ONC Site Map Updated in Conjunction with New Health IT Unified Theme

“Connecting America for Better Health” – ONC for HIT
Web Site Map for Office of the National Coordinator for Health IT
On August 27, 2010, the Office of National Coordinator (ONC) for Health IT announced a new “unified identity for Health IT”  which includes a “new theme and visual identity” for the ONC Web site and ONC and can be seen at the top of ONC Web pages.

The site map below for  ONC’s Web site is pulled primarily from the left navigation bar on the ONC site with some additional links to key areas. [Please send any corrections or comments to e-Healthcare Marketing. This is an update to a previous site map posted on February 16, 2010 on e-Healthcare Marketing, including new workgroups.]

While the visible structure of the Web site remains mainly the same, the home page and much of the underlying architecture appears to have been updated to simplify access to users, highlight new and important content, and simplify the addition of new information anticipated to come soon, such as announcements of the  Authorized Testing and Certification Bodies (ATCB) and Certified EHRs and EHR Modules.

The new theme and identity ”really captures the spirit of these combined efforts to boost national adoption of electronic health records and ensure success. The insignia will also help people easily identify and connect with official HITECH information, resources, programs, and partners,” wrote Communucations Director Peter Garrett on the Health IT Buzz blog on August 27, 2010. Now to the site map.

DERIVED SITE MAP FOR  http://healthit.hhs.gov

FEATURED AREAS
          Meaningful Use
          Certification Program
          Privacy and Security
          HITECH Programs
          On the Frontlines of Health Information Technology
               NEJM Articles: Dr. Blumenthal
                                             Dr. Benjamin
          Federal Advisory Committees

Top Banner Links
          Get email updates from ONC
          Follow ONC on Twitter

HITECH & FUNDING Opportunities
          Contract Opportunities
          Learn about HITECH
          HIT Extension Program — Regional Extension Centers Program
          Beacon Community Program

HITECH PROGRAMS
     State Health Information Exchange Cooperative Agreement Program
     Health Information Technology Extension Program
     Strategic Health IT Advanced Research Projects (SHARP) Program
     Community College Consortia to Educate HIT Professionals Program
     Curriculum Development Centers Program
     Program of Assistance for University-Based Training
     Competency Examination Program
     Beacon Community Program

FEDERAL ADVISORY COMMITTEES
                  (Meeting Calendar At-A-Glance)

HEALTH IT POLICY COMMITTEE
HIT Policy Committee Meetings
          Meeting Webcast & Participation
         
Upcoming Meetings
         
Past Meetings
HIT Policy Committee Recommendations
HIT Policy Committee Workgroups
          Meaningful Use
          Certification/Adoption
          Information Exchange
          Nationwide Health Information Network (NHIN)
          Strategic Planning
          Privacy & Security Policy
          Enrollment
          Privacy & Security Tiger Team
          Governance
          Quality Measures

HEALTH IT STANDARDS COMMITTEE
Health IT Standards Committee Meetings
          Meeting Webcast & Participation
         
Upcoming Meetings
         
Past Meetings
HIT Standards Committee Recommendations
HIT Standards Committee Workgroups
          Clinical Operations
          Clinical Quality
          Privacy & Security
          Implementation
          Vocabulary Task Force
          

REGULATIONS & GUIDANCE     
           Meaningful Use
           Privacy and Security
           Standards and Certification
            
ONC INITIATIVES
          State-Level Health Initiatives 
          Nationwide Health Information Network
          Federal Health Architecture
          Adoption
          Clinical Decision Support & the CDS Collaboratory
         
          Events
                 FACA Meeting Calendar
          Fact Sheets
          Reports
          Federal Health IT Programs
          Technical Expert Workshops
          Acronyms
          Glossary

OUTREACH, EVENTS, & RESOURCES
         News Releases (2007 – Present)
         Events
         FACA Meeting Calendar
         Fact Sheets
         Reports 
         Federal Health IT Programs
         Technical Expert Workshops
         Acronyms 
         Glossary

ABOUT ONC
          Coordinator’s Corner: Updates from Dr. Blumenthal
          Organization               
          Budget & Performance
          Contact ONC and Job Openings
#                             #                     #

For a review of the new look and feel of the ONC site, see an earlier post on e-Healthcare Marketing.

Privacy and Security Tiger Team’s Recommendations in Full Text

Health IT Policy Committee Approves Tiger Team Recommendations
Mary Mosquera reported in Government HealthIT reported on August 20, 2010
“The Health & Human Services Department Health IT Policy Committee endorsed a set of recommendations on when health care providers must obtain consent before exchanging patient heath records electronically with other clinicians, testing labs or health information exchange (HIE) networks.”

Here’s the full-text version of the Tiger Team’s recommendations to the Health IT Policy Committee, which the committee approved and sent on to the Office of the National Coordinator (ONC) for Health IT.
PDF Version
HTML Version below:

August 19, 2010

David Blumenthal, MD, MPP
Chair, HIT Policy Committee
U.S. Department of Health and Human Services
Washington, D.C. 20201

Dear Mr. Chairman:

An important strategic goal of the Office of the National Coordinator (ONC) is to build public trust and participation in health information technology (IT) and electronic health information exchange by incorporating effective privacy and security into every phase of health IT development, adoption, and use.

A Privacy and Security “Tiger Team,” formed under the auspices of the HIT Policy Committee, has met regularly and intensely since June to consider how to achieve important aspects of this goal.

The Tiger Team has focused on a set of targeted questions raised by the ONC regarding the exchange of personally identifiable health information required for doctors and hospitals to qualify for incentive payments under Stage I of the Electronic Health Records Incentives Program.

This letter details the Tiger Teamʼs initial set of draft recommendations for the HIT Policy Committeeʼs review and approval.

Throughout the process, the HIT Policy Committee has supported  the overall direction of the Tiger Teamʼs evolving recommendations, which have been discussed in presentations during regular Policy Committee meetings this summer. There has always been an understanding, however, that the Tiger Team would refine its work and compile a set of formal recommendations at the end of summer for the HIT Policy Committeeʼs final review and approval.

It bears repeating: The following recommendations apply to electronic exchange of patient identifiable health information among known entities to meet Stage I of “meaningful use — the requirements by which health care providers and hospitals will be eligible for financial incentives for using health information technology. This includes the exchange of information for treatment and care coordination, certain quality reporting to the Centers for Medicare & Medicaid Services (CMS), and certain public health reporting.

Additional work is needed to apply even this set of initial recommendations specifically to other exchange circumstances, such as exchanging data with patients and sharing information for research. We hope we will be able to address these and other key questions in the months to come.

Most importantly, the Tiger Team recommends an ongoing approach to privacy and security that is comprehensive and firmly guided by fair information practices, a well-established rubric in law and policy. We understand the need to address ad hoc questions within compressed implementation time frames, given the statutory deadlines of the EHR Incentives Program. However, ONC must apply the full set of fair information practices as an overarching framework to reach its goal of increasing public participation and trust in health IT.

I. FAIR INFORMATION PRACTICES AS THE FOUNDATION
Core Tiger Team Recommendation:
All entities involved in health information exchange – including providers (1)
and third party service providers like Health Information Organizations (HIOs) and other intermediaries – should follow the full complement of fair information practices when handling personally identifiable health information.

Fair information practices, or FIPs, form the basis of information laws and policies in the United States and globally. This overarching set of principles, when taken together, constitute good data stewardship and form a foundation of public trust in the collection, access, use, and disclosure of personal information.

We used the formulation of FIPs endorsed by the HIT Policy Committee and adopted by ONC in the Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information. (2)  The principles in the Nationwide Framework are:
———————————–
(1) Our recommendations are intended to broadly apply to both individual and institutional providers.
(2) http://healthit.hhs.gov/portal/server.pt/gateway/PTARGS_
0_10731_848088_0_0_18/NationwidePS_Framework-5.pdf

——————————————–
            • Individual Access – Individuals should be provided with a simple and timely means to access and obtain their individually identifiable health information in a readable form and format.           

            • Correction – Individuals should be provided with a timely means to dispute the  accuracy or integrity of their individually identifiable health information, and to have  erroneous information corrected or to have a dispute documented if their requests are denied.           

            • Openness and Transparency – There should be openness and transparency    about policies, procedures, and technologies that directly affect individuals and/or their individually identifiable health information.           

            • Individual Choice – Individuals should be provided a reasonable opportunity and  capability to make informed decisions about the collection, use, and disclosure of  their individually identifiable health information. (This is commonly referred to as the individualʼs right to consent to identifiable health information exchange.)          

            • Collection, Use, and Disclosure Limitation – Individually identifiable health      information should be collected, used, and/or disclosed only to the extent necessary         to accomplish a specified purpose(s) and never to discriminate inappropriately.           

            • Data Quality and Integrity – Persons and entities should take reasonable steps to         ensure that individually identifiable health information is complete, accurate, and up-    to-date to the extent necessary for the personʼs or entityʼs intended purposes and     has not been altered or destroyed in an unauthorized manner.          

            • Safeguards – Individually identifiable health information should be protected with           reasonable administrative, technical, and physical safeguards to ensure its  confidentiality, integrity, and availability and to prevent unauthorized or inappropriate   access, use, or disclosure.           

            • Accountability – These principles should be implemented, and adherence  assured, through appropriate monitoring and other means and methods should be in   place to report and mitigate non-adherence and breaches.

The concept of remedies or redress — policies formulated in advance to address situations where information is breached, used, or disclosed improperly — is not expressly set forth in this list (although it is implicit in the principle of accountability). As our work evolves toward a full complement of privacy policies and practices, we believe it will be important to further spell out remedies as an added component of FIPs.

We also note that in a digital environment, robust privacy and security policies should be bolstered by innovative technological solutions that can enhance our ability to protect information. This includes requiring that electronic record systems adopt adequate security protections (like encryption, audit trails, and access controls), but it also extends to decisions about infrastructure and how health information exchange will occur, as well as how consumer consents will be represented and implemented. The Tiger Teamʼs future work will need to address the role of technology in protecting privacy and security.

 II. CORE VALUES  

In addition to a firm embrace of FIPs, the Tiger Team offers the following set of Core Values to guide ONCʼs work to promote health information technology:

             • The relationship between the patient and his or her health care  provider isthe foundation for trust in health information exchange, particularly with  respect to protecting the confidentiality of personal health information.           

             • As key agents of trust for patients, providers are responsible for  maintaining the privacy and security of their patientsʼ records.           

              • We must consider patient needs and expectations. Patients should not  be surprised about or harmed by collections, uses, or disclosures of  their  information.Ultimately, to be successful in the use of health information exchange  to  improve health and health care, we need to earn the trust of both consumers    and physicians.

III. SPECIFIC RECOMMENDATIONS REQUESTED

ONC has asked the Tiger Team for specific recommendations in the following areas:

            • Use of intermediaries or third party service providers in identifiable health  information exchange;

            • Trust framework to allow exchange among providers for purpose of treating  patients;

            • Ability of the patient to consent to participation in identifiable health information  exchange at a general level (i.e., yes or no), and how consent should be  implemented;

            • The ability of technology to support more granular patient consents (i.e., authorizing  exchange of specific pieces of information while excluding other records); and

            • Additional recommendations with respect to exchange for Stage I of Meaningful Use – treatment, quality reporting, and public health reporting.

All of our recommendations and deliberations have assumed that participating individuals and entities are in compliance with applicable federal and state privacy and security laws.

We evaluated these questions in light of FIPs and the core values discussed above.

1.    Policies Regarding the Use of Intermediaries/Third Party Service Providers/ Health Information Organizations (HIOs)

In the original deliberations of the Privacy and Security Work Group of the HIT Policy Committee, we concluded that directed exchange among a patientʼs treating providers – the sending of personally identifiable health information from “provider A to provider B” – is generally consistent with patient expectations and raises fewer privacy concerns, assuming that the information is sent securely.

However, the Tiger Team recognized that a number of exchange models currently in use are known to involve the use of intermediaries or third party organizations that offer valuable services to providers that often facilitate the effective exchange of identifiable health information (“third party service organizations”). A common example of a third party service organization is a Health Information Organization (HIO) (as distinguished from the term “health information exchange” (HIE), which can be used to refer to information exchange as a verb or a noun.) The exposure of a patientʼs personally identifiable health information to third party service organization raises risk of disclosure and misuse, particularly in the absence of clear policies regarding that organizationʼs right to store, use, manipulate, re-use or re-disclose information.

Our recommendations below regarding third party service organizations aim to address the following fair information practices:           

             Individual Access
            Correction
✔        Openness and Transparency 
            Individual Choice
✔        Collection, Use, and Disclosure Limitation
             
Data Quality and Integrity Safeguards
✔        Accountability

Tiger Team Recommendation 1: With respect to third-party service organizations:

                    Collection, Use and Disclosure Limitation: Third party service organizations   may not collect, use or disclose personally identifiable health information for   any purpose other than to provide the services specified in the business   associate or service agreement with the data provider, and necessary  administrative functions, or as required by law.

                      Time limitation: Third party service organizations may retain personally identifiable health information only for as long as reasonably necessary to  perform the functions specified in the business associate or service agreement  with the data provider, and necessary administrative functions.

                        Retention policies for personally identifiable health information must be established,   clearly disclosed to customers, and overseen. Such data must besecurely returned or destroyed at the end of the specified retention period, according to established NIST standards and conditions set forth in the business associate or service agreement.

                      Openness and transparency: Third party service organizations should be obligated to disclose in their business associate or service agreements with  their customers how they use and disclose information, including without   limitation their use and disclosure of de-identified data, their retention policies   and procedures, and their data security practices.(3)

            • Accountability: When such third party service organizations have access to  personally identifiable health information, they must execute and be bound by  business associate agreements under the Health Insurance Portability and   Accountability Act regulations (HIPAA). (4) However, itʼs not clear that those agreements have historically been sufficiently effective in limiting a third-partyʼs use or disclosure of identifiable information, or in providing the required transparency.

               • While significant strides have been made to clarify how business associates  may access, use and disclose information received from a covered entity, business associate agreements, by themselves, do  not address the full complement of governance issues, including oversight,
——————————————-
(3) This is the sole recommendation in this letter that also applies to data that qualifies as de-identified under HIPAA. The “Tiger Team” intends to take up de-identified data in a more comprehensive way in subsequent months.
(4)  45 CFR 164.504(e).
———————————–
accountability, and enforcement. We recommend that the HIT Policy  Committee oversee further work on these governance issues.

