12 Introduction to Health Information Privacy and Security .docx
- 1. 12 Introduction to Health Information Privacy and Security FIGURE 1.7. Service areas accredited by the National Committee for Quality Assurance (NCOA) Accountable care organizations Health plan accreditation Wellness and health promotion Managed behavioral healthcare organizations New health plans Disease management Source: NCQA 2012 more than 30 states exempt NCQA-accredited organizations from state audit requirements (NCQA 2012). The Healthcare Effectiveness and Data Information Set (HEDIS) is a tool offered by NCQA that measures the quality of health plans. Health plan purchasers- which are mostly employers-and consumers use it to compare health plan performances (Gregg Fahrenholz 2012). The service areas that NCQA accredits are listed in figure 1.7. ONC-Authorized EHR Certification Bodies The adoption of electronic health records (EHRs) among healthcare providers has been a continuous process. As this section will discuss, the federal government has propelled this process forward by creating guidelines and financial incentives
- 2. for EHR adoption. EHR Adoption and Meaningful Use For several years the federal government has promoted the adoption of health information technology, specifically the EHR, by healthcare providers. The Office of the National Coordinator for Health Information Technology (ONC), an agency within HHS, was formed in 2004 via presidential executive order to guide this initiative. The agency was later codified ( established by statute) via ARRA. However, adopting an EHR has been daunting for many providers. The significant cost of adopting an EHR has been the greatest concern. There are also logistical concerns associated with implementing both a new product and a new workflow. Finally, many providers with little knowledge of technology have been overwhelmed with the prospect of selecting one EHR vendor from dozens of options. How do they discern good products from bad products, and reputable vendors from vendors that are not trustworthy or not likely to remain in business to provide technical supports and upgrades? One of the most important steps a provider can take is to select an electronic health record that has been certified by an ONC-authorized technology review body. These ONC designees, Office of the National Coordinator for Health Information Technology-Authorized Testing and Certification Bodies ( ONC-ATCBs) and Office of the National Coordinator
- 3. for Health Information Technology-Authorized Certification Bodies (ONC-ACBs), test EHR systems to make sure they comply with HHS standards and certification criteria. If they do, the EHR systems are certified. By purchasing a certified product, a provider is ensured that the EHR meets key standards and is capable of performing the required functions (ONC 2012). The ONC-ATCB program will sunset when the permanent ONC-ACB certification program is in place. This was to occur no earlier than January 1, 2012, and it has been delayed. How Health Information Is Regulated I 13 In addition to required privacy and security features, an important element of certification is meaningful use, which describes a government-prescribed level of effective EHR use. According to ARRA, "three components of meaningful use are: ( 1) use of a certified EHR in a meaningful manner, (2) use of certified EHR technology for electronic exchange of health information to improve quality of healthcare, and (3) use of certified EHR technology to submit clinical quality and other measures" (CMS 2012). Three meaningful use time periods have been established. Under Stage 1, hospitals must meet 14 required core objectives and must select five menu set objectives from 10 options to achieve meaningful use. Eligible professionals (including physicians, dentists, optometrists, chiropractors, and podiatrists) must meet 15 required core
- 4. objectives and must select five menu set objectives from 10 options to achieve meaningful use. Figures 1.8 and 1.9 list the required core objectives and the menu set objectives for hospitals and eligible professionals, respectively. To be staged in over five years, Stage 1 (years 2011 and 2012) sets meaningful use baseline criteria. Stage 2 ( with the final administrative rule published in August 2012) and Stage 3 (expected for year 2015) will expand on the baseline criteria (CMS 2012). Without providing functionalities that enable a hospital or eligible provider to meet meaningful use criteria, an EHR product cannot be certified. Although the ultimate goal of EHR use is improved patient care, Stage 1 is designed primarily to motivate providers to implement EHRs (Dimick 2011). Elements of Stage 2 include: • "Allowing patients to view online, download, and transmit their health information from participating physicians within four business days of the information being available" • Requiring eligible hospitals to "allow patients the ability to view online, download, and transmit their health information within 36 hours of discharge" • Requiring physicians and hospital staff to "track how many patients access their health records during the program reporting period" ( to meet meaningful use requirements, greater than five percent of patients seen by a physician or discharged
- 5. by a hospital must access their records) • Requiring healthcare providers to "offer and use secure electronic messaging to communicate with patients on relevant health information'' ( to meet meaningful use requirements, five percent of patients must use this feature) • Aligning "clinical quality measures with other reporting programs to reduce burden and duplication of efforts" and • Transitioning "all HIT Menu Set measures to Core Set of measures except for electronic syndromic surveillance data and advance directives" FIGURE 1.8. Hospital core objectives and menu set objectives for Stage 1 meaningful use 1 2 Co re Objectives Use computerized provider order entry (CPOE) for medication orders directly entered by any licensed healthcare professional who can enter orders into the medical record per state, local, and professional guidelines. Implement drug-drug and drug-allergy interaction checks .
