform.

“The first project (Project A) will examine methods to create efficient reimbursement incentives for improving health care quality in federally qualified health centers (FQHCs), rural health clinics (RHCs), and free clinics. Project A requires a Report to Congress by February, 2011.

“The second project (Project B) will investigate the impact of Health Information Technology (HIT), including electronic health records (EHR), in communities with health disparities and in areas with a high proportion of individuals who are uninsured, underinsured, and medically underserved (including urban and rural areas). This project will also identify practices to increase adoption of HIT by health care providers in such communities and the use of HIT to reduce and better manage chronic diseases.

“The purpose of Project A under this contract is to examine methods to create efficient reimbursement incentives for improving health care quality in federally qualified health centers (FQHCs), rural health clinics (RHCs), and free clinics. This project was mandated in the American Recovery and Reinvestment Act (ARRA) of 2009 (P.L. 111-5, section 13113(b)), and requires, not later than 2 years after the date of the enactment of the Act, the submission of a Report to the appropriate committees of jurisdiction of the House of Representatives and the Senate. Project A will review and assess different reimbursement incentives that have been utilized in Medicare, Medicaid and by private payers and States. The study should then address whether or not these incentives can be duplicated among safety-net providers. Since the study was authorized in The Health Information Technology for Economic and Clinical Health (HITECH) Act (P.L. 111-5, Sec. 13113(b)), it should include a focus on the role of payment incentives for health information technology (HIT), including payment for telehealth services, and how these incentives can lead to improved health care.

“This study will investigate the impact of Health Information Technology (HIT) including electronic health records (EHR) in communities with health disparities and in areas with a high proportion of individuals who are uninsured, underinsured, and medically underserved (including urban and rural areas). The study will also identify practices to increase adoption of HIT by health care providers in such communities and the use of HIT to reduce and better manage chronic diseases. Legislative authority for this activity is found in the American Recovery and Reinvestment Act (ARRA) of 2009 (P.L. 111-5, Sec. 13101, Subtitle A, Sec. 3001).”

Project A:

“The need to reform current health care payment methods that promote inappropriate or inefficient behaviors and that impede progress toward better quality care has been established. The current basic payment systems reward overuse of services and use of high-cost complex procedures; it is understood that there is a wide variation in practice patterns and that these variations do not necessarily correlate with improved quality. Payment reforms are recognized as a key ingredient to promote high quality clinical, patient-centered, and efficient care. The concept of payment that rewards higher quality has begun to be accepted by payers and to take shape in ways such as through CMS demonstration programs, performance measures, and other private payer incentive programs. The evidence in support of various public- and private-sector programs designed to align payment incentives to promote better-quality care by rewarding providers who perform well has been reported. Current efforts to link health care payment to the quality and efficiency of care provided are shifting the reimbursement structure away from paying providers based solely on their volume of services.

“The current structure of reimbursement programs designed to promote quality often limit FQHC, RHC, and free clinic participation because of their unique payment methodologies. These types of providers generally bill Medicare on an institutional claim form which does not include certain critical data elements necessary for implementing quality incentive types of programs established by CMS and other payers. FQHC and RHC participation in previous quality incentive programs has been contingent on whether or not they elect to bill on a physician claim form and be paid according to the physician fee schedule. Changing to this billing approach would result in eligibility to participate in the demonstration programs.

“The Office of the National Coordinator for Health IT (ONC), in coordination with other offices in the Department, seeks to describe and assess methods to create efficient reimbursement incentives for improving health care quality in FQHCs, RHCs and free clinics, under the guidance provided in ARRA section 13113(b).”

Project B:

“The U.S. health care system faces multiple challenges that require new approaches to protecting the health of the American people and to providing essential health care services. These challenges include rising health care costs, ongoing evidence of poor quality and outcomes, an aging population with multiple chronic conditions, an ethnic and racial diversity in health care access and outcomes, and an increasingly complex health care system.

“Interoperable health information technology (HIT) includes a promising set of tools that can help address these issues by improving quality, safety and efficiency of health care. These technologies include telehealth, EHRs, and personal health records (PHRs), to enhance communication and access between patients and providers, as well as health information exchange (HIE) to facilitate appropriate sharing of health care data and coordination among health care practitioners.

Project A Goals:

“The goals for the project are to:

1. Provide a baseline understanding and assessment of reimbursement incentive programs in place or in the process of being implemented. This assessment shall include different categories of quality incentive programs, targeted goals and outcomes, methodologies for payment, and the types of providers participating in the programs. It should discuss provider reimbursement incentive initiatives in the planning stages or under discussion and how FQHCs, RHCs, and free clinics might participate in those quality-related incentive programs. Future reimbursement initiatives might include, for example, those under consideration in Congressional health reform legislation, initiatives under development at the Centers for Medicare and Medicaid Services, or state-specific reimbursement initiatives that could be generalized across FQHCs, RHCs and free clinics.

2. Provide options for potential approaches to increase the participation of FQHCs, RHCs, and free clinics in initiatives involving efficient reimbursement for improving health care quality.

3. Define the conditions, catalysts and barriers that facilitate and hinder FQHCs, RHCs, and free clinics programs’ participation in quality-related reimbursement initiatives.

4. Using an expert panel and regional meetings, identify the most promising methods and successful approaches to establish quality-related reimbursement programs that include FQHCs, RHCs, and free clinics. The methods and topics reviewed by the expert panel should take into account time-sensitive issues such as health care reform, accountable care organizations, episodes of care, medical home, and “meaningful use” HIT incentive payments. Topics should focus on pay for performance approaches that result in both cost reduction and quality improvement.

5. Create a set of options demonstrating what is needed to include and sustain participation of FQHCs, RHCs, and free clinics in quality-related incentive programs including barriers, gaps and successful strategies and suggestions for future opportunities. ”

“To accomplish these goals, the Contractor will conduct an assessment of current quality incentive reimbursement programs. The assessment will examine how these programs have been structured in the past and how they have evolved over time and the extent that these incentive programs are effective at achieving the intended outcomes (e.g. improved quality, efficiency). The Contractor will conduct an environmental scan that will provide an analytic framework for the project that can be used to clarify the types and characteristics of various public- and private-sector programs designed to align payment incentives to promote better quality of care. The environmental scan will include information from published as well as unpublished resources, open-ended discussions with payer organizations such as the Centers for Medicare and Medicaid Services as well as discussions with organizations representing FQHCs, RHCs and free clinics, and other resources, academia, and experts in health care financing. An important aspect of the environmental scan will be the identification of gaps, as well as recommendations for studies and approaches to fill those gaps. These identified gaps can be used to generate topics for additional research.

“The environmental scan will provide information to assist in the development of a slate of topics to be further evaluated in white papers to be developed. An expert panel will be convened to help guide the study content. The expert panel will work on identifying topics for a series of white papers based on a set of focused questions on key topic areas

“A meeting of internal and external stakeholders will be held to provide input in establishing methods to create efficient reimbursement incentives for improving health care quality in FQHCs, RHCs, and free clinics. The Contractor will follow the definitions for FQHCs, RHCs, and free clinics found in current federal guidelines. External stakeholders should include organizations such as the National Association of State Medicaid Directors, the National Association of Community Health Centers (NACHC), the National Association of Rural Health Clinics (NARHC), and the National Association of Free Clinics (NAFC). In addition, foundations and other organizations that have offered or studied quality incentive programs will be included in these meetings.