2. Trust Framework For Exchange Among Providers for Treatment

The issue of provider identity and authentication is at the heart of even the most basic exchange of personally identifiable health information among providers for purposes of a patientʼs treatment. To an acceptable level of accuracy, Provider A must be assured that the information intended for provider B is in fact being sent to provider B; that providers on both ends of the transaction have a treatment relationship with the subject of the information; and that both ends are complying with baseline privacy and security policies, including applicable law.

Our recommendations below regarding trusted credentialing aim to address the following fair information practices:
           
Individual Access Correction
✔        Openness and Transparency 
            Individual Choice Collection, Use, and Disclosure Limitation
✔        Data Quality and Integrity 
            Safeguards    
✔        Accountability

 Tiger Team Recommendation 2.1:

            • Accountability: The responsibility for maintaining the privacy and security of        a patientʼs record rests with the patientʼs providers, who may delegate    functions such as issuing digital credentials or verifying provider identity, as  long as such delegation maintains this trust.  

                        o To provide physicians, hospitals, and the public with an acceptable  level of accuracy and assurance that this credentialing responsibility is  being delegated to a “trustworthy” organization, the federal government   (ONC) has a role in establishing and enforcing clear requirements about     the credentialing process, which must include a requirement to validate   the identity of the organization or individual requesting a credential.

                         o State governments can, at their option, also provide additional rules  for credentialing service providers so long as they meet minimum  federal requirements.  

We believe further work is necessary to develop policies defining the appropriate level of assurance for credentialing functions, and we hope to turn to this work in the fall. A trust framework for provider-to-provider exchange also must provide guidance on acceptable levels of accuracy for determining whether both the sending and receiving provider each have a treatment relationship with the person who is the subject of the information being exchanged. Further, the trust framework should require transparency as to whether both senders and recipients are subject to baseline privacy and security policies. We offer the following recommendations on these points:

Tiger Team Recommendation 2.2:  

Openness and transparency: The requesting provider, at a minimum, should provide attestation of his or her treatment relationship with the individual who is subject of the health information exchange.  

Accountability: Providers who exchange personally identifiable health information should comply with applicable state and federal privacy and security rules. If a provider is not a HIPAA-covered entity or business associate, mechanisms to secure enforcement and accountability may include:  

o Meaningful user criteria that require agreement to comply with the HIPAA Privacy and Security Rules;  

o NHIN conditions of participation;  

o Federal funding conditions for other ONC and CMS programs; and  

o Contracts/Business Associate agreements that hold all participants to HIPAA, state laws, and any other policy requirements (such as those that might be established as the terms of participation).

Openness and transparency: Requesting providers who are not covered by HIPAA should disclose this to the disclosing provider before patient information is exchanged.  

3.    Right of the patient or provider to consent to identifiable health information       exchange at a general level — and how are such consents implemented

The Tiger Team was asked to examine the role that one of the fair information practices – individual choice or patient consent – should play in health information exchange. The recommendations cover the role of consent in directed exchange, triggers for when patient consent should be required (beyond what may already be required by law), the form of consent, and how consent is implemented. We also set forth recommendations on whether providers should be required to participate in certain forms of exchange. We must emphasize that looking at one element of FIPs in isolation is not optimal and our deliberations have assumed strong policies and practices in the other elements of FIPs required to support the role of individual consent in protecting privacy. 

            Our recommendations below regarding patient consent aim to address the following fair information practices:

            Individual Access 
  
          Correction            
            Openness and Transparency
✔        Individual Choice
          
Collection, Use, and Disclosure Limitation
         
 Data Quality and Integrity  
           Safeguards 
           Accountability

 A.   Consent and Directed Exchange

 Tiger Team Recommendation 3.1:

            • Assuming FIPs are followed, directed exchange for treatment does not  require patient consent beyond what is required in current law or what has been customary practice.

 Our recommendation about directed exchange is not intended to change the patient-provider relationship or the importance of the providerʼs judgment in evaluating which parts of the patient record are appropriate to exchange for a given purpose. The same considerations and customary practices that apply to paper or fax exchange of patient health information should apply to direct electronic exchange. As always, providers should be prepared and willing to discuss with patients how their information is disclosed; to take into account patientsʼ concerns for privacy; and also ensure the patient understands the information the receiving provider or clinician will likely need in order to provide safe, effective care.

B. Trigger for Additional Patient Consent
     Tiger Team Recommendation 3.2: 
 

      •     When the decision to disclose or exchange the patientʼs identifiable health  information from the providerʼs record is not in the control of the provider or  that providerʼs organized health care arrangement (“OHCA”), (5) patients   should be able to exercise meaningful consent to their participation. ONC    should promote this policy through all of its levers.  

            •   Examples of this include:  

                        o A health information organization operates as a centralized model, which retains identifiable patient data and makes that information available to other parties.  

                        o A health information organization operates as a federated model and                                 exercises control over the ability to access individual patient data.            

                        o Information is aggregated outside the auspices of the provider or OHCA and comingled with information about the patient from other    sources.
___________________________
(5)
Organized health care arrangement (45 CFR 160.103) means: (1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider; (2) An organized system of health care in which more than one covered entity participates and in which the participating covered entities: (i) Hold themselves out to the public as participating in a joint arrangement; and (ii) Participate in joint activities that include at least one of the following: (A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf; (B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or (C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk. [provisions applicable to health plans omitted]
___________________________

             • As we have noted previously, the above recommendation on consent applies  to Stage 1 Meaningful Use (thus, if consent applies, it applies to exchange for    treatment). We will need to consider potential additional triggers when we start  to discuss exchange beyond Stage One of Meaningful Use.  

            An important feature of meaningful consent criteria, outlined further below, is  that the patient be provided with an opportunity to give meaningful consent    before the provider releases control over exchange decisions. If the patient does not consent to participate in an HIO model that “triggers” consent, the   provider should, alternatively, exchange information through directed    exchange. There are some HIOs that offer multiple services. The provider may still contract with an HIO to facilitate directed exchange as long as the      arrangement meets the requirements of recommendation 1 of this letter.

C. Form of Consent

Consent in our discussions refers to the process of obtaining permission from an individual to collect, use or disclose her personal information for specified purposes. It is also an opportunity to educate consumers about the decision, its potential benefits, its boundaries, and its risks.

While the debate about consent often devolves into a singularly faceted discussion of opt-in or opt-out, we have come to the conclusion that both opt-in and opt-out can be implemented in ways that fail to permit the patient to give meaningful consent. For example, consider the case in which patients are provided with opt-in consent, but the exercise of consent and education about it are limited – the registration desk provides the patient with a form that broadly describes all HIO uses and disclosures and the patient is asked to check a box and consent to all of it. As another example, consider the case in which patients have a right to opt-out – but the patient is not provided with time to make the decision and information about the right or how to exercise it can only be found in a poster in the providerʼs waiting room or on a page of the HIOʼs website. It would jeopardize the consumer trust necessary for HIOs to succeed to simply provide guidance to use “opt-in” or “opt-out” without providing additional guidance to assure that the consent is meaningful.

Tiger Team Recommendation 3.3: Meaningful Consent Guidance When Trigger Appliesʼs consent is “triggered,” such consent must be meaningful (6) in that it:

In a circumstance where patient

            Allows the individual advanced knowledge/time to make a decision. (e.g., outside of the urgent need for care.)          

            • Is not compelled, or is not used for discriminatory purposes. (e.g., consent to participate in a centralized HIO model or a federated HIO model is not a  condition of receiving necessary medical services.)

            • Provides full transparency and education. (i.e., the individual gets a clear   explanation of the choice and its consequences, in consumer-friendly language that is conspicuous at the decision-making moment.)

            • Is commensurate with the circumstances. (I.e., the more sensitive, personally  exposing, or inscrutable the activity, the more specific the consent   mechanism. Activities that depart significantly from patient reasonable    expectations require greater degree of education, time to make decision,  opportunity to discuss with provider, etc.)

            • Must be consistent with reasonable patient expectations for privacy, health, and safety; and

            • Must be revocable. (i.e., patients should have the ability to change their consent preferences at any time. It should be clearly explained whether such    changes can apply retroactively to data copies already exchanged, or whether  they apply only “going forward.”)

 D. Consent Implementation Guidance

Further considerations for implementation includes the following guidance:

Tiger Team Recommendation 3.4 :

            • Based on our core values, the person who has the direct, treating    relationship with the individual, in most cases the patientʼs provider, holds the    trust relationship and is responsible for educating and discussing with
————————————————–
(6)
http://www.connectingforhealth.org/phti/reports/cp3.html
————————————————–
 patients about how information is shared and with whom.            • Such education should include the elements required for meaningful choice, as well as understanding of the “trigger” for consent (i.e., how information is being accessed, used and disclosed).            • The federal government has a significant role to play and a responsibility to educate providers and the public (exercised through policy levers).            • ONC, regional extension centers, and health information organizations  should provide resources to providers, model consent language, and educational materials to demonstrate and implement meaningful choice. HIOs  should also be transparent about their functions/operations to both providers  and patients.            • The provider/provider entity is responsible for obtaining and keeping track of  patient consent (with respect to contribution of information from their records.) However, the provider may delegate the management/administrative functions to a third party (such as an HIO), with appropriate oversight.The Tiger Team was asked whether providers should have a choice about participating in exchange models.

E. Provider Consent to Participate in Exchange

Tiger Team Recommendation 3.5: Yes! Based on the context of Stage I Meaningful Use, which is a voluntary program, ONC is not requiring providers to participate in any particular health information exchange.Our recommendations below regarding granular consent aim to address the           following fair information practices:Individual Access                  
                        Correction
                        Openness and Transparency
           
✔        Individual Choice
                       
Collection, Use, and Disclosure Limitation
                        Data Quality and Integrity
                        Safeguards
                        Accountability
In making recommendations about granular consent and sensitive data, we have the following observations:

4. The current ability of technology to support more granular patient consents.

            • All health information is sensitive, and what patients deem to be sensitive is likely to be dependent on their own circumstances.

            • However, the law recognizes some categories of data as being more sensitive than others.            

            • Unless otherwise required by law and consistent with our previous recommendation 3.1, with respect to directed exchange for treatment, the presence of sensitive data  in the information being exchanged does not trigger an additional requirement to  obtain the patientʼs consent in the course of treating a patient.

            • Our recommendations on consent do not make any assumptions about the capacity for an individual to exercise granular control over their information. But since this capability is emerging and its certainly fulfills the aspiration of individual control, we  sought to understand the issue in greater depth.

            • The Tiger Team considered previous NVHS letters and received a presentation of  current NCVHS efforts on sensitive data. We also held a hearing on this topic to try to understand whether and how current EHR technology supports the ability for patients to make more granular decisions on consent – in particular, to give consent to the providers to transmit only certain parts of their medical record.

            • We learned that many EHR systems have the capability to suppress psychotherapy notes (narrative). We also learned that some vendors offer the individual the ability to suppress specific codes. We believe this is promising. With greater use and demand, this approach could possibly drive further innovations.

            • We also note, however, that the majority of witnesses with direct experience in    offering patients the opportunity for more granular control indicated that most patients (7) agreed to the use of their information generally and did not exercise   granular consent options when offered the opportunity to do so. The Tiger Team also learned that the filtering methodologies are still evolving and improving, but that challenges remain,
————————————
(7) Witnesses offered estimates of greater than 90%.
——————————————–
 particularly in creating filters that can remove any associated or related information  not traditionally codified in standard or structured ways.

            • While it is common for filtering to be applied to some classes of information by commercial applications based on contractual or legal requirements, we understand that most of the commercial EHR systems today do not provide this filtering capability at the individual patient level. There are some that have the capability to allow the user to set access controls by episode of care/encounter/location of  encounter, but assuring the suppression of all information generated from a particular episode (such as prescription information) is challenging.

            • Preventing what may be a downstream clinical inference is clearly a remaining   challenge and beyond the state of the art today. Even with the best filtering it is hard to guarantee against “leaks.”

            • The Tiger Team believes that methodologies and technologies that provide filtering capability are important in advancing trust and should be further explored. There are several efforts currently being piloted in various stages of development. We believe   communicating with patients about these capabilities today still requires a degree of  caution and should not be over sold as fail-proof, particularly in light of the reality of             downstream inferences and the current state of the art with respect to free text.    Further, communicating to patients the potential implications of fine-grained filtering  on care quality remains a challenge.

            • We acknowledge that even in the absence of these technologies, in very sensitive cases there are instances where a completely separate record may be maintained and not released (abortion, substance abuse treatment, for example). It is likely that  these practices will continue in ways that meet the expectations and needs of  providers and patients.

            • In our ongoing deliberations, we discussed the notion of consent being bound to the data such that it follows the information as it flows across entities. We know of no    successful large-scale implementation of this concept in any other sector (in that it achieved the desired objective), including in the case of digital rights management   (DRM) for music. Nonetheless, we understand that work is being done in this emerging area of technology, including by standards organizations.

            • While popular social networking sites are exploring allowing users more granular control (such as Facebook), the ability of individuals to exercise this capability as     intended is still unclear.(8) In addition, the data that
————————————–
(8) See http://www.nytimes.com/2010/05/13/technology/personaltech/13basics.html  and http://www.nytimes.com/interactive/2010/05/12/business/facebook-privacy.html .
————————————-

                        populates a Facebook account is under the userʼs control and the user has unilateral access to it. Health data is generated and stored by myriad of entities in addition to the patient.

            • Even the best models of PHRs or medical record banks provide individuals with control over copies of the individualʼs information. They do not provide control over the copy of the information under the providerʼs control or that is generated as a part of providing care to the patient. They also do not control the flow of information once    the patient has released it or allowed another entity to have access to it.

            • Discussions about possible or potential future solutions were plentiful in our deliberations. But the Tiger Team believes that solutions must be generated out of  further innovation and, critically, testing of implementation experience.

            • The Tiger Team also considered previous NCVHS letters and received a presentation of current NCVHS efforts on sensitive data.

            • The Tiger Team therefore asked whether and what actions ONC might take to stimulate innovation and generate more experience about how best to enable patients to make more granular  consent decisions.

