ELECTRONIC 

HEALTH RECORDS

First Year of CMS’s 

Incentive Programs 

Shows Opportunities 

to Improve Processes 

to Verify Providers 

Met Requirements

Report to Congressional Committees

April 2012

GAO-12-481

United States Government Accountability Office

GAO
United States Government Accountability Office

Highlights of GAO-12-481, a report to 

congressional committees

April 2012

ELECTRONIC HEALTH RECORDS

First Year of CMS’s Incentive Programs Shows 

Opportunities to Improve Processes to Verify 

Providers Met Requirements

Why GAO Did This Study

The Health Information Technology for 

Economic and Clinical Health 

(HITECH) Act established the 

Medicare and Medicaid electronic 

health records (EHR) programs. CMS 

and the states administer these 

programs which began in 2011 to 

promote the meaningful use of EHR 

technology through incentive payments 

paid to certain providers—that is, 

hospitals and health care 

professionals. Spending for the 

programs is estimated to total 

$30 billion from 2011 through 2019. 

Consistent with the HITECH Act, GAO 

(1) examined efforts by CMS and the 

states to verify whether providers 

qualify to receive EHR incentive 

payments and (2) examined 

information reported to CMS by 

providers to demonstrate meaningful 

use in the first year of the Medicare 

EHR program. GAO reviewed 

applicable statutes, regulations, and 

guidance; interviewed officials from 

CMS; interviewed officials from four 

states, which were judgmentally 

selected to obtain variation among 

multiple factors; and analyzed data 

from CMS and other sources.

What GAO Recommends

GAO is making four recommendations 

to CMS in order to improve processes 

to verify whether providers met 

program requirements for the Medicare 

and Medicaid EHR programs, including 

opportunities for efficiencies. HHS

agreed with three of GAO’s 

recommendations, but disagreed with 

the fourth recommendation that CMS 

offer to collect certain information on 

states’ behalf. GAO continues to 

believe that this action is an important 

step to yield potential cost savings.

What GAO Found

The Centers for Medicare and Medicaid Services (CMS), an agency within the 

Department of Health and Human Services (HHS), and the four states GAO 

reviewed are implementing processes to verify whether providers met the 

Medicare and Medicaid EHR programs’ requirements and, therefore, qualified to 

receive incentive payments in the first year of the EHR programs. To receive 

such payments, providers must meet both (1) eligibility requirements that specify 

the types of providers eligible to participate in the programs and (2) reporting 

requirements that specify the information providers must report to CMS or the 

states, including measures that demonstrate meaningful use of an EHR system 

and measures of clinical quality. For the Medicare EHR program, CMS has 

implemented prepayment processes to verify whether providers have met all of 

the eligibility requirements and one of the reporting requirements. Beginning in 

2012, the agency also has plans to implement a risk-based audit strategy to 

verify on a postpayment basis that a sample of providers met the remaining 

reporting requirements. For the Medicaid EHR Program, the four states GAO 

reviewed have implemented primarily prepayment processes to verify whether 

providers met all eligibility requirements. To verify the reporting requirement, all 

four states implemented prepayment processes, postpayment processes, or 

both. CMS officials stated that the agency intends to evaluate how effectively its 

Medicare EHR program audit strategy reduces the risk of improper EHR 

incentive payments, though the agency has not yet established corresponding 

timelines for doing this work. Such an evaluation could help CMS determine 

whether it should revise its verification processes by, for example, implementing 

additional prepayment processes, which GAO has shown may reduce the risk of 

improper payments. In addition, CMS has opportunities to improve the efficiency 

of verification processes by, for example, collecting certain data on states’ behalf. 

CMS allows providers to exempt themselves from reporting certain measures if 

providers report that the measures are not relevant to their patients or practices. 

Measures calculated based on few patients may be statistically unreliable, which 

limits their usefulness as tools for quality improvement. CMS and others 

acknowledged that the availability of measures that are relevant to providers’ 

patients and practices and are statistically reliable is important to provide useful 

information to providers. Among participants in the first year of the Medicare EHR 

program, the majority of providers chose to exempt themselves from reporting on 

at least one meaningful use measure and many providers reported at least one 

clinical quality measure based on few—less than seven—patients.

Information on measures reported by first year participants 

View GAO-12-481. For more information, 

contact Linda Kohn at (202) 512-7114 or

kohnl@gao.gov.
Page i GAO-12-481 Electronic Health Records

Letter 1 

Background 8

For the First Program Year, Processes Are Being Implemented to 

Verify Requirements Were Met, and CMS Has Opportunities to 

Improve Them 19

Most Medicare Providers Exempted Themselves from Reporting 

Certain Measures and Many Reported Others Based on Few 

Patients 29

For the First Program Year, Providers Experienced Challenges and 

Used Strategies and Services to Facilitate Participation 38

Conclusions 44

Recommendations for Executive Action 45

Agency Comments and Our Evaluation 46

Appendix I Scope and Methodology 50

Appendix II How Medicare and Medicaid EHR Program Incentive Payments 

Are Calculated 56

Appendix III Meaningful Use and Clinical Quality Measures for the Medicare 

EHR Program, 2011 57

Appendix IV Regional Extension Center Program, Goals, and Progress in 

Helping Providers Demonstrate Meaningful Use 65

Appendix V Comments from the Department of Health and Human Services 72

Appendix VI GAO Contact and Staff Acknowledgments 77

Contents
Page ii GAO-12-481 Electronic Health Records

Tables

Table 1: Medicare EHR Program’s Eligibility and Reporting 

Requirements, 2011 12

Table 2: Medicaid EHR Program’s Eligibility and Reporting 

Requirements, 2011 15

Table 3: CMS’s Processes to Verify Whether Providers Met 

Medicare EHR Program Eligibility and Reporting 

Requirements in 2011 21

Table 4: Four States’ Processes to Verify Whether Providers Met 

Medicaid EHR Program Eligibility and Reporting 

Requirements in 2011 24

Table 5: Percentage of Professionals Who Participated in the 

Medicare EHR Program That Claimed an Exemption for at 

Least One Meaningful Use Measure, through December 8, 

2011 30

Table 6: Percentage of Hospitals That Participated in the Medicare 

EHR Program That Claimed an Exemption for at Least 

One Meaningful Use Measure, 2011 32

Table 7: Percentage of Professionals Who Participated in the 

Medicare EHR Program That Reported at Least One 

Clinical Quality Measure That Was Calculated Based on 

Few Patients, through December 8, 2011 35

Table 8: Percentage of Hospitals That Participated in the Medicare 

EHR Program That Reported at Least One Clinical Quality 

Measure That Was Calculated Based on Few Patients, 2011 37

Table 9: Number of Measures Providers Must Report or Claim 

Allowed Exemptions from Reporting for the Medicare 

EHR Program, 2011 58

Table 10: Meaningful Use Measures for Professionals and Hospitals 

in the Medicare EHR Program, 2011 59

Table 11: Clinical Quality Measures for Professionals in the 

Medicare EHR Program, 2011 61

Table 12: Clinical Quality Measures for Hospitals in the Medicare 

EHR Program, 2011 64

Table 13: Goals and Number of Professionals Assisted in 

Progressing Towards Demonstrating Meaningful Use, by 

Regional Extension Center, through December 19, 2011 66

Table 14: Goals and Number of Hospitals Assisted in Progressing 

Towards Demonstrating Meaningful Use, by Regional 

Extension Center, through December 19, 2011 69
Page iii GAO-12-481 Electronic Health Records

Figures

Figure 1: Permissible Provider Types in the Medicare and Medicaid 

EHR Programs 9

Figure 2: Years in Which Incentive Payments Are Available and 

When Penalties Will be Assessed in the Medicare and 

Medicaid EHR Programs 10

Figure 3: Oversight Process CMS and States May Use to Verify 

Providers Met Eligibility and Reporting Requirements for 

the Medicare and Medicaid EHR Programs 17

Figure 4: Practice Settings of Professionals with Signed Technical 

Assistance Agreements with Regional Extension Centers, 

through December 19, 2011 41

Figure 5: Examples of Services Provided by Regional Extension 

Centers 43

Abbreviations

CMS Centers for Medicare & Medicaid Services

EHR electronic health record

HHS Department of Health and Human Services

HITECH Act Health Information Technology for Economic and 

 Clinical Health 

OIG Office of Inspector General

ONC Office of the National Coordinator for Health 

 Information Technology

Recovery Act American Recovery and Reinvestment Act of 2009

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-12-481 Electronic Health Records

United States Government Accountability Office

Washington, DC 20548

April 30, 2012

Congressional Committees

Widespread use of health information technology, such as electronic 

health records (EHR), has the potential to improve the quality of care 

patients receive and reduce health care costs. Historically, patient health 

information has been scattered across paper records kept by many 

different providers in many different locations. When this occurs, health 

care professionals may lack ready access to critical information needed to 

make the most informed decisions on treatment options, potentially 

putting the patient’s health at risk or leading to inappropriate or duplicative 

tests and procedures that increase health care spending. To help address 

these issues, EHRs can be used, for example, to electronically collect, 

store, retrieve, and transfer clinical information related to patients’ care, 

allowing ready access to this information by multiple providers in different 

locations. Despite the potential benefits, studies have estimated that as of 

2009, 78 percent of office-based physicians and 91 percent of hospitals 

had not adopted EHRs.1

The Health Information Technology for Economic and Clinical Health 

(HITECH) Act, enacted as part of the American Recovery and 

Reinvestment Act of 2009 (Recovery Act),2

 

1

The following studies surveyed office-based physicians or hospitals’ health information 

technology staff to determine the percentage that had adopted EHR systems: C.J. Hsiao, 

E. Hing, T.C. Socey, and B. Cai, “Electronic Medical Record/Electronic Health Record 

Systems of Office-Based Physicians: United States, 2009 and Preliminary 2010 State 

Estimates,” National Center for Health Statistics Health E-stat (2010); and A.K. Jha, C.M. 

DesRoches, P.D. Kralovec, and M.S. Joshi, “A Progress Report On Electronic Health 

Records In U.S. Hospitals,” Health Affairs, no.10 (2010):1951-1957. 

among other things, provided 

funding for various activities intended to promote the adoption and 

2

The HITECH Act was enacted as title XIII of division A and title IV of division B of the 

Recovery Act. Pub. L. No. 111-5, div. A, tit. XIII, 123 Stat. 115, 226-279 and div. B, tit. IV, 

123 Stat. 115, 467-497 (Feb. 17, 2009). 

 
 

Page 2 GAO-12-481 Electronic Health Records

meaningful use of certified EHR technology.3 The largest of these 

activities, in terms of potential federal expenditures, are the Medicare and 

Medicaid EHR programs.4 These programs aim to increase the 

meaningful use of EHR technology by providing incentive payments and, 

later, penalties for providers—that is, certain hospitals and professionals, 

such as physicians and nurse practitioners, who participate in Medicare 

or Medicaid.5

 To receive incentive payments under the EHR programs, 

providers must meet two types of requirements: (1) eligibility 

requirements that specify the types of providers eligible to participate in 

the programs and (2) reporting requirements that specify the information 

providers must report to the Centers for Medicare & Medicaid Services 

(CMS), an agency within HHS, or the states to demonstrate that they 

have adopted or meaningfully used the EHR technology.6

 

3

Congress defined “meaningful use” in this context to mean that the user of health 

information technology demonstrates to the satisfaction of the Secretary of the 

Department of Health and Human Services (HHS) that the technology is certified and 

being used in a meaningful manner, that the technology is connected in a manner that 

provides for the electronic exchange of health information to improve the quality of health 

care, and that such information is submitted in a form and manner specified by the 

Secretary. See Pub. L. No. 111-5, § 4101(a) 123 Stat. 467-472. Certified EHR technology 

is technology that meets certain certification criteria established by HHS’s Office of the 

National Coordinator for Health Information Technology (ONC). The certification criteria 

describe the minimum related standards and implementation specifications. 

For example, in 

2011, Medicare professionals had to report 20 meaningful use measures 

4

See Pub. L. No. 111-5, §§ 4101-4201, 123 Stat. 467-494. Medicare is a federal program 

financing health care for individuals aged 65 and older, certain disabled individuals, and 

individuals with end-stage renal disease. In 2010, Medicare covered 47 million 

beneficiaries. Medicaid is a federal-state program financing health care for certain lowincome children, families, and individuals who are aged or disabled. In fiscal year 2009, 

Medicaid covered over 65 million beneficiaries.

5

See Pub. L. No. 111-5, § 4101(a)-(b), 123 Stat. 467-473.Beginning in 2015, the Medicare 

EHR program is to begin applying a payment adjustment, referred to in this report as a 

penalty, for hospitals and professionals that do not meet the Medicare EHR program 

requirements. The Medicaid EHR program does not impose penalties on Medicaid 

providers that do not meet the Medicaid EHR program’s requirements by a specific date; 

however, if Medicaid providers also treat Medicare patients, they are required to meet the 

Medicare EHR program’s requirements from 2015 onward to avoid penalties from the 

Medicare EHR program. 

6

In February 2012, CMS announced a proposed rule that would set out the next steps and 

criteria for providers participating in the Medicare and Medicaid EHR programs. Among 

other things, this proposed rule would revise certain reporting requirements that may take 

effect as early as 2013. See CMS, “Medicare and Medicaid Programs; Electronic Health 

Record Incentive Program—Stage 2” downloaded from 

http://www.ofr.gov/ofrupload/ofrdata/2012-0043_PI.pdf on February 24, 2012.
 

Page 3 GAO-12-481 Electronic Health Records

to CMS which encompass a variety of activities related to the delivery of 

health care and encourage providers to consistently capture information 

in their EHR systems, such as patient demographics and clinical 

conditions. In contrast, during the first year professionals participate in the 

Medicaid EHR program, they need only report having adopted, 

implemented, or upgraded to a certified EHR system. However, in 

subsequent years, Medicaid professionals will have to report on 

meaningful use measures.

The Congressional Budget Office estimated total spending for the 

Medicare and Medicaid EHR programs to be $30 billion from 2011, the 

year incentive payments began, through 2019.7 Partial-year estimates for 

the 2011 program year show that 42,897 providers received 

approximately $3.1 billion in Medicare and Medicaid EHR incentive 

payments.8 CMS is responsible for administering the Medicare EHR 

program. These responsibilities include ensuring providers meet program 

eligibility and reporting requirements, issuing payments, and ensuring the 

integrity of those payments. The states and U.S. insular areas are 

responsible for administering and overseeing the Medicaid EHR program, 

with additional oversight from and partial funding provided by CMS.9

 

7

Congressional Budget Office, “Health Information Technology for Economic and Clinical 

Health Act” (Washington, D.C.: Jan. 21, 2009). This estimate includes spending estimates 

for bonuses and payment reductions from the penalties. 

8

Due to various reasons, such as the time needed to process providers’ payments, at the 

time of our analysis, CMS and the states were still in the process of making payments to 

providers for the 2011 program year. Therefore, these totals reflect partial-year data and 

are expected to increase. See CMS, “Medicare and Medicaid EHR Incentive Program 

Payment and Registration Report, January 2012” downloaded from 

https://www.cms.gov/EHRIncentivePrograms/56_DataAndReports.asp on February 19, 

2012. In the comments HHS provided on our draft report in April 2012, HHS reported that 

57,765 professionals had attested to meaningful use. CMS projected that between 62,569 

and 206,276 providers would receive Medicare or Medicaid EHR program incentive 

payments in 2011. See 75 Fed. Reg. 44548 – 44562 (July 28, 2010).

9

CMS provides states 100 percent of the cost of incentive payments made to Medicaid

providers and 90 percent of the costs related to reasonable administrative expenses and 

planning activities related to the Medicaid EHR program. 42 U.S.C. § 1396b(a)(3)(F)(i) 

and (ii).
 

Page 4 GAO-12-481 Electronic Health Records

States are not required to offer the Medicaid EHR program, although 

CMS anticipates that the majority of states will eventually participate.10

The HITECH Act requires us to report on the effect, among other things, 

of its provisions on the adoption of EHRs by providers.11 As discussed 

with the committees of jurisdiction, our objectives for this report are to 

(1) examine efforts by CMS and the states to verify whether providers 

meet program requirements and can, therefore, receive incentive 

payments under the Medicare and Medicaid EHR programs; (2) examine 

information reported to CMS by providers to demonstrate meaningful use 

in the first year of the Medicare EHR program; and (3) describe providers’ 

experiences during the first year of the Medicare and Medicaid EHR 

programs.12

To examine efforts by CMS and the states to verify whether providers met 

program requirements and qualify to receive incentive payments in 2011, 

we identified the eligibility and reporting requirements that providers must 

meet in order to receive incentive payments under the Medicare and 

Medicaid EHR programs.13

 

10According to a monthly report on CMS’s website, through January 2012, 34 states 

issued incentive payments to providers that participated in the Medicaid EHR Program. 

The agency anticipates that 8 additional states will issue incentive payments for 2011.

To do this, we reviewed applicable statutes, 

regulations, and guidance. We also interviewed officials from CMS and 

four states (Iowa, Kentucky, Pennsylvania, and Texas) that we 

judgmentally selected to obtain more information about their specific 

efforts or processes used to verify whether providers met these eligibility 

11Pub.L. No. 111-5, § 13424(e), 123 Stat. 278-279.

12We also discussed with the committees of jurisdiction that we would report on, at a later 

date, the number and characteristics of providers that received incentive payments from 

CMS during the first year of the Medicare and Medicaid EHR programs. 

13The HITECH Act created incentive programs for Medicare fee-for-service, Medicare 

Advantage, and Medicaid. Under the Medicare Advantage EHR program, Medicare 

Advantage Organizations—private companies that provide Medicare health insurance 

coverage to beneficiaries for hospital, physician, and other services—receive incentive 

payments for certain affiliated professionals and hospitals that meet program 

requirements. Pub. L. No. 111-5, § 4101(c), 123 Stat. 473-476. A review of the Medicare 

Advantage EHR program is outside the scope of this report. Throughout this report, we 

use the term Medicare EHR program to refer to the Medicare fee-for-service EHR 

program. 
 