“The study will provide an assessment of whether and how FQHCs, RHCs, and free clinics can more effectively participate in quality incentive programs and will identify methods to create new appropriate reimbursement incentives for improving health care quality for these provider types. The final product will include a synthesis report with specific and practical methods regarding ways these programs can achieve quality improvement through payment incentives. The study will provide the Congress with information regarding innovative quality reimbursement incentives.”

Project B Goals:

“The goals for the project are to:

1. Assess the impact of HIT and EHR in communities with health disparities and in areas with a high proportion of individuals who are uninsured, underinsured, and medically underserved (including urban and rural areas);

2. Identify practices to increase the adoption of HIT by health care providers in such communities; and

3. Identify practices to increase the use of HIT to reduce and better manage chronic diseases.”

“In order to accomplish these goals, the contractor shall work closely with the ONC project officer to:
“• Assist in the formation and convening of an interdisciplinary panel of experts in HIT, frontline healthcare delivery, health disparities and quality measurement, quality improvement and other disciplines as necessary. The expert panel shall assist with all phases of the contract, as described in the following sections. The composition of the interdisciplinary panel shall be developed in consultation with the project officer and shall be approved by the project officer before appointments are made. The interdisciplinary panel of experts shall be no larger than 10 non-federal individuals.

“• Conduct an environmental scan and literature review using published and gray literature as well as interviews. The environmental scan should provide an analytic framework for the project that can be used to clarify the types and characteristics of model HIT adopters in the context of this study. As part of the environmental scan, the contractor will identify potential sources of data supported by rigorous research and robust studies that can be used for the analysis. Specific health information technologies and tools (including, but not limited to, electronic health records, electronic registries, public health information systems, telehealth, personal health records and health information exchanges) should be included in the environmental scan to evaluate whether and how these technologies might impact health disparities. The contractor will be required to select a reference point from which disparities can be measured; whether disparities should be measured in relative or absolute terms; the precision of the statistics used to measure disparities; the use and interpretation of summary measures of disparities; etc.

“• Develop and implement a study framework to examine the impact of HIT on communities with health disparities and in areas with a high proportion of individuals who are uninsured, underinsured, and medically underserved (including urban and rural areas). This assessment should provide information and recommendations regarding practices to increase the use of HIT by both patients and providers to reduce and better manage chronic diseases. “

ONC-ATCB? ONC-Authorized Testing and Certification Body

FINAL RULE Issued: Temporary Certification Program for Health IT
Published in Federal Register on June 24, 2010
AGENCY: Office of the National Coordinator for Health Information
Technology, Department of Health and Human Services.
45 CFR Part 170
“Establishment of the Temporary Certification Program for Health
Information Technology; Final Rule” was published in the Federal Register on June 24, 2010, with excerpts below and links to html and PDF versions. ONC now estimates there may be as many as five ONC-ATCBs, up from the three estimated in the interim rule and that they will certify ”at most, approximately 205 Complete EHRs and/or EHR Modules under the temporary certification program.” Organizations for ATCB status may start applying July 1, 2010.

FORMATS: HTML , PDF , SUMMARY

“SUMMARY: This final rule establishes a temporary certification program
for the purposes of testing and certifying health information technology. This final rule is established under the authority granted to the National Coordinator for Health Information Technology (the National Coordinator) by section 3001(c)(5) of the Public Health Service Act (PHSA), as added by the Health Information Technology for Economic and Clinical Health (HITECH) Act. The National Coordinator will utilize the temporary certification program to authorize organizations to test and certify Complete Electronic Health Records (EHRs) and/or EHR Modules, thereby making Certified EHR Technology available prior to the date on which health care providers seeking incentive payments available under the Medicare and Medicaid EHR Incentive Programs may begin demonstrating meaningful use of Certified EHR Technology.”

II. Overview of the Temporary Certification Program

“The temporary certification program provides a process by which an organization or organizations may become an ONC-Authorized Testing and Certification Body (ONC-ATCB) and be authorized by the National Coordinator to perform the testing and certification of Complete EHRs and/or EHR Modules.
   
“Under the temporary certification program, the National Coordinator will accept applications for ONC-ATCB status at any time. In order to become an ONC-ATCB, an organization or organizations must submit an application to the National Coordinator to demonstrate its competency and ability to test and certify Complete EHRs and/or EHR Modules. An
applicant will need to be able to both test and certify Complete EHRs and/or EHR Modules. We anticipate that only a few organizations will qualify and become ONC-ATCBs under the temporary certification program. These organizations will be required to remain in good standing by adhering to the Principles of Proper Conduct for ONC-ATCBs. ONC-ATCBs will also be required to follow the conditions and requirements applicable to the testing and certification of Complete EHRs and/or EHR Modules as specified in this final rule. The temporary certification program will sunset on December 31, 2011, or if the permanent certification program is not fully constituted at that time, then upon a subsequent date that is determined to be appropriate by the National Coordinator.”

Analysis and Response to Public Comments: Overview
 ”This section discusses the 84 timely received comments on the Proposed Rule’s proposed temporary certification program and our responses. We have structured this section of the final rule based on the proposed regulatory sections of the temporary certification program and discuss each regulatory section sequentially. For each discussion of the regulatory provision, we first restate or paraphrase the provision as proposed in the Proposed Rule as well as identify any
correlated issues for which we sought public comment. Second, we summarize the comments received. Lastly, we provide our response to the  comments, including stating whether we will finalize the provision as proposed in the Proposed Rule or modify the proposed provision in
response to public comment. Comments on the incorporation of the “recognized certification body” process, “grandfathering” of  certifications, the concept of “self-developed,” validity and expiration of certifications, general comments, and comments beyond the scope of this final rule are discussed towards the end of the preamble.”

Several Excerpts About Increase Estimate to Five ONC-ATCBs
Different Levels of Preparedness

“As stated in the collection of information section, we estimate that each ONC-ATCB will incur the same burden and, assuming that there are 5 ONC-ATCBs, will test and certify, at most, approximately 205 Complete EHRs and/or EHR Modules under the temporary certification program.”

“In the Proposed Rule, we stated that we  anticipated that there would be no more than 3 applicants for ONC-ATCB  status. Based on the comments received, we now believe that there may be up to 5 applicants for ONC-ATCB status. In addition, we believe that up to 2 of these applicants will not have the level of preparedness that we originally estimated for all potential applicants for ONC-ATCB status.”

“In the Proposed Rule, we stated that we anticipated that there would be no more than 3 applicants for ONC-ATCB status. Based on the comments received, we now believe that there may be up to 5 applicants for ONC-ATCB status. In addition, we believe that up to 2 of these applicants will not have the level of preparedness that we originally estimated for all potential applicants for ONC-ATCB status.”