Tiger Team Recommendation 4: Granular ConsentThe technology for supporting more granular patient consent is promising  but is still in the early stages of development and adoption. Furthering   experience and stimulating innovation for granular consent are needed.This is an area that should be a priority for ONC to explore further, with a wide vision for possible approaches to providing patients more granular  control over the exchange and use of their identifiable health information, while also considering implications for quality of care and patient safety, patient educational needs, and operational implications.The goal in any related endeavor that ONC undertakes should not be a search for possible or theoretical solutions but rather to find evidence (such as through pilots) for models that have been implemented successfully and in   ways that can be demonstrated to be used by patients and fulfill their expectations. ONC and its policy advising bodies should be tracking this issue in an ongoing way and seeking lessons learned from the field as health information exchange matures.

            • In the interim, and in situations where these technical capabilities are being developed and not uniformly applied, patient education is  paramount: Patients must understand the implications of their decisions and the extent to which their requests can be honored, and we  encourage setting realistic expectations. This education has implications for providers but also for HIOs and government.                       Our additional recommendations below regarding Stage 1 of Meaningful Use aim to address the following fair information practices:
                       
Individual Access
                        Correction
                        Openness and Transparency
           
✔        Individual Choice
           
✔        Collection, Use, and Disclosure Limitation
                         
Data Quality and Integrity
                        Safeguards
                        Accountability
Tiger Team Recommendation 5:

5. Exchange for Stage 1 of Meaningful Use – Treatment, Quality reporting, Public health reporting

                      • Individual Consent: The exchange of identifiable health information for “treatment” should be limited to treatment of the individual who is the subject of the information, unless the provider has the consent of the subject individual to access, use, exchange or disclose his or her  information to treat others. (We note that this recommendation may  need to be further refined to ensure the appropriate care of infants or  children when a parentʼs or other family members information is needed to provide treatment and it is not possible or practical to obtain even a general oral assent to use a parentʼs information.)Collection, Use and Disclosure Limitation: Public health reporting by providers (or HIOs acting on their behalf) should take place using the least amount of identifiable data necessary to fulfill the lawful public  health purpose for which the information is being sought. Providers   should account for disclosure per existing law. More sensitive identifiable data should be subject to higher levels of protection.  
                        o In cases where the law requires the reporting of identifiable data (or where identifiable data is needed to accomplish the  lawful public health purpose for which the information is sought),                                    identifiable data may be sent. Techniques that avoid identification, including pseudonymization, should be considered, as appropriate.

            • Collection, use and Disclosure Limitation: Quality data reporting by providers (or HIOs acting on their behalf) should take place using the least amount of identifiable data necessary to fulfill the purpose for which the information is being sought. Providers should account for disclosure. More  sensitive identifiable data should be subject to higher levels of protection.

            • The provider is responsible for disclosures from records under its control, but    may delegate lawful quality or public health reporting to an HIO (pursuant to a business associate agreement) to perform on the  providerʼs behalf; such delegation may be on a “per request” basis or  may be a more general delegation to respond to all lawful requests.

IV. CONCLUSION

The foregoing recommendations were targeted to address set of questions raised by ONC. They should not be taken as the definitive or final word on privacy and security and health IT/health information exchange; they are instead a set of concrete steps that the Tiger Team believes are critical to establishing and maintaining trust. As we have said from the outset, these recommendations can only deliver the trust necessary when they are combined with the full implementation of all the FIPs. Only a systemic and comprehensive approach to privacy and security can achieve confidence among the public. In particular, our recommendations do not address directly the need to also establish individual access, correction and safeguards capabilities, and we recommend these be considered closely in the very near future, in conjunction with a further detailed assessment of how the other FIPs are being implemented.

We look forward to continuing to work on these issues.

Sincerely,
Deven McGraw Chair
Paul Egerman Co-Chair

Appendix A—Tiger Team Members
Deven McGraw, Chair, Center for Democracy & Technology
Paul Egerman, Co-Chair
Dixie Baker, SAIC
Rachel Block, NYS Department of Health
Carol Diamond, Markle Foundation
Judy Faulkner, EPIC Systems Corp.
Gayle Harrell, Consumer Representative/Florida
John Houston, University of Pittsburgh Medical Center; NCVHS
David Lansky, Pacific Business Group on Health
David McCallie, Cerner Corp.
Wes Rishel, Gartner
Latanya Sweeney, Carnegie Mellon University
Micky Tripathi, Massachusetts eHealth Collaborative

State Medicaid Directors Letters on Health IT from CMS

State Medicaid Directors Letters from CMS on Health IT Programs
2010 and 2009 Letters
This post includes both the latest letter from 2010 in PDF and html formats, that was issued this week; and a link to letter from about one year ago in 2009 in PDF format only .
August 17, 2010 Letter: 
          Federal Funding for Medicaid HIT Activities 
          ARRA of 2009 Section 4201
          PDF Version  (Excerpted below in html)

September 1, 2009 Letter: 
          Federal Funding for Medicaid HIT Activities 
          ARRA of 2009 Section 4201
          PDF Version
 

August 17, 2010 CMS Letter to State Directors on Health IT:
DEPARTMENT OF HEALTH & HUMAN SERVICES
Centers for Medicare & Medicaid Services
Baltimore, Maryland
Center for Medicaid, CHIP and Survey & Certification  
SMD# 10-016

August 17, 2010
Re: Federal Funding for Medicaid HIT Activities

Dear State Medicaid Director:

This letter provides guidance to State Medicaid agencies regarding implementation of section 4201 of the American Recovery and Reinvestment Act of 2009 (the Recovery Act), Pub. L. 111-5, and our recently published regulations at 42 CFR Part 495, Subpart D. Section 4201, as well as our final regulations, will allow the payment of incentives to eligible professionals (EPs) and eligible hospitals to promote the adoption and meaningful use of certified electronic health record (EHR) technology.

The Recovery Act provides 100 percent Federal financial participation (FFP) to States for incentive payments to eligible Medicaid providers to adopt, implement, upgrade, and meaningfully use certified EHR technology, and 90 percent FFP for State administrative expenses related to the program.

The Centers for Medicare & Medicaid Services (CMS) issued a State Medicaid Director (SMD) letter on September 1, 2009, that provided guidance to States on allowable expenses for activities supporting the administration of incentive payments to providers. CMS has now promulgated final regulations that also govern State administrative expenses related to administering the program. Both the SMD letter and our regulations at 42 CFR section 495.318 explain that, in order to qualify for the 90 percent FFP administrative match, a State must, at a minimum, demonstrate to the satisfaction of the Secretary compliance with three requirements:

•           Administration of Medicaid incentive payments to Medicaid EPs and eligible hospitals;

•           Oversight of the Medicaid EHR Incentive Program, including routine tracking of meaningful use attestations and reporting mechanisms; and

•           Pursuit of initiatives that encourage the adoption of certified EHR technology for the promotion of health care quality and the electronic exchange of health information.

Page 2 – State Medicaid Director

This letter and the accompanying enclosures provide more detailed guidance from CMS on the expectations relating to the activities and potential uses of the 90/10 matching funds.

I.          Administration of the Medicaid EHR Incentive Program

Title IV, Division B of the Recovery Act established the Medicare and Medicaid EHR incentives programs, as one component of the Health Information Technology for Economic and Clinical Health (HITECH) Act. This initiative supports the goals of health reform by helping to improve

Americans’ health, and increase safety and efficiency in health care through expanded use of EHRs. Accordingly, States’ administration of the Medicaid EHR Incentive Program, and their role in fostering adoption and meaningful use of certified EHR technology, are essential components of broader reforms. States can receive the enhanced FFP for approved design, development, and implementation of systems and processes that are necessary to effectively administer the Medicaid EHR Incentive Program. When developing their implementation timelines, States should consider the critical role the Medicaid EHR Incentive Program plays in the success of related HITECH programs. In order for States to benefit most from available Federal resources, including time-limited funding and technical assistance, timely initiation of their Medicaid EHR Incentive Programs (i.e., as soon as possible in 2011) is important.

Enclosure A outlines CMS’ expectations and provides examples of potentially allowable activities and reasonable costs related to State administration of the program.

II.        Oversight of the Medicaid EHR Incentive Program

Under section 1903(t)(9)(B) of the Social Security Act and our recently published regulations at 42 CFR Part 495, Subpart D, States are required to conduct adequate oversight of the Medicaid EHR Incentive Program. Although the provider incentive payments are paid by the States, they are 100 percent reimbursable under Medicaid. States must ensure that the program meets all statutory and regulatory requirements and is implemented in a manner that minimizes the potential for fraud, waste and abuse. The 90 percent matching rate for FFP is available to States for approved processes, systems, and activities necessary to ensure that the incentive payments are being properly made to the appropriate providers, in the appropriate circumstances, and in an auditable and defensible manner. We emphasize that an effective and efficient oversight strategy is one that is timely, targeted, and balances risk with available auditing resources.

Enclosure B provides additional information about CMS’ initial expectations for States’ auditing and oversight of their Medicaid EHR Incentive Program.

III.       Pursuing Initiatives to Encourage the Adoption of Certified EHR Technology and Health Information Exchange

CMS expects that State Medicaid agencies will have a role in the promotion of EHR adoption and health information exchange. HITECH provided several funding sources, including various grant programs through the Office of the National Coordinator for HIT (ONC) for States to achieve improved health care outcomes through health information technology (HIT). Medicaid plays an important role as both a payer and a collaborator with these other HIT initiatives to produce the desired impact on the health care system. Where possible, CMS encourages State Medicaid agencies to collaborate on HIT initiatives with Federal programs and other partners in

Page 3 – State Medicaid Director

the States, such as public health departments, county governments, and local governments. Costs will be distributed equitably across all payers following fair share and cost allocation principles, per section 495.358.

Enclosure C outlines the CMS guiding principles for the availability of the 90 percent FFP administrative matching funds for basic administration and oversight of the Medicaid EHR Incentive Program, as well as efforts to promote its success among eligible Medicaid providers.

IV.       State Medicaid Health Information Technology Plan (SMHP) and HIT Implementation Advance Planning Document (HIT IAPD)

The SMHP (the product of the initial HITECH planning funds awarded to States) should outline the State’s current (“As-Is”) and future (“To-Be”) HIT landscape and plan for the administration and oversight of its Medicaid EHR Incentive Program in compliance with our regulations. As States establish the broad vision for their Medicaid EHR Incentive Programs in the SMHP, however, not all activities will necessarily be eligible for FFP under HITECH. States must use the HIT Implementation Advance Planning Document (IAPD) to request FFP and receive approval before implementing proposed State Medicaid HIT plan activities and services or acquire equipment. There may be activities that are more appropriately reimbursed as Medicaid Management Information Systems (MMIS) or general program administration expenditures, or may not be eligible for any CMS funding at all.

Enclosure D outlines the CMS process for reviewing the SMHP and associated funding request documents (HITECH and MMIS).

CMS expects that States will take an incremental approach to the initial implementation of their Medicaid EHR Incentive Programs. For example States may begin by focusing on provider outreach and registration, then on provider attestation and verification of eligibility, next on provider payments, and finally on capturing meaningful use data. Toward that end, we have identified elements of an SMHP that are considered critical for the initial submission and those that may be deferred for future updates. States must outline their timeline, noting critical benchmarks and dependencies. An updated template for the SMHP for States to use as a guide is available on the CMS Web site for download at: http://www.cms.gov/EHRIncentivePrograms/91_Information_for_States.asp#TopOfPage .

CMS will seek ONC input as we review SMHPs to ensure a coordinated approach for the State EHR Incentive Program and health information exchange (HIE) efforts. While the SMHP focuses on the Medicaid strategy for moving toward meaningful use of certified EHR technology, it should be consistent with and complementary to the overall State HIT strategy developed under section 3013 of the Public Health Service Act (PHS). CMS and ONC will work together in the review of both strategies to prevent duplicative efforts of statewide HIT/HIE activities, provider outreach activities, and Medicaid HIT activities.

We encourage States to use the resources, tools, Frequently Asked Questions, and information available at the Federal level, particularly through the CMS EHR Incentive Program Web site: http://www.cms.gov/EHRIncentivePrograms/  and the ONC Web site: http://www.healthit.gov. We look forward to collaborating with State Medicaid agencies and learning from your experiences as we provide technical assistance, policy guidance, and Federal resources to ensure successful development and implementation of Medicaid EHR Incentive Programs. CMS believes that health information technology can be a transformative tool, improving the quality,

Page 4 – State Medicaid Director

efficacy, timeliness, and safety of patient care. With the States, as our partners, we can leverage the momentum provided by the Recovery Act’s EHR incentive programs to ensure that the innovations enabled by technology can support the framework of health care reform.

For further information or clarification on this State Medicaid Director letter, please contact Mr. Rick Friedman at CMS…

Enclosures:
A) Administering the Medicaid EHR Incentive Program
B) Oversight of the Medicaid EHR Incentive Program
C) Guiding Principles for the Use of the 90 Percent FFP for EHR Promotion
D) SMHP/IAPD Review Process

cc:
CMS Regional Administrators

CMS Associate Regional Administrators
Division of Medicaid and Children’s Health Operations

Ann C. Kohler
NASMD Executive Director
American Public Human Services Association

Joy Wilson
Director, Health Committee
National Conference of State Legislatures

Matt Salo
Director of Health Legislation
National Governors Association

Debra Miller
Director for Health Policy
Council of State Governments

Christine Evans, M.P.H.
Director, Government Relations
Association of State and Territorial Health Officials

Sincerely,
/s/
Cindy Mann Director

Page 5 – State Medicaid Director

Alan R. Weil, J.D., M.P.P.
Executive Director
National Academy for State Health Policy

David Blumenthal, M.D.
National Coordinator
Office of the National Coordinator for HIT

Page 6 – State Medicaid Director

Enclosure A
Administering the Medicaid EHR Incentive Program

Under the Recovery Act, States have the option to participate in the Medicaid EHR incentive program. States may receive 90 percent FFP for reasonable administrative expenditures incurred in planning and implementing the program.

States will undertake a number of activities relative to the administration of the Medicaid EHR Incentive program. As indicated in the CMS Electronic Health Record Incentive Program Final Rule at § 495.332, States will be expected to describe in detail in the State Medicaid HIT Plan (SMHP) a number of activities that CMS considers vital to the effective administration of the EHR Incentive Program. In order for States to claim the 90 percent FFP match, they must submit both a State Medicaid HIT Plan and an HIT Implementation Advance Planning Document (HIT IAPD). We recognize that not all States will administer the program using the same systems and processes; therefore we will assess each State’s SMHP to determine which activities would most appropriately be funded with the HITECH enhanced match and which might be better applicable to MMIS or regular program administration funding, or which may not be eligible for any CMS funding at all. In order to be eligible for the HITECH 90 percent FFP, activities must be directly related to the success of the Medicaid EHR Incentive Program, as described further in Enclosure C. In addition, please see Enclosure D for additional details about submitting SMHPs with HIT IAPD’s for both HITECH and MMIS funding.