Page 5 GAO-12-481 Electronic Health Records

and reporting requirements.14 In addition, we reviewed these states’ State 

Medicaid Health Information Technology Plans, which describe how the 

states plan to implement and oversee their Medicaid EHR programs and 

which CMS is responsible for reviewing. We also reviewed an HHS Office 

of Inspector General (OIG) report, issued in July 2011, which describes 

the processes used and the challenges that selected states face in 

verifying whether providers meet the Medicaid EHR program’s eligibility 

requirements.15 Finally, as part of our review, we assessed the verification 

processes used by CMS and the four states in the context of federal 

standards for internal controls for risk assessment and control activities.16

To examine the information reported to CMS by providers in the first year 

of the Medicare EHR program, we conducted several analyses of CMS’s 

National Level Repository data from 2011.

The internal control for risk assessment refers to an agency’s 

identification, analysis, and management of relevant risks associated with 

achieving the agency’s objectives, such as risks to program integrity. 

Control activities refer to an agency’s ability to ensure that the policies 

and procedures that enforce management’s directives—such as the 

processes used to verify that providers qualify to receive incentive 

payments—are carried out in an effective and efficient manner.

17

 

14From among the states that had started registering providers for their states’ Medicaid 

EHR program as of June 6, 2011, we judgmentally selected these four states based on 

the variation in the following: geographic region, total state population, Medicaid 

enrollment as a percentage of state population, and whether the state had started making 

incentive payments as of May 31, 2011.

Specifically, we analyzed the 

meaningful use and clinical quality measures providers reported to CMS 

through December 8, 2011, to demonstrate meaningful use under the 

Medicare EHR program. We analyzed the CMS data to identify

15HHS, OIG, “Early Review of States’ Planned Medicaid Electronic Health Record 

Incentive Program Oversight,” OEI-05-10-00080 (Washington, D.C.: July 15, 2011).The 

OIG selected 13 states because they had CMS-approved State Medicaid Health 

Information Technology Plans as of January 14, 2011, and were available for interviews at 

the time of OIG’s review. The 4 states we reviewed were among those included in the OIG 

report. 

16See GAO, Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999) and GAO, Internal Control 

Management and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001). 

17We analyzed data submitted by providers from April 18, 2011, the date CMS began 

collecting these data, through December 8, 2011. 
 

Page 6 GAO-12-481 Electronic Health Records

• the extent to which providers claimed an exemption, as allowed under 

the program, from reporting certain meaningful use measures if, 

according to the providers, those measures were not relevant to their 

patient populations or clinical practices. The agency allows providers 

to claim exemptions from reporting certain meaningful use measures 

in 2011 to help ensure that providers with all types of patient 

populations and clinical practices could potentially demonstrate 

meaningful use;18

• the frequency with which providers reported meaningful use measures 

for which exemptions were allowed; and

• the extent to which providers had few patients—less than seven—who 

could be included in the calculation of at least one clinical quality 

measure.19

As part of our analysis, we also analyzed data from CMS and HHS’ 

Health Resources and Services Administration to compare, among 

different types of providers, the percentage of providers that (1) reported 

an exemption from reporting certain meaningful use measures and 

(2) reported clinical quality measures based on few patients. To ensure 

the reliability of the various data we analyzed, we interviewed officials 

from CMS, reviewed relevant documentation, and conducted electronic 

testing to identify missing data and obvious errors. On the basis of these 

activities, we determined that the data we analyzed were sufficiently 

reliable for our analysis. In addition to conducting data analyses, we 

interviewed officials and reviewed documents from the following 

organizations to obtain information on measures providers were required 

to report to CMS to demonstrate meaningful use in 2011: the American 

Medical Association; the American Hospital Association; and the Health 

Information Technology Policy Committee and the Health Information 

Technology Standards Committee, both of which advise HHS’s Office of 

 

18See 75 Fed. Reg. 44328-44329 (July 28, 2010). 

19Measures that capture a small number of patients may be unreliable measures of quality 

because relatively small changes in the number of patients who experienced the care 

processes or outcomes targeted by the measure can generate large shifts in the 

calculated percentage for the measure. 
 

Page 7 GAO-12-481 Electronic Health Records

the National Coordinator for Health Information Technology (ONC) on a 

variety of health technology issues.20

To describe providers’ experiences during the first year of the Medicare 

and Medicaid EHR programs, we interviewed six judgmentally selected 

providers (three professionals and three hospitals) about their 

experiences adopting and meaningfully using certified EHR technology in 

2011.21 To obtain additional information on providers’ experiences 

participating in the Medicare and Medicaid EHR programs in 2011, we 

interviewed officials and reviewed documents from the following 

organizations: the American Medical Association; the American Hospital 

Association; and four judgmentally selected Regional Extension 

Centers.22 The Regional Extension Center program was established by 

the HITECH Act and is administered by ONC to help some types of 

providers, such as those in rural areas, participate in CMS’s EHR 

programs.23

 

20Both committees were established under the HITECH Act. The Health Information 

Technology Policy Committee is charged with making recommendations to ONC on a 

policy framework for the development and adoption of a nationwide health information 

infrastructure whereas the Health Information Technology Standards Committee is 

charged with making recommendations to ONC on standards, implementation 

specifications, and certification criteria for the electronic exchange and use of health 

information. Pub. L. No. 111-5, § 13101, 123 Stat. 228-242. 

We also analyzed data reported as part of the Regional 

Extension Center program to identify the number of providers they helped 

participate in CMS’s EHR programs. To ensure the reliability of the data 

we analyzed, we interviewed officials from ONC, reviewed relevant 

documentation, and conducted electronic testing to identify obvious 

errors. On the basis of these activities, we determined that the data we 

21We judgmentally selected these six providers in order to provide variation among the 

following: type of provider (hospital or professional), professional specialty (professionals 

only), whether the professional belonged to a group practice (professionals only), and 

geographic region. We selected these providers based on CMS data on providers that 

received incentive payments from the Medicare EHR program as of July 31, 2011.

22We judgmentally selected these four Regional Extension Centers in order to provide 

variation based on the following: total funding levels under the Regional Extension Center 

program, progress towards meeting the Regional Extension Center’s goal for the number 

of professionals assisted, geographic region, and urban-rural population mixes. 

23Pub. L. No 111-5 § 13101, 123 Stat. 246-250. We did not review all ONC or CMS efforts 

to educate providers about the Medicare and Medicaid EHR programs. For example, CMS 

created a website that provides various educational materials that we did not include in 

our review. 
 

Page 8 GAO-12-481 Electronic Health Records

analyzed were sufficiently reliable for our analysis. Appendix I provides 

more information on our data analyses.

We conducted this performance audit from April 2011 through April 2012 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Although the Medicare and Medicaid EHR programs are generally similar, 

there are some differences related to the types of providers that are 

permitted to participate, the duration and amount of incentive payments 

and penalties, and information providers must submit to satisfy the 

programs’ requirements.

The types of providers eligible to participate in the Medicare and Medicaid 

EHR programs—referred to as permissible providers—differ. See figure 1 

below.

Background 

Permissible Providers
 

Page 9 GAO-12-481 Electronic Health Records

Figure 1: Permissible Provider Types in the Medicare and Medicaid EHR Programs

a

Physician assistants are one of the permissible provider types if they also work in a federally 

qualified health center or rural health center that is led by a physician assistant.

b

Professionals that are eligible to participate in both the Medicare and Medicaid EHR programs may 

only receive an incentive payment from one program per year.

c

In contrast to professionals, hospitals that are eligible to participate in both the Medicare and 

Medicaid EHR programs may receive an incentive payment from both programs in the same year.

d

For the Medicare EHR program, acute care hospitals refer to hospitals described in Section 1886(d) 

of the Social Security Act, which are paid under the inpatient prospective payment system. For the 

Medicaid EHR program, acute care hospitals refer to hospitals with an average length of patient stay 

of 25 days or fewer with a CMS Certification Number that has the last four digits in the series 0001-

0879 or 1300-1399 and excludes critical access hospitals and cancer hospitals.
 

Page 10 GAO-12-481 Electronic Health Records

Beginning in 2011, the first year of the Medicare and Medicaid EHR 

programs, the programs have provided incentive payments to eligible 

providers that met program requirements. Beginning in 2015, the 

Medicare EHR program is generally required to begin applying a penalty 

for hospitals and professionals that do not meet the Medicare EHR 

program requirements. Figure 2 below provides information on the years 

that incentive payments are available and that penalties, if applicable, will 

be assessed for professionals and hospitals under the Medicare and 

Medicaid EHR programs.

Figure 2: Years in Which Incentive Payments Are Available and When Penalties Will be Assessed in the Medicare and 

Medicaid EHR Programs

Note: Payment years are determined and awarded on a calendar year basis for professionals and on 

a fiscal year basis for hospitals. Professionals may not receive incentive payments under both the 

Medicare EHR program and the Medicaid EHR program during the same year; they must choose one 

of the two programs under which they will participate. In contrast, hospitals may qualify for incentive 

payments under both programs during the same year.

a

The Medicaid EHR program does not impose penalties on Medicaid providers that do not meet the 

Medicaid EHR program’s requirements by a specific date; however, if Medicaid providers also treat 

Medicare patients, they are required to meet the Medicare EHR program’s requirements from 2015 

onward to avoid penalties from the Medicare EHR program.

The amount of incentive payment varies depending on the type of 

provider (professionals or hospitals) and the program in which the 

provider participates (Medicare EHR program or Medicaid EHR program). 

For example, in the Medicare EHR program, professionals cannot earn 

more than $18,000 in incentive payments in their first year, and, over a 

5-year period, payments cannot exceed a total of $44,000. In contrast, in 

the Medicaid EHR program, professionals cannot earn more than 

$21,250 in incentive payments in the first year and $8,500 during each of 

Incentive Payments and 

Penalties
 

Page 11 GAO-12-481 Electronic Health Records

5 subsequent years for a total of $63,750. (See app. II for more 

information on the amounts of incentive payments available under both 

programs and how the amounts are calculated.)

To receive incentive payments from either the Medicare or Medicaid EHR 

programs, providers must meet eligibility and reporting requirements.24 To 

do so, providers report certain information to CMS, the states, or to 

both—a process referred to as “attestation”—by entering certain 

information into CMS’s or the states’ EHR program web-based attestation 

tools. Providers that, based on information submitted to CMS and the 

states, meet the requirements receive incentive payments. Some of the 

eligibility and reporting requirements for the Medicare EHR program differ 

from those in the Medicaid EHR program.

To receive Medicare EHR incentive payments in 2011, professionals had 

to meet three eligibility and three reporting requirements, while hospitals 

had to meet two eligibility and two reporting requirements. (See table 1.)

 

24CMS plans to make the requirements that providers must meet more robust over time. 

According to CMS, the current focus of the EHR programs includes electronically 

capturing health information in a structured format and tracking key clinical conditions. 

Medicare EHR Program 

Requirements
 

Page 12 GAO-12-481 Electronic Health Records

Table 1: Medicare EHR Program’s Eligibility and Reporting Requirements, 2011

Requirement Professional Hospital

Eligibility requirements

Provider type

Provider is a permissible provider type. √ √

Professional is not hospital-based.

Professional cannot have performed 90 percent or more of his/her services in the prior year in 

hospital inpatient or emergency room settings. 

√

Provider qualifications

Provider is not excluded, sanctioned, or otherwise deemed ineligible to receive payments from 

the federal government.a

 

√ √

Reporting requirements

Provider uses a certified EHR system. √ √

At least 50 percent of a professional’s patient encounters during the reporting period occurred at 

practice(s) or location(s) equipped with certified EHR technology.

√

Provider demonstrates meaningful use.

Professionals must report 20 meaningful use measures; hospitals must report 19 such 

measures.

b

√ √

Source: GAO analysis of applicable CMS regulations and interviews with CMS officials.

Note: Providers attest to information submitted to CMS regarding the Medicare EHR program’s 

eligibility requirements, which specify the types of providers eligible to participate in the program. To 

demonstrate that providers met the Medicare EHR program’s reporting requirements, providers must 

report information to CMS to demonstrate that they have meaningfully used the certified EHR 

technology.

a

Professionals may not receive incentive payments from both the Medicare and Medicaid EHR 

programs in the same year.

b

One of the meaningful use measures requires professionals and hospitals to report clinical quality 

measures. The reporting period for the first year a provider demonstrates meaningful use is any 

90 consecutive days during the year; for subsequent years, the reporting period is the full year.

One noteworthy reporting requirement for 2011 was that providers were 

required to demonstrate meaningful use of certified EHR technology by 

collecting and reporting information to CMS on various measures 

established by CMS. Specifically, in 2011, professionals had to report on 

a total of 20 meaningful use measures, and hospitals had to report on a 
 

Page 13 GAO-12-481 Electronic Health Records

total of 19 meaningful use measures. This information had to be collected 

over 90 consecutive days during 2011.25

• Professionals. Of the 20 meaningful use measures for professionals, 

15 are mandatory. Of those 15 mandatory measures, 6 measures 

allow professionals to claim exemptions—that is, they may report to 

CMS that those measures are not relevant to their patient populations 

or clinical practices.26 One of the mandatory meaningful use 

measures—“report clinical quality measures to CMS”—requires 

professionals to report on at least 6 clinical quality measures identified 

by CMS.27 Professionals have the flexibility to choose the remaining 5 

meaningful use measures from a menu of 10 measures.

• Hospitals. Of the 19 meaningful use measures hospitals must report, 

14 are mandatory. Of those 14 mandatory measures, 3 measures 

allow hospitals to claim exemptions. Similar to professionals, to satisfy 

the mandatory meaningful use measure “report clinical quality 

measures to CMS,” hospitals must report on 15 clinical quality 

measures identified by CMS. Hospitals have the flexibility to choose 

the remaining 5 meaningful use measures from a menu of 10 

measures.

See appendix III for a listing of the meaningful use measures and clinical 

quality measures for 2011.

 

25To receive incentive payments in 2011, providers must collect data related to the 

meaningful use measures and clinical quality measures in any 90 consecutive days during 

that year and report those data to CMS. To receive incentive payments in subsequent 

years, providers must collect data related to the meaningful use measures over a full year 

and report those data to CMS.

26In order to meet the definition of meaningful use, eligible professionals and hospitals 

must report on measures specified by CMS. An exclusion for a nonapplicable measure is 

permitted if the provider meets certain requirements specified in the regulation. 42 C.F.R. 

§ 495.6. In this report we use the term “exemption” to refer to the exclusion of a 

nonapplicable measure. 

27A clinical quality measure is a mechanism used for assessing the degree to which a 

provider competently and safely delivers clinical services that are appropriate for the 

patient in an optimal time frame. Professionals must report on 3 core clinical quality 

measures and 3 menu clinical quality measures from a list of 38 such measures. If 

professionals have zero patients that could be included in the calculation of any one of the 

core measures, they must report on up to 3 alternate core measures. In contrast to 

professionals, hospitals do not have the option of choosing which clinical quality measures 

they can report.
 

Page 14 GAO-12-481 Electronic Health Records

To receive Medicaid EHR incentive payments during 2011, professionals 

had to meet seven eligibility requirements, hospitals had to meet six 

eligibility requirements, and both hospitals and professionals had to meet 

one reporting requirement. (See table 2.) Compared to the Medicare EHR 

program, the Medicaid EHR program requirements had two noteworthy 

differences in 2011.

• Providers had to meet a patient volume requirement.28 This 

requirement was established to ensure that providers that receive 

incentive payments from the Medicaid EHR program serve a 

minimum volume of Medicaid patients, or, for certain 

professionals, a minimum volume of needy patients.29 Specifically, 

professionals must have a Medicaid patient volume of at least 

30 percent unless they are pediatricians or practice predominantly 

in a federally qualified health center or rural health center; 

hospitals generally must have a Medicaid patient volume of at 

least 10 percent.30

• Providers only had to adopt, implement, or upgrade to a certified 

EHR system in 2011 and did not have to demonstrate meaningful 

use during the first year they participate in the Medicaid EHR 

program. However, in subsequent years, they must demonstrate 

meaningful use.31

 

28No such patient volume requirement applies to the Medicare EHR program.

29Needy patients are defined by CMS as patients who are enrolled in Medicaid or the 

Children’s Health Insurance Program, receive uncompensated care, or receive care at no 

cost or on a sliding scale determined by ability to pay. 

30Pediatricians must have a Medicaid patient volume of at least 20 percent. Professionals 

who practice predominantly in a federally qualified health center or rural health center 

must have a needy patient volume of at least 30 percent. To be considered as practicing 

predominantly in a federally qualified health center or rural health center, a professional 

must treat over 50 percent of his or her total patient volume over a period of 6 months in a 

federally qualified health center or rural health center. Hospitals must have a Medicaid 

patient volume of at least 10 percent, except for children’s hospitals, which do not have a 

patient volume requirement. 

31In general, the meaningful use criteria for the Medicare and Medicaid EHR programs are 

identical. CMS is allowing states to require Medicaid providers to report additional 

information related to public health and data registries as a condition for receiving 

incentive payments. 

Medicaid EHR Program 

Requirements
 

Page 15 GAO-12-481 Electronic Health Records

Table 2: Medicaid EHR Program’s Eligibility and Reporting Requirements, 2011

Requirement Professional Hospital

Eligibility requirements

Provider type

Provider is a permissible provider type. √ √

Professional is not hospital-based.

Professional cannot have performed 90 percent or more of his/her services in the prior year in 

hospital inpatient or emergency room settings. 

√

Hospital has an average length of stay of 25 days or less.a √a

If professional is a physician assistant, s/he works in a physician assistant-led federally qualified 

health center or rural health center.

√

Provider qualifications

Provider is licensed to practice in the state. √ √

Provider is a Medicaid provider in the state. √ √

Provider is not excluded, sanctioned, or otherwise deemed ineligible to receive payments from 

the state/federal government.b √ √

Provider meets patient volume requirements.

Professionals must have a Medicaid patient volume of at least 30 percent unless they are 

pediatricians or practice predominantly in a federally qualified health center or rural health center.

c

Hospitals must have a Medicaid patient volume of at least 10 percent.

d

√ √

Reporting requirements

Provider has adopted, implemented, or upgraded to a certified EHR system.e √ √

Source: GAO analysis of applicable CMS regulations and guidance.