“As part of the temporary certification program, an applicant will be required to submit an application and complete a proficiency exam. We do not believe that there will be an appreciable difference in the time commitment an applicant for ONC-ATCB status will have to make based on the type of authorization it seeks (i.e., we believe the application process and time commitment will be the same for applicants seeking authorization to conduct the testing and certification of
either Complete EHRs or EHR Modules). We do, however, believe that there will be a distinction between applicants based on their level of preparedness. For the purposes of estimating applicant costs, we have divided applicants into two categories, “conformant applicants” and
“partially conformant applicants.” We still believe, after reviewing comments, that there will be three “conformant applicants” and that these applicants will have reviewed the relevant requirements found in the ISO/IEC standards and will have a majority, if not all, of the documentation requested in the application already developed and available before applying for ONC-ATCB status. Therefore, with the exception of completing a proficiency examination, we believe “conformant applicants” will only spend time collecting and assembling already developed information to submit with their application. Conversely, we believe that there will be up to two “partially conformant applicants” and that these applicants will spend significantly more time establishing their compliance with Guide 65 and ISO 17025.”
#                             #                              #

For several interesting points in the rule, see John Halamka’s June 25, 2010 post in his Life as a CIO blog. He credits Robin Raiford for bookmarking the site, to whom–in serial form–this blog give credit as well.

e-Healthcare Marketing published a post on June 19, 2010 on Final Rule with HSS press release, FAQs, overview, and ONC’s blog post from David Blumenthal.

Toward Enhanced Information Capacities for Health: Achieving the Promise: NCVHS

NCVHS Concept Paper Looks How to Achieve the
Promise of Health Reform and Electronic Health Records
The National Committee on Vital and Health Statistics (NCVHS) met June 16-17, 2010 in Washington, DC, and used the NCVHS concept paper “Toward Enhanced Information Capacities for Health” as the basis of discussions for their 6oth Anniversary Symposium of the committee. The paper, issued May 26, 2010, focuses on policies HHS could establish to maximize the benefits that could be acheived through the appropriate use of the tremendous amount of health data that will be generated with Electronic Health Records.

The committee advises the Secretary of  HHS on policies toward health data, statistics, privacy, national health information policy, and Administrative Simplication of HIPAA.

NCVHS Concept Paper
“Toward Enhanced Information Capabilities for Health”
PDF FORMAT
The text of the 11-page paper is reproduced in whole below.

EXECUTIVE SUMMARYHealth care reform and federal stimulus legislation have created an unprecedented opportunity to improve health and health care in the United States. The nation’s ability to seize this opportunity will depend greatly on the existence of robust health information capacities. The National Committee on Vital and Health Statistics (NCVHS) is the statutory advisory body on health information policy to the Department of Health and Human Services. On the occasion of the Committee’s 60th anniversary, this concept paper outlines its current thinking about the necessary information capacities and how NCVHS can help the Department guide their development.

We are entering a new chapter in the health and health care of Americans. The expansion of health care coverage, the infusion of new funds and adoption of standards for electronic health records (EHRs), and increased administrative simplification offer us the potential to use the enriched data generated to better address our country’s health and health care challenges. Having better information with which to measure and understand the processes, episodes, and outcomes of care as well as the determinants of health can bring considerable health benefits, not only to individuals but also to the population as a whole.

To be able to achieve the promise of these new developments, we need to be attentive to the underpinnings of the data, ensuring that they are easy to generate and use at the front lines as well as easy to reuse, manipulate, link, and learn from within a mantle of privacy and security. It is important to remember that the new data sources are not necessarily a replacement for traditional sources such as administrative and survey data, which play a key role in our infrastructure. Rather, the new sources present an opportunity to augment and enrich traditional sources. While efficiency may be gained by replacing some survey and administrative data with newer EHR data, we must continue to nourish and sustain the traditional data sources that offer unique and irreplaceable information for both clinical and population health purposes.

National health information capacities must enable not just better clinical care but also population health and the many synergies between the two. More specifically, health information policy should foster improved access to affordable, efficient, quality health care; enhanced clinical care delivery; greater patient safety; empowered and engaged patients and consumers; patient trust in the protection of their health information; continuous improvement in population health and the elimination of health disparities; and support of clinical and health services research. A major priority of health information policy should be to enable the multiple uses of data, drawn from the full range of sources, while minimizing burden. Most sources have primary uses for which they were designed; however, with adequate standardization, privacy protections, and technology, the data from many sources can be used for multiple purposes. Realizing the collective potential of all information sources is what will allow the U.S. to maximize the return on its investments in system reform and health IT for the benefit of all Americans.

As information capacities expand, it is critical that the information be comprehensive, timely, efficiently retrievable, and usable, with full individual privacy protections in place. “Comprehensive” refers to the inclusion not just of traditional health-related data, but also of data on the full array of determinants of health, including community attributes and cultural context. Usability of the data—whether for initial use or reuse―requires a well-coordinated effort to assure the accessibility and availability of information as well as its standardization.

NCVHS will continue to use its consultative and deliberative processes, working collaboratively with other HHS advisory committees, to help the Department meet these opportunities and challenges. Given the rapidity of the changes now under way, we cannot over-emphasize the urgency of this endeavor and the need to move ahead with deliberate speed.

INTRODUCTION

Health care reform and federal stimulus legislation have created an unprecedented opportunity to improve health and health care in the United States. The nation’s ability to seize this opportunity will depend greatly on the existence of robust health information capacities. 1 To maximize the return on these enormous investments and make it possible to evaluate their impact, health information capacities must be carefully developed with an eye to their uses for improving health care and health for all Americans. New investments in EHRs and health information exchanges are important contributors, especially for clinical care, but the benefits from these investments will be limited unless the synergies with other types of health information are recognized and used. Population-level data from vital statistics systems, surveys, and public health surveillance and health care administrative data are equally important information sources. Assuring that all these sources are adequately developed and supported and can be integrated appropriately is essential to developing the information capacities the nation needs.

The National Committee on Vital and Health Statistics, the Department’s statutory advisory body on health information policy, has long assisted the Department in the development of national health information policy, providing thought leadership and expert advice in the areas of population health, privacy, standards, the NHII/NHIN, health care quality, and more. Nearly ten years ago, NCVHS put forward a vision for a national health information infrastructure in its 2001 report, Information for Health,2 followed in 2002 by a vision for 21st century health statistics.3 Today, as data and communication capacities explode and health care coverage expands, new thinking and visioning are needed to clarify the information capacities that will make it possible to meet our national goals for better health and health care for all Americans. On the occasion of the Committee’s 60th anniversary, this concept paper outlines its current thinking about the required capacities and their development.

In 2009, as course-altering legislation was unfolding, NCVHS began to consider how it could assist the Department’s development of the necessary information capacities.4 All four NCVHS subcommittees have contributed to the early thinking on this subject, and all plan further work

—————————————————————————-
1 We use the term capacities in the sense of the ability to perform or produce. That is, information capacities are understood in relation to specific needs, purposes, and functions of information.
2 NCVHS, Information for Health: A Strategy for Building the National Health Information Infrastructure, November 2001.
3 NCVHS, Shaping a Health Statistics Vision for the 21st Century, November 2002.
4 As part of this process, NCVHS in 2009 commissioned two authors of the 2002 health statistics vision report to help the Committee consolidate and update its recommendations. Their report to the Committee is posted on the NCVHS website. < http://www.ncvhs.hhs.gov/090922p3.pdf >
————————————————————————————-
in their respective domains, as described below. 5 The Committee has crafted a highly effective process for bringing multiple points of view and areas of expertise to bear as it develops recommendations to the Secretary, and this process is well suited to the work that lies ahead. NCVHS will continue to use its consultative process to create venues for dialog, eliciting input and perspectives from stakeholders and experts regarding critical challenges, potential opportunities, and next steps. It will use this external input and its own broad expertise to help the Department develop health information policies that are commensurate with new opportunities and needs. Given the rapidity of the changes now under way, we cannot over- emphasize the urgency of this endeavor and the need to move ahead with deliberate speed.