- 6. (Continued on nex t page) "·· 14 Introduction to Health Information Privacy and Security FIGURE 1.8. (Continued) Core Objectives 3 Maintain an up-to-date problem list of current and active diagnoses. 4 Maintain active medication list. 5 Maintain active medication allergy list. 6 Record all of the following demographics : preferred language; gender; race; ethnicity; date of birth ; date and preliminary cause of death in the event of mortality in the eligible hospital or critical access hospital. 7 Record and chart changes in the following vital signs : height; weight; blood pressure; calculate and display body mass index (BMI) ; plot and display growth charts for children 2 to 20 years, including BM!. 8 Record smoking for patients 13 years old or older. 9 Report hospital clinical quality measures to CMS or, in the case of Medicaid
- 7. eligible hospitals, the states. 10 Implement on clinical decision support rule related to a high priority hospital condition along with the ability to track compliance with that rule . 11 Provide patients with an electron ic copy of their health information (including diagnostic tests results, problem list, medication lists, medication allergies, discharge summary, procedures), upon request. 12 Provide patients with an electron ic copy of their discharge instructions at time of discharge, upon request. 13 Capability to exchange key clinical information (for example, problem list, medication list, medication allergies, and diagnostic test results), among providers of care and patient authorized entities electronically. 14 Protect electronic health information created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities . Menu Set Objectives 1 Implement drug formulary checks .
- 8. 2 Record advance directives for patients 64 years old or older. 3 Incorporate clinical lab-test results into EHR as structured data . 4 Generate lists of patients by specific conditions to use for quality improvement, reduction of disparities, research, or outreach . 5 Use certified EHR technology to identify patient-specific education resources and provide those resources to the patient if appropriate . How Health Information Is Regulated i:.:~ l=tb!u~J ~ . (Continued) 6 7 8 9 10 Menu Set Objectives 1 The eligible hospital or critical access hospital that receives a patient from I another setting of care or provider of care or believes an encounter is relevant
- 9. I should perform medication reconciliation. I 1 The eligible hospital or critical access hospital that transitions their patient to I another setting of care or provider of care or refers their patient to another provider of care should provide summary care record for each transition of care I or referral. Capability to submit electronic data to immunization registries or immunization I information systems and actual submission according to applicable law and practice. I Capability to submit electronic data on reportable (as required by state or local law) lab results to public health agencies and actual submission according to applicable law and practice. I Capability to submit electronic syndromic surveillance data to public I health agencies and actual submission according to applicable law and
- 10. practice . I Source: CMS 2012 FIGURE 1.9. Eligible professional core objectives and menu set objectives for Stage 1 meaningful use Core Objectives 1 Use computerized provider order entry (CPOE) for medication orders directly entered by any licensed healthcare professional who can enter orders into the medical record per state, local, and professional guidelines . 2 Implement drug-drug and drug-allergy interaction checks. 3 Maintain an up-to-date problem list of current and active diagnoses . 4 Generate and transmit permissible prescriptions electronically (eRx). 5 1 Maintain active medication list. 6 I Maintain active medication allergy list. 7 I Record all of the following demographics: preferred language; gender; race; 1 ethnicity; date of birth. 15
- 11. (Continued on nex t page) 16 Introduction to Health Information Privacy and Security I l::llC'l.11:i ~ (Continued) 8 Record and chart changes in the following vital signs: height; weight; blood pressure; calculate and display body mass index (BMI); plot and display growth charts for children 2 to 20 years, including BMI. 9 Record smoking status for patients 13 years old or older. 10 Report ambulatory clinical quality measures to CMS or, in the case of Medicaid eligible professionals, the states . 11 Implement on clinical decision support rule relevant to specialty or high clinical priority along with the ability to track compliance with that rule. 12 Provide patients with an electronic copy of their health information (including diagnostic tests results, problem list, medication lists, medication allergies) upon request. 13 Provide clinical summaries for patients for each office visit.