Note: Providers attest to information submitted to CMS and/or the states regarding the Medicaid EHR 

program’s eligibility requirements, which specify the types of providers eligible to participate in the 

program. To demonstrate that providers met the Medicaid EHR program’s reporting requirement, 

providers must report information to the states to demonstrate that they have adopted, implemented,

or upgraded to the certified EHR technology.

a

Children’s hospitals are not subject to this requirement.

b

Professionals may not receive incentive payments from both the Medicare and Medicaid EHR 

programs in the same year. In addition, Medicaid professionals and hospitals cannot receive incentive 

payments from more than one state in the same year.

c

Pediatricians must have a Medicaid patient volume of at least 20 percent. Professionals who practice 

predominantly in a federally qualified health center or rural health center must have a needy patient 

volume of at least 30 percent. A needy individual is defined as someone who is enrolled in Medicaid 

or the Children’s Health Insurance Program, receives uncompensated care, or receives care at no 

cost or on a sliding scale determined by ability to pay. To practice predominantly in a federally 

qualified health center or rural health center means that a professional treats over 50 percent of his or 

her total patient volume over a period of 6 months in a federally qualified health center or rural health 

center.

d

Hospitals must have a Medicaid patient volume of at least 10 percent, except for children’s hospitals, 

which do not have a patient volume requirement.

e

During the first year providers participate in the Medicaid EHR program, they need only adopt, 

implement, or upgrade to a certified EHR system. In subsequent years, they must meet two other 

reporting requirements—demonstrate meaningful use and at least 50 percent of the professional’s 

patient encounters during the reporting period occurred at practices or locations equipped with 

certified EHR technology.
 

Page 16 GAO-12-481 Electronic Health Records

To help ensure the integrity of incentive payments, CMS and the states 

are responsible for developing oversight strategies, which may include 

conducting verifications of provider-submitted information before 

payments are made (prepayment) or after payments are made 

(postpayment). The latter consists of verifying provider-submitted 

information by auditing a sample of providers. See figure 3 for information 

on the sequence of pre- and postpayment verification.

Oversight Responsibilities 

for the EHR Programs
 

Page 17 GAO-12-481 Electronic Health Records

Figure 3: Oversight Process CMS and States May Use to Verify Providers Met 

Eligibility and Reporting Requirements for the Medicare and Medicaid EHR 

Programs
 

Page 18 GAO-12-481 Electronic Health Records

The HITECH Act established the Regional Extension Center program and 

approximately $721 million in grants were awarded to Regional Extension 

Centers. Administered by HHS’s ONC, the primary mission of the 

Regional Extension Center program is to assist providers with adopting, 

implementing, and meaningfully using EHRs, particularly those providers 

that may face challenges due to, for example, limited financial and staff 

resources.32

The Regional Extension Center program targets professionals who work 

in certain settings for assistance:

This assistance is intended to facilitate providers’ 

participation in the Medicare and Medicaid EHR programs. There are 

62 Regional Extension Centers, covering all 50 states, the District of 

Columbia, and all U.S. insular areas.

• individual or group primary care practices with 10 or fewer 

professionals;

• public, rural, and critical access hospitals;

• community health centers and rural health clinics;

• collaborative networks of small practices;33 and

• other settings that predominantly serve medically underserved 

populations, as defined by each Regional Extension Center.34

ONC also provides funding for Regional Extension Centers to provide 

assistance to certain hospitals—critical access and rural hospitals—to 

ensure that centers’ services are available in those settings.

 

32Regional Extension Centers offer assistance to providers irrespective of whether they 

are eligible to receive incentive payments under the EHR programs. 

33ONC defines collaborative networks of small practices as practices of 10 or fewer 

professionals who share services, purchasing arrangements, and/or patient coverage. 

34In some of these categories, such as the category of “other settings that predominantly 

serve medically underserved populations,” ONC required each Regional Extension Center 

to define the types of professionals they would assist by addressing local concerns, such 

as professionals in practices with a high percentage of uninsured patients. 

Regional Extension Center 

Program
 

Page 19 GAO-12-481 Electronic Health Records

ONC’s overall goal for the Regional Extension Center program is to help 

100,000 professionals meet the EHR programs’ requirements for 

meaningful use by 2014 and to help a total of 1,777 critical access and 

rural hospitals meet the EHR programs’ requirements for meaningful use 

by 2014. In its agreement with ONC, each Regional Extension Center 

established its own goal for the number of providers it would assist to help 

the program meet its overall goal.

CMS and the four states we reviewed are implementing processes to 

verify whether providers met the Medicare or Medicaid EHR programs’ 

eligibility and reporting requirements and, therefore, qualified to receive 

incentive payments in the programs’ first year. Although CMS is taking 

some steps to improve the processes CMS and states use to verify 

whether providers have met Medicare and Medicaid EHR program 

requirements, we found that CMS has additional opportunities to assess 

and improve these processes.

For the first program year, CMS is implementing a combination of preand postpayment processes to verify whether providers have met all of 

the Medicare EHR program eligibility and reporting requirements. In 

addition, the four states we reviewed have implemented or plan to 

implement a combination of pre- and postpayment processes to verify 

whether providers have met Medicaid EHR program eligibility and 

reporting requirements.

CMS has developed and begun to implement processes to verify whether 

providers participating in the Medicare EHR program have met all of the 

program’s eligibility and reporting requirements and thereby qualify to 

receive incentive payments. In 2011, CMS implemented prepayment 

processes to verify whether providers have met all three of the Medicare 

EHR program’s eligibility requirements. These processes consist of 

automatic checks that are built into CMS’s databases to verify the 

information submitted by providers when they register for the program.35

 

35According to CMS officials, because a provider’s status may change, CMS has also 

implemented processes to recheck whether the provider has met some of the Medicare 

EHR program’s eligibility requirements before payments are issued to providers.

For the First Program 

Year, Processes Are 

Being Implemented to 

Verify Requirements 

Were Met, and CMS 

Has Opportunities to 

Improve Them

CMS and Selected States 

Are Implementing 

Processes to Verify 

Whether Providers Met 

Requirements to Receive

Incentive Payments

Verification under the Medicare 

EHR Program 
 

Page 20 GAO-12-481 Electronic Health Records

CMS also implemented a process to verify, on a prepayment basis, 

whether providers have met one of the Medicare EHR program’s 

reporting requirements—to use a certified EHR system.36

In 2012, according to CMS officials, the agency plans to implement 

additional processes to verify, on a postpayment basis, whether a sample 

of providers has met all three of the Medicare EHR program’s reporting 

requirements. To conduct these verifications, CMS has developed a riskbased approach that will be used to identify a sample of about 10 percent 

of professionals and 5 percent of hospitals for audits.

Specifically, 

CMS built an automatic check to compare the EHR certification numbers 

for the systems providers reported using during attestation against a list 

of EHR systems that have been certified by ONC.

37 Under CMS’s 

planned audit strategy, the agency may request that providers selected 

for postpayment audits submit documentation, such as patient rosters, 

EHR screenshots, and reports generated by the EHR system to support 

data the providers reported to CMS during attestation. If CMS determines 

during the audits that a provider has failed to meet any one of the 

reporting requirements, it plans to take steps to recoup incentive 

payments. CMS officials said that they decided to wait until 2012 to begin 

conducting audits of providers that received incentive payments in 2011, 

the first payment year, to ensure that the agency does not unfairly target 

a disproportionate number of early participants in the Medicare EHR 

program.38 For an overview of CMS’s processes to verify whether 

providers met the Medicare EHR program’s eligibility and reporting 

requirements, see table 3.

 

36CMS also plans to verify whether providers have met this requirement on a postpayment 

basis by reviewing documentation that supports that providers have the EHR technology 

they attested to using. 

37In addition, according to CMS officials, the agency plans to conduct a separate audit, 

beginning in 2012, to verify that providers had the certified EHR systems they attested to 

using. For these audits, CMS anticipates sampling roughly 20 percent of professionals 

and 10 percent of hospitals, identified through random sampling as well as some targeted 

selection. 

38These officials also explained that, because this is a new program, the agency will 

continue to reevaluate and improve its audit process using the best information that is 

currently available.
 

Page 21 GAO-12-481 Electronic Health Records

Table 3: CMS’s Processes to Verify Whether Providers Met Medicare EHR Program Eligibility and Reporting Requirements in 

2011 

Requirement

Verification through 

prepayment 

processes in 2011

Verification through 

postpayment audit processes 

planned for 2012

Eligibility requirements

Provider is a permissible provider type. √

Professional is not hospital-based. √

Provider is not excluded, sanctioned, or otherwise deemed ineligible to 

receive payments from the federal government.

√

Reporting requirements

Provider uses a certified EHR system.a √ √

Provider demonstrates meaningful use. √b

At least 50 percent of a professional’s patient encounters during the 

reporting period occurred at practice(s) or location(s) equipped with certified 

EHR technology.

√

Source: GAO analysis of CMS documents and interviews with CMS officials. 

Note: Providers attest to information submitted to CMS regarding the Medicare EHR program’s 

eligibility requirements, which specify the types of providers eligible to participate in the program. To 

demonstrate that providers met the Medicare EHR program’s reporting requirements, providers must 

report information to CMS to demonstrate that they have meaningfully used certified EHR technology.

a

CMS implemented a process to verify, on a prepayment basis, whether providers have met the 

requirement to use a certified EHR system. Specifically, CMS built an automatic check to compare 

the EHR certification numbers providers reported during attestation against a list of EHR systems 

certified by the Office of the National Coordinator for Health Information Technology. CMS also plans 

to implement a process to verify this requirement on a postpayment basis by reviewing 

documentation that supports that providers have the EHR system they claimed to use.

b

CMS checks, after providers attest, that the information they submitted met the thresholds for the 

meaningful use measures, where applicable. However, the agency does not verify the accuracy of the 

information submitted until after payments are issued. For example, for the meaningful use measure 

that providers record demographic information for 50 percent or more of their patients, CMS checks 

that the information providers submitted met that threshold. However, the agency does not verify that 

all demographic information for at least 50 percent of the providers’ patients has been populated in 

their EHR system until after payments are issued.

According to CMS officials, the agency is also developing processes to 

verify the accuracy of the incentive payment amounts made to hospitals 

in the first year of the Medicare EHR program. The Medicare EHR 

incentive payment amount is calculated based on information from 

Medicare cost reports. According to CMS officials, by mid-2012, the 

agency plans to audit this information to verify that the information is 

accurate. In contrast, CMS is not developing processes to verify the 

accuracy of incentive payment amounts made to professionals in the first 
 

Page 22 GAO-12-481 Electronic Health Records

year of the program because those amounts are based on information 

from Medicare Part B claims that it has already audited.39

Three of the states we reviewed—Iowa, Kentucky, and Pennsylvania—

have implemented processes to verify whether providers have met all the 

Medicaid EHR program’s eligibility and reporting requirements and 

thereby qualify to receive incentive payments. The fourth state, Texas, 

has implemented processes to verify whether providers met most of the 

program’s eligibility and reporting requirements and is in the process of 

developing additional verification processes as part of its postpayment 

audit strategy. Because CMS allows states flexibility in determining how 

they verify compliance with these requirements, the states vary in terms 

of whether they use prepayment or postpayment verification processes.

In order to verify whether providers have met the Medicaid EHR 

program’s eligibility requirements, all four states have primarily 

implemented prepayment processes, some of which are automated 

checks built into their databases. Iowa, Kentucky, and Pennsylvania also 

conduct postpayment audits of samples of providers to verify whether 

they have met requirements that were not checked on a prepayment 

basis.40

Three states—Iowa, Kentucky, and Pennsylvania—use a combination of 

pre- and postpayment processes to verify whether providers have met the 

eligibility requirement regarding the Medicaid patient volume threshold, 

which is determined by dividing a professional’s number of Medicaid 

patient visits by their total number of patient visits. For example, they use 

Medicaid claims data to verify, on a prepayment basis, the professionals’ 

number of Medicaid patient visits over the reporting period. Then, on a 

postpayment basis for a sample of professionals, the states use 

These states identify samples of providers to be audited using 

various risk-based approaches. Texas intends to conduct postpayment 

audits as well, but has not finalized its audit strategy.

 

39Medicare Part B covers physician, outpatient hospital, home health care, and certain 

other services.

40These states also reverify, on a postpayment basis, whether providers have met some 

eligibility requirements that were checked prepayment. In addition, CMS officials told us 

that the agency checks some eligibility information submitted by Medicaid providers. For 

example, after a provider registers at the CMS EHR program website, CMS automatically 

validates that the provider has not been excluded from participating in federal health care 

programs. 

Verification under the Medicaid 

EHR Program 
 

Page 23 GAO-12-481 Electronic Health Records

documentation submitted by professionals, such as patient billing reports, 

to verify their total number of patient visits. Most states, including these 

three, must rely on provider self-reported information to verify compliance 

with this requirement, because states typically do not collect data on 

some of the professionals’ patient visits, such as visits paid for by private 

insurance.41

To verify whether providers have met the Medicaid EHR program’s 

reporting requirement to adopt, implement, or upgrade to a certified EHR 

system, the four states we reviewed use prepayment processes, 

postpayment processes, or both. The four states we reviewed have 

implemented processes, on a prepayment basis, that check the EHR 

certification numbers reported by providers against a list of EHR systems 

that have been certified by ONC.42 Further, Kentucky takes additional 

steps to verify, on a prepayment basis, compliance with this requirement 

by reviewing documentation, such as EHR invoices. Iowa and 

Pennsylvania include a similar verification process as part of their 

postpayment audits. Texas has not yet determined whether it will conduct 

additional postpayment verifications. For an overview of the four selected 

states’ processes to verify whether providers met the Medicaid EHR 

program’s eligibility and reporting requirements, see table 4.

 

41CMS officials recognize that verifying whether professionals met the patient volume 

requirement is challenging for states, and the OIG report also found that states had 

difficulty verifying that professionals met this requirement. CMS plans to continue to 

provide additional guidance to states on how they can ensure professionals complied with 

this requirement.

42CMS expects states to check the certification number providers submitted against a list 

of such numbers maintained by ONC prior to issuing payments to providers. CMS State 

Medicaid Director Letter, Aug. 17, 2010 (SMD# 10-016), Enclosure B. Accessed at 

www.cms.gov on April 13, 2011. 
 

Page 24 GAO-12-481 Electronic Health Records

Table 4: Four States’ Processes to Verify Whether Providers Met Medicaid EHR Program Eligibility and Reporting 

Requirements in 2011 

Iowa Kentucky Pennsylvania Texas

Requirement

Verified 

prepayment

Verified 

postpayment

Verified 

prepayment

Verified 

postpayment

Verified 

prepayment

Verified 

postpayment

Verified 

prepayment 

Verified 

postpaymenta

Eligibility requirements

Provider type

Provider is a 

permissible provider 

type.

√ √ √ √ √ a

Professional is not 

hospital-based.

√ √ √ √ √ √ √ a

Hospital has an 

average length of stay 

of 25 days or less.

√ √ √ √ a

If professional is a 

physician assistant, 

s/he works in a 

physician assistant-led 

federally qualified 

health center or rural 

health center.

√ √ √ a

Provider qualifications

Provider is licensed to 

practice in the state.

√ √ √ √ √ a

Provider is a Medicaid 

provider in the state.

√ √ √ √ a

Provider is not 

excluded, sanctioned, 

or otherwise deemed 

ineligible to receive 

payments from the 

state/federal 

government.

√ √ √ √ a

Provider meets patient 

volume requirements.b √ √ √ √ √ √ √ a

Reporting requirementc

Provider has adopted, 

implemented, or 

upgraded to a certified 

EHR system.d

√ √ √ √ √ √ a

Source: GAO analysis of State Medicaid Health Plans and other state documents, and interviews with state officials.
 

Page 25 GAO-12-481 Electronic Health Records

Note: Providers attest to information submitted to CMS and/or the states regarding the Medicaid EHR 

program’s eligibility requirements, which specify the types of providers eligible to participate in the 

program. To demonstrate that providers met the Medicaid EHR program’s reporting requirement, 

providers must report information to the states to demonstrate that they have adopted, implemented, 

or upgraded to certified EHR technology.

a

As of December 2011, Texas had not finalized its postpayment audit strategy.

b

Iowa, Kentucky, and Pennsylvania use a combination of pre- and postpayment processes to verify 

whether providers have met this requirement. For example, these states use processes to verify 

whether certain professionals have met the Medicaid patient volume requirement, on a prepayment 

basis, using Medicaid claims data to check the professionals’ number of Medicaid patient visits. Then, 

they use processes to verify whether a sample of professionals have met this requirement, on a 

postpayment basis, using documentation submitted by providers, such as patient billing reports, to 

confirm their total number of patient visits.

c

During the first year providers participate in the Medicaid EHR program, they need only adopt, 

implement, or upgrade to a certified EHR system. In subsequent years, they must meet two other 

reporting requirements—demonstrate meaningful use and at least 50 percent of the professional’s 

patient encounters during the reporting period occurred at practices or locations equipped with 

certified EHR technology.

d

Iowa, Pennsylvania, and Kentucky use two verification processes to check whether providers have 

met the reporting requirement to adopt, implement, or upgrade to a certified EHR system. Consistent 

with CMS guidance, these states as well as Texas implemented processes to verify, on a prepayment 

basis, whether providers have met this requirement by checking the EHR certification numbers 

providers reported during attestation against a list of EHR systems certified by the Office of the 

National Coordinator for Health Information Technology. CMS State Medicaid Director Letter, 

August 17, 2010 (SMD# 10-016), Enclosure B. Accessed at www.cms.gov on April 13, 2011. These 

states also verify whether providers have met this requirement by reviewing documentation that 

supports that providers have the EHR system they claimed to have. Kentucky conducts this additional 

verification prior to issuing payments to providers, and Iowa and Pennsylvania conduct it after 

payments are issued.

The four states we reviewed are also implementing processes to verify 

the accuracy of the incentive payment amounts made to hospitals under 

the Medicaid EHR program. CMS allows states flexibility in how they 

ensure the accuracy of these payments, and, according to CMS officials, 

states are implementing different approaches to verify the accuracy of this 

information. CMS officials told us that, for example, some states with 

Medicaid EHR programs use cost reports to verify the accuracy of 

hospital incentive payments and recheck the information using data from 

the state’s Medicaid claims database and other sources. In contrast, for 

professionals, the amount of incentive payments received in any given 

year is, in general, a fixed amount—$21,250 in the first year and $8,500 

in up to 5 subsequent years. Therefore, states do not need to implement 

processes to ensure the amount of incentive payments professionals 

receive is accurate.
 