INFORMATION CAPACITIES FOR HEALTH AND HEALTH CAREPublic sector involvement in health information has a long history. State, local, and federal agencies have gathered information through vital records, hospital and ambulatory data sets, public health surveillance, population surveys, and other sources to monitor health trends, identify threats, and guide interventions to protect and promote health. Congress initiated a new type of government involvement in 1996 when the Health Information Portability and Accountability Act (HIPAA) recognized the importance of protecting individuals’ health care information while improving the efficiency of health care delivery through standardized electronic administrative transactions. Most recently, the American Recovery and Reinvestment Act of 2009 (ARRA) began another type of intervention, providing financial incentives for health IT adoption in the nation’s hospitals and physician offices as well as funding for infrastructure support.

While much current attention is focused on the ARRA funding of health IT and critical associated tasks such as defining and implementing “meaningful use” of EHRs, a broader perspective is required to take full advantage of evolving opportunities. Widespread use of optimally configured, standardized EHRs will greatly expand the information available on health care services, users, and providers. However, promoting the health and wellness of the population also requires information about those who have not received health care services, among other things, as well as information on other determinants of health beyond traditional health care, including environmental, social, and economic factors.6

In short, national health information capacities must support a broad array of uses and purposes that include improving access to affordable and efficient quality health care, supporting clinicians in delivering care, empowering and engaging patients and consumers in their care,
—————————————————————————-
5 At present, NCVHS has subcommittees on population health, standards, quality, and privacy/confidentiality/security.
6 See the NCVHS-developed graphic of the determinants of health on page 9 of its report on a vision for 21st century health statistics (see note 3).
—————————————————————————-
ensuring patient safety, promoting patient trust, eliminating health disparities, monitoring and improving population health, and supporting health services and clinical research. As these capacities are developed, it is critical that the information being collected be comprehensive, timely, efficiently retrievable, and usable, and that individual privacy be protected.

In the Committee’s view, this requires a well-coordinated effort that assures the following:

1.  Accessibility and availability of information. The availability of sufficient, timely information from relevant sources must be assured to meet the priority needs of diverse users (including clinicians, consumers, purchasers, payors, researchers, public health officials, regulators, and policymakers) for taking action and evaluating outcomes. To minimize burden, wherever possible data should be collected once, for multiple appropriate uses by authorized users. Where appropriate, the capacity to connect data from multiple sources should be provided.

2.  Standardization. Standardization is necessary to enable interoperability for the efficient collection and timely sharing of information among all types of users. Robust standards should be assured through the definition, application, and adoption of terminologies, codes, and messaging in the areas of reimbursement, public health, regulation, statistical use, clinical use, e-prescribing, and clinical documents.

3.  Privacy, confidentiality, and security protections. With the increasing adoption of interoperable electronic health records technology, along with the move toward global access to health data and emerging new uses of data, methods of access and information availability raise significant new and unique privacy and security concerns. Appropriate privacy, confidentiality, and security protections; data stewardship; governance; and an understanding of shared responsibility for the proper collection, management, sharing, and use of health data are critical to addressing these concerns.

Each is briefly discussed below.

1. ACCESSIBILITY AND AVAILABILITY OF INFORMATION

In today’s world, the boundaries between health care, population health, and even individual personal health management are permeable, and information exchange is increasingly multi- directional. The domains traditionally called “public health” and “health care” are increasingly intertwined, often sharing broad, common information sources and capacities. For example, promoting the health and wellness of individuals and the population requires attention to health determinants including not only the treatment and prevention of disease and the nature of community health resources but also environmental, housing, educational, nutritional, economic, and other influences. Continuously improving the quality, value, and safety of health care involves, among other things, research and knowledge management, meaningful performance measurement, education and workforce development, and support for personal and family health management. Finally, improving health and health care on a national scale requires monitoring and eliminating health disparities and assessing the health status of all Americans, including vulnerable sub-populations.

A major priority of health information policy should be to facilitate these interconnections and enable the multiple uses of information for current and emerging data needs. With health IT, complemented by the necessary privacy protections and data stewardship and facilitated by well designed standards, data can be combined to create richer information and used to address a broad array of current and emerging health and health care issues. Realizing the collective potential of all information sources is what will allow the U.S. to maximize the return on its investments in system reform and health IT for the benefit of all Americans.

At present, the major sources of data on health are:

       Surveys (interview and examination) and Censuses    Public health surveillance data (e.g., notifiable disease reporting, medical device reporting)        Health care data (EHRs, HIEs, registries, and other such as prescription history, labs, imaging)
      Administrative data (claims, hospital discharge data, vital records)
      Research data (community-based studies, clinical trials, research data repositories)

Another essential set of sources for understanding health is the information on influences on health (including transportation, housing, air and water quality, land use, education, and economic factors) managed by various public and private sector agencies. In addition to all these well-established sources, new ones such as personal health records and computerized personal health monitoring devices are emerging with the potential to contribute to understanding health at individual and population levels. Social networking content has the potential to provide yet another new and novel resource.

Most data sources have primary uses for which they were designed. However, given adequate standardization, privacy protections, and informatics technology, these sources have great potential to be used for multiple purposes. For example, EHR data elements are collected to document and manage clinical care, but also can be used for public health reporting (such as communicable diseases and medication safety) and to evaluate population health and conduct health services research. Surveys are principally for population-level analysis, but survey information also contributes to clinical care. Vital records not only provide information about births and deaths, but also serve as the “bookends” of population health data. Administrative data (ICD-9-CM disease codes and CPT-4/HCPS procedure codes) were initially used for management and reimbursement, but today play a critical role in quality assessment and public health monitoring (e.g., quality and safety indicators and disease prevalence evaluation). As we look to the future, the goal is to leverage all these sources, when appropriate, and expand their utility for understanding personal and population health and their determinants while carefully protecting the confidentiality of the data they contain.

To bring about the needed improvements and efficiencies and draw all possible benefit from the large and growing investment in health IT, the emerging information capacities must enable both more effective and cost-effective clinical services and population health promotion, and their many synergies. This can be facilitated through multi-directional data sharing and linkages to generate information that is comprehensive and broadly representative. It will be critical to break down the silos that now make it difficult to share and connect data. This requires addressing the policy, institutional, technical, and other barriers that contribute to the existing silos. A workforce trained to take advantage of the broader data and informatics capacities is also essential. Detailed local data are needed to enable understanding of health and health care at local neighborhood, community, sub-population, and other levels of aggregation. Key decisions about health and health care are made at the local level, and we envision the potential to meet these needs in ways not previously possible. Finally, a critical use of population health data, especially with the advent of health care reform, is to assess the effectiveness, comparative effectiveness, and equity of health care.

Because resources are limited and burden must be minimized, information policy must set priorities regarding which data are most important in order to target investments in data collection. As noted, burden can be minimized by collecting data once for multiple uses. At least in the near term, provided that data can be put in the hands of trusted stewards, enhanced administrative data may be a powerful component that reduces the burden of multiple collections. As new capacities come on line, it may be possible to curtail or redirect some current collection activities.