States may potentially receive 90 percent FFP for the following program administration activities (not an exhaustive list), subject to CMS prior approval. (Note, as required by § 495.358, all costs are subject to cost allocation rules in 45 CFR Part 95.):

  • System and resource costs associated with the National Level Repository (NLR)
  • Interface System and resource costs associated with State interfaces of a Health Information Exchange (HIE)–(e.g., laboratories, immunization registries, public health databases, other HIEs, etc.)
  • Creation or enhancement of a Data Warehouse/Repository (should be cost allocated)
  • Development of a Master Patient Index (should be cost allocated)
  • Communications/Materials Development about the EHR Incentive Program and/or EHR Adoption/meaningful use
  • Provider Outreach Activities (workshops, webinars, meetings, presentations, etc).
  • Provider Help-Line/Dedicated E-mail Address/Call Center (hardware, software, staffing)
  • Web site for Provider Enrollment/FAQs
  • Hosting Conferences/Convening Stakeholder Meetings
  • Business Process Modeling
  • System and resource costs associated with the collection and verification of meaningful use data from providers’ EHRs
  • System and resource costs to develop, capture, and audit provider attestations
  • Evaluation of the EHR Incentive Program (Independent Verification (IV) & Validations (V) and program’s impact on costs/quality outcomes)
  • Data Analysis, Oversight/Auditing and Reporting on EHR Adoption and Meaningful Use
  • Environmental Scans/Gap Analyses SMHP updates/reporting; IAPD updates
  • Developing Data Sharing & Business Associate Agreements (legal support, staff)

Page 7 – State Medicaid Director

  • Ongoing costs for Quality Assurance activities
  • Multi-State Collaborative for Health IT annual dues
  • Staff/contractual costs related to the development of State-Specific meaningful use and patient volume criteria
  • Medicaid Staff Training/Prof. Development (consultants, registration fees, etc.)

CMS strongly encourages States to collaborate with other State-level and local partners in the design, development, and even procurement of systems needed to administer their EHR Incentive Programs. Doing so would make more effective use of both CMS’ and States’ share of the cost and would shorten the timeline for actually dispersing incentive payments to eligible providers. CMS is available to provide technical assistance to States interested in exploring collaborative approaches, and will disseminate information on approved and successful models.

CMS also strongly encourages States to consider the activities they plan to undertake to administer their EHR Incentive Program and to identify any that may overlap with other Federally-funded activities, such as provider outreach, development of a Master Patient Index, external inquiry management, etc. Where possible, these activities should be accomplished collaboratively, in which case costs are allocated across partners.

Budgeting for the 90 Percent FFP

States will be responsible for estimating the expenditures for the Medicaid EHR Incentive Program on the State’s quarterly budget estimate reports via Form CMS-37. These reports are used as the basis for Medicaid quarterly grant awards that would be advanced to the State for the Medicaid EHR incentive program. These forms are submitted electronically to CMS via the Medicaid and State CHIP Budget and Expenditure System (MBES/CBES). On Form CMS-37, States should include any projections of administration related expenditures for the implementation costs. On Form CMS-64, a State submits on a quarterly basis actual expenses incurred, which is used to reconcile the Medicaid funding advanced to States for the quarter made on the basis of the Form CMS-37. (Refer to Enclosure D and its section on State Reporting of Estimates, Expenditures, and Timing of the Grant Award Letter.)

To assist States in properly reporting expenditures using the MBES/CBES, the CMS-37 and CMS-64 reports will include a new category for reporting the 90 percent FFP match for State administrative expenses associated with the Medicaid EHR Incentive Program. The new category will be called “Health Information Technology Administration.” This reporting category is located on the 64.10 base page lines 24A and 24B for Administration. Implementation expenditures are included on lines 24C and 24D.

CMS will monitor State agency compliance through systems performance reviews, focused reviews, and audits of the processes documented in the SMHP, and other planning documents. CMS may review States’ EHR Incentive Programs using a variety of audit/review tools, including, but not limited to, financial audits, State Program Integrity Reviews, and payment data analysis. CMS is allowed to suspend payments if the State fails to provide access to information, per our final regulations, § 495.330.

Page 8 – State Medicaid Director

In order to track progress made towards the nationwide implementation of the Medicaid EHR Incentive Programs, CMS requests that States indicate to us through their State Medicaid HIT Plans, the target date by which they plan to launch their program. For consistency’s sake, we will consider a State’s Medicaid EHR Incentive Program ready to launch when a State has met all of the following criteria:

The State has an approved SMHP and an approved IAPD. The State has initiated outreach and communications about the Medicaid EHR Incentive Program, including posting information on its Web site. The State has an effective and tested interface to accept provider registration information from the CMS NLR (i.e., has successfully tested with the NLR). The State is now capable, or will be capable within 3 months, of accepting provider attestations. The State is now capable, or will be capable within 5 months, of making provider incentive payments. The State has sufficient controls in place to ensure that the right incentive payments are made to the right providers before initiating provider incentive payments.

Prior to the release of the 100 percent FFP provider incentive funding, CMS will require that States provide a brief written update regarding the launch criteria above.

Page 9 – State Medicaid Director

Enclosure B
Oversight of the Medicaid EHR Incentive Program

Under Section 1903(t)(9)(B) of the Social Security Act, States are required to conduct adequate oversight of the Medicaid incentive program. Our regulations, including §§ 495.318(b), 495.332, 495.366, and 495.368, also require States to conduct oversight to monitor, among other things, provider eligibility, payments, fraud, waste, and abuse.

In addition, CMS is developing a joint Medicare/Medicaid audit strategy. In the interim, this enclosure provides initial CMS expectations regarding State responsibilities for oversight and audit in the early stage of EHR incentive program implementation. CMS will expand and build upon these requirements after the joint strategy is finalized and States begin implementing their programs.

CMS expects States to implement a risk-based auditing approach to prevent making improper Medicaid EHR Incentive payments and to monitor the program for potential fraud, waste, and abuse. For 2011, CMS expects that, at a minimum, States will focus their auditing resources on the following specific items:

Provider eligibility: for example, an identified means to verify that providers are credentialed, not-sanctioned, not hospital-based, practicing predominately, and are one of the types of eligible professionals or institutions under the EHR incentive program. Patient volume: for example, an identified means to audit or verify the attestation data, including use of proxy data (such as claims) where appropriate to identify risk. Adopt, implement, or upgrade (AIU): for example, have an identified means to audit or verify that providers have actually adopted, implemented, or upgraded certified EHR technology. (Note: CMS does not anticipate that States will audit meaningful use in 2011 as all eligible Medicaid providers can receive an EHR incentive payment for AIU in their first participation year.) Certified EHR technology: for example, States should collect the certified EHR technology code (see below) as part of provider attestation for AIU, and should verify that the code is on the Office of the National Coordinator (ONC) list of certified EHR technology prior to issuing an incentive payment to that provider.

Prior to January 2011, ONC will make available through a public Web service (URL is still to- be-determined), a list of all certified EHR technology, including the name of the vendor and product, the product’s unique certification code, and the meaningful use criteria for which the product was certified. After January 2011, the ONC Web service is expected to have additional functionality related to combinations of certified EHR modules. For combinations of separate certified EHR technology that collectively could achieve meaningful use (e.g., modules), the ONC Web service would allow providers to enter the codes from the different certified modules and request a unique certification code that represents that specific combination. The Web service would then store and reflect for other providers that particular combination of certified EHR technology and the unique code associated with it. States should utilize the ONC Web service to automate the pre-payment verification of providers’ attestations regarding use of certified EHR technology. States should plan to test this process prior to accepting provider attestations. CMS will provide further details as soon as they become available.

Page 10 – State Medicaid Director

Using either their attestation system or other means, States must notify providers that it is the provider’s responsibility to ensure that its certified EHR technology code is listed on the ONC Web service before attesting to the State. Otherwise, the State’s verification system might produce a false negative result (e.g., the EHR technology was certified but there was a delay before it was added to the ONC Web service).

States may receive enhanced matching funds for the following audit/oversight activities, subject to CMS prior approval:

Auditing contractor(s)/Auditing In-House Activities Systems costs for interfaces to verify provider identity/eligibility (e.g., provider enrollment, license verification, sanctions, patient volume) System and Resource Costs associated with Provider Appeals for EHR Incentive Payments Staff and resources for data analysis and reporting requirements for the CMS EHR Incentive Program Privacy/Security Controls

We strongly recommend that States consider the data sources and partners (such as Regional Extension Centers and HIEs, etc.) that are available to support their auditing and oversight responsibilities- including using them as tools for conducting risk assessments for fraud, waste and abuse. For example, where appropriate, States should utilize reliable third-party data sources rather than conduct resource-intense individual on-site reviews. As noted above, we will be issuing further guidance related to oversight and auditing of meaningful use in the Medicare and Medicaid EHR Incentive Programs. At that time, CMS will share with States its auditing plans for the Medicare EHR Incentive Program. We will look for opportunities where appropriate to leverage Federal efforts on behalf of the States, including, but not limited to our auditing strategy for hospitals that are eligible for both Medicare and Medicaid EHR incentive payments. Further details regarding potential State and CMS collaboration on the auditing of meaningful use for hospitals that are eligible for both incentive payments is forthcoming. States should recognize that it is their sole responsibility to audit hospitals that are Medicaid-only (e.g., children’s and cancer hospitals).

The primary means for CMS and States to avoid duplicate payments to eligible professionals is through joint use of the National Level Repository (NLR). States must interface with the NLR not just to receive provider registration data and to ensure that there are no duplicative payments prior to issuing provider incentives, but also to notify the NLR when they have made an incentive payment. CMS expects that States will notify the NLR that an incentive payment has been made within 5 business days. Similarly, if a State has determined that the provider is ineligible for a payment, CMS expects that the State will notify the NLR within 5 business days. Finally, in accordance with our regulations, § 495.332, the State must make a payment within 45 days of completing all eligibility verification checks. In the case of providers registering at the end of a calendar year, a payment for that year must be made no later than 60 days into the next calendar year for EPs, or fiscal year, for hospitals. The full requirements document and interface control document developed for States’ interface with the NLR was made available to States through the CMS regional offices, with the July 13, 2010, release of the CMS final rule.

Page 11 – State Medicaid Director

CMS will monitor State agency compliance with audit and oversight requirements through systems performance reviews, focused reviews, and audits of the processes documented in the SMHP, and other planning documents. CMS may review States’ EHR Incentive Programs using a variety of audit/review tools, including, but not limited to, financial audits, State Program Integrity Reviews, and payment data analysis. CMS is allowed to suspend payments if the State fails to provide access to information, per our final regulations, § 495.330.

In accordance with the CMS final rule, Medicaid agencies must implement a provider appeals process.     See § 495.370 of our final regulations for details regarding provider appeals, as well as the SMHP template, which is located on the CMS Web site at: http://www.cms.gov/EHRIncentivePrograms/91_Information_for_States.asp#TopOfPage. Enclosure E also discusses information regarding provider appeals in the context of the SMHP contents.

Page 12 – State Medicaid Director

Enclosure C
Guiding Principles for Use of the CMS 90 Percent Administrative Matching Funds for the Medicaid EHR Incentive Program

State Medicaid agencies can receive enhanced matching funds at a 90-percent rate for their administration and oversight of the Medicaid EHR incentive program. CMS also expects that States will request the enhanced matching funds for reasonable administrative expenses related to their efforts to promote the adoption of certified EHR technology and health information exchange (HIE).

We recognize that not all States will implement their programs in the same manner, and each State may face unique barriers to adoption and meaningful use. The principles below provide an overarching framework by which CMS will consider State requests for 90 percent FFP. Each proposal will be examined by CMS (with input from ONC) to ensure funds provide direct support to the success of the Medicaid EHR incentive program, are coordinated with other State HIT-related activities, do not duplicate other funding sources, and are implemented in the most efficient and effective manner. In addition, we strongly encourage States to collaborate with other States and local partners in the design, development, and procurement of any new systems.

CMS will consider approval for 90 percent FFP for EHR/HIE promotion initiatives that will meet all of the following criteria:

  • Serve as a direct accelerant to the success of the State’s Medicaid EHR Incentive Program and facilitate the adoption and meaningful use of certified EHR technology. Expenses that do not directly correlate to the EHR Incentive Program will not be approved. Examples that may correlate include:
                      – Expenditures related to provider needs assessments, provider outreach about adoption and meaningful use of certified EHR technology, staff training, identification and development of tools to connect to health information exchanges, record locater services, secure messaging gateways, provider directories, development of privacy and governance policies and procedures, master patient indexes, interfaces for data (e.g., laboratory) that is important to Medicaid providers to be fully successful in an HIE environment, and procuring technical assistance for Medicaid providers to achieve meaningful use.
  • Are consistent with the ONC long-term vision for health information exchange, and are supportive of the activities prioritized by ONC cooperative agreement funding, namely secure messaging, the electronic reporting of structured laboratory data and enabling e- prescribing.
  • Are not duplicating meaningful use technical assistance efforts conducted by the ONC- funded Regional Extension Centers, Workforce Grantees, Beacon Grantees or other Federally-funded projects whose target population is the same, as well as ONC cooperative agreement grant funding for the development of HIE.