Page 26 GAO-12-481 Electronic Health Records

CMS has taken some steps, consistent with federal internal control 

standards, to assess how states have implemented the Medicaid EHR 

program, including their efforts to prevent improper payments by verifying 

whether providers have met the program’s requirements.43 According to 

CMS officials, the agency has entered into two contracts to conduct an 

assessment and to identify tools and resources states could use to 

improve their implementation and oversight of the Medicaid EHR 

programs. In the case of the Medicare EHR program, CMS officials 

recognize that because the program is also in the early stages of 

implementation, it is important to continually assess the extent to which 

CMS’s audit strategy mitigates the risk of improper payments. These 

officials told us that the agency intends to evaluate whether its Medicare 

EHR program audit strategy is effective in reducing the risk of improper 

payments. However, the agency has not yet determined what this 

evaluation will entail or established corresponding timelines for initiating 

this evaluation.44

If completed, this evaluation provides an opportunity for CMS to assess 

whether or to what extent the agency should revise its verification 

processes to further mitigate the risk of making improper payments by, for 

example, implementing additional prepayment processes as appropriate 

to verify whether providers have met the Medicare EHR program’s 

reporting requirements. As we have noted in our prior work, it is more 

effective and efficient to prevent improper payments than to detect and 

recoup them later.45

 

43See GAO, Standards for Internal Control in the Federal Government, 

Verifying that providers qualify for incentive 

payments on a prepayment basis—that is, before disbursing an incentive 

payment—is one way to prevent improper payments. Furthermore, 

conducting this evaluation is important because we have designated the 

GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999) and GAO, Internal Control 

Management and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001).

44CMS officials told us that the agency plans to determine what its evaluation of the 

Medicare EHR program audit strategy will entail and develop a corresponding timeline for 

beginning this work after it begins conducting Medicare EHR program postpayment audits.

45GAO, Improper Payments: Status of Agencies’ Efforts to Address Improper Payment 

and Recovery Auditing Requirements, GAO-08-438T (Washington, D.C.: Jan. 31, 2008).

CMS Has Opportunities to 

Assess and Improve 

Processes to Verify 

Whether Requirements 

Have Been Met
 

Page 27 GAO-12-481 Electronic Health Records

Medicare program as being vulnerable to making improper payments.46

In addition, CMS has two opportunities to improve the efficiency of 

processes to verify whether providers met requirements for the Medicare 

and Medicaid EHR programs. Ensuring program efficiency is consistent 

with federal internal control standards.

The EHR programs may be at greater risk of improper payments than 

other, more established CMS programs because they are new programs 

with complex requirements that providers must meet to qualify for 

incentive payments.

• First, while CMS took steps to improve the efficiency of postpayment 

audits under the Medicaid EHR program, it has not done so for the 

Medicare EHR program. For example, in the case of the Medicaid 

EHR program, CMS asked states to obtain additional information, 

when they begin collecting meaningful use attestations from providers 

in 2012, in order to ensure that providers satisfied the meaningful use 

reporting requirement to submit electronic data to immunization 

registries or immunization information systems.47 CMS officials 

explained that collecting this information at the time of attestation 

would increase the amount of information available to the states when 

they conduct postpayment audits. However, while CMS officials 

recognized that the Medicare EHR program could benefit from taking 

steps to collect similar information from Medicare providers, the 

agency has not yet done so.

• Second, although states were directed by CMS to develop tools to 

collect information reported by providers when they attest that they 

have met the meaningful use requirements, according to a senior 

CMS official, CMS could potentially collect this information for 

Medicaid providers on the states’ behalf. All states with an EHR 

program will have to begin collecting meaningful use attestations in 

 

46High-Risk Series: An Update, GAO-11-278 (Washington, D.C.: February 2011). GAO 

has designated Medicare as a high-risk program since 1990 recognizing that the size of 

the program, its rapid growth, and its complexity continue to present vulnerabilities that 

challenge CMS’s ability to safeguard against improper payments. GAO has designated 

Medicaid as a high-risk program since 2003 because of concerns about the program’s 

size, growth, diversity, and fiscal management. 

47CMS suggests states ask providers to indicate during attestation (a) the name of the 

immunization registry they submitted their information to and (b) if they did so 

successfully.
 

Page 28 GAO-12-481 Electronic Health Records

the second year of their program as the Medicaid reporting 

requirements are increased to be more like Medicare’s. Several states 

have already developed web-based meaningful use attestation tools, 

while other states have not yet done so. Were CMS to collect this 

information on states’ behalf, federal and state cost savings could 

potentially be realized inasmuch as states are reimbursed by CMS for 

90 percent of the costs related to planning for and administering the 

Medicaid EHR program, including the cost of creating their attestation 

tools.48 Furthermore, CMS currently collects this information on behalf 

of the states for some Medicaid providers, in addition to collecting this 

information for all Medicare providers.49 If CMS were to offer to collect 

this information from all Medicaid providers on behalf of states, as the 

agency currently does for some Medicaid providers, it could alleviate 

the need for some states—especially those that have not yet 

developed their attestation tools—to have to create similar web-based 

attestation tools, which could potentially yield cost savings at both the 

federal and state levels. Furthermore, even states that have already 

developed these tools to capture meaningful use attestations in 2012 

will need to make changes to their attestation tools in subsequent 

years of the program. Having CMS capture meaningful use 

attestations on the states’ behalf in subsequent years would alleviate 

the need for them to make these changes.

 

48The HITECH Act appropriated $300 million over the course of fiscal years 2009 

through 2016 for carrying out the Medicaid EHR program. Pub. L. No. 111-5, § 4201(b), 

123 Stat. 494 (2009). The costs associated with carrying out the Medicaid EHR program, 

which CMS generally refers to as administrative costs, vary across states. For example, to 

develop web-based attestation tools, officials from one state we reviewed reported that the 

state will spend more than $1 million whereas officials from another state reported 

spending considerably less because they shared costs with other states.

49CMS already collects meaningful use attestation information on behalf of the states for 

hospitals that are eligible to receive both Medicare and Medicaid EHR incentive payments. 

CMS has not reported that this process delayed incentive payments to hospitals.
 

Page 29 GAO-12-481 Electronic Health Records

Most providers participating in the first year of the Medicare EHR program 

through December 8, 2011, exercised program flexibility to exempt 

themselves from reporting on at least one mandatory meaningful use 

measure. In addition, many providers also reported at least one clinical 

quality measure based on few patients.

During the first year of the Medicare EHR program through December 8, 

2011, most participating providers exercised flexibility allowed under the 

program to claim an exemption from reporting at least one mandatory 

meaningful use measure. Specifically, 72.4 percent of professionals and 

79.6 percent of hospitals claimed such an exemption.50

We found that a greater percentage of some professionals reported at 

least one exemption than other professionals. Specifically, we found that

Providers may 

exempt themselves from reporting certain mandatory meaningful use 

measures—up to six measures for professionals and up to three 

measures for hospitals—if they report to CMS that those measures are 

not relevant to their patient populations or clinical practices.

• a greater percentage of chiropractors, dentists, optometrists, 

specialists, and other eligible physicians reported at least one 

exemption compared to generalists; and

• a greater percentage of professionals with 2010 Medicare Part B 

charges at or below the 75th percentile reported at least one 

exemption compared to those with charges above the 75th percentile.

 

50We analyzed full-year data for hospitals and partial-year data for professionals. For 

more information on the data we analyzed, including information on providers we included 

and excluded from our analysis, see app. II. 

Most Medicare 

Providers Exempted 

Themselves from 

Reporting Certain 

Measures and Many 

Reported Others 

Based on Few 

Patients 

Most Providers Exercised 

Program Flexibility to 

Exempt Themselves from 

Reporting on Certain 

Mandatory Measures
 

Page 30 GAO-12-481 Electronic Health Records

We also found that among specialists, the largest specialty group of 

participating professionals, over three-quarters claimed at least one 

exemption. (See table 5.)

Table 5: Percentage of Professionals Who Participated in the Medicare EHR 

Program That Claimed an Exemption for at Least One Meaningful Use Measure, 

through December 8, 2011

Professional characteristics

Number of 

participating 

professionals 

Percentage 

reporting at least 

one exemption 

Overall 23,844 72.4

Professional specialty

Dentist 14 100.0

Chiropractor 202 99.0

Optometrist 737 92.0

Specialist 11,046 75.9

Podiatrist 1,212 75.5

Generalist 9,569 66.2

Other eligible physiciana 900 69.0

Practice locationb

Rural 2,725 78.1

Urban 21,099 71.7

Amount of 2010 Medicare Part B charges

≤ 25th percentile 1,027 83.0

> 25th percentile, but ≤ 50th percentile 3,392 77.9

> 50th percentile, but ≤ 75th percentile 7,867 75.6

> 75th percentile 11,199 67.5

Source: GAO analysis of CMS and Health Resources and Services Administration data.

Note: This analysis is based on partial-year data for professionals. Specifically, we analyzed data 

professionals reported to demonstrate meaningful use for the Medicare EHR program from April 

2011, when CMS began collecting these data, through December 8, 2011. To demonstrate 

meaningful use for the 2011 program year, professionals could continue to report these data through 

February 29, 2012. The sum of the number of professionals listed by professional specialty, practice 

location, and amount of 2010 Medicare Part B charges is not equal to the overall number of 

professionals due to missing data. Unless otherwise noted, all differences among groups are 

significant at the 0.05 level.

a

“Other eligible physician” includes physicians for whom the information on professional specialty 

needed to classify them into one of the other professional specialty categories was not available in 

CMS’s National Plan and Provider Enumeration System.

b

The difference between the percentage reporting at least one exemption for professionals practicing 

in urban and rural locations is not statistically significant.
 

Page 31 GAO-12-481 Electronic Health Records

We found that a greater percentage of some hospitals reported at least 

one exemption than other hospitals. Specifically, we found that

• a greater percentage of critical access hospitals reported at least one 

exemption compared to acute care hospitals, and

• a greater percentage of hospitals with less than 200 beds reported at 

least one exemption compared to hospitals with 200 beds or more.

We also found that among acute care hospitals, the largest type of 

participating hospital, slightly over three-quarters claimed at least one 

exemption.51 (See table 6.)

 

51Acute care hospitals refer to hospitals described in Section 1886(d) of the Social 

Security Act, which are paid under the inpatient prospective payment system. 
 

Page 32 GAO-12-481 Electronic Health Records

Table 6: Percentage of Hospitals That Participated in the Medicare EHR Program 

That Claimed an Exemption for at Least One Meaningful Use Measure, 2011

Hospital characteristics

Number of 

participating hospitals

Percentage reporting 

at least one exemption

Overall 803 79.6

Type of hospital

Critical access hospital 174 85.1

Acute care hospitala 626 78.1

Ownership typeb

Proprietary 169 84.6

Government-owned 189 78.8

Nonprofit 442 78.1

Bed size

1 to 49 beds 240 84.2

50 to 99 beds 128 79.7

100 to 199 beds 145 82.1

200 or more beds 287 74.6

Hospital locationb

Rural 300 81.0

Urban 500 78.8

Source: GAO analysis of CMS and Health Resources and Services Administration data. 

Note: The sum of the number of hospitals listed by type of hospital, ownership type, bed size, and 

location is not equal to the overall number of hospitals due to missing data. Unless otherwise noted, 

all differences among groups are significant at the 0.05 level.

a

Acute care hospitals refer to hospitals described in Section 1886(d) of the Social Security Act, which 

are paid under the inpatient prospective payment system

b

The difference in the percentage of hospitals reporting at least one exemption based on this variable 

was not statistically significant.

Of the mandatory meaningful use measures for which providers may 

claim exemptions, we found that the majority of providers claimed an 

exemption from the mandatory measure “provide patients with an 

electronic copy of their health information.” Providers may claim an 

exemption from this measure if they receive no requests from patients for 

an electronic copy of their health information. This measure was the 

least frequently reported mandatory measure for both professionals 

(32.7 percent) and hospitals (30.3 percent). In contrast, the most 

frequently reported mandatory measure for which exemptions were 

permitted was “record smoking status for patients 13 years old or older” 

for both professionals (99.4 percent) and hospitals (99.5 percent).
 

Page 33 GAO-12-481 Electronic Health Records

Our finding that a majority of providers claimed exemptions from reporting 

at least one mandatory meaningful use measure is consistent with 

comments made by stakeholders in response to CMS’s Rule on the 

Electronic Health Record Incentive Program.52 Specifically, those 

stakeholders stated that certain providers, including specialists and small 

hospitals, would not be able to report all mandatory meaningful use 

measures, since some measures would be outside the scope of their 

practice. While CMS currently allows providers the flexibility to claim 

exemptions from reporting certain mandatory meaningful use measures, 

in future years of the EHR programs, CMS stated that it may not allow 

providers the same flexibility.53 It is unclear what effect, if any, such a 

change would have on participation levels in future program years.

Our analysis of clinical quality measures found that many providers 

reported at least one such measure based on few patients—less than 

seven—during the first year of the Medicare EHR program through 

December 8, 2011.54

 

52See CMS, Final Rule, Medicare and Medicaid Programs: Electronic Health Record 

Incentive Program; 75 Fed. Reg. 44314 (July 28, 2010).

Providers were required to report these measures to 

satisfy one of the mandatory meaningful use measures—”report clinical 

quality measures to CMS.” Specifically, 41.3 percent of professionals and 

86.9 percent of hospitals reported at least one clinical quality measure 

based on few patients. Clinical quality measures calculated using few 

patients may be statistically unreliable, which, according to the American 

53In the preamble to CMS’s Rule on the Electronic Health Record Incentive Program, the 

agency stated that it allowed providers to claim exemptions from reporting certain 

meaningful use measures in 2011 to help ensure that providers with all types of patient 

populations and clinical practices could potentially demonstrate meaningful use. See 

75 Fed. Reg. 44328-44329 (July 28, 2010).

54The meaningful use reporting period is 90 days in the first year; providers will be 

required to report meaningful use for an entire year during subsequent years. Assuming a 

steady rate of change, providers that had fewer than seven patients meet inclusion criteria 

for calculating clinical quality measures during the 90-day reporting period would have 

fewer than 25 patients meet these criteria during the full-year reporting period.

Many Providers Reported 

Clinical Quality Measures 

Based on Few Patients
 

Page 34 GAO-12-481 Electronic Health Records

Hospital Association and others, could detract from providers’ abilities to 

use those measures as meaningful tools for quality improvement.55

We found that a greater percentage of some professionals reported 

measures based on few patients than other professionals. Specifically, 

we found that

• a greater percentage of chiropractors, dentists, optometrists, 

specialists, podiatrists, and other eligible professionals reported at 

least one clinical quality measure that was calculated using few 

patients compared to generalists;

• a greater percentage of professionals practicing in urban locations 

reported at least one clinical quality measure that was calculated 

using few patients compared to those practicing in rural locations; and

• a greater percentage of professionals with 2010 Medicare Part B 

charges at or below the 50th percentile or above the 75th percentile 

reported at least one clinical quality measure that was calculated 

using few patients compared to those with charges above the 50th 

percentile, but at or below the 75th percentile.

We also found that about half of specialists, the largest specialty group of 

participating professionals, reported at least one clinical quality measure 

based on few patients. (See table 7.)

 

55In other programs, CMS has recognized that including a small number of patients in the 

calculation of a measure is a reliability issue. For example, on the agency’s Hospital 

Compare website, which publicly reports clinical quality measures by hospital, CMS 

indicates whether the number of patients included in a particular measure calculation was 

based on less than 25 patients and is thus too small to reliably tell how well the hospital 

was performing. 
 

Page 35 GAO-12-481 Electronic Health Records

Table 7: Percentage of Professionals Who Participated in the Medicare EHR 

Program That Reported at Least One Clinical Quality Measure That Was Calculated 

Based on Few Patients, through December 8, 2011

Professional characteristics

Number of 

participating 

professionals 

Percentage reporting 

at least one clinical 

quality measure 

using fewer than 

seven patientsa

Overall 23,844 41.3

Professional specialty

Dentist 14 78.6

Chiropractor 202 79.7

Optometrist 737 87.7

Specialist 11,046 52.8

Podiatrist 1,212 52.8

Generalist 9,569 21.2

Other eligible physicianb 900 51.7

Practice location

Rural 2,725 35.7

Urban 21,099 42.0

Amount of 2010 Medicare Part B charges

≤ 25th percentile 1,027 62.3

> 25th percentile, but ≤ 50th percentile 3,392 44.3

> 50th percentile, but ≤ 75th percentile 7,867 35.5

> 75th percentile 11,199 42.0

Source: GAO analysis of CMS and Health Resources and Services Administration data.

Note: This analysis is based on partial-year data for professionals. Specifically, we analyzed data 

professionals reported to demonstrate meaningful use for the Medicare EHR program from April 

2011, when CMS began collecting these data, through December 8, 2011. To demonstrate 

meaningful use for the 2011 program year, professionals could continue to report these data through 

February 29, 2012. The sum of the number of professionals listed by professional specialty, practice 

location, and amount of 2010 Medicare Part B charges is not equal to the overall number of 

professionals due to missing data. All differences among groups are significant at the 0.05 level.

a

For our analysis, we identified clinical quality measures as unreliable if fewer than seven patients 

met inclusion criteria for the calculation. Measures that capture a small number of patients may be 

unreliable measures of quality because relatively small changes in the number of patients who

experienced the care processes or outcomes targeted by the measure can generate large shifts in 

the calculated percentage for the measure.

b

“Other eligible physician” includes physicians for whom the information on professional specialty 

needed to classify them into one of the other professional specialty categories was not available in 

CMS’s National Plan and Provider Enumeration System.
 

Page 36 GAO-12-481 Electronic Health Records

We found that a greater percentage of some hospitals reported measures 

based on few patients than other hospitals. Specifically, we found that

• a greater percentage of critical access hospitals reported at least one 

clinical quality measure that was calculated using few patients 

compared to acute care hospitals,

• a greater percentage of government-owned and proprietary hospitals 

reported at least one clinical quality measure that was calculated 

using few patients compared to nonprofit hospitals,

• a greater percentage of hospitals with less than 200 beds reported at 

least one clinical quality measure that was calculated using few 

patients compared to hospitals with 200 beds or more, and

• a greater percentage of hospitals located in rural areas reported at 

least one clinical quality measure that was calculated using few 

patients compared to hospitals located in urban areas.

We also found that among acute care hospitals, the largest type of

participating hospital, more than 80 percent reported at least one clinical 

quality measure based on few patients. (See table 8.)
 

