Department of Health and Human Services 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
 
E A F
ARLY  SSESSMENT  INDS 
 
 
T CMS F
HAT    ACES 
 
 
O O
BSTACLES IN  VERSEEING 
 
 
M EHR
THE  EDICARE   
 
I P  
NCENTIVE  ROGRAM 
 
Daniel R. Levinson  
Inspector General 
 
November 2012 
OEI-05-11-00250 
     
   
EARLY ASSESSMENT FINDS THAT CMS FACES OBSTACLES IN 
OVERSEEING THE MEDICARE EHR INCENTIVE PROGRAM, 
OEI-05-11-00250 
 
WHY WE DID THIS STUDY  
 
This study is an early assessment of CMSs oversight of the Medicare electronic health 
record (EHR) incentive program, for which CMS estimates it will pay $6.6 billion in 
incentive payments between 2011 and 2016.  Because professionals and hospitals self-
report data to demonstrate that they meet program requirements, CMSs efforts to verify 
these data will help ensure the integrity of Medicare EHR incentive payments. 
 
HOW WE DID THIS STUDY 
 
This study reviewed CMSs oversight of professionals and hospitals self-reported 
meaningful use of certified EHR technology in 2011, the first year of the program.  To 
address our objective, we analyzed self-reported information to ensure it met program 
requirements.  We also reviewed CMSs audit planning documents, regulations, and 
guidance for the program, and conducted structured interviews with CMS staff regarding 
CMSs oversight. 
 
WHAT WE FOUND 
 
CMS faces obstacles to overseeing the Medicare EHR incentive program that leave the 
program vulnerable to paying incentives to professionals and hospitals that do not fully 
meet the meaningful use requirements.  Currently, CMS has not implemented strong 
prepayment safeguards, and its ability to safeguard incentive payments postpayment is 
also limited.  The Office of the National Coordinator for Health Information Technology 
(ONC) requirements for EHR reports may contribute to CMSs oversight obstacles. 
 
WHAT WE RECOMMEND 
 
We recommend that CMS:  (1) obtain and review supporting documentation from 
selected professionals and hospitals prior to payment to verify the accuracy of their 
self-reported information and (2) issue guidance with specific examples of documentation 
that professionals and hospitals should maintain to support their compliance.  CMS did 
not concur with our first recommendation, stating that prepayment reviews would 
increase the burden on practitioners and hospitals and could delay incentive payments.  
We continue to recommend that CMS conduct prepayment reviews to improve program 
oversight.  CMS concurred with our second recommendation. 
 
We recommend that ONC:  (1) require that certified EHR technology be capable of 
producing reports for yes/no meaningful use measures where possible and (2) improve 
the certification process for EHR technology to ensure accurate EHR reports.  ONC 
concurred with both recommendations.
     
TABLE OF CONTENTS 
 
Objective ......................................................................................................1 
Background ..................................................................................................1 
Methodology ................................................................................................5 
Findings........................................................................................................9 
CMS does not verify the accuracy of professionals or hospitals 
self-reported meaningful use information prior to payment ............9 
CMSs planned postpayment audits may not conclusively verify 
the accuracy of professionals and hospitals self-reported 
meaningful use information ........................................................... 11 
Conclusion and Recommendations ............................................................16 
Agencies Comments and Office of Inspector General 
Response ........................................................................................18 
Appendixes ................................................................................................20 
A:  Meaningful Use Measures for Professionals and Hospitals ....20 
B:  Centers for Medicare & Medicaid Services Assessment of 
Data Sources To Verify the Accuracy of Self-Reported   
Meaningful Use Information, by Measure .....................................26 
C:  Agencies Comments ................................................................30 
Acknowledgments......................................................................................34 
   
   
OBJECTIVE 
To conduct an early assessment of the Centers for Medicare & Medicaid 
Services (CMS) oversight of the Medicare electronic health record (EHR) 
incentive program. 
BACKGROUND  
The Medicare EHR Incentive Program  
The American Recovery and Reinvestment Act (ARRA) established EHR 
incentive programs for both Medicare and Medicaid to promote the use of 
EHR technology by health care professionals and hospitals.1  EHR 
technology refers to computerized recordkeeping systems that store 
patients health-related information, including medical histories and 
procedure notes. 
Only certain types of health care professionals and hospitals are eligible to 
participate in the Medicare EHR incentive program.2  Eligible health care 
professionals include physicians, dentists, podiatrists, optometrists, and 
chiropractors.  Eligible hospitals include acute care hospitals and critical 
access hospitals. 
CMS began making Medicare EHR incentive payments in May 2011 and, 
as of September 2012, had paid about $4 billion to 82,535 professionals 
and 1,474 hospitals.3  Per ARRA, CMS will continue to make Medicare 
EHR incentive payments to professionals and hospitals through 2016.  
CMS anticipates spending an estimated $6.6 billion in incentive payments 
between 2011 and 2016.4  Professionals can receive up to $44,000 each in 
incentive payments over the duration of the program.5  Hospital incentive 
payments for each year of the program begin with a $2 million base 
amount that is adjusted by a number of hospital-specific factors and 
gradually decreased over the duration of the program.6 
 
1
 ARRA  4101 and 4201, amending Titles XVIII and XIX of the Social Security Act (SSA). 
2 SSA  1848(o)(5)(C) and 1886(n)(6), as added by ARRA  4101 and 4102; 
42 CFR  495.100. 
3
 CMS, Data and Reports Page.  Accessed at www.cms.gov on November 15, 2012. 
4
 CMS, Justification of Estimates for Appropriations Committees, Fiscal Year 2012.  
Accessed at www.cms.gov on July 5, 2011. 
5
 SSA  1848(o)(1), as added by ARRA  4101(a); 42 CFR  495.102. 
6
 SSA  1886(n)(2), as added by ARRA  4102(a); 42 CFR  495.104. 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  1 
 
     
   
Medicare EHR Incentive Program Requirements 
To qualify for Medicare EHR incentive payments, professionals and 
hospitals must:  (1) possess certified EHR technology; and 
(2) meaningfully use that certified EHR technology, in accordance with 
requirements defined by CMS, for a 90-day reporting period.7 
Certified EHR Technology.  The Office of the National Coordinator for 
Health Information Technology (ONC) defined EHR technology 
certification requirements in Federal regulations.8  EHR technology must 
include certain functions in support of meaningful use requirements to 
receive certification.9  ONC requires certified EHR technology to be 
capable of producing reports (EHR reports) on meaningful use by 
aggregating information from records in the system. 
ONC also defined the EHR technology certification process in Federal 
regulations.10  According to this process, private entities (certification 
bodies) certify that EHR technology meets certification requirements 
using vendor-supplied test data.11  ONC lists all certified EHR technology 
in the Certified Health Information Technology Product List (CHPL), an 
online, publicly accessible database. 
Meaningful Use.  Professionals and hospitals must also meaningfully use 
their certified EHR technology to qualify for Medicare EHR incentive 
payments.  To meaningfully use certified EHR technology, professionals 
and hospitals must use numerous EHR technology functions defined in 
Federal regulations as meaningful use measures.  These measures 
encompass EHR technology functions meant to improve health care 
quality and efficiency, such as computerized provider order entry, 
electronic prescribing (e-prescribing), and exchange of key clinical 
information. 
Each meaningful use measure has a specified criterion.  Each criterion 
involves performing a one-time action (yes/no measure) or performing a 
certain action for a specified percentage of unique patients, patient visits, 
or other events (percentage-based measure).  For example, one yes/no 
measure requires professionals to enable drug interaction checks in their 
 