- 12. 14 Capability to exchange key cl ini ca l information (for example, problem list, medication list, allergies, and diagnostic test results) , among providers of care and patient authorized entities electronically. 15 Protect electronic health informat ion created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities. Menu Set Objectives 1 Implement drug formulary checks. 2 Incorporate clinical lab-test results into EHR as structured data . 3 Generate lists of patients by specific conditions to use for quality improvement, reduction of disparities, research, or outreach. 4 Send patient reminders per patient preference for preventive or follow-up care. 5 Provide patients with timely electronic access to their health information (including lab results, problem list, medication lists, and allergies) within four business days of the information being available to the eligible
- 13. professional. 6 Use certified EHR technology to identify patient-specific education resources and provide those resources to the patient if appropriate . 7 The eligible professional who receives a patient from another setting of care or provider of care or believes an encounter is relevant should perform medication reconciliation. 8 The eligible professional who transitions their patient to another setting of care or provider of care or refers their patient to another provider of care should provide summary care record for each transition of care or referral. How Health Information Is Regulated FIGURE 1.9. (Continued) 9 10 Menu Set Objectives Capability to submit electronic data to immunization registries or immunization information systems and actual submission according to
- 14. applicable law and practice. Capability to submit electronic syndromic surveillance data to public health agencies and actual submission according to applicable law and practice. So urce: CMS 2012 FIGURE 1.10. Description of EHR adoption incentive plan timelines for eligible professionals Qualifies to Receive First Medicare Incentive Payment in ... Payment Amount I 2011 2012 2013 2014 2015 by Year 2011 I $1s.ooo - 2012 I $12,000 $18,000 - 2013 I $8,000 $12,000 $15,000 - 2014 I $4,000 $8,000 $12,000 $12,000 - 2015 $2,000 $4,000 $8,000 $8,000 2016 $2,000 $4,000 $4,000
- 15. Total payment $44,000 $44,000 $39,000 $24,000 Source: Dimick 2011 The compliance date for Stage 2 meaningful use is 2014. (AHIMA 2012) 17 Payments from the federal government have already begun for those who have demonstrated Stage 1 meaningful use. Eligible professionals in the Medicare EHR Incentive Program must achieve meaningful use of a certified product by 2014 to be eligible to receive the government's incentive payments. Funds for incentive payments were established in ARRA. A final rule by CMS in July 2010 established the details of the incentive program, which was developed in conjunction with ONC. The first EHR products were certified for the incentive programs in autumn 2010. Registration for the Medicare program began in January 2011. For demonstrating meaningful use of certified health IT systems, physicians in the Medicare program are eligible to earn up to $44,000. If they qualify for the first payment in 2011 or 2012, they can receive the full amount. The meaningful use incentive plan timeline for eligible professionals is detailed in figure 1.10. It shows that providers who enter the incentive program early earn the greatest amount of money (Dimick 2011).