Page 37 GAO-12-481 Electronic Health Records

Table 8: Percentage of Hospitals That Participated in the Medicare EHR Program 

That Reported at Least One Clinical Quality Measure That Was Calculated Based on 

Few Patients, 2011

Number of 

participating 

hospitals

Percentage reporting 

at least one clinical 

quality measure using 

fewer than seven 

patientsa

Overall 803 86.9

Type of hospital

Critical access hospital 174 99.4

Acute care hospitalb 626 83.5

Ownership type

Government-owned 189 95.2

Proprietary 169 89.9

Nonprofit 442 82.4

Bed size

1 to 49 beds 240 100

50 to 99 beds 128 93.0

100 to 199 beds 145 85.5

200 or more beds 287 74.2

Hospital location

Rural 300 96.7

Urban 500 81.2

Source: GAO analysis of CMS and Health Resources and Services Administration data. 

Note: The sum of the number of hospitals listed by type of hospital, ownership type, bed size, and 

location is not equal to the overall number of hospitals due to missing data. All differences among 

groups are significant at the 0.05 level.

a

For our analysis, we identified clinical quality measures as unreliable if fewer than seven patients 

met inclusion criteria for the calculation. Measures that capture a small number of patients may be 

unreliable measures of quality because relatively small changes in the number of patients who

experienced the care processes or outcomes targeted by the measure can generate large shifts in 

the calculated percentage for the measure.

b

Acute care hospitals refer to hospitals described in Section 1886(d) of the Social Security Act, which 

are paid under the inpatient prospective payment system. 

The American Medical Association and others stated that some providers 

may experience challenges selecting clinical quality measures to report. 

CMS has acknowledged that the availability of clinical quality measures 

that are relevant to providers’ patient populations and clinical practices is 

important to inform providers’ efforts to improve quality of care and to 

measure potential impacts of the EHR programs. In an effort to increase 

the availability of such measures, officials from the Health Information 
 

Page 38 GAO-12-481 Electronic Health Records

Technology Policy Committee and the Health Information Technology 

Standards Committee, which advise ONC on the development of 

meaningful use reporting requirements, noted that additional clinical 

quality measures may be added to the EHR programs over time. This 

action would help to ensure that there are a sufficient number of 

measures that providers can report on.

Providers identified challenges to participating in the first year of the 

Medicare and Medicaid EHR programs and strategies used to help 

providers participate. Numerous professionals and hospitals have signed 

agreements with Regional Extension Centers for technical assistance, 

which includes services to facilitate providers’ participation in the 

Medicare and Medicaid EHR programs.

Acquiring and implementing a certified EHR system are among the first 

challenges providers face as they take steps to qualify for a Medicare or 

Medicaid EHR incentive payment. Challenges to acquiring EHR systems 

described by providers and officials from the American Medical 

Association and American Hospital Association we interviewed included 

the following: the cost of purchasing or upgrading to a certified EHR 

system; obtaining sufficient broadband access, which can affect 

providers’ abilities to exchange health information; and obtaining buy-in 

from professionals. Challenges to implementing EHR systems described 

by providers we interviewed included needing to train staff on how to use 

the EHR systems and getting professionals to use the systems.

Officials we interviewed from hospitals described strategies providers 

used to overcome some of the challenges related to acquiring and 

implementing EHR systems. For example, one hospital official stated that, 

in order to implement a certified EHR system, hospital officials designated 

“super users” as a strategy to help their professionals transition to the 

EHR system. For instance, one hospital appointed a nurse as a “super 

user” who assisted others in learning how to use the EHR system. 

Additionally, the chief information officer of another hospital stated her 

organization obtained buy-in from professionals and encouraged them to 

use the system by presenting the EHR system as a way to improve 

For the First Program 

Year, Providers 

Experienced 

Challenges and Used 

Strategies and 

Services to Facilitate 

Participation 

Providers Identified 

Challenges and Used 

Strategies to Facilitate 

First Year Participation
 

Page 39 GAO-12-481 Electronic Health Records

patient safety and quality of care rather than as only an information 

technology project.

Once a certified EHR system is acquired and implemented, ensuring the 

system is effectively used to meet the Medicare meaningful use reporting 

requirements can also be challenging for some providers. Specifically, 

providers and others we interviewed identified challenges related to 

capturing data needed to demonstrate meaningful use, such as lacking a 

workflow that allowed the needed data to be collected electronically at the 

right time by the right staff member.

Providers we interviewed noted several strategies they used to capture 

data in ways which helped them demonstrate meaningful use, including 

the following:

• understanding which fields of the EHR system must be completed and 

collecting additional data, as necessary;

• revising forms, retraining staff so they knew how to complete the 

forms, and conducting quality assurance training to ensure that the 

appropriate data were being captured consistently; and

• analyzing workflow, including understanding which staff members are 

to enter information into the EHR system and when data entry must 

occur.

One provider we interviewed elaborated on the strategy she used to

change the workflow in her practice so that she could satisfy the 

meaningful use measure—”provide patients with clinical summaries for 

each office visit.” She decided that to meet this meaningful use measure 

she would provide the clinical summary to her patients before they left her 

office. To do so, she changed her workflow by spending an additional 45 

minutes each morning preparing parts of her patient notes in advance of 

the patient visit and by scheduling additional time in between patient visits 

in order to complete the clinical summaries.
 

Page 40 GAO-12-481 Electronic Health Records

As of December 2011, about 115,000 professionals and about 1,000 

hospitals have signed agreements to receive technical assistance from 

one of the 62 Regional Extension Centers.56 This assistance includes 

services to facilitate providers’ participation in the Medicare and Medicaid 

EHR programs.57 Of these professionals, 54,241 had implemented an 

EHR system, of which 4,072 had demonstrated meaningful use.58

 

56We analyzed Regional Extension Center program data as of December 19, 2011.

The 

professionals assisted by the Regional Extension Center program work in 

targeted settings, such as individual primary care practices or rural health 

clinics. See figure 4, which illustrates the practice settings of 

professionals who have agreements with the Regional Extension Centers.

57Providers sign technical assistance agreements with the Regional Extension Centers 

that specify the services that will be provided to them and the terms and amount (if any) of 

payment the centers will charge for these services. 

58These data are reported by the Regional Extension Centers to ONC and do not 

necessarily mean that the provider received an incentive payment from either the 

Medicare or Medicaid EHR programs.

Numerous Providers Have 

Signed Agreements with 

Regional Extension 

Centers for Services to 

Facilitate Participation
 

Page 41 GAO-12-481 Electronic Health Records

Figure 4: Practice Settings of Professionals with Signed Technical Assistance 

Agreements with Regional Extension Centers, through December 19, 2011

Note: The figure shows the distribution of the 115,921 priority primary care professionals that signed 

agreements with one of the 62 Regional Extension Centers.

a

The Office of the National Coordinator for Health Information Technology defines collaborative 

networks of small practices as practices of 10 or fewer professionals that share services, purchasing 

arrangements, and/or patient coverage.

In addition, 1,001 rural hospitals and critical access hospitals have signed 

agreements with a Regional Extension Center for technical assistance, 

through December 19, 2011. Of these hospitals, 243 had implemented an 

EHR system and of those, 41 had demonstrated meaningful use. For 

more information on each Regional Extension Center’s progress in 

assisting providers to demonstrate meaningful use, see appendix IV.

Regional Extension Centers offer various services to providers with whom 

they have agreements to facilitate the providers’ participation in the EHR 

programs by helping them meaningfully use EHR systems. Providers 

trying to demonstrate meaningful use generally follow a four-step 

process, throughout which Regional Extension Centers may provide 
 

Page 42 GAO-12-481 Electronic Health Records

assistance to providers. These steps are: (1) prepare to participate in the 

CMS EHR programs, (2) select a certified EHR system, (3) implement the 

selected EHR system, and (4) demonstrate meaningful use.59

 

59Some services provided by the Regional Extension Centers, such as sharing information 

on the Medicare and Medicaid EHR programs, workflow support, and project 

management, may be offered to providers during more than one step. In addition, not all 

providers need the Regional Extension Centers’ assistance at all steps. For example, 

some providers have selected and implemented a certified EHR system before retaining 

the services of one of the centers. 

Examples 

of the services offered by the Regional Extension Centers during each of 

these steps are described in figure 5.
 

Page 43 GAO-12-481 Electronic Health Records

Figure 5: Examples of Services Provided by Regional Extension Centers

During the first step, Regional Extension Center officials can help 

providers prepare to participate in the EHR programs by explaining those 

programs’ requirements and helping providers identify how their workflow 

and processes may change with the introduction of an EHR system.60

 

60Regional Extension Center officials generally identified providing information and 

guidance on the EHR programs and workflow redesign services as the services that 

providers value most highly.

For 

example, officials from one Regional Extension Center told us they 

helped providers determine whether they would qualify for the Medicare 
 

Page 44 GAO-12-481 Electronic Health Records

or Medicaid EHR programs. During the second step, the Regional 

Extension Centers can help providers select a certified EHR system. For 

example, officials from one Regional Extension Center told us they 

shared a vendor evaluation tool with providers, which helped providers 

evaluate factors such as EHR systems’ capabilities and cost. During the 

third step, Regional Extension Center officials can help providers 

implement an EHR system by, for example, suggesting best practices for 

securing and protecting the privacy of personal health information stored 

and processed by the EHR system. During the fourth step, the Regional 

Extension Centers provide services that help providers to meet the EHR 

programs’ meaningful use criteria. For example, the Regional Extension 

Centers may help their clients identify approaches for satisfying certain 

program reporting requirements by helping providers capture and 

exchange health data.

The aim of the Medicare and Medicaid EHR programs is not just to 

increase EHR adoption, but to support the meaningful use of EHR 

technology to improve quality and reduce the cost of care. As a result, the 

programs have the potential to affect the millions of people who receive 

care through Medicare or Medicaid. Since the programs began in 2011, 

CMS has issued $3.1 billion in incentive payments to providers. As a new 

program with particular complexities—such as the number and types of 

measures providers must report—there are risks to program integrity, and 

CMS could take steps, beyond those already taken, to assess and 

mitigate the risk of improper payments and to improve program efficiency. 

It is encouraging that CMS has awarded contracts to evaluate states’ 

implementation of the Medicaid EHR program, including their efforts to 

prevent improper payments. However, CMS, while planning to assess its 

audit strategy for the Medicare EHR program, has not yet specified time 

frames for implementing this assessment. As CMS moves forward, it is 

important that the agency assess whether verifying additional reporting 

requirements on a prepayment basis could improve the integrity of the 

Medicare EHR program. Conducting prepayment verifications may be 

more effective in minimizing improper payments because CMS’s planned 

postpayment audits will be conducted for only a small sample of 

providers, whereas CMS’s prepayment verification processes are 

conducted for all providers that apply for incentive payments. In addition, 

prepayment verifications help to avoid the difficulties associated with the 

“pay and chase” aspects of recovering improper payments.

Conclusions 
 

Page 45 GAO-12-481 Electronic Health Records

We identified two opportunities for CMS to improve the efficiencies of the 

Medicare and Medicaid EHR programs. First, CMS identified and took 

action to improve the efficiency of audits under the Medicaid EHR 

program but did not take a similar action in the Medicare EHR program. 

Specifically, although CMS suggested that states collect additional 

information from providers at the time of attestation to improve the 

efficiency of the postpayment audit process, CMS has not done so for the 

Medicare EHR program, but acknowledged that this action would be 

beneficial. Doing so would improve the efficiency of the postpayment 

audit process for the Medicare EHR program. Second, CMS could offer 

states the option of having CMS collect Medicaid providers’ meaningful 

use attestations on their behalf rather than requiring states to collect this 

information on their own. CMS, by offering to collect this information from 

all Medicaid providers on behalf of states, as the agency currently does 

for some Medicaid providers, could alleviate the need for many states to 

create and maintain similar web-based attestation tools and could 

potentially yield cost savings at both the federal and state levels.

In order to improve the efficiency and effectiveness of processes to verify 

whether providers meet program requirements for the Medicare and 

Medicaid EHR programs, we recommend that the Administrator of CMS 

take the following four actions:

• Establish time frames for expeditiously implementing an evaluation of 

the effectiveness of the agency’s audit strategy for the Medicare EHR 

program.

• Evaluate the extent to which the agency should conduct more 

verifications on a prepayment basis when determining whether 

providers meet Medicare EHR program’s reporting requirements.

• Collect the additional information from Medicare providers during 

attestation that CMS suggested states collect from Medicaid providers 

during attestation.

• Offer states the option of having CMS collect meaningful use 

attestations from Medicaid providers on their behalf.

Recommendations for 

Executive Action
 

Page 46 GAO-12-481 Electronic Health Records

We provided a draft of this report to HHS for comment. In its written 

comments (reproduced in app. V), HHS concurred with three of our 

recommendations to CMS. Specifically, we are encouraged that HHS said 

that to help implement these recommendations, CMS will evaluate the 

effectiveness of the audit strategy for the Medicare EHR program on an 

ongoing basis and document results quarterly, beginning approximately 

3 months after the audits begin. In addition, CMS will evaluate the 

feasibility of conducting additional prepayment verifications under the 

Medicare EHR program. Further, CMS will explore collecting additional 

information from Medicare providers during attestation that CMS has 

suggested that states collect under the Medicaid EHR program.

HHS disagreed with our fourth recommendation that CMS offer to collect 

meaningful use attestations data from Medicaid providers on behalf of the 

states, citing two reasons. First, HHS does not believe there are 

significant barriers to states implementing attestation tools. It stated that 

the 43 states participating in the Medicaid EHR program have established 

a means for providers to attest to eligibility requirements and the 

adoption, implementation, or upgrade of their EHR. In HHS’s view, 

incorporating the meaningful use attestations tools into the states’ existing 

systems does not pose a barrier in part because HHS says CMS has 

taken steps to help the states design their attestation tools and has 

approved designs developed by vendors that the states can use. Second, 

HHS does not believe that implementing this recommendation would 

create a streamlined attestation process for Medicaid providers. It states 

that Medicaid providers would have to provide certain information to CMS 

and other information to the states, requiring providers to submit data to 

multiple sites. HHS believes this change could result in confusion and 

payment delays. In addition, HHS believes a more compelling challenge 

is designing a way for providers to report clinical quality measures 

electronically from their EHRs to the states and CMS. HHS stated that 

CMS established pilots that are intended to help providers leverage 

existing infrastructure to electronically exchange data on clinical quality 

measures directly from their EHRs to CMS.

Despite HHS’s objections, we continue to believe that our 

recommendation should be implemented. In response to HHS’s first 

reason, we believe that while some states have created tools to collect 

Medicaid attestation data, over the long run implementing our 

recommendation could improve the efficiency of the Medicaid EHR 

program and thereby minimize additional administrative costs, especially 

in the program’s future years. Currently, both CMS and states create and 

maintain meaningful use attestation tools. The Medicaid EHR program 

Agency Comments 

and Our Evaluation
 

Page 47 GAO-12-481 Electronic Health Records

requirements in the second year of the program and through the rest of 

the decade will become increasingly similar to the requirements for the 

Medicare EHR program as will the information collected from providers by 

the states and CMS. Having both CMS and states design and maintain 

systems to collect much of the same information is inefficient. Further, it is 

expected that in future years, to demonstrate meaningful use, Medicare 

and Medicaid providers will be required to report additional information, 

and both CMS and the states will need to expend resources to update the 

attestation tools used to collect this information, a point we clarified in our 

report. By collecting meaningful use attestations on behalf of some states 

and U.S. insular areas, CMS could help ensure effective use of the 

$300 million that Congress provided for administrative costs of the 

Medicaid EHR program from 2009-2016.

In response to HHS’s second reason, the report notes that under the 

current process for registering for the Medicaid EHR program, providers 

must already submit information on eligibility to both CMS and the states. 

Therefore, providers are familiar with submitting information to multiple 

sites. Furthermore, CMS currently collects meaningful use attestations for 

some Medicaid providers and has not reported that the transfer of this 

information to the states has delayed payments.

We agree with CMS that designing a means to electronically transmit 

meaningful use information, including clinical quality measures, directly 

from providers’ EHRs to CMS and the states may present challenges. It is 

encouraging that the agency is attentive to electronic data exchange 

issues and is working with providers in the Medicare program to identify 

ways to leverage existing infrastructure to accomplish this goal. However, 

it is important for CMS to consider all approaches, including collecting 

meaningful use data on behalf of states, to ensure the Medicare and 

Medicaid EHR programs are administered as efficiently as possible.

As part of HHS’s written response, the department also provided other 

general comments, which we incorporated as appropriate.

We are sending copies of this report to the Secretary of Health and 

Human Services, the Administrator of CMS, the National Coordinator for 

Health Information Technology, and other interested parties. In addition, 

the report will be available at no charge on GAO’s website at 

http://www.gao.gov. 
 

Page 48 GAO-12-481 Electronic Health Records

If you or your staff have any questions about this report, please contact 

me at (202) 512-7114 or at kohnl@gao.gov. Contact points for our Office 

of Congressional Relations and Office of Public Affairs can be found on 

the last page of this report. Other major contributors to this report are 

listed in appendix V.

Linda T. Kohn

Director, Health Care
Page 49 GAO-12-481 Electronic Health Records

List of Committees

The Honorable Max Baucus

Chairman

The Honorable Orrin G. Hatch

Ranking Member

Committee on Finance

United States Senate

The Honorable Tom Harkin

Chairman

The Honorable Michael B. Enzi

Ranking Member

Committee on Health, Education, Labor, & Pensions

United States Senate

The Honorable Fred Upton

Chairman

The Honorable Henry A. Waxman

Ranking Member

Committee on Energy and Commerce

House of Representatives

The Honorable Dave Camp

Chairman

The Honorable Sander M. Levin

Ranking Member

Committee on Ways and Means

House of Representatives
Appendix I: Scope and Methodology

Page 50 GAO-12-481 Electronic Health Records

This appendix provides additional details regarding our analysis of 

(1) measures providers reported to the Centers for Medicare and 

Medicaid Services (CMS) to demonstrate meaningful use and 

(2) Regional Extension Center data.