An important criterion is that information, whatever its source, must be meaningful to users. Experience has demonstrated that having relevant data and information available does not ensure that it is accessible in a timely manner and useful form to the full range of potential users. Delays may be created by approval processes or regulatory requirements, as well as by the lack of data handling and analysis capacities that could enable a user to pose a question, indentify relevant data sources, and request a report that is understandable and protects the privacy of data sources. Ensuring access to useful information is a critical part of the challenge. An overarching goal of all these endeavors is to assure that data can be converted into information and ultimately into knowledge that can answer the priority questions about personal and population health in the U.S. and enable effective decisions and actions to improve them.

2.  STANDARDS FOR INTEROPERABILITY, USABILITY, QUALITY, SAFETY, AND EFFICIENCY

The purposes of health information standards are to ensure the efficient, secure, safe, and effective delivery of high quality health care and population health services; to support the information exchange needs of health care, public health, and research; and to empower consumers to improve their health.

The impending implementation of the next generation of HIPAA standards, the enactment of The Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009, and the recent signing of health reform into law are creating an unprecedented convergence of driving forces, foundational components, technology advances and capabilities, and regulatory requirements. Together, these assets can help create a common national pathway toward achieving the vision and policy priorities of a 21st century health system that relies on a strong health information and health information technology foundation. The past five years have seen a remarkable transformation in the adoption and use of standards for electronic exchange of health information. The transformation encompasses privacy and security standards, standards for administrative and financial transactions, the establishment of unique identifiers, and more recently the adoption of standards for codifying, packaging, and transmitting clinical information between and across health care organizations. This rapidly evolving transformation is moving us closer to the ideal of a fully interoperable electronic health information collection and exchange environment that supports all functions and needs of the country’s health and health care ecosystem, as discussed in the previous pages.

Data standards provide a key architectural building block that supports the collection, use, and exchange of health information. Health information standards have been developed and are being adopted and implemented in many different areas. Capturing information in codified format through standard representations such as clinical vocabularies and terminologies, code sets, classification systems, and definitions is a key strategy for achieving semantic interoperability. The inclusion of standardized metadata, which describe characteristics of the data such as provenance, increases the potential for assessing the reliability and validity of the data for aggregation, research, and other uses. Organizing and packaging data through defined electronic message and document standards to be accessed and exchanged via standardized electronic transport mechanisms and protocols achieves access and exchange of health information. The availability and integrity of health information is protected and ensured through the deployment of security standards, thus guaranteeing confidentiality and privacy of protected health information. Finally, the certification of health information technology for Meaningful Use depends on the wise deployment and use of health information standards.

3. PRIVACY, CONFIDENTIALITY, SECURITY

With the move toward the management of health data in electronic form, there is a significant opportunity to enhance health data access, utility in patient care, and important secondary uses. The opportunity is further enhanced through the emergence of new methods to exchange health data, both on a regional and national basis. However, the ability to realize the potential of electronic health data depends greatly on ensuring that uses are appropriate and individuals’ reasonable privacy, confidentiality, and security expectations are met.

Individuals should have the right to understand how their health data may be used, and to provide consent where appropriate. Often, consent is difficult, as not all uses are known at the time the health data are collected. Further, standards do not yet exist to track an individual’s consent as data are exchanged. Although many of the population health uses described in this concept paper involve aggregated or de-identified health data, legitimate concerns exist about group harms and possible re-identification. In addition, the possibility of using health data from emerging information sources, such as personal health record systems, raises unique privacy concerns.

NCVHS has discussed many of these privacy challenges in numerous reports and letters to the Secretary. Most notably, NCVHS published two reports, a Primer on health data stewardship 7 and Recommendations on Privacy and Confidentiality, 2006-2008. Both are available on the NVCHS website.8

Further work is necessary to develop the privacy, confidentiality, and security standards that should apply as these data uses continue to evolve. In addition, work is needed to establish governance structures to provide the proper oversight of entities that exchange and use health data. In essence, governance is the accountability for ensuring that proper data stewardship (as described in the NCVHS Primer cited above) is practiced. To differentiate between governance and data stewardship, data stewardship is focused on the internal practices of the entity that uses health data, whereas governance is focused on the oversight of such entities to ensure that their data stewardship practices are adequate. Such oversight includes initially approving entities that have access to data, ensuring that such entities appropriately use and protect data, and ensuring that entities that misuse data are appropriately sanctioned.

THE WAY FORWARDTaken together, today’s emerging policy opportunities and the nation’s longstanding health challenges create a situation of considerable urgency for the United States. The openness to bold new approaches offered by recent legislation will disappear quickly. Given that the U.S. lags behind most other industrialized countries in the health status of its citizens, we must seize the opportunities to maximize the health benefits and begin to assess whether the huge investments are indeed having the desired impact.

This paper has noted the critical federal role in devising health information policy to support national health goals. Federal leadership is more needed than ever to create the comprehensive approaches that will guide the development of information capacities and coordinate efforts by actors in the public and private sectors. Whatever progress is made in the critical transition to electronic health records, clinical data alone will not suffice; broad information capacities that

————————————————————
7
An NCVHS Primer: Health Data Stewardship―What, Why, Who, How, December 2009.
8 http://www.ncvhs.hhs.gov
————————————————————

draw on all the sources and serve all the purposes discussed in this paper will be necessary. This will require shoring up the data resources for public functions such as surveys, safety surveillance, and vital records, along with strategic thinking to determine what capacities will be needed in the future and how to guide their development. Many issues require research and demonstration as part of a prioritized, adequately funded research agenda. In addition, further investments in a trained workforce are needed, to ensure the availability of professionals and leaders who can properly use information resources for analysis and decision-making.

As it develops policies and strategies, the Department has always invited input from experts and stakeholders; and NCVHS has long helped to facilitate this dialogue and distill the key messages and lessons. NCVHS will continue to use its consultative and deliberative processes, working collaboratively with other HHS advisory committees, to help the Department meet the current opportunities and challenges. As noted, all NCVHS subcommittees plan to be involved in this effort; this report is an early installment on subcommittee and full Committee work plans for the coming 18 months or more. NCVHS expects to develop recommendations on a research agenda, which may be the focus of one or more hearings. Each of the subcommittees is identifying the key issues in its domain, to be pursued through workshops, hearings, and internal deliberations as NCVHS develops recommendations for the Secretary. The subcommittees’ preliminary thinking is outlined below.

SUBCOMMITTEE ON QUALITY

Over the next two years, the NCVHS Subcommittee on Quality will focus on supporting the development of meaningful measures, leveraging both existing and emerging data sources (e.g., patient-generated data, remote monitoring, personal health records), and in particular identifying significant opportunities and gaps. Critical to meaningful measurement is the availability of relevant data elements that could be easily captured using certified EHR technology and functionality, among other tools. The Subcommittee on Quality will identify emerging health data needs for a health system where the individual engages in his or her health and health care. As a near-term priority, the Subcommittee will address the data needs of person-centered health and health care, emphasizing coordination and continuity of care across a continuum of services. A longer term goal is to develop a national strategy to leverage clinically rich health data to address important national questions about determinants of health and disease.