7
 The 90-day reporting period applies to a professionals or hospitals first year of 
participation; in subsequent years of participation, professionals and hospitals must 
meaningfully use a certified EHR for the entire year.  SSA  1848(o)(1) and (2), as added by 
ARRA  4101(a); SSA  1886(n)(1) and (3), as added by ARRA  4102(a); 42 CFR  495.4. 
8
 45 CFR pt. 170, subpart C. 
9
 Ibid. 
10
 45 CFR pt. 170, subparts D and E. 
11 Ibid. 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  2 
 
     
   
certified EHR technology.12  One percentage-based measure requires 
professionals to submit more than 40 percent of all prescriptions 
electronically.13 
Professionals and hospitals must meet criteria for a specified number of 
meaningful use measures for CMS to deem them meaningful users.  CMS 
established 25 measures for professionals15 mandatory measures (core 
measures) and 10 additional measures (menu measures).  From the 
10 menu measures, each professional must select and meet 5.  Similarly, 
CMS established 24 measures for hospitals14 core measures and 
10 menu measures.  Like professionals, each hospital must select and meet 
5 menu measures.  Professionals must meet criteria for 20 measures and 
hospitals must meet criteria for 19 measures for CMS to deem them 
meaningful users.14 
Table 1 illustrates the breakdown of yes/no and percentage-based 
meaningful use measures, as well as the total number of core and menu 
measures that CMS established for professionals and hospitals.  For a 
complete list of professional and hospital meaningful use measures, see 
Appendix A. 
Table 1:  Number of Meaningful Use Measures by Type 
      Percentage-Based  Yes/No  Total 
Core  10  5  15 
Professionals 
Menu  6  4  10 
Core  9  5  14 
Hospitals 
Menu  5  5  10 
    Total  30  19  49 
Source:  Office of Inspector General (OIG) analysis of Federal regulations, 2011. 
Demonstrating Meaningful Use of Certified EHR Technology. 
Professionals and hospitals must demonstrate meaningful use of certified 
EHR technology for each year that they wish to receive an incentive 
payment.  As such, professionals and hospitals who received incentive 
payments for 2011 will have to demonstrate meaningful use of certified 
EHR technology anew in subsequent years to receive additional incentive 
payments. 
 
12
 42 CFR  495.6(d)(2). 
13
 42 CFR  495.6(d)(4). 
14
 Many measures for professionals involve objectives and EHR capabilities similar to 
measures for hospitals, although the precise measure definitions differ. 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  3 
 
     
   
Professionals and hospitals demonstrate meaningful use of certified EHR 
technology through online self-reporting in the National Level Repository 
(NLR).  The NLR is a CMS database that stores professionals and 
hospitals information relevant to the EHR incentive program. 
Professionals and hospitals submit self-reported information for 
meaningful use measures to the NLR.  For yes/no measures, professionals 
and hospitals indicate that they have met the measure criteria by checking 
a box.  For percentage-based measures, professionals and hospitals 
provide numerical totals for the numerator and denominator of each 
measure.  For example, to fulfill the e-prescribing measure, professionals 
must report both the number of prescriptions submitted electronically and 
the total number of prescriptions. 
Professionals and hospitals also report their certified EHR technology to 
the NLR using an EHR certification code.  They obtain an EHR 
certification code that corresponds to their certified EHR technology from 
the CHPL database. 
CMSs Oversight of the Medicare EHR Incentive Program 
To oversee the Medicare EHR incentive program, CMS has authority to 
review professionals and hospitals demonstrations of meaningful use.15  
CMSs reviews consist of prepayment validation in the NLR and 
postpayment audits. 
Prepayment Oversight.  CMS conducts prepayment validation of 
professionals and hospitals self-reported meaningful use information to 
ensure that it meets program requirements.  To do so, the NLR runs 
prepayment system edits to validate that self-reported information meets 
measure criteria.  For example, for each percentage-based measure, the 
NLR divides the self-reported numerator by the self-reported denominator 
and determines whether the result meets the relevant percentage threshold.  
The NLR also automatically checks professionals and hospitals 
self-reported EHR certification codes against ONCs CHPL database to 
confirm that they are valid.  CMS does not approve incentive payments for 
professionals and hospitals whose self-reported information fails 
prepayment validation. 
Postpayment Oversight.  To verify that professionals and hospitals 
self-reported meaningful use information is accurate, CMS plans to audit 
selected professionals and hospitals after payment.  It plans to conduct a 
risk assessment using data analyses to select audit targets (e.g., check that 
self-reported denominators are consistent across certain meaningful use 
 
15
 42 CFR  495.8(c). 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  4 
 
     
   
measures).  At the time of our review, CMS had not yet completed any 
postpayment audits. 
Professionals and hospitals selected for audit will first undergo a desk 
audit, during which they will provide documentation supporting their 
self-reported information to CMS.  If CMS is unable to verify the 
accuracy of that information, it will proceed with an onsite audit.  
Professionals and hospitals must retain documentation supporting their 
self-reported meaningful use information for 6 years.16 
Per its policy, CMS will recover incentive payments when audits find 
noncompliance.17  Federal regulations state that professionals and 
hospitals must meet all relevant meaningful use requirements to receive 
incentive payments.18  Partially meeting meaningful use requirements 
does not qualify professionals and hospitals to receive incentive payments. 
Related Work 
This is the second of two OIG studies on CMSs and States oversight of 
the Medicare and Medicaid EHR incentive programs, respectively.  The 
first study in this series reviewed 13 States oversight of their Medicaid 
EHR incentive programs.19  OIG found that all 13 States planned to verify 
compliance with at least half of eligibility requirements prior to making 
EHR incentive payments.  OIG also found that data availability limits both 
the number of eligibility requirements that States plan to verify prior to 
payment and the completeness of those verifications. 
OIG is also conducting a series of audits of Medicare and Medicaid EHR 
incentive payments.  These audits will verify the accuracy of 
professionals and hospitals self-reported meaningful use information, as 
well as eligibility and payment amounts. 
METHODOLOGY 
Scope 
We conducted an early assessment of CMSs oversight of professionals 
and hospitals self-reported meaningful use information for 2011, the first 
year of the Medicare EHR incentive program.  The goal of this assessment 
was to identify any potential vulnerabilities in CMSs initial oversight 
design for the program. 
 