Analysis of measures providers reported to CMS to demonstrate 

meaningful use. We conducted several analyses of data from CMS’s 

National Level Repository that providers reported to CMS to demonstrate 

meaningful use under the Medicare electronic health records (EHR) 

program in 2011.1 We analyzed data submitted by providers from April 

18, 2011, the date CMS began collecting these data, through December 

8, 2011.2

Specifically, we analyzed meaningful use and clinical quality measures 

providers reported to CMS and which we obtained from CMS’s National 

Level Repository to identify the following:

As a result, the data we analyzed for hospitals included full-year 

information because they were required to report these data by 

November 30, 2011, to receive a Medicare EHR incentive payment for 

2011. In contrast, the data we analyzed for professionals did not include 

full-year information because CMS permitted them to submit these data 

through February 29, 2012, to receive a Medicare EHR incentive payment 

for 2011. We included all hospitals and professionals that, according to 

data from CMS’s National Level Repository, had successfully 

demonstrated meaningful use even though some of those providers had 

not received Medicare EHR program incentive payments from CMS as of 

December 8, 2011.

• Frequency of measures reported. We identified the frequency with 

which providers reported the mandatory meaningful use measures for 

 

1

The National Level Repository is a database that contains information on providers 

pertaining to the Medicare EHR program, including information on providers that 

registered for the incentive program; whether those providers attested to meaningfully 

using an EHR system; and the amount of incentive payments, if applicable. The National 

Level Repository also contains some information on providers pertaining to the Medicaid 

EHR program, which we did not include in our analysis.

2

In general, our analysis does not include data providers affiliated with Medicare 

Advantage Organizations reported to demonstrate meaningful use. However, we did 

analyze data reported by professionals who may ultimately qualify for incentive payments 

under the Medicare Advantage EHR program. At the time of our analysis, CMS had not 

yet determined whether the professionals or the Medicare Advantage Organizations would 

receive the incentive payments. 

Appendix I: Scope and Methodology
Appendix I: Scope and Methodology

Page 51 GAO-12-481 Electronic Health Records

which providers may claim exemptions. Six measures allow 

professionals to claim exemptions and three measures allow hospitals 

to claim exemptions if, according to the providers, those measures are 

not relevant to their patient populations or clinical practices.

• Extent to which providers claimed allowable exemptions from 

reporting certain mandatory measures. We determined the 

percentage of providers that claimed an exemption from reporting at 

least one mandatory meaningful use measure. As part of this 

analysis, we examined whether a greater percentage of certain types 

of providers reported at least one exemption compared to other types 

of providers.

• Extent to which providers had patients who could be included in the 

calculation of clinical quality measures. We examined the extent to 

which providers had few patients who could be included in the 

calculation of at least one clinical quality measure.3

 

3

Some clinical quality measures are comprised of more than one submeasure. In these 

cases, we analyzed the submeasure for which providers reported the greatest number of 

patients in the denominator of the measure. 

Measures that 

capture a small number of patients may be unreliable measures of 

quality because relatively small changes in the number of patients 

who experienced the care processes or outcomes targeted by the 

measure can generate large shifts in the calculated percentage for the 

measure. CMS has recognized in other programs that including a 

small number of patients in the calculation of a measure is a reliability 

issue. For example, on the agency’s Hospital Compare website, which 

publicly reports clinical quality measures by hospital, CMS indicates 

whether the number of patients included in a particular measure 

calculation was based on less than 25 patients and thus too small to 

reliably tell how well the hospital was performing. For our analysis, we 

identified clinical quality measures as unreliable if fewer than 

seven patients met inclusion criteria for the calculation. The reporting 

period for the first year a provider demonstrates meaningful use is any 

90 consecutive days during the year; for subsequent years, the 

reporting period is the full year. Assuming a steady patient population,

providers that had fewer than seven patients meet inclusion criteria for 

calculating clinical quality measures during the 90-day reporting 

period would have fewer than 25 patients meet these criteria during 

the full-year reporting period. As part of this analysis, we examined 

whether a greater percentage of certain types of providers reported at 
Appendix I: Scope and Methodology

Page 52 GAO-12-481 Electronic Health Records

least one clinical quality measure based on few patients compared to 

other types of providers.

We also analyzed other data sources to determine whether the reporting 

of meaningful use and clinical quality measures varied based on 

providers’ characteristics, such as whether critical access hospitals were 

more likely than acute care hospitals to claim an exemption from reporting 

at least one mandatory meaningful use measure. We used Chi-square 

likelihood tests to determine whether differences in provider 

characteristics were statistically significant. In particular, we analyzed 

data from the following sources: CMS’s Online Survey, Certification, and 

Reporting System (downloaded May 2011);4 CMS’s National Plan and 

Provider Enumeration System Downloadable File (downloaded October 

2011); the Health Resources and Services Administration’s 2009-2010 

Area Resource File (released August 2010);5

• Hospital type. We obtained data on hospital type—acute care or 

critical access hospital—from CMS’s Online Survey, Certification, and 

Reporting System.

and CMS’s 2010 Medicare 

Part B claims (downloaded February 2012). Using these data, we 

examined the following provider characteristics:

6

• Hospital ownership type. We obtained data on hospital ownership 

type from CMS’s Online Survey, Certification, and Reporting System. 

We created the ownership type of proprietary by selecting proprietary; 

the ownership type of nonprofit by combining voluntary nonprofit – 

church, voluntary nonprofit – private, and voluntary nonprofit – other; 

and the ownership type of government-owned by combining the four 

 

4

During the course of our work, CMS transitioned from using the Online Survey, 

Certification, and Reporting System to using the Certification and Survey Provider 

Enhanced Reports System to store certain data on hospital characteristics, and we were 

unable to obtain more recent data from the latter in time for our analysis. 

5

Although the Area Resource File is typically released annually, at the time of our 

analysis, the 2010-2011 Area Resource File had not yet been made publicly available. 

6

Three hospitals (less than 0.4 percent) are missing from our analysis of hospital 

characteristics because we were unable to match the hospitals to records contained in 

CMS’s Online Survey, Certification, and Reporting System. CMS later provided 

clarification on this issue, which enabled us to match the hospitals to records contained in 

the Online Survey, Certification, and Reporting System, though we did not receive this 

information in time to include those hospitals in our analysis. 
Appendix I: Scope and Methodology

Page 53 GAO-12-481 Electronic Health Records

government designations (federal, state, local, and hospital district or 

authority).

• Hospital number of beds. We obtained data on the number of beds in 

hospitals, which includes beds that are certified for payment for 

Medicare and/or Medicaid, from CMS’s Online Survey, Certification, 

and Reporting System. Using those data, we created four categories 

for the number of beds: (a) 1 to 49 beds, (b) 50 to 99 beds, (c) 100 to 

199 beds, and (d) 200 or more beds.

• Professional specialty. We obtained data on professionals’ primary 

specialty from CMS’s National Plan and Provider Enumeration 

System Downloadable File. Then, with the assistance of a crosswalk 

that we obtained from CMS that aggregates specialty taxonomy codes 

into a smaller number of specialties, we created the following seven 

professional specialty categories: (a) chiropractor, (b) dentist, 

(c) generalist, (d) optometrist, (e) podiatrist, (f) specialist, and (g) other 

eligible physician.7 Of those professionals who demonstrated 

meaningful use in the Medicare EHR program in 2011, we were 

unable to identify a primary specialty for 164 professionals (less than 

0.7 percent) using the CMS downloadable file. The 900 professionals 

that were classified as “other eligible physicians” (about 3.8 percent) 

includes physicians for whom the information on professional 

specialty needed to classify them into one of the other professional 

specialty categories was not available in CMS’s National Plan and 

Provider Enumeration System; however, we determined that those 

professionals had specialty types that were eligible to receive 

incentive payments using other CMS databases.8

• Professionals’ Medicare Part B charges. We obtained all 2010 

Medicare Part B charges from CMS.9

 

7

We classified doctors of medicine and osteopathic medicine that specialize in family 

practice, general practice, or internal medicine as generalists; all other doctors of medicine 

and osteopathic medicine were classified as specialists. 

For each professional (identified 

8

Of the 900 professionals who were classified as other eligible physicians, 856 had 

permissible professional specialties listed in a July 2011 extract from CMS’s Provider 

Enrollment, Chain, and Ownership System, which is the system that CMS uses to verify 

whether professionals are a permissible provider type. CMS provided documentation to

support that the remaining 44 professionals also had permissible professional specialties.

9

Medicare Part B charges refer to payments for physician, outpatient hospital, home 

health care, and certain other services. 
Appendix I: Scope and Methodology

Page 54 GAO-12-481 Electronic Health Records

by National Provider Identifier), we summed the amount of Medicare 

Part B charges over the year. Subsequently, we created four 

categories by aggregating total charges by professional: (a) less than 

or equal to the 25th percentile, (b) greater than the 25th percentile 

and less than or equal to the 50th percentile, (c) greater than the 50th 

percentile and less than or equal to the 75th percentile, and (d) 

greater than the 75th percentile.10 Of those professionals who 

demonstrated meaningful use in the Medicare EHR program in 2011, 

information on the amount of Part B charges was missing for 359 

professionals (about 1.5 percent).

• Provider location. We obtained zip codes for facility or practice 

locations for hospitals and professionals from CMS’s Online Survey, 

Certification, and Reporting System and CMS’s National Plan and 

Provider Enumeration System, respectively.11 Then, with the 

assistance of a zip code to Federal Information Processing Standard 

code crosswalk file we obtained from CMS, we used the Health 

Resources and Services Administration’s Area Resource File to 

identify whether providers were located in a metropolitan area—an 

area that has at least one urbanized area of 50,000 people. We then 

categorized providers located in metropolitan areas as being located 

in urban areas and providers that were not as being located in rural 

areas. We were unable to match 20 providers’ zip codes to the Area 

Resource File (which is less than 0.1 percent of participating 

professionals).

To ensure the reliability of the data we analyzed, we interviewed officials 

from CMS, reviewed relevant documentation, and conducted electronic

testing to identify missing data and obvious errors. On the basis of these 

activities, we determined that the data we analyzed were sufficiently 

reliable for our analysis.

Analysis of Regional Extension Center data. We analyzed data we 

obtained from the Office of the National Coordinator for Health 

Information Technology (ONC) in December 2011. The data, which the 

 

10Percentiles were created using information on 2010 Medicare Part B charges for all 

professionals who had greater than $0 in charges. 

11Practice location zip codes contained in CMS’s National Plan and Provider Enumeration 

System are self-reported by professionals to CMS. We did not independently verify that 

professionals’ practices were located in the self-reported zip code. 
Appendix I: Scope and Methodology

Page 55 GAO-12-481 Electronic Health Records

agency collects from Regional Extension Centers, contains information 

about the providers to whom the centers provided technical assistance. 

We determined the number of providers assisted by the Regional 

Extension Center program as well as the percentage of those providers 

overall and for each center that had (1) signed an agreement with a 

center, (2) implemented an EHR, and (3) demonstrated meaningful use. 

In addition, we determined the types of professionals who had signed an 

agreement for technical assistance with a center.

We made some adjustments to the data we obtained for professionals 

based on information obtained from officials at ONC. Specifically, we 

limited our analysis to professionals identified by a Regional Extension 

Center as being priority primary care providers, which are types of 

professionals for which ONC reimburses centers for providing technical 

assistance. This excluded 7,019 professionals (about 5.7 percent) from 

our analysis. We also excluded from our analysis professionals whose 

data we determined were unreliable based on information obtained from 

ONC officials. Specifically, we excluded any professionals who were 

missing or had anomalous entries for both an individual national provider 

identifier and an organizational national provider identifier. This excluded 

355 professionals (about 0.3 percent) from the analysis. We also 

excluded another 2 professionals (less than 0.1 percent) who were 

identified in the data as being a type of professional that was not 

considered to be a priority primary care provider even though the 

professional was designated as such in the ONC data.

We also made some adjustments to the data we obtained for hospitals 

based on information obtained from officials at ONC. Specifically, we 

limited our analysis to hospitals identified by a Regional Extension Center 

as being a type of hospital targeted for outreach—that is, a critical access 

hospital or rural hospital. This excluded four organizations (about 0.4 

percent) from the analysis.

To ensure the reliability of the data we analyzed, we interviewed officials 

from ONC, reviewed relevant documentation, and conducted electronic 

testing to identify obvious errors. On the basis of these activities, we 

determined that the data we analyzed were sufficiently reliable for our 

analysis.
Appendix II: How Medicare and Medicaid EHR 

Program Incentive Payments Are Calculated

Page 56 GAO-12-481 Electronic Health Records

Provider type EHR program Incentive payment 

Professionalsa Medicare EHR program The amount of incentive payment in any given year is equal to 75 percent of the 

professional’s Medicare Part B charges for the year, subject to an annual limit which 

varies by year. The amount of the incentive payment in the first year cannot exceed 

$18,000 and the total over a 5-year period cannot exceed $44,000.b To earn the 

maximum amount, professionals must first demonstrate meaningful use in calendar year 

2011 or 2012. Professionals who first demonstrate meaningful use in calendar year 2015 

or later will not receive an EHR incentive payment.

Medicaid EHR programc The amount of incentive payment that a professional receives in any given year is, in 

general, a fixed amount; $21,250 in the first year and $8,500 in up to 5 subsequent years 

and the total amount over a 6-year period cannot exceed $63,750.d Professionals must 

receive an incentive payment by calendar year 2016 in order to receive incentive 

payments in subsequent years.

Hospitalse Medicare EHR program For acute care hospitals, the amount of incentive payment in any given year is generally 

based on the hospital’s annual discharges and Medicare share (i.e., percentage of 

inpatient days at the hospital in a given year attributable to Medicare patients).f

Incentive 

payments are awarded over periods of up to 4 years. To earn the maximum amount, 

acute care hospitals must first demonstrate meaningful use in fiscal year 2011, 2012, 

or 2013.

For critical access hospitals, the incentive payment amount is generally based on the 

hospital’s Medicare share and the reasonable costs incurred for the purchase of 

depreciable assets necessary to administer certified EHR technology, such as computers 

and associated hardware and software. Critical access hospitals can earn payments for 

up to 4 years. To earn the maximum amount, critical access hospitals must first 

demonstrate meaningful use in fiscal year 2011 or 2012.

Medicaid EHR programc The amount of incentive payment that a hospital receives in any given year is generally

based on the hospital’s annual discharges and Medicaid share. The number of years over 

which incentive payments are awarded (between 3 to 6 years) is at the discretion of the 

state.

Source: GAO analysis of CMS documents.

a

Professionals may not receive incentive payments under both the Medicare and Medicaid programs 

during the same year; they must choose in which program to participate. Until 2015, professionals 

eligible for both the Medicare and Medicaid EHR programs may switch programs only once after the 

first incentive payment is initiated.

b

CMS will increase the incentive payments that would otherwise apply by 10 percent each year for 

Medicare professionals that predominantly furnish services in geographic areas designated as health 

professional shortage areas, such as areas that have a shortage of primary medical care.

c

Medicaid providers can only receive incentive payments from one state in the same payment year.

d

Pediatricians with at least 20 percent Medicaid patient volume, but less than 30 percent Medicaid 

patient volume only qualify to receive $14,167 in the first year, $5,667 in subsequent years, and the 

total amount over a 6-year period cannot exceed $42,500. 

e

Hospitals may qualify to receive incentive payments under the Medicare EHR program and the 

Medicaid EHR program during the same year.

f

Acute care hospitals refer to hospitals described in Section 1886(d) of the Social Security Act, which 

are paid under the inpatient prospective payment system.

Appendix II: How Medicare and Medicaid 

EHR Program Incentive Payments Are 

Calculated
Appendix III: Meaningful Use and Clinical 

Quality Measures for the Medicare EHR 

Program, 2011

Page 57 GAO-12-481 Electronic Health Records

To demonstrate meaningful use in the first year of the Medicare EHR 

program, professionals must report on a total of 20, and hospitals must 

report on a total of 19, meaningful use measures.1 For certain meaningful 

use measures, providers may report to CMS that the measures are not 

relevant to them; this is referred to as claiming an exemption. 

Furthermore, to satisfy the requirement for one of the meaningful use 

measures “report clinical quality measures to CMS,” providers must report 

on clinical quality measures identified by CMS.2 Table 9 below provides 

the number of meaningful use measures and clinical quality measures 

providers must report for the first year of the Medicare EHR program. 

Table 10 describes the meaningful use measures, and table 11 and table 

12 describe the clinical quality measures for professionals and hospitals, 

respectively.

 

1

To receive incentive payments during the first year of the Medicare EHR program, 

providers must collect data related to the meaningful use measures in any 90 consecutive 

days during that first payment year and report those data to CMS. To receive incentive 

payments in subsequent years, providers must collect data related to the meaningful use 

measures over a full year and report that data to CMS.

2

According to CMS, clinical quality measures help quantify health care processes, 

outcomes, patient perceptions, and organizational structure. 