Page 13 – State Medicaid Director

  • Will, to the extent possible, be normalized and integrated into the Medicaid business enterprise. Examples include:          
                    -Expenditures related to technical bridges between Medicaid and health information exchanges or all-payer clinical/claims data warehouses or technologies to authenticate providers and beneficiaries (e.g., master provider or patient indices).
  • Cannot otherwise be funded by the MMIS matching funds. MMIS will be examined as a more appropriate funding source before HITECH because HITECH funds should be targeted toward scenarios that contribute to the transformation of the MMIS into a clinical- and claims-based engine that supports Medicaid’s broader health care reform goals. Examples of expenditures that relate to the Medicaid EHR Incentive Program but that might more appropriately be funded through the enhanced MMIS match include:
                   -  Expenditures related to the design, development, and testing of a standard continuity of care record (CCR) or continuity of care document (CCD) based upon Medicaid claims; or building a portal between the MMIS and a clinical data repository or an immunization registry.
  • Are designed to be well-defined, developmental, and time-limited projects, with specific goals that would enable eligible Medicaid providers who qualify for the Medicaid EHR Incentive Program to achieve meaningful use of certified EHR technology.
                   – Providers’ transactional and on-going expenses derived from participation in health information exchange would not be eligible for the 90 percent HITECH Medicaid administrative match. Instead, CMS believes such costs are more appropriately addressed through State reimbursement to providers. CMS will entertain State plan amendments that speak to payment policies designed to incentivize providers to report data, such as the medical home per-member/per- month model.
  • Are not intended to be permanent initiatives but will lead within a reasonably short timeframe to sustainable outcomes.
                    - Sustainability refers to the responsibility for on-going costs for operations and maintenance of systems initially developed or enhanced using HITECH funding. After a defined milestone, funding sources other than HITECH must be used.
                   – Personnel costs for those who work directly on the Medicaid EHR Incentive Program are permissible expenditures for the enhanced match over the short term; however, States must plan to absorb or bear those costs in the future.
  • Are developed in accordance with Medicaid Information Technology Architecture (MITA) principles, as required by §495.332.
  • Are distributed equitably across all payers following the fair share principle. CMS recognizes that Medicaid is often one of the largest insurers in a State and, as such, stands to benefit from efficiencies associated with health information exchange and meaningful use of EHRs. However, Medicaid’s contribution to health information technology should be weighted and allocated based on contributions by other payers, and not be the sole or primary source of start-up or operational funding.

Page 14 – State Medicaid Director

  • Are cost-allocated per Office of Management and Budget (OMB) Circular A-87. CMS will work with States on an individual basis to determine the most appropriate cost allocation methodology.
                   -  HITECH cost allocation formulas should be based on the direct benefit to the Medicaid EHR incentive program, taking into account State projections of eligible Medicaid provider participation in the incentive program.
                   -  Cost allocation must account for other available Federal funding sources, the division of resources and activities across relevant payers, and the relative benefit to the State Medicaid program, among other factors.
                   -  Cost allocations should involve the timely and ensured financial participation of all parties so that Medicaid funds are neither the sole contributor at the onset nor the primary source of funding. Other payers who stand to benefit must contribute their share from the beginning. The absence of other payers is not sufficient cause for Medicaid to be the primary payer.

Page 15 – State Medicaid Director

Enclosure D
State Medicaid HIT Plan and Implementation Advance Planning Process

This Enclosure provides guidance on the following topics regarding the State’s Medicaid HIT Plan (SMHP) and the State’s HIT Implementation Advance Planning Document (HIT IAPD):

  • HIT IAPD Preparation and On-Going Planning Activities
  • Budget Preparation Tips
  • State Submission and CMS Review and Approval Process for the SMHP and the HIT IAPD
  • State Reporting of Estimates, Expenditures, and Timing of the Grant Award Letter
  • Retroactive Requests for Planning Activities Funded at 90/10 Federal Financial Participation (FFP)

HIT IAPD Preparation and On-Going Planning Activities

Since the publication of the State Medicaid Director’s Letter on September 1, 2009, nearly every State and Territorial Medicaid agency has been approved to conduct HIT planning activities through the HIT Planning Advance Planning Document process (HIT PAPD), with the remaining agencies expected to submit funding requests in the coming months. A required deliverable of the HIT PAPD is the completion of a State Medicaid HIT Plan (SMHP), which must include the elements contained at §495.332 of the Medicare and Medicaid Programs’ EHR Incentive Program Final Rule. Once approved, the SMHP and the results of the planning activities must be included in the States’ HIT Implementation Advance Planning Document (HIT IAPD). The HIT IAPD is a plan of action that requests FFP and approval to acquire and implement the proposed State Medicaid HIT Plan activities, services or equipment. The end result of implementation will be the ability for the State Medicaid agency to successfully operate its EHR Incentive Program. States will then be able to make provider incentive payments with 100 percent FFP for State expenditures.

To the extent possible, the HIT IAPD must include the list of the HIT IAPD required elements that are contained in the Final Rule at: §495.338. In addition, the State should consider incorporating the optional SMHP elements included in the revised SMHP template located on the CMS Web site at: http://www.cms.gov/EHRIncentivePrograms/91_Information_for_States.asp#TopOfPage . It is possible that some planning activities may be on-going. In these instances, the State should continue to describe on-going planning activities using the As-Needed HIT Advance Planning Document Update (HIT APDU) process to request funding approval for project continuation, scope, and schedule changes, for incremental funding authority and project continuation when approval is being granted by phases.

Page 16 – State Medicaid Director

Budget Preparation Tips

We believe the provisions of the HITECH Act provide the necessary assistance and technical support to providers, enable coordination and alignment within and among States, establish connectivity to the public health community in case of emergencies, and ensure that the workforce is properly trained and equipped to be meaningful users of certified EHR technology. It is therefore important that the HIT IAPD include information about any grants, State or local funds, or other funding sources that are available to the State and that will contribute to the costs of activities for which the State is requesting HITECH matching funds. This information is not meant to duplicate what is in the SMHP but rather to provide CMS with adequate information to determine if the proposed cost allocation and/or division of labor and responsibilities among the various State partners are appropriate to existing rules and regulations and CMS expectations. For example, if a State wishes to build System X, it should indicate all other sources of funding that will contribute to System X, including other Federal HIT grant funding.

Example:

Grant/Funding Source:    

Share of the Cost Allocation    

Timing of the Funding Contribution (e.g., current, FY11, TBD)    

Lead Agency    

Contact Information    

State HIE Cooperative Agreement Program    

$5,000,000    

State Office of E-Health    

NamePhone numberE-mail  

ONC Regional Extension Center Cooperative Agreement Program    

$3,500,000    

State University of XYZ    

NamePhone numberE-mail  

Follow this link for a full description of each grant, listed in the bullets below:

.
 
 

 

.

State Health Information Exchange Cooperative Agreement Program Health Information Technology Extension Program Strategic Health IT Advanced Research Projects (SHARP) Program Beacon Community Program

Community College Consortia to Educate Health Information Technology Professionals Program Curriculum Development Centers Program Program of Assistance for University-Based Training

Competency Examination for Individuals Completing Non-Degree Training Program

The HIT IAPD proposed budget should follow the requirements at § 495.338 in the Final Rule and include the source of all funds which will be utilized by the State Medicaid agency for the

Page 17 – State Medicaid Director

specific activities outlined in the IAPD. This includes the following grants to the Medicaid agency:

CHIPRA Quality Demonstration Grant, if HIT related Medicaid Transformation Grant Primary Care Stabilization Grant

Enhancements to the State’s MMIS, such as building an interface to a source of HIT data, or shared reporting between the multiple projects, which will be cost allocated between the different projects, should be described in a separate MMIS APD. The separate MMIS APD may be included in the submission of the State’s HIT IAPD and, as an example, may be titled Part 1 – HIT, Part 2 – MMIS. Recovery funds must be tracked separately. That is the reason for separating the two documents. Funding requests for the MMIS APD should follow MMIS-specific guidance about the matching levels and permitted expenditures.

State Submission and CMS Review and Approval Process for the SMHP and the HIT IAPD

The State may simultaneously submit to CMS for approval both the SMHP and the HIT IAPD; or the State may choose to submit the SMHP first, receive CMS approval, and then submit the HIT IAPD to CMS. Either way, implementation activities cannot begin until the SMHP and the HIT IAPD have both been approved by CMS. As with the HIT Planning Advance Planning Document (PAPD), prior approval is required for States requesting FFP before conducting implementation activities. Exceptions will be made for States that have previously conducted planning activities and are requesting retroactive approval for 90 percent FFP for activities that occurred on or after February 18, 2009. Instructions for submitting these requests are described below under the heading, “Retroactive Approval of FFP with an Effective Date of February 18, 2009.”

CMS will determine which activities will be eligible for a 90 percent FFP match for State expenses for administration of the incentive payments and for promoting EHR adoption implementation activities. States should contact their CMS regional office representatives regarding funding questions. Enclosures A, B, and C contain examples of partial lists of implementation expenditures/activities that may be considered eligible for 90 percent FFP for administrative expenses to implement the activities contained in the State’s SMHP and HIT IAPD.

CMS will be using a joint Central Office/Regional Office review approach. In addition, CMS will share the States’ SMHPs with the Office of the National Coordinator for HIT (ONC) to ensure a coordinated approach for the State EHR Incentive Program and HIE efforts. While the SMHP focuses on the Medicaid strategy for moving toward meaningful use of certified EHR technology, it should be consistent with and complementary to the overall State HIT strategy developed under section 3013 of the Public Health Service Act (PHS). CMS and ONC will work together in the review of both strategies to prevent duplicative efforts of statewide HIT/HIE activities, provider outreach activities, and Medicaid HIT activities.

Page 18 – State Medicaid Director

State Reporting of Estimates, Expenditures and Timing of the Grant Award Letter

For the purposes of this guidance, CMS is using the term “grant award” when approving Federal funding for allowable Medicaid expenditures. This should not be confused with competitive grant awards (e.g., Transformation Grants, CHIPRA grants, etc.) made by CMS or other Federal agencies, such as ONC, for HITECH activities. Once CMS has officially approved the SMHP and HIT IAPD, a CMS HIT approval letter will be issued notifying the State of the approved funding to conduct implementation activities. Only then may a State request to receive the grant award on a quarterly basis. On the Forms CMS-37.9 and CMS-37.10, the new line items listed below have been added to reflect provisions under section 4201 of the Recovery Act:

Line 24A – HIT: Planning: Cost of In-house Activities Planning Activities for administrative expenses to oversee incentive payments made to providers: Cost of In- house Activities

Line 24B – HIT: Planning: Cost of Private Contractors Planning Activities for administrative expenses to oversee incentive payments made to providers: Cost of Private Sector Contractors

Line 24C – HIT: Implementation and Operation: Cost of In-house Activities Implementation Activities for administrative expenses to oversee incentive payments made to providers: Cost of In-house Activities

Line 24D – HIT: Implementation and Operation: Cost of Private Contractors Implementation Activities for administrative expenses to oversee incentive payments made to providers: Cost of Private Sector Contractors

In addition, the CMS 64.10 report includes expenditure reporting for the following line items:

Line 24A – HIT Planning: Cost of In-house Activities Line 24B – HIT Planning: Cost of Private Contractors Line 24C – HIT Implementation and Operation: Cost of In-house Activities Line 24D – HIT Implementation and Operation: Cost of Private Contractors

For both the CMS 37.9, 37.10 and 64.10 reports, estimates and expenditures only pertain to HITECH and not to MMIS reporting for the line items listed above. In that regard, do not include any projections or expenditures of provider incentive payment for this provision for either FY 2010 or FY 2011 on the CMS-37.9, CMS-37.10, or 64.10 reports. When State staff are preparing the budget for the HIT IAPD, it is critical that both program and financial staff communicate with each other to ensure consistent State reporting to CMS’ Financial Management Group in order to eliminate discrepancies in both the APD estimates and the information being reported by the State fiscal staff pertaining to Form CMS-37.9 and Form CMS-37.10.

On the quarterly CMS-37 budget submission, a State may request to receive its HIT IAPD CMS grant award by including an estimated HIT IAPD expenditure in the CMS-37.10 Form. This estimated expenditure will result in a grant award to cover those expenses specified for that quarter. Therefore, it is imperative to accurately estimate the HIT IAPD expenditures by quarter.

Page 19 – State Medicaid Director

CMS will finalize the HIT IAPD grant award against the 64 HIT IAPD expenditures. The HIT IAPD grant award will be issued separately with a specified Payment Management System subaccount code.

If a State has not received its HIT IAPD approval letter, the State may still include a footnote in the Form CMS-37.12 of anticipated HIT IAPD expenditures, broken out by quarter.

Retroactive Approval of 90/10 FFP with an Effective Date of February 18, 2009

For administrative activities performed by a State, prior to having an approved HIT PAPD, which are in support of administrative expenditures for planning activities for incentive payments to providers, a State may request consideration of retrospective FFP by including a request in a HIT advance planning document or implementation advance planning document update.  In considering such a request, the agency takes into consideration overall Federal interests which may include any of the following:

(a) The acquisition must not be before February 18, 2009.

(b) The acquisition must be reasonable, useful, and necessary.

(c) The acquisition must be attributable to payments for reasonable administrative expenses per our regulations in §495.362.

The activities must be related to planning, and can be requested in the HIT APD that is active at the time of the request. As an example, if the HIT PAPD has ended and the State is preparing the HIT IAPD, then this request can be included in a separate section titled: “Request for Retroactive HIT Planning Funding” and must follow the criteria above. It can also be included in an Update or in the Annual APD report due 60 days from the approved APD anniversary date.

Health Affairs Blog: Advancing EHR Adoption and Meaningful Use

Washington, DC Follow-up to Health Industry Forum at Brandeis
Covered in Series of Post on Health Affairs Blog
In a series of posts collected on Health Affairs blog by Chris Fleming on August 5, 2010, a range of stakeholders wrote articles inspired by their presentations at an August 5 forum held by Health Affairs and Health Industry Forum. This forum was a follow-up to a July 8, 2010 roundtable hosted at Brandeis University with Health Industry Forum. Both sessions featured National Health IT Coordinator David Blumenthal, who was joined by the new CMS Administrator Donald Berwick in the latest session.

Note: Series of Videos from the August 5 event are now available on the Health Affairs Web site.