16
 Ibid. 
17
 CMS, Attestation Overview.  Accessed at www.cms.gov on May 9, 2012. 
18
 42 CFR pt. 495, subpart B. 
19
 OIG, Early Review of States Planned Medicaid Electronic Health Record Incentive 
Program Oversight, OEI-05-10-00080, July 2011. 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  5 
 
     
   
For our assessment, we reviewed Federal regulations in effect at the time 
of our data collection.  CMS and ONC have recently issued updated 
regulations for meaningful use and certified EHR technology, respectively.  
Both CMS and ONC plan to issue additional regulatory updates in future 
years of the program. 
We reviewed CMSs current and planned activities to verify the accuracy 
of professionals and hospitals self-reported meaningful use information.  
We also analyzed self-reported meaningful use information for 
professionals and hospitals that CMS approved to receive incentive 
payments. 
We reviewed the components of ONCs certification process and 
requirements for EHR technology that affect CMSs oversight activities 
for the Medicare EHR incentive program.  Because this study focuses on 
CMS oversight, we did not conduct a complete review of ONCs 
certification process and requirements for EHR technology. 
We did not review the appropriateness of the meaningful use measures as 
defined by CMS in Federal regulations.  We also did not review CMSs 
activities to verify that professionals and hospitals were among the types 
eligible for the Medicare EHR incentive program.  Further, we did not 
review the accuracy of CMSs calculated incentive payment amounts for 
professionals or hospitals.  Finally, we did not audit professionals or 
hospitals self-reported meaningful use information to verify its accuracy. 
Data Collection and Analysis 
To address the studys objective, we analyzed professionals and hospitals 
self-reported meaningful use information, CMSs audit planning 
documents, and Federal regulations and guidance for the Medicare EHR 
incentive program.  We also conducted structured interviews with CMS 
staff about current and planned oversight. 
Professionals and Hospitals Self-Reported Meaningful Use Information.  
We collected professionals and hospitals self-reported information from 
the NLR from the programs inception in May 2011 through December 
2011.  We requested all registration, meaningful use, and payment 
information from this period.  This included self-reported meaningful use 
information for 26,653 professionals and 668 hospitals that CMS approved 
for about $1.7 billion in incentive payments.  Professionals and hospitals 
that CMS approved for payments included those that had received 
incentive payments as well as those waiting to receive their payments. 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  6 
 
     
   
We also collected certified EHR technology information from ONCs 
CHPL database.  We obtained a list of all valid EHR certification codes 
that were present in the CHPL database as of December 2011. 
We determined whether professionals and hospitals self-reported 
meaningful use information met meaningful use measure criteria.  
Specifically, we checked that self-reported numerators and denominators 
met the required thresholds for percentage-based measures, that 
professionals and hospitals selected yes for yes/no measures, and that 
they reported the correct number of core and menu measures.  We also 
compared professionals and hospitals self-reported EHR certification 
codes to the list of valid EHR certification codes from the CHPL database. 
We also replicated part of CMSs risk analysis of professionals and 
hospitals self-reported meaningful use information.  We compared 
denominator values across selected percentage-based measures that should 
have the same denominator to detect mismatches.  We selected measures 
for comparison based on CMSs audit planning documents. 
CMSs Audit Plan, Staff Interviews, and Guidance to Professionals and 
Hospitals.  We collected planning documents outlining CMSs audit 
strategy for the Medicare EHR incentive program in December 2011, and 
obtained updates to these documents in April 2012.  The documents 
included a comprehensive overview of CMSs planned audit strategy and 
details on CMSs audit plan for each meaningful use measure. 
In December 2011, we also conducted structured interviews with CMS 
staff about CMSs prepayment and postpayment oversight.  We 
interviewed staff responsible for implementation and oversight of the 
Medicare EHR incentive program, including staff from the Office of 
E-Health Standards and Services, the Office of Financial Management, the 
Office of Information Systems, and the Office of Clinical Standards and 
Quality. 
We analyzed the information from CMSs audit planning documents and 
interviews to identify any limitations to CMSs prepayment and 
postpayment oversight.  First, we reviewed CMSs audit planning 
documents to determine what data sources CMS had identified to verify 
the accuracy of professionals and hospitals self-reported meaningful use 
information.  We then analyzed the interview results to determine what 
current and planned prepayment and postpayment verification activities 
CMS conducts using those data sources. 
We also reviewed Federal regulations for the Medicare EHR incentive 
program, a list of frequently asked questions (FAQ) on the Medicare EHR 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  7 
 
     
   
incentive program, and other information on the CMS Web site to 
determine what audit guidance CMS provided. 
Limitations                                                                                                
This report is an early assessment of CMSs oversight as it existed at the 
time of our data collection.  We did not review completed audits 
conducted by CMS because, at the time of our data collection, CMS had 
not performed any. 
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  8 
 
     
   
FINDINGS 
CMS does not verify the accuracy of professionals or 
hospitals self-reported meaningful use information 
prior to payment 
CMS determines that professionals and hospitals are meaningful users of 
certified EHR technology, and therefore qualify for incentive payments, 
based solely on self-reported information.  CMS does not verify that 
self-reported information is accurate prior to payment.  Although CMS is 
not required to verify the accuracy of this information prior to payment, 
doing so would strengthen its oversight of the anticipated $6.6 billion in 
incentive payments.  Verifying self-reported information prior to payment 
could also reduce the need to identify and recover erroneous payments 
after they are made. 
CMSs prepayment validation functions correctly but does not 
verify the accuracy of self-reported information 
CMSs prepayment validation of professionals and hospitals self-reported 
meaningful use information functions correctly.  We found that all 
self-reported information met meaningful use criteria for professionals and 
hospitals approved for payment as of December 2011.  In addition, all 
professionals and hospitals reported valid EHR certification codes and the 
correct number of core and menu measures. 
Although CMSs prepayment validation functions correctly, it does not 
verify that self-reported information is accurate.  The validation checks 
that self-reported numerators and denominators calculate to required 
percentage thresholds and that all relevant yes/no measures were checked 
yes.  However, it does not verify that numerators and denominators 
entered for percentage-based measures reflect the actual number of 
patients for a given measure or that professionals and hospitals possess 
certified EHR technology. 
Sufficient data are not available to verify self-reported 
information through automated system edits 
CMS staff reported that CMS considered using automated NLR system 
edits to verify professionals and hospitals self-reported meaningful use 
information prior to payment, but found that sufficient data were not 
available to do so.  Automated system edits in the NLR could compare 
self-reported meaningful use information to other data sources as a means 
of verification. 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  9 
 
     
   
 
CMS did not identify any data sources it could use to verify any of the 
49 meaningful use measures.  According to CMS staff, existing internal 
and external data sources are not comprehensive enough for verification 
and, in some cases, are not easily accessible.  Further, no data sources 
exist for many of the meaningful use measures.  Table 2 provides detail on 
CMSs assessment of data sources for verification.  For a measure-specific 
breakdown of the categories in Table 2, see Appendix B. 
 
Table 2:  CMSs Assessment of Data Sources To Verify the Accuracy of 
Self-Reported Meaningful Use Information 
Assessment  Number of Meaningful Use Measures 
Internal CMS data sources are accessible but not 
comprehensive enough for verification (e.g.,  25 
Medicare claims data).  
External data sources are not accessible for 
verification (e.g., privately held e-prescribing data,  6 
State public health agency data). 
No data source exists (i.e., data for measure are 
19 
not currently collected by any entity). 
Internal CMS data sources and external data 
sources exist but are not comprehensive or  (1) 
accessible for verification, respectively. 
   Total  49 
Source:  OIG analysis of CMS documents and interview data, 2012. 
 