Appendix III: Meaningful Use and Clinical 

Quality Measures for the Medicare EHR 

Program, 2011
Appendix III: Meaningful Use and Clinical 

Quality Measures for the Medicare EHR 

Program, 2011

Page 58 GAO-12-481 Electronic Health Records

Table 9: Number of Measures Providers Must Report or Claim Allowed Exemptions from Reporting for the Medicare EHR 

Program, 2011

Type of measure Professionals Hospitals

Meaningful use measures

Mandatorya 15

(6 allowed exemptionsb

) 

14

(3 allowed exemptionsb) 

Menu 5 from a menu of 10

(8 on menu allowed exemptionsb) 

5 from a menu of 10

(4 on menu allowed exemptionsb) 

Total meaningful use measures that providers must 

report if no exemptions claimed

20 19

Clinical quality measures

Core measures and/or alternate core measuresc 3 to 6 15

Menu 3 from a menu of 38 N/A

Total clinical quality measures that must be reported 6 to 9 15

Source: GAO analysis of CMS documents.

a

One of the mandatory meaningful use measures requires professionals and hospitals to report 

clinical quality measures.

b

Professionals and hospitals may report to CMS that certain measures are not relevant to them; this 

is referred to as claiming an exemption.

c

Professionals report all three core clinical quality measures, even if none of their patients could be 

included in the calculation of the measures. However, for any core clinical quality measure for which 

zero patients could be included in the calculation, professionals must pick a replacement from the 

alternate core measures.
Appendix III: Meaningful Use and Clinical 

Quality Measures for the Medicare EHR 

Program, 2011

Page 59 GAO-12-481 Electronic Health Records

Table 10: Meaningful Use Measures for Professionals and Hospitals in the Medicare EHR Program, 2011

Professionals Hospitals

Meaningful use measure Mandatory Menua Mandatory Menua

Use computerized provider order entry for medication orders: At least one 

medication order entered using computerized provider order entry for more than 

30 percent of patients with at least one medication in their medication lists 

Xb X 

Implement drug-drug and drug-allergy interaction checks: Enable the EHR 

system’s ability to check for these interactions 

X X 

Maintain an up-to-date problem list of current and active diagnoses: Record list 

of current and active diagnoses or indicate no known problems for more than 

80 percent of patients 

X X 

Generate and transmit permissible prescriptions electronically: Generate and 

transmit more than 40 percent of permissible prescriptions electronically 

Xb

Maintain active medication list: Record at least one entry or indicate no current 

prescriptions for more than 80 percent of patients 

X X 

Maintain active medication allergy list: Record at least one entry or indicate no 

known medication allergies for more than 80 percent of patients 

X X 

Record demographics: Record preferred language, gender, race, ethnicity, and 

date of birth for more than 50 percent of patients; hospitals must also record 

date and preliminary cause of death in the event of mortality

X X 

Record and chart changes in vital signs: Record height, weight, and blood 

pressure for more than 50 percent of patients age 2 and older; calculate and 

display body mass index and plot and display growth charts for children age 2 

though 20 

Xb X 

Record smoking status for patients 13 years old or older: Record smoking status 

for more than 50 percent of patients age 13 and older 

Xb Xb

Report clinical quality measures to CMSc X X 

Implement one clinical decision support rule: Implement one clinical decision 

support rule related to specialty or high clinical priority along with the ability to 

track compliance with that rule 

X X 

Provide patients with an electronic copy of their health information: Provide 

information (for professionals and hospitals, provide diagnostic test results, 

problem list, medication lists, and medication allergies, and for hospitals also 

provide discharge summary and procedures) within 3 business days to more 

than 50 percent of patients who requested that information 

Xb Xb

For professionals, provide patients with clinical summaries for each office visit 

within 3 business days; for hospitals, provide patients with electronic copy of 

discharge instructions at the time of discharge, upon request: For professionals, 

provide information for more than 50 percent of visits; for hospitals, provide 

information for more than 50 percent of patients who requested that information 

Xb Xb

Exchange key clinical information electronically: Perform at least one test of 

EHR technology’s capacity to exchange key clinical information 

X X 

Protect electronic health information created or maintained by the certified EHR 

technology: Conduct or review a security risk analysis, implement security 

updates as necessary, and correct identified security deficiencies 

X X 
Appendix III: Meaningful Use and Clinical 

Quality Measures for the Medicare EHR 

Program, 2011

Page 60 GAO-12-481 Electronic Health Records

Professionals Hospitals

Meaningful use measure Mandatory Menua Mandatory Menua

Implement drug formulary checks: Enable this functionality and maintain access 

to at least one internal or external formulary 

Xb X 

Incorporate clinical lab-test results into EHR as structured data: Incorporate into 

the EHR technology more than 40 percent of the clinical lab test results ordered 

whose results are positive, negative, or in numerical format 

Xb X 

Generate patient lists by specific conditions: Generate at least one report listing 

patients with a specific condition to use for quality improvement, reduction of 

disparities, research, or outreach 

X X 

Send patient reminders per patient preference for preventive or follow-up care: 

Send appropriate reminders to more than 20 percent of patients age 65 and 

older or age 5 and younger 

Xb

Provide patients with timely electronic access to their health information: Provide 

electronic access to health information (including lab results, problem list, 

medication lists, and allergies) to at least 10 percent of patients within 

4 business days 

Xb

Use certified EHR technology to identify patient-specific education resources 

and provide those resources to the patient if appropriate: Provide to more than 

10 percent of patients 

X X 

Perform medication reconciliation for patients received from another setting of 

care or provider of care: Perform for more than 50 percent of transitions of care 

Xb X 

Provide summary care record for each transition of care or referral care: Provide 

for more than 50 percent of transitions of care and referrals

Xb X 

Submit electronic data to immunization registries or immunization information 

systems: Perform at least one test of EHR technology’s capacity to submit 

electronic data to immunization registries and follow up submission if the test is 

successful 

Xb Xb

Submit electronic syndromic surveillance data to public health agencies: Perform 

at least one test of EHR technology’s capacity to submit electronic syndromic 

surveillance data to public health agencies 

Xb Xb

Submit electronic data on reportable lab results to public health agencies: 

Perform at least one test of EHR technology’s capacity to submit electronic 

reportable (as required by state or local law) lab results to public health agencies 

and follow up submission if the test is successful 

Xb

Record advance directives for patients 65 years or older: Record indication of 

advance directive status for more than 50 percent of all unique patients age 65 

and older 

Xb

Total measures 15 10 14 10

Measures with exemptions 6 8 3 4 

Source: GAO analysis of CMS documents.

a

Menu clinical quality measures refer to the set of 10 clinical quality measures from which CMS allows 

providers the flexibility to select 5 measures to report.

b

Providers may claim exemptions from reporting the measure if, according to the providers, the 

measure is not relevant to their patient populations or clinical practices.

c

Professionals generally must report on 6 clinical quality measures from a list of 44 measures 

identified by CMS. Hospitals must report on 15 clinical quality measures.
Appendix III: Meaningful Use and Clinical 

Quality Measures for the Medicare EHR 

Program, 2011

Page 61 GAO-12-481 Electronic Health Records

Table 11: Clinical Quality Measures for Professionals in the Medicare EHR Program, 2011

Clinical quality measure 

National Quality Forum 

measure numbera

Core measures (3)

Blood pressure measurement for hypertension patients: Percent of visits for patients ages 18 years and 

older with hypertension who have been seen for at least two office visits and have had blood pressure 

recorded 

0013

Tobacco use assessment and cessation intervention: Percent of patients ages 18 years and older who 

have been seen for at least 2 office visits who were queried about tobacco use and, if applicable, received 

a cessation intervention 

0028

Adult weight screening and follow-up: Percent of patients ages 18 years and older with a body mass index 

documented within the past 6 months and, if the most recent body mass index is outside parameters, a 

follow-up plan is documented 

0421

Alternate core measures (3)

Weight assessment and counseling for children and adolescents: Percent of patients ages 2-17 years who 

had an outpatient visit with a primary care physician or obstetrician/gynecologist who had a body mass 

index documented and received counseling for nutrition and physical activity 

0024

Influenza immunization for patients ages 50 years and older: Percent of patients ages 50 years and older 

who received an influenza immunization during the flu season 

0041

Childhood immunization status: Percent of children aged 2 years who had recommended childhood 

immunizations by their second birthday 

0038

Menu measures (38)

Hemoglobin A1c poor control for diabetics: Percent of patients ages 18-75 years with diabetes who had 

hemoglobin A1c > 9 percent 

0059

Cholesterol management and control for diabetics: Percent of patients ages 18-75 years with diabetes who 

had low density lipoprotein cholesterol < 100 mg/dL 

0064

Blood pressure management for diabetics: Percent of patients ages 18-75 years with diabetes who had 

blood pressure <140/90 mmHg 

0061

Treatment for heart failure: Percent of patients ages 18 years and older with heart failure and left 

ventricular systolic dysfunction who were prescribed an angiotensin-converting enzyme inhibitor or 

angiotensin receptor blocker 

0081

Beta-blocker therapy for coronary artery disease patients: Percent of patients ages 18 years and older with 

a diagnosis of coronary artery disease and a prior myocardial infarction who were prescribed beta-blocker 

therapy 

0070

Pneumonia vaccination for older adults: Percent of patients ages 65 years and older who have received a 

pneumococcal vaccine 

0043

Breast cancer screening: Percent of women ages 40-69 years who had a mammogram to screen for breast 

cancer 

0031

Colorectol cancer screening: Percent of adults ages 50-75 who had appropriate screening for colorectol 

cancer 

0034

Oral antiplatelet therapy for patients with coronary artery disease: Percent of patients ages 18 years and 

older with coronary artery disease who were prescribed oral antiplatelet therapy 

0067

Beta-blocker therapy for heart failure patients: Percent of patients ages 18 years and older with a diagnosis 

of heart failure and left ventricular systolic dysfunction who were prescribed beta-blocker therapy

0083
Appendix III: Meaningful Use and Clinical 

Quality Measures for the Medicare EHR 

Program, 2011

Page 62 GAO-12-481 Electronic Health Records

Clinical quality measure 

National Quality Forum 

measure numbera

Antidepressant medication management: Percent of patients ages 18 years and older who were diagnosed 

with a new episode of major depression, were treated with antidepressant medication, and remained on 

antidepressant medication 

0105

Optic nerve evaluation for glaucoma patients: Percent of patients ages 18 years and older with primary 

open angle glaucoma who have been seen for at least two office visits and have had an optic nerve 

evaluation 

0086

Diabetic retinopathy assessment: Percent of patients ages 18 years and older with diabetic retinopathy 

who had a dilated macular or fundus examination that included documentation of the level of severity of 

retinopathy and the presence or absence of macular edema 

0088

Diabetic retinopathy communication: Percent of patients ages 18 years and older with diabetic retinopathy 

for whom the results of a dilated macular or fundus examination was communicated to the physician 

responsible for managing ongoing care 

0089

Asthma pharmacologic therapy: Percent of patients ages 5-40 years with persistent asthma who were 

prescribed a preferred medication or acceptable alternative treatment 

0047

Asthma assessment: Percent of patients ages 5-40 years with asthma who have been seen for at least two 

office visits and received an asthma symptom assessment 

0001

Appropriate testing for children with pharyngitis: Percent of children ages 2-18 years with pharyngitis who 

were dispensed an antibiotic and received a group A streptococcus test 

0002

Hormonal therapy for breast cancer: Percent of female patients ages 18 years and older with stage IC - IIIC 

estrogen receptor/progesterone receptor positive breast cancer who were prescribed tamoxifen or 

aromatase inhibitor 

0387

Chemotherapy for stage III colon cancer patients: Percent of patients ages 18 years and older with 

Stage III colon cancer who are referred for, prescribed, or have previously received adjuvant chemotherapy 

0385

Avoidance of overuse of bone scan for staging low-risk prostate cancer: Percent of patients with low-risk 

prostate cancer who were treated and did not have a bone scan performed since being diagnosed with 

prostate cancer 

0389

Smoking and tobacco use cessation assistance: Percent of patients ages 18 years and older who smoked 

or used tobacco, were seen by a professional, and received advice to quit smoking or using tobacco or 

discussed cessation medications, methods, or strategies 

0027

Eye exam for diabetics: Percent of patients ages 18-75 years with diabetes who had a retinal or dilated eye 

exam or a negative retinal exam by an eye care professional 

0055

Urine screening for diabetics: Percent of patients ages 18-75 years with diabetes who had a nephropathy 

screening test or evidence of nephropathy 

0062

Foot exam for diabetics: Percent of patients ages 18-75 years with diabetes who had a foot exam 0056

Cholesterol-lowering therapy for coronary artery disease patients: Percent of patients ages 18 years and 

older with coronary artery disease who were prescribed a lipid-lowering therapy 

0074

Warfarin therapy for heart failure patients with atrial fibrillation: Percent of patients ages 18 years and older 

with heart failure and atrial fibrillation who were prescribed warfarin therapy 

0084

Blood pressure management for patients with ischemic vascular disease: Percent of patients ages 18 

years and older who had an acute myocardial infarction, coronary artery bypass graft, or percutaneous 

transluminal coronary angioplasty, or had a diagnosis of ischemic vascular disease and whose blood 

pressure was in control 

0073
Appendix III: Meaningful Use and Clinical 

Quality Measures for the Medicare EHR 

Program, 2011

Page 63 GAO-12-481 Electronic Health Records

Clinical quality measure 

National Quality Forum 

measure numbera

Use of an antithrombic for ischemic vascular disease patients: Percent of patients ages 18 years and older 

who had an acute myocardial infarction, coronary artery bypass graft, or percutaneous transluminal 

coronary angioplasty, or had a diagnosis of ischemic vascular disease and who had documentation of use 

of aspirin or another antithrombotic 

0068

Initiation and engagement of alcohol and other drug dependence treatment: Percent of adolescent and 

adult patients with a new episode of alcohol and other drug dependence who initiate treatment within 14 

days of the diagnosis and had two or more additional alcohol and other drug services within 30 days of the 

initiation visit 

0004

Prenatal screening for Human Immunodeficiency Virus: Percent of patients who gave birth who were 

screened for human immunodeficiency virus during the first or second prenatal care visit 

0012

Prenatal anti-D immune globulin: Percent of D (Rh) negative, unsensitized patients who gave birth and 

received anti-D immune globulin at 26-30 weeks gestation 

0014

High blood pressure control: Percent of patients ages 18-85 years with hypertension and whose blood 

pressure was adequately controlled 

0018

Cervical cancer screening: Percent of women ages 21-64 years who received one or more Pap tests to 

screen for cervical cancer 

0032

Chlamydia screening for women: Percent of women ages 15-24 years who were identified as sexually 

active who had at least one test for chlamydia 

0033

Use of appropriate medications for asthma: Percent of patients ages 5-50 years with persistent asthma and 

were appropriately prescribed medication 

0036

Use of imaging studies for low back pain: Percent of patients with low back pain who did not have an 

imaging study within 28 days of diagnosis 

0052

Lipid panel and cholesterol control for ischemic vascular disease patients: Percent of patients ages 18 

years and older who had an acute myocardial infarction, coronary bypass, or coronary angioplasty, or had 

a diagnosis of ischemic vascular disease who had a complete lipid profile performed and whose low 

density lipoprotein cholesterol < 100 mg/dL 

0075

Hemoglobin A1c control for diabetics: Percent of patients ages 18-75 years with diabetes who had 

hemoglobin A1c < 8 percent 

0575

Source: GAO analysis of CMS documents. 

Note: To demonstrate meaningful use, professionals must report on all 3 core clinical quality 

measures and select an additional 3 measures from a menu of 38 measures to report. Professionals 

must report all 3 core clinical quality measures, even if none of their patients could be included in the 

calculation of the measures. However, for any core clinical quality measure for which zero patients 

could be included in the calculation, professionals must pick a replacement from the alternate core 

measures. As a result, professionals could report up to 6 core and alternate core clinical quality 

measures if zero patients could be included in the calculation of all 3 core measures. For additional 

information about these measures, see 75 Fed. Reg. 44314 (July 28, 2010).

a

The measure number refers to a number that can be used to search for and review additional 

information regarding the quality measure on the National Quality Forum’s website. See 

http://www.qualityforum.org/Measures_List.aspx. The National Quality Forum is a nonprofit member 

organization that fosters agreement on national standards for measuring and public reporting of 

health care performance data.
Appendix III: Meaningful Use and Clinical 

Quality Measures for the Medicare EHR 

Program, 2011

Page 64 GAO-12-481 Electronic Health Records

Table 12: Clinical Quality Measures for Hospitals in the Medicare EHR Program, 2011

Clinical quality measure 

National Quality Forum 

measure numbera

Emergency Department Throughput – 1: Median time from emergency department arrival to time of 

departure from the emergency room for patients admitted to the facility from the emergency department 

0495

Emergency Department Throughput – 2: Median time from admit decision time to time of departure 

from the emergency department of emergency department patients admitted to inpatient status 

0497

Stroke patients discharged on anti-thrombotics: Percent of ischemic stroke patients prescribed 

antithrombotic therapy at hospital discharge 

0435

Stroke patients discharged on anticoagulants: Percent of ischemic stroke patients with atrial 

fibrillation/flutter who are prescribed anticoagulation therapy at hospital discharge 

0436

Stroke patients that received thrombolytic therapy within 2 hours: Percent of acute ischemic stroke 

patients who arrived at the hospital within 2 hours of symptom onset and received thrombolytic therapy 

within 3 hours of symptom onset 

0437

Stroke patients that received antithrombotic therapy within 2 days: Percent of acute ischemic stroke 

patients administered antithrombotic therapy by the end of hospital day 2 

0438

Stroke patients discharged on statins: Percent of ischemic stroke patients with elevated low-density 

lipoprotein cholesterol, for whom cholesterol was not measured, or who were prescribed lipid-lowering 

medications prior to hospital admission that were prescribed a statin medication at hospital discharge 

0439

Stroke patients that received stroke education: Percent of ischemic or hemorrhagic stroke patients or 

their caregivers who were given educational materials that address specific topics during the hospital 

stay 

0440

Stroke patients that received a rehabilitation assessment: Percent of ischemic or hemorrhagic stroke 

patients who were assessed for rehabilitation services 

0441

Venous thromboembolism prophylaxis within 24 hours: Percent of patients who received venous 

thromboembolism prophylaxis or have documentation of why no such prophylaxis was given the day of 

or the day after hospital admission or surgery

0371

Venous thromboembolism prophylaxis in intensive care units: Percent of patients who received venous 

thromboembolism prophylaxis or have documentation of why no such prophylaxis was given the day of 

or the day after admission to the intensive care unit or surgery 

0372

Anticoagulation overlap therapy: Percent of patients with venous thromboembolism who received an 

overlap of parenteral anticoagulation and warfarin therapy 

0373

Platelet monitoring for patients on heparin: Percent of patients with venous thromboembolism who 

received intravenous unfractionated heparin therapy and had their platelet counts monitored 

0374

Venous thromboembolism discharge instructions: Percent of patients with venous thromboembolism 

who are discharged to selected settings with written discharge instructions that address four criteria 

0375

Potentially preventable venous thromboembolism: Percent of patients with venous thromboembolism 

during hospitalization who did not receive venous thromboembolism prophylaxis between hospital 

admission and the day before the embolism diagnostic testing was ordered 

0376

Source: GAO analysis of CMS documents.

Note: For additional information about these measures, see 75 Fed. Reg. 44314 (July 28, 2010).

a

The measure number refers to a number that can be used to search for and review additional 

information regarding the quality measure on the National Quality Forum’s website. See 

http://www.qualityforum.org/Measures_List.aspx. The National Quality Forum is a nonprofit member 

organization that fosters agreement on national standards for measuring and public reporting of 

health care performance data.
Appendix IV: Regional Extension Center 

Program, Goals, and Progress in Helping 

Providers Demonstrate Meaningful Use

Page 65 GAO-12-481 Electronic Health Records

Regional Extension Centers report to the Office of the National 

Coordinator for Health Information Technology (ONC) data that describes 

the progress they have made in providing technical assistance to 

professionals or hospitals to help those providers meaningfully use EHRs. 