SUBCOMMITTEE ON PRIVACY, CONFIDENTIALITY AND SECURITY

The NCVHS Subcommittee on Privacy, Confidentiality and Security will focus its efforts on providing recommendations that support national priorities, in coordination with such groups as the ONC HIT Policy Committee’s Privacy and Security Workgroup. In the next year, the Subcommittee plans to develop recommendations regarding governance as well as a framework for the identification and appropriate management of sensitive data. The Subcommittee will also consider transparency and the role of patient consent. In addition, it will continue to review and make recommendations regarding new privacy, confidentiality, and security regulations; compliance with these regulations; and strategies for effective enforcement.

SUBCOMMITTEE ON STANDARDS

Health care reform legislation now provides a new opportunity to continue the administrative simplification that began under HIPAA―a process in which NCVHS will remain heavily involved. The NCVHS Subcommittee on Standards will continue to meet its responsibilities related to HIPAA; will implement the many administrative simplification responsibilities assigned by the Health Reform Act of 2010; and will meet new requests for recommendations on the use of standards to enhance interoperability of the transmission and semantics of health data as they arise. As we look to the future, several goals stand out with respect to standards. The Subcommittee will seek to ensure a comprehensive framework and roadmap for health information standards that support the national health IT strategic framework, vision and policy priorities; the public health policy agenda; the NCVHS proposed data stewardship framework; a national research agenda that includes comparative effectiveness; and the needs of all data users.

SUBCOMMITTEE ON POPULATION HEALTH

Understanding the population’s health and its determinants relies on multiple data sources, including population surveys, clinical data, administrative data (notably, birth and death records and billing data on use of health services), and public health and environmental reporting systems. At the national level, Federal agencies such as the National Center for Health Statistics are charged with developing methods, assessing validity, and reporting national population health information. As we envision building a comparable capacity for communities and states across America, the quality of information and its timeliness will be central to success. The Subcommittee on Population Health will focus on facilitators and barriers to data linkage at state and local levels as a critical part of health information infrastructure, specifically linking EHR data with existing administrative and local survey data. Fundamental to understanding population health is describing the underlying population, which also comprises those who have not seen a doctor recently or have refused to respond to a survey. The work of the Subcommittee will focus on methods to ensure that linked data sources provide valid health information, including methods to adjust for missing data and methods to protect privacy.

CMS Launches Official EHR Incentive Program Website: FAQs, Fact Sheet, Overview

The Electronic Health Record (EHR) Incentive Program Website is now available on CMS.gov!
Rec’d email from ONC on June 21, 2010
The Centers for Medicare & Medicaid Services (CMS) has launched the official website for the Medicare & Medicaid EHR Incentive Programs. This website provides the most up-to-date, detailed information about the EHR incentive programs.

“The Medicare and Medicaid EHR Incentive Programs will provide incentive payments to eligible professionals and hospitals as they adopt, implement, upgrade, or demonstrate meaningful use of certified EHR technology.”

Bookmark the new site and visit often to learn about who is eligible for the programs, how to register, meaningful use, upcoming EHR training and events, and much more!
http://www.cms.gov/EHRIncentivePrograms

Excerpted on June 21, 2010 from
The Official Web Site for the Medicare and Medicaid EHR Incentive Programs

The official web site provides up-to-date, detailed information about the Electronic Health Record (EHR) incentive programs. (On official site, there are  the tabs to the left to find additional information regarding various aspects of the program. On e-Healthcare Marketing, see the section below  called “EHR Incentive Programs Navigation” for other aspects of program.)

EHR Incentive Programs Navigation
The following program pages were published on June 18, 2010, contain  compilations of  links to most of the relevant  documents, and provide a central location to house future information.

Background
The nation’s healthcare system is undergoing a transformation in an effort to improve quality, safety and efficiency of care, from the upgrade to ICD-10 to information exchanges of EHR technology.   To help facilitate this vision, the Health Information Technology for Economic and Clinical Health Act, or the “HITECH Act” established programs under Medicare and Medicaid to provide incentive payments for the “meaningful use” of certified EHR technology.  The Medicare and Medicaid EHR incentive programs will provide incentive payments to eligible professionals and eligible hospitals as they  adopt, implement, upgrade or demonstrate meaningful use of certified EHR technology.  The programs begin in 2011. These incentive programs are designed to support providers in this period of Health IT transition and instill the use of EHRs in meaningful ways to help our nation to improve the quality, safety and efficiency of patient health care.

NOTE: This is a new program, and it is separate from other active CMS incentive programs, such as Physicians Quality Reporting Initiative (PQRI), Reporting Hospital Quality Data for Annual Payment Update (RHQDAPU) and e-Prescribing.

Establishing the New Program
CMS is establishing the EHR Incentive program through formal rule making. A proposed rule on the EHR incentive programs (and the definition of meaningful use) was published, and CMS accepted public comments for 60 days, which ended on March 15, 2010. More than 2,000 comments were received. CMS is currently working to develop and release the final rule in late spring/early summer 2010. This rule will provide many of the parameters and requirements for the Medicare & Medicaid EHR Incentive Programs. A copy of the proposed rule and related documents is accessible below in the Downloads and Links Inside CMS sections.

CMS’ Role in Other HITECH Areas
CMS is also working with the Office of the National Coordinator for Health Information Technology (ONC) in developing standards, implementation specifications, and certification criteria for EHR technology. More information on certification can be found in the tab on the left.  

Patient privacy and security is an important consideration in implementing the EHR incentive programs. CMS is also working with the Office for Civil Rights (OCR) and ONC to address the privacy and security protections under HITECH Act. More information on privacy and security related to the Health IT is available by clicking “Health IT/Privacy and Security” and “HHS Office for Civil Rights” in the Related Links Outside CMS section below.

Downloads
Most of these downloads are from 2009, with published rule in a  January 2010 Federal Register.
Fact Sheet: Medicare and Medicaid EHR Incentive Programs: Title IV of Recovery Act

Press Release: CMS and ONC Issue Regulations Proposing a Definition of “Meaningful Use” and Setting Standards for EHR Incentive Program

Copy of Published Proposed Rule for EHR Incentive Programs and Definition of Meaningful Use [7.37 MB] 

Fact Sheet: Proposed Requirements for Medicaid EHR Incentive Program

Fact Sheet: Proposed Requirements for Medicare EHR Incentive Program

Fact Sheet: Proposed Definition of Meaningful Use

Related Links Inside CMS
Health IT Frequently Asked Questions

Related Links Outside CMS
HHS/Office of National Coordinator Health IT Web Site

Health IT/Privacy and Security

HHS Office for Civil Rights

FACT SHEET from June 2009 (last year) contains much of the basic information with new information coming in June/July 2010.
EXCERPTED FROM CMS site on June 21, 2010

MEDICARE AND MEDICAID HEALTH INFORMATION TECHNOLOGY: TITLE IV OF THE AMERICAN RECOVERY AND REINVESTMENT ACT

Background

On Feb. 17, 2009, President Obama signed the American Recovery and Reinvestment Act of 2009 (Recovery Act), a critical measure to stimulate the economy.  Among other provisions, the new law provides major opportunities for the Department of Health and Human Services (DHHS), its partner agencies, and the States to improve the nation’s health care through health information technology (HIT) by promoting the meaningful use of electronic health records (EHR) via incentives. For a copy of the full bill, go to:  http://www.hhs.gov/recovery/overview/index.html

The HIT provisions of the Recovery Act are found primarily in Title XIII, Division A, Health Information Technology, and in Title IV of Division B, Medicare and Medicaid Health Information Technology.  These titles together are cited as the Health Information Technology for Economic and Clinical Health Act or the HITECH Act.  This fact sheet focuses on the provisions of Title IV only.