CMS has identified internal data sources for 25 meaningful use measures 
but does not use the data to verify the accuracy of self-reported 
information because they do not match measure definitions.  For example, 
CMS cannot verify self-reported denominators using Medicare claims data 
because these data only cover the portions of the denominators associated 
with Medicare patients.  To verify self-reported denominators, CMS would 
also need information about the non-Medicare patients. 
CMS identified external data sources for six measures, but either did not 
have access to them or chose not to use them to verify self-reported 
information at the time of our data collection.  For one measure, CMS 
staff reported that the cost of obtaining e-prescribing data from a private 
company, as well as the logistical difficulty of establishing real-time 
access, prevented CMS from using that source.  For five measures, CMS 
identified public health data sources, such as State immunization 
registries, for potential use.  CMS staff reported that CMS would attempt  
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  10 
 
     
   
 
to gain access to these State data sources but, at the time of our data 
collection, did not yet have access. 
For 19 meaningful use measures, CMS did not identify any data sources it 
could use to verify the accuracy of self-reported information.  CMS staff 
noted that these measures involve information that is not currently 
collected by any entity. 
CMS does not collect supporting documentation to verify 
self-reported information prior to payment 
CMS does not direct professionals or hospitals to submit supporting 
documentation to substantiate their self-reported meaningful use 
information prior to payment.  While collecting this documentation for all 
professionals and hospitals may not be feasible, CMS could feasibly 
conduct risk analyses to select a subset of professionals and hospitals from 
which to request supporting documentation.  CMS could then review this 
documentation to verify those professionals and hospitals self-reported 
meaningful use information where possible.  Conducting such prepayment 
reviews would be consistent with CMSs stated objective of moving from 
a pay and chase model to a prevention-oriented approach focused on 
high-risk providers.20 
Per OIG analysis, if prior to payment CMS had applied one of the risk 
analyses it proposes to use to select postpayment audit targets, it would 
have identified 14 percent of professionals (3,825 professionals) and 
17 percent of hospitals (111 hospitals) for potential prepayment review.  
These professionals and hospitals reported different denominator values 
across selected meaningful use measures that should have the same 
denominator. 
CMSs planned postpayment audits may not 
conclusively verify the accuracy of professionals and 
hospitals self-reported meaningful use information 
In the event of an audit, CMS plans to rely on a combination of EHR 
reports and supporting documentation to verify that self-reported 
information is accurate.  CMS staff reported that they plan to use EHR 
reports to verify the accuracy of self-reported information where possible, 
and obtain supporting documentation from professionals and hospitals as 
necessary to verify measures not covered by those reports. 
 
20
 CMS, Statement by Dr. Peter Budetti, JD, on Fighting Fraud and Waste in Medicare and 
Medicaid.  Accessed at www.hhs.gov on July 18, 2012. 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  11 
 
     
   
To determine compliance conclusively, CMSs audits must verify that 
professionals and hospitals self-reported meaningful use information is 
accurate.  As such, the EHR reports and other supporting documentation 
that CMS plans to rely on must be both sufficient (i.e., cover all aspects of 
each meaningful use measure) and accurate. 
Reports from certified EHR technology are not sufficient for 
CMS to verify self-reported information and may not always be 
accurate 
In the event of an audit, CMS plans to use EHR reports to verify 
professionals and hospitals self-reported meaningful use information.  
These reports aggregate information from individual records in the 
certified EHR technology to support the numbers that professionals and 
hospitals self-reported to CMS to qualify for incentive payments. 
CMS Cannot Verify Self-Reported Information Using Only Reports From 
Certified EHR Technology.  CMS cannot use EHR reports to verify all 
self-reported meaningful use information because ONC does not require 
certified EHR technology to be capable of producing reports for all 
meaningful use measures.  ONC requires only that certified EHR 
technology be capable of producing reports covering professionals and 
hospitals performance on the 30 percentage-based meaningful use 
measures.21  ONC does not require certified EHR technology to be 
capable of producing reports for the 19 yes/no measures.22 
EHR reports also do not contain information necessary for CMS to verify 
all percentage-based measures.  Specifically, the denominators for many 
percentage-based measures include both patients who have records in the 
certified EHR technology and patients who do not (i.e., those who have 
paper records only).23  Because EHR reports contain information only on 
patients with records in the certified EHR technology, CMS cannot use 
them to verify denominators for percentage-based measures that include 
all patients.  For a list of meaningful use measures that require all patients 
in the denominator, see Appendix A. 
 
 
21
 45 CFR  170.302(n). 
22
 Ibid. 
23
 Federal regulations require that denominators for 11 of the 30 percentage-based measures 
include all patients.  For the remaining 19 percentage-based measures, professionals and 
hospitals may choose to include all patients or only those with records in the certified EHR 
technology for the denominator.  42 CFR  495.6 (c)(1)(2). 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  12 
 
     
   
Reports From Certified EHR Technology May Produce Inaccurate 
Information.  One EHR technology vendor acknowledged that two of its 
certified products could produce inaccurate EHR reports for three 
percentage-based meaningful use measures.24  According to ONC staff, 
the certification process did not identify these potential inaccuracies 
because the vendor-supplied test data did not account for the manner in 
which some professionals use the products.  Similar problems may exist 
with EHR reports in other certified EHR technology. 
The vendor is working to correct the problem and has notified CMS, 
professionals, and hospitals.  As of December 2011, 1,079 professionals 
using the affected products (or 4 percent of all professionals receiving 
payment) had been approved for or received Medicare EHR incentive 
payments. 
Inaccurate EHR reports may also lead to inaccurate audit determinations.  
All 30 percentage-based meaningful use measures could potentially be 
affected by this problem. 
CMS may not be able to obtain sufficient supporting 
documentation to verify self-reported information during 
audits 
Although Federal law and regulations require professionals and hospitals 
to keep documentation supporting their demonstrations of meaningful use, 
supplementary guidance from CMS does not provide additional detail on 
the specific types of supporting documentation it expects.  By law, 
professionals and hospitals must retain documentation sufficient to support 
all claims to Medicare, including claims for EHR incentive payments.25  
Federal regulations also state that professionals and hospitals must keep 
documentation supporting their demonstration of meaningful use.26  
CMS has issued additional guidanceincluding information posted on its 
Web site and EHR incentive program FAQsthat provides some further 
detail regarding documentation requirements.27, 28  However, none of this 
guidance details the types of supporting documentation that CMS plans to 
rely on for audits. 
 
24
 GE Healthcare, February letter to customers.  Accessed at www.gehealthcare.com on 
February 13, 2012. 
25
 SSA  1833(e). 
26
 42 CFR  495.8(c). 
27
 CMS, Attestation Overview.  Accessed at www.cms.gov on May 9, 2012. 
28
 CMS, FAQs February 2012.  Accessed at www.cms.gov on May 9, 2012. 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  13 
 
     
   
According to CMS staff, professionals and hospitals should keep detailed 
supporting documentation to substantiate their self-reported meaningful 
use information.  CMS staff indicated that CMS auditors will use 
supporting documentation to verify self-reported meaningful use 
information for measures not covered by required EHR reports (i.e., the 
19 yes/no measures and denominator values for percentage-based 
measures with all-patient denominators).  CMS staff reported, for 
example, that they expect professionals and hospitals to maintain the 
following: 
  screen shots showing that required EHR technology functions were 
enabled on the first day of or at some point during the 90-day 
reporting period (yes/no measures), 
  documents showing that a security risk assessment was conducted 
(yes/no measures), and 
  evidence of the number of patients with paper records for 
percentage-based measures with all-patient denominators 
(percentage-based measures). 
Supporting Documentation That CMS Obtains Will Not Be Sufficient for 
CMS To Verify Self-Reported Information for Six Measures.  Even if 
professionals and hospitals retain the types of supporting documentation 
that CMS staff expect, it will not be sufficient to verify self-reported 
meaningful use information for six measures.  These six yes/no measures 
(three for professionals and three for hospitals) require that professionals 
and hospitals enable certain EHR technology functions for the entire 
90-day reporting period.  Specifically, they require professionals and 
hospitals to implement: 
  drug-drug and drug-allergy interaction checks, 
  one clinical decision support rule, and 
  drug formulary checks. 
Per CMSs audit plan, CMS will accept screen shots or in-person 
demonstrations as supporting evidence to verify the accuracy of 
self-reported meaningful use information.  However, screen shots or 
demonstrations will only verify that professionals and hospitals enabled 
the required EHR technology functions at a specific timenot that they 
enabled them for the entire 90-day reporting period. 
These six meaningful use measures may be particularly vulnerable to 
noncompliance.  They require use of clinical decision support tools, which 
physicians often view as onerous or unnecessary.  Several studies show 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  14 
 
     
   
that physicians frequently develop alert fatigue with clinical decision 
support tools, especially with medication alerts.29, 30  As a result, 
professionals and hospitals may disable clinical decision support tools for 
all or part of their 90-day reporting period. 
   