The data the Regional Extension Centers report to ONC describe the 

following three milestones in the technical assistance provided:

• The professional or hospital signs an agreement with a Regional 

Extension Center to receive technical assistance.1

• The professional or hospital implemented an EHR which has 

electronic prescribing and measure reporting functionality.

• The professional or hospital demonstrated meaningful use, consistent 

with the Medicare and Medicaid EHR programs’ requirements.2

When the program was established, ONC also required each of the 62 

Regional Extension Centers to set a targeted numbers of professionals 

and hospitals each center would assist—that is, the center’s goal for the 

number of providers it would help meaningfully use EHRs. ONC uses the 

data the Regional Extension Centers report for each of the three 

milestones in the technical assistance process as well as the goals each 

center established to evaluate the effectiveness of individual Regional 

Extension Centers and of the program as a whole. Tables 13 and 14 list 

the goals and number of professionals and hospitals, respectively, 

assisted towards meaningful use by each center.

 

1

The technical assistance agreement specifies the services the Regional Extension 

Center will provide and the terms and amount (if any) of payment the center will charge for 

these services.

2

This milestone is documented even if the professional or hospital is not eligible to receive 

incentive payments under the Medicare or Medicaid EHR programs.

Appendix IV: Regional Extension Center 

Program, Goals, and Progress in Helping 

Providers Demonstrate Meaningful Use
Appendix IV: Regional Extension Center 

Program, Goals, and Progress in Helping 

Providers Demonstrate Meaningful Use

Page 66 GAO-12-481 Electronic Health Records

Table 13: Goals and Number of Professionals Assisted in Progressing Towards Demonstrating Meaningful Use, by Regional 

Extension Center, through December 19, 2011

Number of professionals (percent of the goal)

Location Regional Extension Center name

Goal number of 

professionals 

targeted for 

assistance

Signed an 

agreement 

with a 

Regional 

Extension 

Center

Implemented 

an EHR

Demonstrated 

meaningful use

AK Alaska eHealth Network 1,000 338 (34) 184 (18) 30 (3)

AL The Alabama Regional Extension Center 1,304 1,213 (93) 684 (53) 58 (4)

AR Arkansas Foundation for Medical Care 1,280 949 (74) 515 (40) 23 (2)

AZ Arizona Regional Extension Center 1,958 1,755 (90) 590 (30) 48 (3)

CA California Health Information Partnership 

Services Organization North

3,403 719 (72) 333 (33) 0 (0)

CA California Health Information Partnership 

Services Organization South

2,784 3,777 (111) 1,311 (39) 35 (1)

CA CalOPTIMA Regional Extension Center 1,000 2,766 (99) 747 (27) 40 (1)

CA Health Information Technology Extension 

Center for Los Angeles

3,000 2,575 (86) 1,038 (35) 27 (1)

CO Colorado Regional Health Information 

Organization

2,295 2,435 (106) 1,548 (68) 226 (10)

CT eHealthConnecticut Regional Extension 

Center 

1,308 1,131 (87) 498 (38) 33 (3)

DC District of Columbia Regional Extension 

Center 

1,000 884 (88) 593 (59) 6 (1)

DE Quality Insights of Delaware, Inc. 1,000 1,133 (113) 870 (87) 130 (13)

FL Center for the Advancement of Health 

Information Technology

2,026 1,353 (67) 594 (29) 19 (1)

FL Central Florida Health Information Technology 

Initiative

1,363 1,209 (89) 456 (34) 41 (3)

FL PaperFree Florida Collaborative Health 

Information Technology Regional Extension 

Center 

1,000 1,019 (102) 477 (48) 13 (1)

FL South Florida Regional Extension Center 2,500 2,221 (89) 525 (21) 10 (0)

GA Georgia Health Information Technology 

Regional Extension Center 

5,200 4,099 (79) 2,433 (47) 83 (2)

HI Hawaii Health Information Exchange 1,000 295 (30) 101 (10) 1 (0)

IA Telligen 1,200 1,225 (102) 438 (37) 16 (1)

IL Chicago Health Information Technology 

Regional Extension Center

1,486 1,449 (98) 447 (30) 18 (1)

IL Illinois Health Information Technology 

Regional Extension Center

1,300 1,384 (107) 690 (53) 38 (3)
Appendix IV: Regional Extension Center 

Program, Goals, and Progress in Helping 

Providers Demonstrate Meaningful Use

Page 67 GAO-12-481 Electronic Health Records

Number of professionals (percent of the goal)

Location Regional Extension Center name

Goal number of 

professionals 

targeted for 

assistance

Signed an 

agreement 

with a 

Regional 

Extension 

Center

Implemented 

an EHR

Demonstrated 

meaningful use

IN Indiana Health Information Technology 

Extension Center 

2,200 2,125 (97) 1,226 (56) 61 (3)

KS Kansas Foundation for Medical Care 1,200 1,266 (106) 634 (53) 92 (8)

KY Kentucky Regional Extension Center 1,000 1,048 (105) 302 (30) 1 (0)

LA Louisiana Health Care Quality Forum 1,042 1,091 (105) 231 (22) 8 (1)

MA Massachusetts eHealth Institute 2,487 2,607 (105) 1,572 (63) 142 (6)

MD Chesapeake Regional Information System for 

our Patients

1,000 1,408 (141) 461 (46) 16 (2)

ME HealthInfoNet 1,000 1,036 (104) 357 (36) 10 (1)

MI Michigan Center for Effective Information 

Technology Adoption

3,724 3,781 (102) 1,405 (38) 106 (3)

MN & ND Regional Extension Assistance Center for 

Health Information Technology 

3,600 4,352 (121) 2,202 (61) 76 (2)

MO Missouri Health Information Technology 

Assistance Center

1,167 1,473 (126) 664 (57) 69 (6)

MS Mississippi Regional Extension Center 1,000 1,167 (117) 736 (74) 26 (3)

MT & WY Health Technology Services Regional 

Extension Center 

1,000 880 (88) 322 (32) 0 (0)

NC North Carolina Regional Extension Center 3,465 3,145 (91) 1,628 (47) 88 (3)

NE Wide River Technology Extension Center 1,129 967 (86) 340 (30) 31 (3)

NH Regional Extension Center of New Hampshire 1,000 1,108 (111) 800 (80) 107 (11)

NJ New Jersey Health Information Technology 

Extension Center

5,000 5,271 (105) 2,417 (48) 263 (5)

NM New Mexico Health Information Technology 

Regional Extension Center 

1,035 970 (94) 498 (48) 14 (1)

NV & UT HealthInsight 1,463 1,596 (109) 866 (59) 98 (7)

NY New York eHealth Collaborative 5,107 3,624 (80) 1,864 (41) 49 (1)

NY New York City Regional Electronic Adoption 

Center for Health

4,543 5,113 (100) 2,689 (53) 277 (5)

OH, IN, & 

KY 

Greater Cincinnati Health Bridge Inc. 1,739 1,857 (107) 1,014 (58) 118 (7)

OH Ohio Health Information Partnership 6,000 6,129 (102) 2,745 (46) 248 (4)

OK Oklahoma Foundation for Medical Quality 1,000 1,089 (109) 544 (54) 39 (4)

OR Oregon Health Information Technology 

Regional Extension Center 

2,674 2,719 (102) 1,577 (59) 118 (4)
Appendix IV: Regional Extension Center 

Program, Goals, and Progress in Helping 

Providers Demonstrate Meaningful Use

Page 68 GAO-12-481 Electronic Health Records

Number of professionals (percent of the goal)

Location Regional Extension Center name

Goal number of 

professionals 

targeted for 

assistance

Signed an 

agreement 

with a 

Regional 

Extension 

Center

Implemented 

an EHR

Demonstrated 

meaningful use

PA Pennsylvania Regional Extension & 

Assistance Center for Health Information 

Technology East

5,700 2,901 (51) 1,339 (24) 300 (5)

PA Pennsylvania Regional Extension & 

Assistance Center for HIT West

3,000 2,106 (70) 990 (33) 111 (4)

PR Ponce Medical School Foundation, Inc. 4,038 3,211 (80) 425 (11) 2 (0)

RI Rhode Island Quality Institute 1,000 904 (90) 528 (53) 84 (8)

SC South Carolina Regional Extension Center 1,000 1,133 (113) 628 (63) 17 (2)

SD HealthPOINT 1,070 690 (65) 105 (10) 1 (0)

TN Tennessee Regional Extension Center 1,343 1,474 (110) 1,179 (88) 44 (3)

Tribal lands National Indian Health Board 2,925 843 (84) 405 (41) 24 (2)

TX CentrEast 1,000 1,131 (40) 307 (11) 22 (1)

TX Gulf Coast Regional Extension Center 2,855 952 (64) 444 (30) 86 (6)

TX North Texas Regional Extension Center 1,498 729 (64) 201 (18) 0 (0)

TX West Texas Health Information Technology 

Regional Extension Center 

1,133 1,875 (64) 548 (19) 0 (0)

VA Virginia Health Information Technology 

Regional Extension Center 

2,285 2,320 (102) 1,432 (63) 196 (9)

VT Vermont Information Technology Leaders, 

Inc.

845 828 (98) 553 (65) 17 (2)

WA & ID Washington & Idaho Regional Extension 

Center 

2,369 2,391 (101) 1,592 (67) 72 (3)

WI Wisconsin Health Information Technology 

Extension Center

1,625 1,695 (104) 940 (58) 70 (4)

WV West Virginia Health Information Technology 

Regional Extension Center 

1,000 987 (99) 459 (46) 74 (7)

Source: GAO analysis of Office of the National Coordinator for Health Information Technology data.

Notes: Professionals who have signed an agreement with a Regional Extension Center to receive 

technical assistance include those who have implemented an EHR and demonstrated meaningful 

use, and professionals who have implemented an EHR include those who have demonstrated 

meaningful use. The data on the number of professionals at each milestone are reported by Regional 

Extension Centers to the Office of the National Coordinator for Health Information Technology and as 

a result do not necessarily mean that these providers received an incentive payment from either the

Medicare or Medicaid EHR programs.
Appendix IV: Regional Extension Center 

Program, Goals, and Progress in Helping 

Providers Demonstrate Meaningful Use

Page 69 GAO-12-481 Electronic Health Records

Table 14: Goals and Number of Hospitals Assisted in Progressing Towards Demonstrating Meaningful Use, by Regional 

Extension Center, through December 19, 2011

Number of hospitals (percent of the goal)

Location Regional Extension Center name

Goal number 

of hospitals 

targeted for 

assistance

Signed an 

agreement with 

a Regional 

Extension 

Center

Implemented 

an EHR

Demonstrated 

meaningful use

AK Alaska eHealth Network 14 4 (29) 2 (14) 0 (0)

AL The Alabama Regional Extension Center 36 0 (0) 0 (0) 0 (0)

AR Arkansas Foundation for Medical Care 35 9 (26) 2 (6) 2 (6)

AZ Arizona Regional Extension Center 20 1 (5) 0 (0) 0 (0)

CA California Health Information Partnership 

Services Organization North

28 23 (82) 5 (18) 0 (0)

CA California Health Information Partnership 

Services Organization South

15 7 (47) 5 (33) 0 (0)

CO Colorado Regional Health Information 

Organization

38 33 (87) 12 (32) 2 (5)

FL Center for the Advancement of Health Information 

Technology

14 4 (29) 0 (0) 0 (0)

FL South Florida Regional Extension Center 3 0 (0) 0 (0) 0 (0)

GA Georgia Health Information Technology Regional 

Extension Center 

56 34 (61) 1 (2) 1 (2)

HI Hawaii Health Information Exchange 12 8 (67) 0 (0) 0 (0)

IA Telligen 87 63 (72) 12 (14) 5 (6)

IL Illinois Health Information Technology Regional 

Extension Center 

60 36 (60) 15 (25) 0 (0)

IN Indiana Health Information Technology Extension 

Center

32 30 (94) 14 (44) 0 (0)

KS Kansas Foundation for Medical Care 95 95 (100) 24 (25) 9 (10)

KY Kentucky Regional Extension Center 30 22 (73) 4 (13) 2 (7)

LA Louisiana Health Care Quality Forum 64 20 (31) 2 (3) 2 (3)

MA Massachusetts eHealth Institute 11 2 (18) 0 (0) 0 (0)

ME HealthInfoNet 22 19 (86) 6 (27) 0 (0)

MI Michigan Center for Effective Information 

Technology Adoption

36 24 (67) 9 (25) 0 (0)

MN & ND Regional Extension Assistance Center for Health 

Information Technology

124 89 (72) 30 (24) 8 (7)

MO Missouri Health Information Technology 

Assistance Center

55 54 (98) 0 (0) 0 (0)

MS Mississippi Regional Extension Center 45 12 (27) 3 (7) 1 (2)
Appendix IV: Regional Extension Center 

Program, Goals, and Progress in Helping 

Providers Demonstrate Meaningful Use

Page 70 GAO-12-481 Electronic Health Records

Number of hospitals (percent of the goal)

Location Regional Extension Center name

Goal number 

of hospitals 

targeted for 

assistance

Signed an 

agreement with 

a Regional 

Extension 

Center

Implemented 

an EHR

Demonstrated 

meaningful use

MT & WY Health Technology Services Regional Extension 

Center 

68 43 (63) 6 (9) 1 (2)

NE Wide River Technology Extension Center 66 38 (58) 4 (6) 0 (0)

NH Regional Extension Center of New Hampshire 13 12 (92) 4 (31) 0 (0)

NM New Mexico Health Information Technology 

Regional Extension Center 

17 7 (41) 2 (12) 1 (6)

NV & UT HealthInsight 39 9 (23) 0 (0) 0 (0)

NY New York eHealth Collaborative 10 10 (100) 6 (60) 0 (0)

OH, IN, & 

KY 

Greater Cincinnati Health Bridge Inc. 24 4 (17) 0 (0) 0 (0)

OH Ohio Health Information Partnership 43 32 (74) 12 (28) 0 (0)

OK Oklahoma Foundation for Medical Quality 62 25 (40) 5 (8) 2 (3)

OR Oregon Health Information Technology Regional 

Extension Center 

32 28 (88) 0 (0) 0 (0)

PA Pennsylvania Regional Extension & Assistance 

Center for Health Information Technology East

15 5 (33) 1 (7) 0 (0)

PA Pennsylvania Regional Extension & Assistance 

Center for Health Information Technology West

12 6 (50) 3 (25) 0 (0)

SC South Carolina Regional Extension Center 13 4 (31) 0 (0) 0 (0)

SD healthPOINT 48 45 (94) 1 (2) 0 (0)

TN Tennessee Regional Extension Center 40 6 (15) 3 (8) 2 (5)

TX CentrEast 32 6 (19) 0 (0) 0 (0)

TX Gulf Coast Regional Extension Center 51 4 (8) 0 (0) 0 (0)

TX North Texas Regional Extension Center 9 3 (33) 0 (0) 0 (0)

TX West Texas Health Information Technology 

Regional Extension Center 

76 19 (25) 5 (7) 1 (1)

Tribal lands National Indian Health Board 26 22 (85) 9 (35) 0 (0)

VA Virginia Health Information Technology Regional 

Extension Center 

7 5 (71) 1 (14) 0 (0)

VT Vermont Information Technology Leaders, Inc. 9 4 (44) 2 (22) 0 (0)

WA & ID Washington & Idaho Regional Extension Center 47 33 (70) 16 (34) 0 (0)

WI Wisconsin Health Information Technology

Extension Center

69 41 (59) 17 (25) 2 (3)
Appendix IV: Regional Extension Center 

Program, Goals, and Progress in Helping 

Providers Demonstrate Meaningful Use

Page 71 GAO-12-481 Electronic Health Records

Number of hospitals (percent of the goal)

Location Regional Extension Center name

Goal number 

of hospitals 

targeted for 

assistance

Signed an 

agreement with 

a Regional 

Extension 

Center

Implemented 

an EHR

Demonstrated 

meaningful use

WV West Virginia Health Information Technology 

Regional Extension Center

17 1 (6) 0 (0) 0 (0)

Source: GAO analysis of Office of the National Coordinator for Health Information Technology data.

Note: Hospitals that have signed an agreement with a Regional Extension Center to receive technical 

assistance include those that have implemented an EHR and demonstrated meaningful use, and 

hospitals that have implemented an EHR include those that have demonstrated meaningful use. The 

data on the number of hospitals at each milestone are reported by Regional Extension Centers to the 

Office of the National Coordinator for Health Information Technology and as a result do not 

necessarily mean that these hospitals received an incentive payment from either the Medicare or 

Medicaid EHR programs.
Appendix V: Comments from the Department 

of Health and Human Services

Page 72 GAO-12-481 Electronic Health Records

Appendix V: Comments from the Department 

of Health and Human Services 
Appendix V: Comments from the Department 

of Health and Human Services

Page 73 GAO-12-481 Electronic Health Records
Appendix V: Comments from the Department 

of Health and Human Services

Page 74 GAO-12-481 Electronic Health Records
Appendix V: Comments from the Department 

of Health and Human Services

Page 75 GAO-12-481 Electronic Health Records
Appendix V: Comments from the Department 

of Health and Human Services

Page 76 GAO-12-481 Electronic Health Records
Appendix VI: GAO Contact and Staff 

Acknowledgments

Page 77 GAO-12-481 Electronic Health Records

Linda T. Kohn, (202) 512-7114 or kohnl@gao.gov

In addition to the contact named above, E. Anne Laffoon, Assistant 

Director; Julianne Flowers; Krister Friday; Melanie Krause; Shannon 

Legeer; Monica Perez-Nelson; Amanda Pusey; and Stephen Ulrich made 

key contributions to this report.

Appendix VI: GAO Contact and Staff 

Acknowledgments 

GAO Contact

Staff 

Acknowledgments 

(290931)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (www.gao ). Each weekday afternoon, 

GAO posts on its website newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to 

.gov

www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: www.gao

E-mail: 

.gov/fraudnet/fraudnet.htm

fraudnet@gao

Automated answering system: (800) 424-5454 or (202) 512-7470

.gov

Katherine Siggerud, Managing Director, siggerudk@gao , (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

.gov

Chuck Young, Managing Director, youngc1@gao , (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

.gov

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations 

Public Affairs

Please Print on Recycled Paper.