–Chris Fleming’s Blog Post:
          Advancing Electronic Health Record Adoption and Meaningful Use
–Blumenthal and Berwick:
          Adoption and Meaningful Use of EHRs–The Journey Begins
–Samuel Nussbaum and Charles Kennedy, WellPoint:
          WellPoint: Supporting Meaningful Use Through Incentive Alignment And Hospital Financing
–Donald Fischer, Highmark Blue Cross Blue Shield:
          Highmark: Using EHRs To Drive Quality Improvement
–John Toussaint, ThedaCare:
          ThedaCare: Meaningful Use And Continuous Improvement
–Will Bloedow, Retired minister and a ThedaCare patient:
          Through A Patient’s Eyes: The Value of EHRs
–Robert Laskowski, Christiana Care Health System:
          Christiana Care: A Leadership Moment For Hospitals And Physicians
–Gary Gottlieb and Thomas Lee:
          Partners HealthCare Applauds EHR Meaningful Use Regs (posted Friday, July 23)
–Humayun Chaudhry, Fed Of State Medical Boards:
          Federation Of State Medical Boards: Maintenance of Licensure and Health IT
–Kevin Weiss and Sheldon Horowitz, ABMS:
          American Board of Med. Specialties: Aligning Maintenance Of Certification and Meaningful Use

Practice-Based Population Health: Information Technology to Support Transformation to Proactive Primary Care

New Practice-Based Population Health Report Now Available
AHRQ released a new research paper, Practice-Based Population Health: Information Technology to Support Transformation to Proactive Primary Care, announced via email on August 4, 2010, and posted the report on its PCMH (Patient-Centered Medical Home) Resource Center.  The paper ”focuses on the concept of practice-based population health (PBPH),” and “examines the potential benefit of greater adoption of PBPH as well as the challenges to adoption by the primary care community.” Select to access the report

The paper was prepared by NORC at the University of Chicago, and was authored by Caitlin M. Cusack, MD, MPH; Alana D. Knudson, PhD, EdM; Jessica L. Kronstadt, MPP; Rachedl F. Singer, PhD, MPH, MPA; and Alexa L. Brown, BS. It holds a July 2010 publication date.3

Summary from PCMH Resource Center (AHRQ-Commissioned Research)
Practice-Based Population Health: Information Technology to Support Transformation to Proactive Primary Care. “This report describes the concept of Practice-Based Population Health as an approach to care that uses information on a group (“population”) of patients within a primary care practice or group of practices (“practice-based”) to improve the care and clinical outcomes of patients within that practice. It also discusses the information management functionalities that may help primary care practices to move forward with this type of proactive management as well as the relationship between these functionalities and health IT certification efforts, proposed objectives for electronic health record incentive programs, and the patient-centered medical home (PCMH) model.” (PDF – 236KB)

Practice-Based Population Health: Information Technology to Support Transformation to Proactive Primary Care.
Excerpts selected on 8/6/2010.  Sections or chapters should only be considered excerpts and may not include complete sections or chapters. PDF also contains charts.

 EXECUTIVE SUMMARY
The transformation of primary care is a key component of current efforts to improve health care in the United States and of the policy debate on national health care reform. The proactive measurement and management of the panel of patients in an individual practice may be one aspect of that transformation. This approach to care and the concept we developed to characterize its core—Practice-Based Population Health (PBPH)—are the focus of the project presented here.

We define PBPH as an approach to care that uses information on a group (“population”) of patients within a primary care practice or group of practices (“practice-based”) to improve the care and clinical outcomes of patients within that practice. With funding from the Agency for Healthcare Research and Quality (AHRQ), the National Opinion Research Center (NORC) at the University of Chicago has identified the functionalities necessary to more effectively prevent disease and manage chronic conditions using a PBPH approach. By helping providers focus on the preventive care needs of all of their patients, including those individuals who do not appear in the office for routine care, PBPH can help practices conduct more comprehensive health promotion and disease management. PBPH can also be used to serve a variety of other purposes—for example, to develop lists of patients to invite to a group educational session on smoking cessation or chronic disease self-management; to identify patients to notify in the case of a medication recall; to find patients who are eligible for participation in clinical trials; and to make informed decisions about areas for continuing medical education.

Information Management Functionalities for Practice-Based Population Health
To further develop the concept of PBPH, the project team developed and vetted a series of information management functionalities to support proactive population management. The list was refined through discussions with a group of experts and a series of interviews with primary care providers and office staff. The functionalities were grouped into the following five domains:

Domain 1: Identify Subpopulations of Patients. Practices can target patients who require preventive care or tests.

Domain 2: Examine Detailed Characteristics of Identified Subpopulations. Information management systems can allow practices to run queries to narrow down the subpopulation of patients or to access patient records or additional patient information.

Domain 3: Create Reminders for Patients and Providers. Information on patients can be made actionable through notifications for patients and members of the practice.

Domain 4: Track Performance Measures. Practices can gain an understanding of how they are providing care relative to national guidelines or peer comparison groups.

Domain 5: Make Data Available in Multiple Forms. Information may be most useful to practices if it can be printed, saved, or exported and if it can be displayed graphically.

Challenges to Adoption of Practice-Based Population Health
During our interviews with providers, we found that practices with electronic health records (EHRs) and registries are performing more of the PBPH functionalities than are paper-based practices, but none of the practices is performing all of the functionalities. More widespread adoption of PBPH will require technological innovations; greater availability of usable data; new methods for reimbursement of primary care; and changes in physicians’ views of care delivery and their practice workflow.

Having access to an EHR or a registry increases the likelihood that practices are performing these functionalities, but such access is not sufficient for the adoption of PBPH. For systems to facilitate population management, they need to be user-friendly and contain robust PBPH capabilities. Several of the 27 providers we interviewed said either that they were unable to find systems that include population management functionalities or that the products they had purchased are not living up to their expectations in performing these management tasks.

However, most providers are not actively seeking the tools needed for PBPH. With this lack of provider demand there is little incentive for vendors to create tools to support these functionalities.

To engage in PBPH, practices need accurate data in a discrete form. Providers we interviewed explained they often are able to run queries only on billing data, which may be inaccurate and insufficient for supporting PBPH. Practices also need to access patient information that is generated from other parts of the health care system, such as laboratory and pharmacy data. Additionally, for performance reporting, many providers feel that systems need to accommodate exception codes, so that patients who have refused treatment or patients for whom a particular treatment is inappropriate because of their comorbidities can be excluded from calculations of performance measures.

Because clinicians are trained to provide individualized care to one patient at a time, changing providers’ focus to the population level will require a paradigm shift. The clinicians we interviewed were also concerned with the disruption of workflow that PBPH could cause because of the time needed to collect and analyze data on the patient population and the increased need for appointments that more proactive care requires.

The providers we interviewed also expressed concern that the current reimbursement system would not cover the costs of more proactive management and coordination of care. Practices are currently using PBPH in limited instances where funding is available through grant programs or insurer incentives that target improved management of particular conditions.

Leveraging Policies to Address Challenges and Next Steps
The movement toward health care reform and unprecedented Federal investment in health information technology (IT) provide a window of opportunity for transforming primary care. To increase the adoption of PBPH, incentives for proactive population management can be incorporated into policies related to provider payment, the health-IT-related economic stimulus provisions in the American Recovery and Reinvestment Act (ARRA), and efforts to strengthen the primary care workforce. Further research and dissemination could also increase appreciation of the potential of PBPH and support broader adoption of this approach to care.

Proposed efforts to reform the health care system may provide opportunities to change the reimbursement structure for primary care. Reimbursement with a greater emphasis on outcomes could provide additional resources and incentives for primary care practices to engage in PBPH. Increased provider demand would probably motivate IT vendors to develop applications that support population management. Health care reform may also support models like the patientcentered medical home, of which PBPH is a component. Another opportunity presented by health reform is that it may lead to a uniform set of performance measures, which would make it easier for vendors to develop products that address PBPH and meet the needs of primary care practices.

Incentives to Medicare and Medicaid providers who demonstrate “meaningful use” of EHRs, which were introduced in ARRA, are likely to boost health IT adoption. PBPH could most directly be supported by this legislation if PBPH functionalities are incorporated into those criteria. ARRA could also increase the amount of information available in electronic form by boosting EHR adoption and health information exchange nationwide. Finally, the ARRA-funded extension centers could provide training to help providers engage in PBPH.

In addition to assistance in using technology, physicians, nurses, and others in the primary care workforce may require additional training to be able to interpret reports on their patient populations. Medical and nursing schools could also support the advancement of PBPH, by helping providers adopt a more population-focused orientation.

Further research may also be important in fostering PBPH. To make population management tools more useful to primary care providers, research could be conducted to advance learning in a number of critical areas—how to automate preventive care or disease management services; to improve natural language processing for converting text into discrete data elements in real time; to effectively use “messy” data in practice; to develop case studies of best practices in PBPH; and to compile specific data elements for PBPH tools.

To translate this project’s findings into practice and, ultimately, influence and advance the transformation of primary care delivery, the concept of PBPH must first be introduced among primary care providers, health IT vendors, educators, policymakers, and third-party payers.

Second, the functionalities required for optimal implementation of PBPH need further vetting and refinement among primary care providers and health IT vendors, which could include adding additional technical specifications. Third, educators need to be acquainted with PBPH concepts in order to develop PBPH education and training that incorporates the use of PBPH in primary care practice.

As training and technology to support population management become more available and incentives are established to foster this type of care, PBPH may become a viable option for primary care providers. Such advances will help PBPH contribute to transforming primary care and to improving health care quality, patient health, provider satisfaction, and the efficiency of the health care system.

CHAPTER 1: INTRODUCTION
The transformation of primary care is a key component of current efforts to improve health care in the United States and of the policy debate on national health care reform. Motivation to change the current primary care system stems, in part, from frustration by what Morrison and Smith have called the “hamster health care” model of care.1 This model is characterized by overloaded primary care practices, fee-for-service reimbursement which pays for acute care services rather than chronic condition management, and the “persistent presence of the ‘tyranny of the urgent’ in everyday practice.”2 These factors often combine to create a style and pace of practice that is a threat to quality of care, as it neither adequately assesses nor systematically improves the health of the population, or panel, of patients seen by a provider.

A key aspect of primary care transformation is the proactive management of a panel of patients within an individual practice. The project presented here focused on this facet of transformation and introduced a concept to characterize its core—Practice-Based Population Health (PBPH). We define PBPH as an approach to care that uses information on a group (“population”) of patients within a primary care practice or group of practices (“practice-based”) to improve the care and clinical outcomes of patients within that practice.

This report describes the concept of PBPH and the information management functionalities that may help primary care practices to move forward with this type of proactive management. With funding from the Agency for Healthcare Research and Quality (AHRQ), the National Opinion Research Center (NORC) at the University of Chicago has identified the functionalities necessary to more effectively prevent disease and manage chronic conditions using a PBPH approach. Specifically, through consultation with primary care providers and an expert panel, we have developed and vetted a list of functionalities to support the PBPH approach to care. While this project focused primarily on the information management functionalities that may help primary care practices proactively manage their patient populations, we note that there are a number of other factors important to facilitating this type of care, most notably the need for changes in workflow and new reimbursement models.4 Tackling these issues will be necessary for the widespread adoption of PBPH, and this report briefly addresses them in the next steps section.

This report begins with a discussion of the methodology employed in the project and an explanation of the project’s scope. It then provides a definition of PBPH and a description of its key elements. We present the set of functionalities that was developed and refined as part of this project. We describe how the providers we interviewed are engaging in population management in their practices, and include providers’ views on the importance of the functionalities and their ability to perform them. To place the functionalities in a broader context, we discuss the relationship between these functionalities and health information technology (IT) certification efforts, proposed objectives for electronic health record (EHR) incentive programs, and the patient-centered medical home (PCMH) model. Our research suggests that proactive population management is relatively rare and thus we discuss some of the challenges to adopting a PBPH approach, as well as a series of recommendations from our project’s experts on how to incorporate PBPH into current policy efforts and specific research and dissemination steps that would serve to foster PBPH. The report concludes with a series of examples, identified through an environmental scan, to illustrate how primary care providers are engaging in some elements of population management.

CHAPTER 2: PROJECT METHODOLOGY
With this project, AHRQ sought to build on earlier work done by the Institute for Healthcare Improvement (IHI). According to the 2007 IHI report, Health Information Technology for Improving Quality of Care in Primary Care Settings,  health IT may improve primary care through: (1) direct benefits, such as operational efficiency and safety achieved by reduction of administrative or clinical errors; and (2) improvements to the system of care, such as proactive planning for population care and whole patient view for planned care. IHI focused on the second area—systems improvements—and our work on this project continued that focus. We incorporated elements from the recommendations of the IHI report into our initial list of functionalities, which were then refined, as described later in this chapter. This project also expanded on the IHI report by seeking additional examples of the approaches primary care practices are taking to incorporate health IT into population health management.

To develop the concept of Practice-Based Population Health (PBPH) and the functionalities to support it, we conducted an environmental scan, convened a group of expert advisors, and conducted a series of semi-structured interviews with primary care providers and office staff.

CHAPTER 7:  CHALLENGES AND NEXT STEPS
Although our interviews and environmental scan identified several examples of primary care practices engaging in proactive population management, there are a number of barriers to its widespread adoption. This section highlights some of the challenges that primary care practices and individual providers face in implementing PBPH. It also includes recommendations from our experts for promoting a population health management approach to primary care.

Challenges to Adoption of  PBPH
Through our discussions with providers and other office staff, as well as input from the experts, we identified some of the major barriers to the adoption of PBPH. There are challenges related to both technology and data that need to be overcome. In addition, changes in reimbursement may be needed to support this paradigm. Lastly, a shift in physicians’ views of care delivery and their workflow may be necessary.

Adopting either a registry or an EHR may be necessary to support the engagement of a primary care practice in PBPH. However, it is important to acknowledge that at this point, adoption of this technology is far from universal. In 2006, just below 30 percent of office-based physicians reported using full or partial EHR systems, with use increasing with the number of physicians in the practice. Registries may also be more common among larger practices, but one national survey of practices with 20 or more physicians found that fewer than half (47 percent) had a registry for at least one chronic disease.

There are many explanations for the slow adoption of EHRs. In our interviews, providers discussed some of the reasons they have not implemented EHRs including the purchase cost, training expenses, productivity loss, lengthy transition time, and uncertain return on investment. These reasons are echoed widely in the literature. Although it is clear that lack of health IT adoption is a critical obstacle to PBPH, our interviews also demonstrated that implementing an EHR or a registry is not sufficient for a practice to engage in population health management. Below, we focus on those challenges specific to PBPH.

Technology Issues
Among populations that adopt a registry or EHR, technology-related challenges remain. To adequately support PBPH, systems need to be user-friendly and contain robust PBPH capabilities, which lead to improved efficiencies. Some providers who were initially enthusiastic about technology spoke of how they are disappointed at their inability to use systems in the way they had envisioned. Other providers face challenges in finding systems that have the functionality they require for supporting PBPH.

For instance, most available systems do not easily generate reports, nor do they present data in a manner that can easily be applied to practice. To try to make off-the-shelf systems more compatible with their needs, some practices build their own back-end SQL reporting systems to allow them to generate reports. Unfortunately, with this additional layer of complexity, clinicians may not be able to run the reports themselves. Some providers we interviewed felt very disconnected from the “black box” from which their reports were generated. One provider mentioned that she does not feel that she has time to request a report from a central office; whereas when she had worked in a smaller practice and could generate reports on her own, she was more inclined to do so.