 
29
 T. Isaac, et al., Overrides of Medication Alerts in Ambulatory Care, Archives of Internal 
Medicine.  2009; 169(3):305311.  Accessed at www.archinte.ama-assn.org on  
March 6, 2012. 
30
 H. Van der Sijs, et al.,Overriding Drug Safety Alerts in CPOE, Journal of American 
Medical Information Association.  2006; 13:138147.  Accessed at www.jama.org on  
March 6, 2012. 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  15 
 
     
   
CONCLUSION AND RECOMMENDATIONS 
CMS faces obstacles to overseeing the Medicare EHR incentive program 
that leave the program vulnerable to paying incentives to professionals and 
hospitals that do not fully meet the meaningful use requirements.  Absent 
changes to the definition of meaningful use, CMS should consider ways to 
strengthen its program oversight to protect the $4 billion in Medicare EHR 
incentive payments that it has paid, as well as billions of dollars in future 
incentive payments. 
Currently, CMS has not implemented strong prepayment safeguards.  
CMS does not verify the accuracy of professionals and hospitals 
self-reported information prior to payment because data necessary for 
verifications are not readily available.  CMS also does not direct high-risk 
professionals and hospitals to submit supporting documentation for 
prepayment review. 
CMSs ability to safeguard incentive payments postpayment is also 
limited.  CMSs planned postpayment audits may not conclusively verify 
the accuracy of professionals and hospitals self-reported information 
because supporting documentation may not be available.  ONCs 
requirements for EHR reports may affect the availability of supporting 
documentation.  If CMS cannot conclusively verify the accuracy of a 
professionals or hospitals self-reported information during a postpayment 
audit, it will be unable to determine whether the professional or hospital 
was a meaningful user and thereby qualified for the disbursed incentive 
payment. 
The following recommendations to CMS and ONC will help strengthen 
oversight of the Medicare EHR incentive program.  Our recommendations 
to CMS focus on immediate changes that CMS can make to improve 
safeguards, and our recommendations to ONC focus on changes to 
enhance EHR reports in support of CMSs oversight activities. 
We recommend that: 
CMS Obtain and Review Supporting Documentation From 
Selected Professionals and Hospitals Prior to Payment To 
Verify the Accuracy of Their Self-Reported Information 
CMS should direct selected high-risk professionals and hospitals to submit 
documentation supporting their self-reported meaningful use information 
for prepayment review.  To identify high-risk professionals and hospitals, 
CMS could use some of the risk analyses it plans to use to select 
postpayment audit targets.  CMS could then collect supporting  
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  16 
 
     
   
documentation and conduct desk or onsite reviews, similar to its planned 
postpayment audit process, prior to making payments. 
CMS Issue Guidance That Details the Types of Documentation 
It Expects Professionals and Hospitals To Maintain To Support 
Their Compliance 
CMS should bolster its current guidance by detailing the types of 
supporting documentation it expects professionals and hospitals to 
maintain for specific meaningful use measures.  To do this, CMS could 
issue an FAQ, conduct provider education, or issue other forms of 
guidance.  This guidance could explain, for example, that CMS expects 
professionals and hospitals to keep documentation such as screen shots 
and proof that a security risk assessment was performed. 
ONC Require Certified EHR Technology To Be Capable of 
Producing Reports for Yes/No Meaningful Use Measures, 
Where Possible 
ONC could do this by updating its current regulations on the standards and 
functions required of certified EHR technology, or by including such a 
requirement in planned future regulations for the program.  OIG 
acknowledges that producing reports may not be possible for some 
measures that include information not contained in the certified EHR 
technology (e.g., that a security risk assessment was conducted). 
EHR reports for yes/no measures could help professionals and hospitals 
prove compliance in the event of an audit and simplify CMSs oversight.  
In particular, these reports could help CMS conclusively verify that 
professionals and hospitals had the relevant EHR technology functions 
enabled for the entire 90-day reporting period. 
ONC Improve the Certification Process for EHR Technology To 
Ensure Accurate EHR Reports 
ONC should ensure that certification bodies comprehensively test EHR 
reports for accuracy as part of the certification process.  For example, 
ONC could require certification bodies to use standardized test data for 
EHR reports instead of relying on vendor-supplied test data.  While 
recreating every manner of using EHR technology for testing purposes is 
not be possible, more comprehensive testing may increase the reliability of 
EHR reports for CMSs postpayment audits. 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  17 
 
     
   
AGENCIES COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
We made four recommendationstwo to CMS and two to ONC.  CMS 
did not concur with our first recommendation, but did concur with our 
second recommendation.  ONC concurred with both our third and fourth 
recommendations. 
CMS did not concur with our first recommendation that it obtain and 
review supporting documentation from selected professionals and 
hospitals prior to payment to verify the accuracy of their self-reported 
information.  CMS stated that the Medicare EHR incentive program is an 
attestation-based program, and that prepayment reviews would impose an 
increased up-front burden on practitioners and hospitals.  CMS further 
stated that conducting prepayment reviews would be difficult for 
practitioners and hospitals beyond their first year of participation, due to 
timing constraints, and could delay incentive payments. 
We continue to recommend that CMS conduct prepayment reviews of 
selected professionals and hospitals.  While we recognize that doing so 
would impose an increased burden on the professionals and hospitals 
selected by CMS, that burden would be justified by the reduced likelihood 
of making improper incentive payments to high-risk professionals and 
hospitals.  We note that the timing constraints CMS raised do not apply to 
all practitioners and hospitals, and therefore do not justify forgoing 
prepayment reviews altogether.  We further note that our recommendation 
leaves the decision of how to select high-risk professionals and hospitals 
to CMSs discretion; as such, CMS can select a methodology that 
appropriately accounts for the logistical and timing constraints it faces. 
CMS concurred with our second recommendation that it issue guidance 
detailing the types of documentation it expects professionals and hospitals 
to maintain to support their compliance.  CMS indicated that it is currently 
developing an FAQ document, to be posted online, that will bolster 
existing guidance to professionals and hospitals.  We note that as detailed 
in our recommendation, the guidance that CMS provides should include 
examples of the types of documentation professionals and hospitals should 
retain for specific meaningful use measures. 
ONC concurred with our third recommendation that it require certified 
EHR technology to be capable of producing reports for yes/no meaningful 
use measures, where possible.  ONC stated that it will request 
recommendations on the scope and feasibility of such a requirement from 
its two Federal advisory committees.  While we support ONCs decision to 
seek input from its advisory committees, we reiterate that requiring 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  18 
 