Funding
Under Title IV, funding is available to certain eligible professionals (EPs) and hospitals, as described below.  Funds will be distributed through Medicare and Medicaid incentive payments to EPs, physicians, and hospitals who are “meaningful EHR users.” In addition, with regard to the Medicaid program, federal matching funds are also available to States to support their administrative costs associated with these provisions.

Criteria for Qualifying for an Incentive
The qualification criteria for incentives (i.e., meeting specified HIT standards, policies, implementation specifications, timeframes, and certification requirements) are still in development, and will be defined through regulation and additional guidance materials.  However, CMS generally expects that under Medicare, “meaningful EHR users” would demonstrate each of the following: meaningful use of a certified EHR, the electronic exchange of health information to improve the quality of health care, and reporting on clinical quality and other measures using certified EHR technology.  Medicaid programs will determine their own requirements in line with the Medicaid-related provisions of the Recovery Act. Funds will be distributed through Medicare and Medicaid incentive payments to EPs and hospitals who are “meaningful EHR users.”  CMS intends to publish a proposed rule in late 2009 to propose a definition of meaningful use of certified Electronic Health Records (EHR) technology and establish criteria for the incentives programs.  CMS is working extensively with the Office of the National Coordinator for Health Information Technology (ONC) to identify the proposed criteria.

Medicare Payment Incentives for Eligible Professionals

  • The Recovery Act establishes financial incentives beginning in January 2011 for eligible professionals (EPs) who are meaningful EHR users.  Beginning in 2015, payment adjustments will be imposed on EPs who are not meaningful EHR users.
  • Hospital-based physicians who substantially furnish their services in a hospital setting are not eligible.
  • Incentive Payments
  • The incentive payment is equal to 75 percent of Medicare allowable charges for covered services furnished by the EP in a year, subject to a maximum payment in the first, second, third, fourth, and fifth years of $15,000; $12,000; $8,000; $4000; and $2,000, respectively.  For early adopters whose first payment year is 2011 or 2012, the maximum payment is $18,000 in the first year.
  • There will be no payments for meaningful EHR use after 2016.
  • There would be no payments to EPs who first become meaningful EHR users in 2015 or thereafter.
  • For EPs who predominantly furnish services in a health professional shortage area (HPSA), incentive payments would be increased by 10 percent. 
  • Payment Adjustments
  • The Medicare fee schedule amount for professional services provided by an EP who was not a meaningful EHR user for the year would be reduced by 1 percent in 2015, by 2 percent in 2016, by 3 percent for 2017 and by between 3 to 5 percent in subsequent years. 
  • For 2018 and thereafter, if the Secretary finds that the proportion of EPs who are meaningful EHR users is less than 75 percent, then the reductions will be increased by 1 percentage point each year, but by not more than 5 percent overall. 

Medicare Payment Incentives for Hospitals

  • Incentive payments are provided, beginning with October 2010, for eligible subsection (d) hospitals and critical access hospitals (CAHs) that are meaningful EHR users. Reduced payment updates beginning in FY 2015 will apply to eligible hospitals that are not meaningful EHR users.
  • An eligible hospital that is a meaningful EHR user could receive up to four years of financial incentives payments, beginning with fiscal year 2011. There will be no payments to hospitals that become meaningful EHR users after 2015. 
  • Incentive Payments for Hospitals
    • The incentive payment for each eligible hospital would be calculated based on the product of (1) an initial amount, (2) the Medicare share, and (3) a transition factor. 

(a)The initial amount is the sum of a $2 million base year amount plus a dollar amount based on the number of discharges for each eligible hospital.

(b)The Medicare share is a fraction based on estimated Medicare fee-for-service and managed care inpatient bed days divided by estimated total inpatient bed-days and modified by charges for charity care.

(c)The transition factor phases down the incentive payments over the four-year period.  The factor equals 1 for the first payment year, ¾ for the second payment year, ½ for the third payment year, and ¼ for the fourth payment year, and zero thereafter.

The Secretary has discretion to use other data if the required data to calculate the incentive payment formula does not exist. 

  • The transition factor is modified for those eligible hospitals that first become meaningful EHR users beginning in 2014.  Such hospitals would receive payments as if they became meaningful EHR users beginning in 2013 (i.e., if a hospital were to begin EHR meaningful use in 2014, the transition factor used for the year would be ¾ instead of 1, ½ for the second year, ¼ for the third year, and zero thereafter ).
  • o   For CAHs that are meaningful EHR users, reasonable costs for the purchase of certified EHR technology would be computed by expensing such costs in a single payment year, rather than depreciating them over time.  In addition, incentive payments for CAHs would be based on the Medicare share formula used for subsection (d) hospitals, plus 20 percentage points (not to exceed a total of 100 percent).  CAHs would receive a prompt interim payment for the Medicare share of such costs (subject to reconciliation). Payments would not be made with respect to a cost reporting period beginning during a payment year after 2015, and in no case would a CAH receive payment with respect to more than 4 consecutive payment years.
  • Market Basket Adjustments for Hospitals that are not Meaningful Users
    • Eligible subsection (d) hospitals that are not meaningful users for a fiscal year would receive a net reduction of ¼, ½, and ¾ of the market basket update that would apply in 2015, 2016, 2017 and thereafter, respectively.
    • The Secretary of HHS may, on a case-by-case basis, exempt a hospital if requiring the hospital to be a meaningful EHR user would result in a significant hardship.
    •   Eligible CAHs that are not meaningful EHR users for a fiscal year and otherwise would be paid at 101 percent of reasonable costs are subject to the following payment adjustments: in FY2015, reimbursement for inpatient services at 100.66 percent of reasonable costs; in FY2016, reimbursement for inpatient services at 100.33 percent of reasonable costs; and in FY2017 and each subsequent year, 100 percent of reasonable costs..

Medicaid Payment Incentives
The Recovery Act establishes 100 percent Federal Financial Participation (FFP) for States to provide incentive payments to eligible Medicaid providers to purchase, implement, and operate (including support services and training for staff) certified EHR technology.  It also establishes 90 percent FFP for State administrative expenses related to carrying out this provision. 

Incentive Payments to Providers

  • Certain classes of Medicaid professionals and hospitals are eligible for incentive payments to encourage the adoption and use of certified EHR technology.  Eligible professionals include physicians, dentists, certified nurse-midwives, nurse practitioners, and physician assistants who are practicing in Federally Qualified Health Centers (FQHCs) or Rural Health Clinics (RHCs) led by a physician assistant. 
  • Eligible professionals must meet minimum Medicaid patient volume percentages, and must waive rights to duplicative Medicare EHR incentive payments.  Eligible professionals may receive up to 85 percent of the net average allowable costs for certified EHR technology, including support and training (determined on the basis of studies that the Secretary will undertake), up to a maximum level, and incentive payments are available for no more than a 6-year period.  
  • Acute care hospitals with at least 10 percent Medicaid patient volume would also be eligible for payments, as would children’s hospitals of any patient volume. Entities that promote the adoption of certified EHR technology, as designated by the State, are also eligible to receive incentive payments through arrangements with eligible professionals under certain conditions.