Systems also may not have tickler/notification systems that are easy to implement. The providers we interviewed noted the importance of alerts and reminders for ensuring patient compliance. However, if not chosen carefully, many alerts and reminders usually lead to alertfatigue, with providers ignoring what may be important information. Many providers said they would like to be able to set reminders that appear in their inboxes at a future date, designed as a tickler system, so that they are not overwhelmed with alerts about followup activities that may be months away. At the same time, providers would like an area within a patient record that summarizes the tests and services due for that patient in the near future, so that scheduling for the next appointment can occur concurrently with the patient’s visit. Providers also expressed a desire to be able to prioritize pop-up reminders according to urgency.

Some practices actively seek software that supports PBPH, but in our interviews we found that many do not. According to one expert, many clinicians view usability of technology in terms of what allows them to continue practicing medicine as it was practiced in a paper-based office. This viewpoint may impact the availability and utility of today’s products—if providers are not seeking tools needed for PBPH, vendors will not have the incentive to create tools to support these functionalities. Several panelists stated that the functionalities in the systems that vendors sell are the functionalities that customers request. Panelists noted that “enterprise customers,” such as cities or regions that represent a large number of providers, have had success in increasing the population health management functionalities offered in vendor products.

Data Issues
Clinicians are quite concerned about obtaining accurate data. At issue are three items: practices must have accurate, comprehensive data generated from within their practice that is in a usable format; practices need access to patient information that is generated from other parts of the health care system, such as laboratory and pharmacy data; and systems must be able to use data to produce standardized and meaningful reports.

Reports generated by information systems are only as good as the data that enter those systems. This data must be entered in a discrete form to support PBPH, so that the data can be searched. Many EHRs do not have data fields for important facets of PBPH. For example, one of our interviewees mentioned that EHRs are typically able to capture smoking status, but are not able to capture smoking history or such subtleties as recording that someone is a social smoker. Although this particular group worked with its vendor to create such functionality, unless there is broad consensus on the types of data fields that are important for preventive care, such fields will be introduced only piecemeal, if at all. Even if appropriate data fields exist, requiring that members of the practice record all relevant information about their patient interactions may generate an unacceptable negative impact on workflow. One provider whom we interviewed noted that it was difficult to train his care team to consistently take note of relevant pieces of information from the patient visit.

In the absence of such data sources, many practices rely on billing data to create reports or identify populations of practice. Such data are often inaccurate and fail to capture sufficient clinical information to support PBPH. For instance, a practice would be unable to use billing data to identify which of the diabetics in the group are poorly controlled.

To fully engage in PBPH, practices need to be able to obtain data from outside of their practices. Those who receive outside data on paper are burdened with manual data entry if they wish to include those data in their systems. Ideally, providers should have access to data exchange mechanisms that allow them to receive patient health information in a standardized, discrete form from laboratories, pharmacies, and other providers and to electronically incorporate this information into their patient records. Many areas in this country lack health information exchange mechanisms, making it difficult for practices to receive patient health information electronically. Even among practices that can receive information transmitted electronically, it may not be in a searchable form. While many EHRs are able to store scanned documents from other providers, the information within these saved documents cannot be searched or captured in reports.

There is a lack of standardization when it comes to generating reports and calculating performance measures. Providers are accountable to a variety of different payers, each with its own guidelines and individualized benchmarks for care. These different requirements impose a large burden on a provider needing to meet the requirements of each of its insurers. As one physician stated, “I want to see standards… rather than each insurer saying they want to look at different things. There’s a hoop for each carrier.” The absence of standardized performance measures may force providers to avoid PBPH-type care and to prioritize the allocation of resources according to the reporting required by their payers for reimbursement.

A particularly challenging issue related to tracking quality measures pertains to the denominators used to generate performance reports. First, queries need to have filters to ensure that patients who should not be included, such as those who are no longer living or those who have transferred to a different practice, are not included in the calculation of performance measures. Many of the providers we interviewed explained that systems need built-in

mechanisms, such as the integration of exception codes, to be able to exclude from calculations patients who have, for example, refused treatment. Currently there is no consensus on how these types of exception codes should be added into health IT systems, and taken into account by payers and others who use the performance data.

Another limitation is the lack of standards related to accounting for individuals for whom guidelines are inappropriate. One physician pointed out, “If you have a patient with five significant medical problems and you try to manage that patient by following the guidelines for the five chronic diseases, you’ll kill [him]!” Without the ability to make accurate calculations, providers may dismiss performance reporting as inaccurate and meaningless. Developing consensus and standards around performance reporting would help advance population management.

Reimbursement Issues
The current model of reimbursement of care creates disincentives to the practice of PBPH and the proactive management and coordination of care. Currently, care is reimbursed primarily would have to be provided without reimbursement. According to current estimates, 40 percent of the primary care workload is not reimbursed under the face-to-face fee-for-service approach to reimbursement.32 PBPH would add to this already heavy burden. A practice must cover its costs in order to remain viable. Clinicians have little choice but to provide only the care insurers consider to be important, which today does not include a PBPH approach. As one provider said, physicians “do [what] we do now because that’s the way we can survive.”

In our interviews we saw a pattern of clinicians utilizing PBPH when there are programs in place to reimburse for that care. For example, several practices are using chronic disease management systems to track patient care related to diabetes or hypertension when their payers have programs which reward that care. Others had devised systems to report the measures necessary for Medicare’s Physician Quality Reporting Initiative (PQRI). Reimbursement policies that provide incentives for proactive preventive care and disease management more broadly would make the practice of PBPH more viable.

Paradigm Shift for the Practice of Care
The movement towards PBPH requires a shift in how medicine is practiced, including changes in providers’ attitudes, workflow, and overall approach to care. As one panelist described it, “PBPH requires moving from running on the hamster wheel to proactively managing a patient panel. This wasn’t how most clinicians were trained to conceptualize their job.” This shift may be met with some resistance as providers assess the impact of making this change on their practices.

It is not hard to see how and why PBPH may be inconsistent with how providers view the practice of medicine. Clinicians are trained to treat their patient populations by providing individualized care to one patient at a time. As one provider stated, “we define our work by what is done in the exam room.” The physician-patient relationship relies heavily on the physician’s ability to develop a trusting relationship with the patient to influence health behaviors. Moving the focus from the individual to the population level constitutes a paradigm shift and may alter how providers view their relationships with their patients. As one provider commented, “population management is something that is taking our physicians a long time to understand.”

Proactively thinking about the entire population is very different from reacting to individual encounters with patients who arrive at the practice. Several of the clinicians we interviewed were uncomfortable about the implication of proactively reaching out to patients to induce them to seek appropriate care. Currently, practices see only those patients who are sufficiently committed to maintaining their health that they schedule appointments. Some clinicians expressed that they were not interested in providing care to patients who did not seek care. In addition, there was concern that the end result may be for patients to be even less accountable for their care than they are today. This shifting of responsibility from the patient to the clinician may not be a burden clinicians want to undertake, especially for those who feel strongly that this is beyond the scope of their responsibilities.

The clinicians we interviewed also expressed concern as to whether or not their practices have the capacity to expand their scope. Many feel they are working to their limits, with timeconstrained schedules, already leading to limited time with patients. There is real concern on he part of providers that PBPH will increase the need for more appointments than their chedules can accommodate.

Adopting PBPH, especially if the use of new technology is involved, has an impact on workflow. For example, rather than relying on dictation of notes following a patient visit, relevant data must be entered into discrete fields in an EHR or a registry for it to be queried and used for population health management. As one physician interviewee commented, “Physicians preferred the EMRs that looked and acted like old paper charts, but [those EMRs] couldn’t manage datasets very well.” The loss of productivity as workflows are adjusted and providers learn new techniques is another concern.

Finally, collecting and documenting data on the patient population represents a significant time burden for physicians and can, as one provider stated, “detract from your ability to care for someone.” Some of the providers we interviewed recommended that health IT systems be developed with enough simplicity so that others within the practice are able to query the system and engage in PBPH. If providers are able to delegate query tasks, it may reduce the time and burden associated with implementing PBPH.

Leveraging Policies to Address Challenges
The project experts noted several opportunities to address some of the above challenges and increase the adoption of PBPH. In particular, they discussed how PBPH could be incorporated into important policy initiatives related to health care reform, ARRA, and initiatives to strengthen the primary care workforce.

Health Care Reform
Proposed efforts to reform the country’s health care system and provide insurance for a greater number of individuals elevate the importance of re-examining the way primary care  services are reimbursed. Reimbursement systems with a greater emphasis on outcomes may incentivize practices to devote additional resources to and more fully engage in PBPH. If providers are more motivated to proactively provide preventive care and disease management services, they may be more likely to demand applications with this functionality. This, in turn, may give IT vendors the incentive to develop such programs. Models like PCMH, which has substantial overlap with PBPH, may also be incentivized in health care reform efforts. This may help support many of the components of proactive population management.

Many of our experts noted that an incremental approach to payment reform may be preferable. It may be appropriate, therefore, to implement rewards for providers who demonstrate that they are performing some population management tasks—like the functionalities outlined here. This could serve as a first step towards payment based on health outcomes.

Health care reform may also smooth the way for PBPH by establishing a uniform set of performance measures. Clarification about what types of measures should be included in a PBPH application will make it easier for vendors to tailor products to the needs of primary care practices. There is already some precedent, on a local level, for this type of harmonization of performance standards. For example, as part of the Quality Health First Initiative, the Indiana Health Information Exchange (IHIE) and a coalition of local employers convened employers, insurers, providers, and other stakeholders to develop a consensus set of quality measures. IHIE generates reports on these measures and disseminates them to participating clinicians.

Addressing concerns about inconsistent measures could make PBPH easier for vendors designing products and reduce provider resistance by distilling population-level data into a set of reports that contain, in one place, all the tracking information necessary for the full panel of patients.

A final benefit from health care reform might be establishing a larger role for patients in their own care. One of our experts explained that involving patients with managing their personal health records allowed them to prevent errors, particularly with medication management. More actively engaged patients may help practices to develop a more comprehensive picture of their patients, which is a key requisite for successful population management.

American Recovery and Reinvestment Act (ARRA)    
Under the American Recovery and Reinvestment Act of 2009, the Federal Government is investing unprecedented resources into health information technology. A significant portion of this funding—approximately $36 billion—will be used to provide incentive payments to providers who demonstrate “meaningful use” of EHRs. Approximately $2 billion will be allocated to training providers through regional extension centers. By providing incentives to Medicare and Medicaid providers who demonstrate “meaningful use” of EHRs, ARRA will likely boost health IT adoption. PBPH could most directly be supported by this legislation if the functionalities established as part of this project are incorporated into the meaningful use criteria. As described above, some of the concepts related to PBPH are supported in the initial recommendations for the definition of meaningful use, but the operationalization of those concepts is not yet clear. While it would be optimal to incorporate all functionalities into any new standards that emerge from ARRA, inclusion of a portion would still increase the population health capabilities of future systems.

Another benefit of ARRA that is relevant to PBPH is the potential to increase the amount of information available in electronic form. If more practices adopt EHRs in order to receive the incentive payments, more data will be stored in discrete forms. In addition, ARRA provides support for health information exchange. This could facilitate the collection of data from other providers and parts of the health care system. This additional information is vitally important for practices trying to manage their patient populations.

Finally, ARRA could also promote PBPH through the provision of training to help providers engage in PBPH. The legislation includes funding for extension centers and training grants to support the implementation of health IT. Our interviews with providers suggest that many will require additional training to take advantage of the population management functions in their systems. On several occasions, we spoke with two individuals from the same practice and each had a different understanding of which functionalities could be performed in their system. It is likely that many providers are not using their current systems to the fullest capacity.

ARRA may provide some opportunities for increased training in the use of health IT to support population management, but workforce development may require investment of resources beyond what is available through ARRA. Physicians, nurses, and others in the primary care workforce who are new to EHRs may require training to effectively use those systems. Even among providers who have adopted an EHR, additional assistance may be needed to enable them to create and interpret reports on their patient populations. They will need to understand how to turn population data into information that can inform practice decisions related to such issues as staffing needs and performance improvement. Training may be required to help providers to capture data efficiently and to use such features as exception codes. Technical assistance may also support the integration of PBPH tools into practice workflows. Additionally, medical and nursing schools could help address one of the other challenges to PBPH—clinician culture. Education and training programs could help providers to adopt a more population-focused orientation. To support this shift in training, it may be necessary to develop PBPH competencies to guide the development of curricula and accreditation exams.

Next Steps
In addition to helping identify the policy opportunities described above, experts offered recommendations for additional research and dissemination to better promote PBPH.

Additional Research
One way to increase the uptake of PBPH is to develop systems that have the potential to be time-savers for primary care providers. Applying clinical decision support (CDS) mechanisms to population health data could automate some processes related to preventive care and disease management services. PBPH systems could not only remind providers and patients about upcoming needs, but could also generate the orders for the required tests. Designing products that have demonstrated value to providers—in both improved outcomes and increased efficiency—is a key to encouraging the spread of PBPH.

Some clinicians may prefer systems that allow them to dictate their notes into an EHR. Whilea great deal of research has been done in the area of natural language processing, further research is needed to effectively convert text into discrete data elements. A greater challenge—one that may call for both technical improvements and new workflows—is to allow those dictated data elements to enter a system in real time so that they can be used to fuel CDS during a given visit.

One potential area for research would be to determine how to make the best use of “messy” data. In addition to trying to make systems that facilitate accurate and complete entry of data, it may be worth determining how to make the most of data that are imperfect. This may entail developing protocols that assess the accuracy of data from different sources and place greater weight on data deemed to be more reliable. Furthermore, a better understanding of the sources of data inaccuracy could inform the development of technology that reduces the likelihood of errors.

A different approach to PBPH-related research would be to gain a better understanding of how practices are able to successfully implement some or all of the functionalities. Through interviews with a variety of providers, we were able to gather some examples of practices that are managing their patient population. However, the interviews were brief and did not allow us to explore more fully how those functionalities are being performed. It might be valuable to conduct a series of case studies to develop a more complete picture of the methods practices are using to engage in PBPH, the obstacles they face, and their techniques for overcoming them. As part of such an effort, a public repository of examples of PBPH reports and techniques that work well could be developed and used to help providers build on the success of other practices’ experiences. In examining PBPH implementations, it would also be valuable to investigate the impact of the functionalities on the efficiency of care delivery and on health outcomes.