     
   
certified EHR technology to be capable of producing EHR reports for 
yes/no meaningful use measures would improve CMSs ability to oversee 
the Medicare EHR incentive program.  As such, we continue to 
recommend that ONC require certified EHR technology to be capable of 
producing reports for all meaningful use measures, where possible, in its 
future rulemaking. 
ONC also concurred with our fourth recommendation that it improve the 
certification process for EHR technology to ensure accurate EHR reports.  
ONC stated that its most recent rulemaking includes more rigorous testing 
requirements for certified EHR technology, and that it will continue to 
work with stakeholders to develop more comprehensive test procedures 
and reduce its reliance on vendor-supplied test data. 
CMS provided one technical comment, which we have incorporated into 
the report. 
For the full text of CMS and ONC comments, see Appendix C. 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  19 
 
     
   
APPENDIX A 
 
Meaningful Use Measures for Professionals and Hospitals 
 
Table A-1:  Professional Meaningful Use Measures 
All-Patient 
Measure  Criterion Type  Measure Criterion  Denominator 
Required  
Core Measures 
More than 30 percent of all unique patients 
1.  Computerized 
with at least one medication in their 
provider order  Percentage-based  No 
medication lists have at least one 
entry (CPOE) 
medication order entered using CPOE. 
The professional enables drug-drug and 
2.  Drug interaction 
Yes/no  drug-allergy check functionality for the  N/A 
checks 
entire reporting period. 
More than 80 percent of all unique patients 
have at least one entry (or an indication 
3.  Problem lists  Percentage-based  Yes 
that no problems are known for the patient) 
recorded as structured data. 
More than 40 percent of all permissible 
prescriptions written by the professional 
4.  Electronic 
Percentage-based  are transmitted electronically using  No 
prescribing 
certified electronic health record (EHR) 
technology. 
More than 80 percent of all unique patients 
have at least one entry (or an indication 
5.  Active medication 
Percentage-based  that the patient is not currently prescribed  Yes 
lists 
any medication) recorded as structured 
data. 
More than 80 percent of all unique patients 
6.  Medication allergy  have at least one entry (or an indication 
Percentage-based  Yes 
lists  that the patient has no known medication 
allergies) recorded as structured data. 
More than 50 percent of all unique patients 
7.  Demographics  Percentage-based  have demographics recorded as structured  Yes 
data. 
More than 50 percent of all unique patients 
age 2 and over have height, weight, and 
8.  Vital signs  Percentage-based  No 
blood pressure recorded as structured 
data. 
continued on next page 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  20 
 
     
   
Table A-1:  Professional Meaningful Use Measures (Continued) 
All-Patient 
Measure  Criterion Type  Measure Criterion  Denominator 
Required  
Core Measures (continued) 
More than 50 percent of all unique patients 
9.  Smoking status  Percentage-based  13 years old or older have smoking status  No 
recorded as structured data. 
The professional successfully reports 
10.  Ambulatory clinical 
ambulatory CQMs selected by the Centers 
quality measures  Yes/no  N/A 
for Medicare & Medicaid Services (CMS) 
(CQM) 
in the manner specified by CMS. 
11.  Clinical decision  The professional implements one clinical 
Yes/no  N/A 
support rule  decision support rule. 
More than 50 percent of all patients who 
12.  Electronic copy of  request an electronic copy of their health 
Percentage-based  No 
health information   information are provided it within 
3 business days. 
Clinical summaries are provided to 
13.  Clinical summaries  Percentage-based  patients for more than 50 percent of all  No 
office visits within 3 days. 
The professional performs at least one test 
14.  Electronic 
of certified EHR technology's capacity to 
exchange of  Yes/no  N/A 
electronically exchange key clinical 
clinical information 
information. 
The professional conducts or reviews a 
security risk analysis in accordance with 
15.  Protection of  the requirements under 45 CFR 
electronic health  Yes/no  164.308(a)(1), implements security  N/A 
information  updates as necessary, and corrects 
identified security deficiencies as part of its 
risk management process. 
Menu Measures 
The professional enables drug-formulary 
1.  Drug formulary  check functionality and has access to at 
Yes/no  N/A 
checks  least one internal or external formulary for 
the entire EHR reporting period. 
More than 40 percent of all clinical lab test 
results ordered by the professional during 
the EHR reporting period whose results 
2.  Clinical lab test 
Percentage-based  are either in a positive/negative or  No 
results 
numerical format are incorporated in 
certified EHR technology as structured 
data. 
continued on next page 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  21 
 
     
   
Table A-1:  Professional Meaningful Use Measures (Continued) 
All-Patient 
Measure  Criterion Type  Measure Criterion  Denominator 
Required  
Menu Measures (continued) 
The professional generates at least one 
3.  Patient lists  Yes/no  report listing patients with a specific  N/A 
condition. 
More than 20 percent of all patients 
65 years old or older or 5 years old or 
4.  Patient reminders  Percentage-based  No 
younger are sent an appropriate reminder 
during the EHR reporting period. 
At least 10 percent of all unique patients 
are provided timely (available to the 
patient within 4 business days of being 
5.  Patient electronic 
Percentage-based  updated in the certified EHR technology)  Yes 
access 
electronic access to their health 
information subject to the professionals 
discretion to withhold certain information. 
6.  Patient-specific  More than 10 percent of all unique patients 
education  Percentage-based  are provided patient-specific education  Yes 
resources  resources. 
The professional performs medication 
7.  Medication 
Percentage-based  reconciliation for more than 50 percent of  No 
reconciliation 
transitions of care. 
The professional who transitions or refers 
a patient to another setting of care or 
8.  Transition of care 
Percentage-based  provider of care provides a summary of  No 
summaries 
care record for more than 50 percent of 
transitions of care and referrals. 
The professional performs at least one test 
9.  Immunization  of certified EHR technologys capacity to 
registries data  Yes/no  submit electronic data to immunization  N/A 
submission  registries and a follow up submission if the 
test is successful. 
The professional performs at least one test 
of certified EHR technology's capacity to 
provide electronic syndromic surveillance 
10.  Syndromic  data to public health agencies and a follow 
surveillance data  Yes/no  up submission if the test is successful  N/A 
submission  (unless none of the public health agencies 
to which a professional submits such 
information has the capacity to receive the 
information electronically). 
Source:  Office of Inspector General (OIG) analysis of Federal regulations, 2011. 
 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  22 
 
     
   