Medicaid Incentive Program Qualifications

To be eligible for incentive payments not associated with the initial adoption/implementation/upgrade of EHR technology, the provider must demonstrate meaningful use of the EHR technology through a means approved by the State and acceptable to the Secretary.  In determining what is “meaningful use,” a State must ensure that populations with unique needs, such as children, are addressed.  A State may also require providers to report clinical quality measures as part of the meaningful use demonstration.  In addition, to the extent specified by the Secretary, the EHR technology must be compatible with State or Federal administrative management systems.

EPs may not receive an incentive under both Medicare and Medicaid in a given year.  CMS and the States will develop means to prevent such duplicate payments.  CMS expects that the prevention of duplicative payments will be addressed more fully through notice and comment rulemaking. 

Frequently Asked Questions (FAQs)

Question:  When will the Centers for Medicare & Medicaid Services (CMS) publish regulations to define certified Electronic Health Records and “meaningful use?”

Answer: CMS intends to publish a proposed rule in late 2009 to define meaningful use of certified Electronic Health Records (EHR) technology and establish criteria for the incentives programs.  We are working extensively with the Office of the National Coordinator for Health Information Technology(ONC) to identify the proposed criteria.

Question: What is CMS’ overall time frame for actions and activities related to the incentive program?

Answer: Although further details will be developed, CMS can provide the following timeline based on the current implementation plan: 

Date Milestone
2009
  • Coordinate with ONC to develop policies such as the definition of meaningful use
  • Develop proposed rules to allow public input to the incentive program policies
  • Plan systems and other requirements needed to support the incentives programs
  • Plan national outreach program
2010
  • Conduct outreach to eligible professionals and providers and to State Medicaid Agencies
  • Develop systems to support the payment of incentives
  • Develop final rules to establish policies needed to pay incentives
  • Develop systems to monitor and evaluate incentive payments
No sooner than October 2010 Start to pay hospital incentives for Medicare and monitor payments
No sooner than January 2011
  • Start to pay eligible professionals for Medicare and monitor payments
  • Begin and monitor Medicaid incentive payments to eligible professionals and hospitals
2011 – 2016 Continue paying hospital incentives for Medicare and monitor payments
2011 – 2016 Continue paying eligible professionals incentives for Medicare and monitor payments
2011 – 2021 Continue paying Medicaid incentives to eligible professionals and hospitals and monitor payments
2015 and thereafter Initiate payment reductions to Medicare hospitals and eligible professionals that fail to adopt EHRs

 

Question:  When will the Centers for Medicare & Medicaid Services (CMS) begin to pay incentives to eligible professionals and hospitals for using certified Electronic Health Records ( EHRs)?

Answer:  By statute, the earliest dates that CMS will be able to pay an incentive under Medicare is October 1, 2010, for hospitals and January 1, 2011, for eligible professionals. 

The statute does not define a date for the Medicaid incentives program.  Given the range of regulatory and planning activities that must precede States being able to make provider incentive payments, as well as the importance of coordinating Medicaid and Medicare payments to prevent duplication, CMS does not expect that States will be able to make such payments until 2011. 

Work is underway to define the meaningful EHR user criteria, as well as the requirements for applying for and receiving the EHR payment incentives, CMS expects to issue a proposed rule in late 2009. 

Question:  If an eligible professional uses a certified Electronic Health Record (EHR) in a meaningful way in accordance with the adopted regulations, and meets the requirements established by CMS, could that professional receive both the Medicare EHR payment incentive as well as the Medicaid EHR payment incentive? 

Answer:  No, an eligible professional may only receive an EHR payment under either Medicare or Medicaid.  CMS expects to more fully address the issue of duplicative payments under Medicare and Medicaid through rulemaking. 

Question:  If I already have an Electronic Health Record (EHR) that has been certified by the Certification Commission for Healthcare Information Technology (CCHIT), will I have to buy a new system if the government mandates that only EHRs that meet a higher certification level are considered certified EHRs? 

Answer:  Decisions about EHR standards, implementation specifications and certification criteria have not been made yet, and are under development.   Policies will be proposed in the regulation to be published in late 2009.

Question:  What is the maximum incentive an eligible professional can earn for using an Electronic Health Record under Medicaid?

Answer:  The statute does not define fixed amounts for the incentive payments, only ceilings that cannot be exceeded.  CMS expects that the actual payment amounts will be more fully addressed through notice and comment rulemaking.

Question:  What is the maximum Electronic Health Record(EHR) incentive an eligible professional can earn under Medicare?

Answer:  Eligible professionals(EPs), who adopt Electronic Health Records as early as 2011 or 2012 may be eligible for up to $44,000 in Medicare incentive payments spread out over five years (increased by 10 percent for EPs who predominantly furnish services in a health professional  shortage area).

Question:  What if my Electronic Health Record (EHR) system costs much more than the incentive the government will pay?  May I request additional funds? 

Answer:  The Recovery Act does not provide for incentive payments under Medicare or Medicaid beyond the limits established by the legislation, regardless of the cost of the EHR system chosen by eligible professionals or hospitals.  With regard to Medicaid, the purpose of the 100 percent FFP provider incentive payments to certain eligible Medicaid providers is to encourage the adoption and meaningful use of certified EHR technology.  While the incentive payments are expected to be used for certified EHR technology and support services, including maintenance and training necessary for the adoption and operation of such technology, the incentive payments are not direct reimbursement for such activities, but rather are intended to serve as an incentive for eligible professionals and hospitals to adopt and meaningfully use certified EHR technology

Question:  What is the earliest date the payment adjustments will start to be imposed for eligible professionals and hospitals that are not meaningful Electronic Health Record (EHR) users under the HITECH provisions of the Recovery Act?

Answer:  The HITECH provisions of the Recovery Act establish 2015 as the first year that payment adjustments will start to be imposed on Medicare eligible professionals and hospitals that are not meaningful EHR users.  There are no payment adjustments associated with the Medicaid provisions under Section 4201.

Question:  How will eligible providers and hospitals apply for incentives if they are using certified Electronic Health Records (EHRs) in accordance with the standards established by Health and Human Services (HHS) under the HITECH portion of the Recovery Act?

Answer:  The Department of Health and Human Services (HHS) will publish a rule establishing the criteria which eligible professionals and hospitals must meet in order to qualify for the EHR incentive payments, including defining meaningful EHR users.  The rule will also explain how to apply for those incentives. 

Question:  How will the public know who has received incentive payments under the Recovery Act?

Answer:  CMS will post the names of those receiving Medicare incentives online.  The list will include the elements identified in the Recovery Act: name, business addresses, and business phone number of all Medicare eligible professionals and hospitals who received incentive payments under the Recovery Act.  There is no such requirement for CMS to publish the names of those receiving Medicaid incentive payments under Section 4201 though States may opt do so.

Question:   What will be done to help prepare providers to take advantage of the incentive payments for the meaningful use of an Electronic Health Record (EHR)?

Answer:  A set of supportive programs will be announced after CMS publishes a proposed rule in late 2009, that is, regarding a definition of meaningful use of certified EHR technology and criteria for the incentives programs.  These programs are intended to educate and support providers, enable health information exchange, and build the workforce that will be needed for success. Information about these supportive efforts will be communicated to eligible providers through many channels.