Additional research needs include developing a better understanding of the types of data fields and reports that are necessary to support PBPH. As discussed above, the functionalities developed through this effort highlight the ways in which providers should be able to manipulate data to make it actionable. Yet, this project does not provide a list of the specific types of fields that are particularly relevant for primary, secondary, and tertiary prevention. As a followup to this study, clinicians and experts could be consulted to compile a specific list of the data elements that would be important to support a variety of aspects of preventive care, ranging from diabetes management to smoking cessation.

Dissemination
Dissemination of this project’s findings is essential to translate them into practice and, ultimately, to influence and support the transformation of primary care delivery. Successful translation from the current recommended functionalities to primary care providers’ offices is predicated on marketing the concept to multiple audiences. The experts identified key issues and audiences who will be critical in increasing the uptake of PBPH. First, the concept of PBPH must be introduced among primary care providers, health IT vendors, educators, policymakers, and third-party payers. Second, the functionalities required for optimal implementation of PBPH need further vetting and refinement among primary care providers and health IT vendors. This could include vetting the revised version of the functionalities presented here with a larger number of providers and adding additional technical specifications in order to make the functionalities more specific for health IT vendors. Third, educators need to be acquainted with PBPH concepts, including opportunities for and barriers to implementation, to develop PBPH education and training that incorporates the use of PBPH in primary care practice.

CONCLUSION
The technology to support a shift from “hamster health care” to proactive population management is part of a larger transformation of primary care. Although some primary care providers are beginning to adopt a proactive, panel-based approach to care, primary care in the U.S. has not yet undergone this paradigm shift. While not sufficient, health IT tools are necessary for conducting PBPH. There is currently a paucity of effective, usable tools to support a population health approach to primary care. This report outlined the key IT functionalities for PBPH, developed from the perspective of providers.

Defining these functionalities is an important step towards greater adoption of PBPH, but many challenges remain. While the adoption of PBPH, as defined in this report, has the potential to improve the quality, efficiency, and effectiveness of primary care delivery, implementation of this approach will require broader changes to the way health care is delivered in this country, including changes in reimbursement systems, data accuracy and availability, and provider culture and training. Providers currently lack the incentive to pursue a proactive, population-based approach to care, given the limitations of the existing reimbursement system. As long as there is limited demand from providers, it is unlikely that vendors will develop the appropriate tools or that consensus will be established on the specific algorithms and data fields necessary for PBPH. Funding for pilot projects to support the development of tools designed by clinicians for clinicians is warranted. As technology evolves, products will incorporate features that will make tools both easier to use and more valuable to providers.

ARRA and pending health care reform legislation offer tremendous opportunities to support the transformation of primary care. The definition of meaningful use for the ARRA incentives is still under discussion. While components of PBPH are included in preliminary recommendations to the National Coordinator, more explicit consideration of objectives to encourage population based care may be warranted. Significant funding from ARRA has been devoted to training providers through regional extension centers. Targeted PBPH training for the health care and health IT workforce will empower providers to better use existing tools and become more savvy consumers. Health reform legislation may also offer opportunities to promote PBPH, especially if restructuring reimbursement for primary care is a critical component of reform.

As training and technology to support a population health approach to primary care become more available and incentives are established to foster this type of care, PBPH may become a more widely viable option for primary care providers. Such advances will help PBPH contribute to transforming primary care and to improving health care quality, patient health, provider 3satisfaction, and the efficiency of the health care system.

#    #    #
Chapter  8 contains examples of Population Health Management including:
–Indian Health Service: iCare
–Washington State Department of Health: Chronic Disease Electronic Management System.
–Vermont Department of Health: DocSite
–New York City Department of Health and Mental Hygiene Primary Care Information
–Project: eClinical Works
–Kaiser Permanente
–Mayo Clinic
–Community-Based Practices

See previous post on AHRQ’s PCMH Web site and a Health IT White Paper called “Necessary, but not sufficient: The HITECH Act’s Potential to Build Medical Homes.”

Colorado 9News Reports on Electronic Health Records

Connecting doctors and patients through online medical records.
On July 26, 2010, Dr. John Torres of Denver, Colorado TV News reported on electronic health records, talking to a patient, Dr. Deb Friesen of Kaiser Permanente, and Phyllis Albritton, Executive Director of Colorado Regional Health Information Organization (CORHIO). Video preceded by a brief commercial.  Click here or photo below to go to video.

Phyllis Albritton, CORHIO

Phyllis Albritton, CORHIO

Found the video in the News section of CORHIO’s Web site.
 

Health Information Exchange: From Princeton to Washington, DC Conferences

July 22, 2010: HIE Day in Two Cities
WASHINGTON, DC (July 22, 2010) — With more than 400 delegates to the National HIE Summit from 38 states meeting in the nation’s capital today and over 125 delegates to the New Jersey HIE Summit & Expo meeting in Princeton, NJ, you can see federalism at work in Health IT.

In the Washington, DC Conference produced by the national eHealth Initiative, and hosted at the Omni Shoreham Hotel, the the topics of the day are:
Getting Started: What to do first?
Sustainability: What works?
Getting to Meaningful Use
Inter-State Coordination
Understanding and Connecting to the NHIN
Engaging Consumers in Health Information Exchange
Measuring Your Progress: What Really Matters?
Beyond Implementation: Planning for Privacy

The Washington session ends with a networking reception.

The Princeton, NJ Conference produced by NJTC (New Jersey Technology Council), and hosted at the New Jersey Hospital Association Conference Center, will cover:
NJ Health IT Extension Center (NJ-HITEC)
Colleen Woods, newly appointed Statewide Health IT Coordinator for New Jersey, will make a presentation.
Components of a Successful HIE
                 Developing a Sustainable Business Model for HIE
                 Managing an Effective Procurement Process
                 Engaging and Supporting Physicians in the Adoption of Heath IT
                 Building Public Private Sector Partnerships for HIE
HIPAA HITECH – Audits, Breaches & Fines
Navigating the Winding Road
                 Know Your Obligations
                 Identify and Address Gaps
                 Security Rule Compliance
                 Test Your Program and Consider Lessons Learned now Your Obligations
HIE Privacy, Security and Compliance
                 Understanding Meaningful Use Requirements
                 Understanding and Applying the New Standards Requirements
                 Developing and Implementing Strong Privacy and Security Policies
                 Advancing Administrative Simplification Efforts

Technologies that Transform Patient Care    

The Princeton session ends with an ice cream reception.   

Personal Notes
In Princeton, Vikas Khosla, President and CEO of  BluePrint Healthcare IT (and my boss), is participating in a panel discussion and focusing on  ”Developing and Implementing Strong Privacy and Security Policies” and joining two of my colleagues Gregory Michaels, Director, Security and Compliance; and Pam Kaur, Client Services Team Lead, who will be attending and working BluePrint’s exhibit table.

In Washington, as VP, Strategic Development and Public Policy, for BluePrint (and as e-Healthcare Marketing blogger), I will be listening, learning, meeting, and greeting state HIE coordinators and Health IT folks from across the country. And we’ll compare notes when the day is done.

BluePrint also issued a press release July 21, 2010 announcing two products that support secure health information exchange by lowering barriers to HIE interoperability and promoting patient confidence: HIE Secure and EMR Secure.

While e-Healthcare Marketing independently collects and reports information on Health IT including EHRs, ONC, CMS, and public policy, a view of the blogger and his business colleagues seemed worth noting today. Thank you for reading.
Mike Squires

ONC Blogs on ‘EHR Security: A Top Priority’

EHR Security: A Top Priority
Monday, July 19th, 2010 | Posted by:
Dr. Deborah Lafky, MSIS Ph.D. CISSP on ONC’s Health IT Buzz Blog and republished in e-Healthcare Marketing
With the passage of the HITECH Act, Congress made health IT security a top priority. ONC is committed to making electronic health information as secure as technically and humanly feasible.

That’s why ONC on April 1, 2010, launched an 18-month, multi-million dollar effort to improve the state of security and cybersecurity across the health IT spectrum. Key initiatives include:

  • Increasing health IT security by systematically assessing risk and providing tools and guidance to minimize it, including product configuration manuals and checklists to help assure secure health IT installations;
  • Educating the health IT community about security awareness with training, video, literature, and other materials;
  • Equipping the health IT workforce with the knowledge they need to manage health IT securely; and
  • Creating support functions such as back-up, recovery, and incident response plans to help when security emergencies strike.

Our ultimate goal is to protect patient information and create confidence in health IT’s security. These initiatives, and others, will help us do just that.

ONC recognizes that breaches are a serious issue. Despite stronger laws regarding breach notification, we must be vigilant and ensure they are reported. What may be surprising are the statistics. For example, we know that in the past 5 years, 80 percent of reported lost records were the result of hard drives, laptops, and other storage devices that disappeared. Interestingly, less than 10 percent of health care information breaches resulted from hacking or Internet crime.

So what does this mean in terms of security? It shows that simply preventing the theft or loss of data storage devices would have a huge impact on the security of our electronic health records. Fortunately, this doesn’t require a major investment in equipment or training. Instead, it requires some clear, common sense policies, such as:

  • Securing all computers that contain patient data;
  • Protecting laptops with a combination of physical, technology, and policy-related methods;
  • Locking drive bays to prevent hard drives from being removed;
  • Placing servers in secure areas, strictly limiting access, and maintaining entry/exit logs; and
  • Establishing security policies that require the use of a high-grade encryption algorithm.

As we roll out these ONC initiatives, I hope some of the readers of this blog will share their own best practices: What security measures have you taken or observed? How do you ensure the security of EHRs in your daily work? Share with us what has worked for you – and what has not. We can all learn from experience.

Watch the ONC website for updates on our available security materials and to see our progress.
#                     #                      #
To comment directly to this post on ONC’s  Health IT Buzz Blog, please click here.

Final Rules–Analysis Roundup Starting w/AHIMA, Halamka, HIMSS

Latest analysis and some catch-up from last week

Journal of AHIMA
Kevin Heubusch posted a chart on July 19, 2010 “Tracking Changes in the Menaingful Use Rule,” showing Stage 1 Objectives for Eligible Professionals, Eligible Hospitals and Critical Access Hospitals (CAH), Stage 1 Measures, and Changes from proposed rule.

John Halamka’s Life as a Healthcare CIO
John Halamka  posted “A Meaningful Use and Standards Rule FAQ” on July 19, 2010, providing his personal interpretation of answers to five questions he’s received since the final rules have been announced.

HIMSS
Health Information Management Systems Society (HIMSS) provides several updates on its “Members Only” resource page, “Meaningful Use, Certification Criteria and Standards, and HHS Certification Process,’ between July 13 and July 19, 2010. The latest update, ”Medicare & Medicaid EHR Incentive Programs – What’s Different Between the NPRM and the Final Rule?” reviews the major differences in a five-page document. 

iHealthBeat
Kate Ackerman, iHealthBeat Senior Editor, wrote “Long-Awaited Final Rule on ‘Meaningful Use’ Strikes Compromise” on July 15, 2010 with brief analysis and reactions from experts.

O’Reilly Radar
Brian Ahier posted “Analysis: A defining moment for ‘meaningful use’: How new rules will affect patients, providers, and electronic health records” on July 15, 2010.

Chilmark Research
John Moore provided his viewpoint in “Meaningful Use Perspectve & Resources,” posted on July 15, 2010.

Blumenthal Letter #17: Future of Health Care with EHRs

Investing in the Future of Health Care with Electronic Health Records

Dr. David Blumenthal

Dr. David Blumenthal

A Message from David Blumenthal, the National Coordinator for Health Information Technology
July 13, 2010
(Excerpted from ONC site)

The Health Information Technology for Economic and Clinical Health Act (HITECH), part of the American Recovery and Reinvestment Act, provides for an unprecedented amount of funding to improve the quality and efficiency of our health care system through health information technology. The HITECH Act’s historic investment in HIT will advance health care in our country through adoption and use of EHRs and other tools of our digital age. As the National Coordinator for Health Information Technology, it is my job to facilitate this effort and help health care providers, and the American people, realize the full value and benefits of electronic health records and digital technology.

The publication of the meaningful use final rule and the standards and certification criteria final rule marks the official launch of EHRS in this country. Health care providers now have the guidelines they need to not only implement electronic health records on a widespread basis, but also to use them in a way that improves care for their patients. Standards and certification criteria help ensure that Certified EHR Technology on the market can maintain data confidentiality, share information securely, and perform a well-defined set of functions to help physicians and hospitals realize the full potential of electronic health records and health information exchange.

For those just beginning the transition to electronic health records, the change can be challenging. Providers may not see themselves as technology experts and may be anxious about learning a new system. Patients may have never thought about how their information is stored, and about how the move to electronic data could improve their health care.

I’d like to share with you a few of the many benefits I believe electronic health records can offer providers and their patients:

Complete and accurate patient information
With electronic health records, providers have more accurate and complete information about their patients, enabling them to provide the best possible care. Providers will know more about their patients and their health history before they walk into the examination room.

Better access to health information
Electronic health records facilitate greater access to health information. Providers can diagnose health problems earlier and improve the health outcomes of their patients. Electronic health records also allow information to be shared securely and more easily among doctors’ offices, hospitals, and across health systems, making for better coordination of care.

Patient empowerment
Electronic health records will help empower patients to take a more active role in their health and in the health of their families. Patients can receive electronic copies of their medical records and share their health information securely over the Internet with their families.

On a broader scale, electronic health information exchange will improve tracking of public health trends such as flu epidemics, health disparities, and gaps in health care. These data that are captured, analyzed, and shared will help us understand which interventions lead to better health outcomes and which areas need significant improvement.

Nearly 200,000 providers have already adopted EHRs and are using them at various levels of technological sophistication and ability. With the support of the President, I have pledged to help the rest of America’s clinicians and hospitals join their ranks. I am confident that the majority of adopters will agree that electronic health records have increased efficiencies and improved care.

I encourage health care providers to become a part of the future by becoming a meaningful user of certified electronic health records.

#                            #                          #

See previous post on e-Healthcare Marketing for Final Rules PDFs, Press Release, Fact Sheets, and additional info.
See Dr. Blumenthal’s blog post on same subject as above, republished on e-Healthcare Marketing.