Table A-2:  Hospital Meaningful Use Measures 
All-Patient 
Measure  Criterion Type  Measure Criterion  Denominator 
Required  
Core Measures 
More than 30 percent of all unique 
patients with at least one medication in 
1.  CPOE  Percentage-based  No 
their medication lists have at least one 
medication order entered using CPOE. 
The hospital enables drug-drug and 
2.  Drug interaction 
Yes/no  drug-allergy check functionality for the  N/A 
checks 
entire EHR reporting period. 
More than 80 percent of all unique 
patients have at least one entry (or an 
3.  Problem lists  Percentage-based  Yes 
indication that no problems are known for 
the patient) recorded as structured data. 
More than 80 percent of all unique 
patients have at least one entry (or an 
4.  Active medication 
Percentage-based  indication that the patient is not currently  Yes 
lists 
prescribed any medication) recorded as 
structured data. 
More than 80 percent of all unique 
patients have at least one entry (or an 
5.  Medication allergy 
Percentage-based  indication that the patient has no known  Yes 
lists 
medication allergies) recorded as 
structured data. 
More than 50 percent of all unique 
6.  Demographics  Percentage-based  patients have demographics recorded as  Yes 
structured data. 
More than 50 percent of all unique 
patients age 2 and over have height, 
7.  Vital signs  Percentage-based  No 
weight, and blood pressure recorded as 
structured data. 
More than 50 percent of all unique 
patients 13 years old or older have 
8.  Smoking status  Percentage-based  No 
smoking status recorded as structured 
data. 
The hospital successfully reports hospital 
9.  Hospital  CQMs  Yes/no  CQMs selected by CMS in the manner  N/A 
specified by CMS. 
10.  Clinical decision  The hospital implements one clinical 
Yes/no  N/A 
support rule  decision support rule. 
More than 50 percent of all patients who 
11.  Electronic copy of  request an electronic copy of their health 
Percentage-based  No 
health information  information are provided it within 
3 business days. 
continued on next page 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  23 
 
     
   
Table A-2:  Hospital Meaningful Use Measures (Continued) 
All-Patient 
Measure  Criterion Type  Measure Criterion  Denominator 
Required  
Core Measures (continued) 
More than 50 percent of all patients who 
12.  Electronic copy of 
are discharged from a hospital and who 
discharge  Percentage-based  No 
request an electronic copy of their 
instructions 
discharge instructions are provided it. 
The hospital performs at least one test of 
13.  Electronic exchange 
certified EHR technology's capacity to 
of clinical  Yes/no  N/A 
electronically exchange key clinical 
information 
information. 
The hospital conducts or reviews a 
security risk analysis in accordance with 
14.  Protection of  the requirements under 45 CFR 
electronic health  Yes/no  164.308(a)(1), implements security  N/A 
information  updates as necessary, and corrects 
identified security deficiencies as part of 
its risk management process. 
Menu Measures 
The hospital enables drug-formulary 
1.  Drug formulary  check functionality and has access to at 
Yes/no  N/A 
checks  least one internal or external formulary for 
the entire EHR reporting period. 
More than 50 percent of all unique 
patients 65 years old or older have an 
2.  Advance directives  Percentage-based  No 
indication of an advance directive status 
recorded as structured data. 
More than 40 percent of all clinical lab test 
results ordered by the hospital during the 
3.  Clinical lab test  EHR reporting period whose results are 
Percentage-based  No 
results  either in a positive/negative or numerical 
format are incorporated in certified EHR 
technology as structured data. 
The hospital generates at least one report 
4.  Patient lists  Yes/no  listing patients of the hospital with a  N/A 
specific condition. 
More than 10 percent of all unique 
5.  Patient-specific  
Percentage-based  patients are provided patient-specific  Yes 
education resources 
education resources. 
The hospital performs medication 
6.  Medication 
Percentage-based  reconciliation for more than 50 percent of  No 
reconciliation 
transitions of care. 
continued on next page 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  24 
 
     
   
Table A-2:  Hospital Meaningful Use Measures (Continued) 
All-Patient 
Measure  Criterion Type  Measure Criterion  Denominator 
Required  
Menu Measures (continued) 
The hospital that transitions or refers its 
patient to another setting of care or 
7.  Transition of care 
Percentage-based  provider of care provides a summary of  No 
summaries 
care record for more than 50 percent of 
transitions of care and referrals. 
The hospital performs at least one test of 
8.  Immunization  certified EHR technologys capacity to 
registries data  Yes/no  submit electronic data to immunization  N/A 
submission  registries and a follow up submission if the 
test is successful. 
The hospital performs at least one test of 
certified EHR technologys capacity to 
9.  Reportable lab 
provide electronic submission of 
results to public  Yes/no  N/A 
reportable lab results to public health 
health agencies 
agencies and a follow up submission if the 
test is successful. 
The hospital performs at least one test of 
certified EHR technologys capacity to 
10.  Syndromic 
provide electronic syndromic surveillance 
surveillance data  Yes/no  N/A 
data to public health agencies and a 
submission 
follow up submission if the test is 
successful. 
Source:  OIG analysis of Federal regulations, 2011. 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  25 
 
     
   
APPENDIX B 
 
Centers for Medicare & Medicaid Services Assessment of Data Sources To 
Verify the Accuracy of Self-Reported Meaningful Use Information, by 
Measure 
 
Table B-1:  Professional Meaningful Use Measure Data Sources 
Measure  Type of Data Source 
Core Measures 
1.  Computerized provider order entry (CPOE)  Internal data source    
2.  Drug interaction checks  No data source 
3.  Problem lists  Internal data source    
Internal data source   
4.  Electronic prescribing (e-prescribing) 
External data source:  privately held e-prescribing data 
5.  Active medication lists  Internal data source    
6.  Medication allergy lists  No data source 
7.  Demographics  Internal data source    
8.  Vital signs  Internal data source    
9.  Smoking status  Internal data source    
10.  Ambulatory clinical quality measures 
Internal data source    
(CQM) 
11.  Clinical decision support rule  No data source 
12.  Electronic copy of health information   No data source 
13.  Clinical summaries  Internal data source    
continued on next page 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  26 
 
     
   
Table B-1:  Professional Meaningful Use Measure Data Sources (Continued) 
Measure  Type of Data Source 
Core Measures (continued) 
14.  Electronic exchange of clinical information  No data source 
15.  Protection of electronic health information  No data source 
Menu Measures 
1.  Drug formulary checks  Internal data source    
2.  Clinical lab test results  Internal data source    
3.  Patient lists  No data source 
4.  Patient reminders  No data source 
5.  Patient electronic access  Internal data source    
6.  Patient-specific education resources  Internal data source    
7.  Medication reconciliation  No data source 
8.  Transition of care summaries  No data source 
9.  Immunization registries data submission  External data source:  public health agency  
10.  Syndromic surveillance data submission  External data source:  public health agency  
Source:  Office of Inspector General (OIG) analysis of CMS documents and interview data, 2012. 
 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  27 
 
     
   
Table B-2:  Hospital Meaningful Use Measure Data Sources 
Measure  Type of Data Source 
Core Measures 
1.  CPOE  Internal data source    
2.  Drug interaction checks  No data source 
3.  Problem lists  Internal data source    
4.  Active medication lists  Internal data source    
5.  Medication allergy lists  Internal data source    
6.  Demographics  Internal data source    
7.  Vital signs  Internal data source    
8.  Smoking status  Internal data source    
9.  Hospital CQMs  No data source 
10.  Clinical decision support rule  No data source 
11.  Electronic copy of health information  No data source 
12.  Electronic copy of discharge instructions  No data source 
13.  Electronic exchange of clinical information  No data source 
14.  Protection of electronic health information  No data source 
Menu Measures 
1.  Drug formulary checks  No data source 
2.  Advance directives  Internal data source    
3.  Clinical lab test results  Internal data source    
continued on next page 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  28 
 
     
   
Table B-2:  Hospital Meaningful Use Measure Data Sources (Continued) 
Measure  Type of Data Source 
Menu Measures (continued) 
4.  Patient lists  No data source 
5.  Patient-specific education resources  Internal data source    
6.  Medication reconciliation  Internal data source    
7.  Transition of care summaries  Internal data source    
8.  Immunization registries data submission  External data source:  public health agency  
9.  Reportable lab results to public health 
External data source:  public health agency  
agencies 
10.  Syndromic surveillance data submission  External data source:  public health agency  
Source:  OIG analysis of CMS documents and interview data, 2012. 
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  29 
 
    APPENDIXC 
Agencies' Comments 
,.'fP."'IC..., 
~
{  DEPARTMENT OF HEALlH & HUMAN SERVICES  Centers for Medicare & Medicaid Services 
'~~ 
Administrator 
Washington, DC 20201 
OCT 09. 2tili 
TO: 	 Daniel R. Levinson 
klspector..Qeneral 
FROM: 	 Mlrl\yrr'flt91l00er 
Acting Atminlftrator 
SUBJECT: 	 Office ofInspector General (OIG) Draft Report-Early Assessment Finds That 
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program, 
OEI-05-11-00250 
Thank you for the opportunity to review and comment on the OIG draft report "Early 
Assessment Finds That CMS Faces Obstacles in Overseeing the Medicare EHR Incentive 
Program" (OEI-05-11-00250). The Centers for Medicare & Medicaid Services (CMS) 
appreciates the contributions and valuable input by the OIG. The draft report assessed CMS's 
oversight ofthe Medicare Electronic Health Record (EHR) Incentive programs. The information 
in the report will help inform our administration ofthe Medicare and Medicaid EHR Incentive 
Programs. 
The CMS continues to work with the Office ofNational Coordinator for Health Information 
Technology (ONC) to maximize the success of the Medicare and Medicaid EHR Incentive 
Programs and the related Health Information Technology for Economic and Clinical Health 
(HITECH) Act provisions. The draft report contained four recommendations: two for CMS and 
two for ONC. We are addressing the CMS recommendations in this response. 
OIG Recommendation 
The CMS obtain and review supporting documentation from selected professionals and hospitals 
prior to payment to verify the accuracy of their self-reported information. 
CMS Response 
The CMS does not believe prepayment audit is necessary at this juncture.  CMS has 
implemented a number ofprepayment verification edits to ensure that providers are eligible to 
participate in the Medicare EHR Incentive Program. In addition, CMS validates all of the EHR 
certification numbers that are provided by providers. The EHR incentive program is an 
attestation-based program and our systems have been designed to accommodate this process. It 
would be particularly difficult to implement for providers after their firSt year of participation 
because the reporting period is an entire year and all attestations are received in a two-month 
period during which CMS would have to review supporting documentation. To change this 
process and implement pre-payment audits could significantly delay payments to providers. 
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11 -00250)  30   
   
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  31 
 
    DEPARTMENT OF HEALTH & HUMAN SERVICES 	 Office of the Secretary 
Office ofthe Natiooal Coordinator 
fur Health lnfonnalion Technology 
Washington, D.C. 20201 
DATE: September 25, 2012 
TO: 	 Daniel R. Levinson 
Inspector General 
FROM: 	Farzad Mostashari 
National Coordinator 
SUB.JECT: The Office of the National Coordinator for Health Information Technology's 
Comments to the Office of Inspector General's Draft Report, Early Asse.'iSment Finds That CMS 
Faces Obstacles in Over!feeing the Medicare EHR Incentive Program, OEI-05-11-00250 
Thank you for the opportunity to review and comment on the findings and recommendations in the Office 
ofinspector General's (O!G) Draft Report, Early Assessment Finds That CMR Faces Obstacles in 
Overseeing the Medicare EHR Incentive Program, OEI-OS-11-00250. The draft report includes 
recommendations for the Office ofthe National Coordinator for Health Information Technology (ONC) 
to enhance reports produced by EHRs to strengthen program oversight of the Medicare EHR incentive 
program. ONC concurs and has already taken steps to address both recommendations. ONC appreciates 
the OIG's efforts to improve program integrity. We will continue to collaborate with the Centers for 
Medicare and Medicaid (CMS) to strengthen the Medicare and Medicaid EHR Incentive Programs and 
the related Health Information Technology for Economic and Clinical Health (HITECH) Act provisions. 
OIG Recommendation 
ONC Require Certified EHR Technology to Be Capable ofProducing Reports for Yes/No Meaningful 
Use Measures, Where Possible 
ONC Response 
ONC concurs with this recommendation and appreciates that the OIG recognizes the difficulty with 
requiring EHR technology to produce a "yes/no" report for some measures that include information not 
contained in the certified EHR technology (e.g., that a security risk assessment Wll$ conducted). As 
stated in the 20 !4 Edition Standards and Certification Criteria Final Rule, we will request ONC's two 
Federal advisory committees, the HIT Policy Committee and HIT Standards Committee, to provide 
recommendations on the appropriate scope and feasibility of a certification criterion focused on "yes/no" 
reports for meaningful usc measure. Once we get their recommendations, we will determine appropriate 
certification criterion in future rulemaking. 
OIG Recommendation 
ONC Improve the Certification Process for EHR Technology to Ensure Accurate EHR Reports 
ONC Response 
ONC concurs with OIG's recommendation and has already taken steps to address this recommendation. 
In response to the HITECH Act, ONC rapidly established the Temporary Certification Program to ensure 
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  32   
   
 
   
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)  33 
 
     
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Ann Maxwell, Regional 
Inspector General for Evaluation and Inspections in the Chicago regional 
office, and Tom Komaniecki and Laura Kordish, Deputy Regional 
Inspectors General.  
Kelly Waldhoff served as the team leader for this study.  Other principal 
Office of Evaluation and Inspections staff from the Chicago regional 
office who contributed to the report include Adam Freeman and Brian 
Jordan; central office staff who contributed include Debra Roush, Kevin 
Manley, and Tasha Trusty. 
Early Review of CMS Oversight of the Medicare EHR Incentive Program (OEI-05-11-00250)   34 
   
   
Office of Inspector General 
http://oig.hhs.gov 
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 
amended, is to protect the integrity of the Department of Health and Human Services 
(HHS) programs, as well as the health and welfare of beneficiaries served by those 
programs.  This statutory mission is carried out through a nationwide network of audits, 
investigations, and inspections conducted by the following operating components: 
Office of Audit Services 
The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 
audits with its own audit resources or by overseeing audit work done by others.  Audits 
examine the performance of HHS programs and/or its grantees and contractors in carrying 
out their respective responsibilities and are intended to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and 
mismanagement and promote economy and efficiency throughout HHS. 
Office of Evaluation and Inspections 
The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud, waste, or abuse and promoting 
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 
of fraud and misconduct related to HHS programs, operations, and beneficiaries.  With 
investigators working in all 50 States and the District of Columbia, OI utilizes its resources 
by actively coordinating with the Department of Justice and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to criminal 
convictions, administrative sanctions, and/or civil monetary penalties. 
Office of Counsel to the Inspector General 
The Office of Counsel to the Inspector General (OCIG) provides general legal services to 
OIG, rendering advice and opinions on HHS programs and operations and providing all 
legal support for OIGs internal operations.  OCIG represents OIG in all civil and 
administrative fraud and abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program guidance, publishes fraud alerts, and provides other 
guidance to the health care industry concerning the anti-kickback statute and other OIG 
enforcement authorities.