Department of Health and Human Services

OFFICE OF

INSPECTOR GENERAL

EARLY ASSESSMENT I F NDS 

THAT CMS FACES 

OBSTACLES IN OVERSEEING 

THE MEDICARE EHR

INCENTIVE PROGRAM 

Daniel R. Levinson 

Inspector General

November 2012

OEI-05-11-00250
 

EARLY ASSESSMENT FINDS THAT CMS FACES OBSTACLES IN 

OVERSEEING THE MEDICARE EHR INCENTIVE PROGRAM, 

OEI-05-11-00250

WHY WE DID THIS STUDY 

This study is an early assessment of CMS’s oversight of the Medicare electronic health 

record (EHR) incentive program, for which CMS estimates it will pay $6.6 billion in 

incentive payments between 2011 and 2016. Because professionals and hospitals selfreport data to demonstrate that they meet program requirements, CMS’s efforts to verify 

these data will help ensure the integrity of Medicare EHR incentive payments.

HOW WE DID THIS STUDY

This study reviewed CMS’s oversight of professionals’ and hospitals’ self-reported 

meaningful use of certified EHR technology in 2011, the first year of the program. To 

address our objective, we analyzed self-reported information to ensure it met program 

requirements. We also reviewed CMS’s audit planning documents, regulations, and 

guidance for the program, and conducted structured interviews with CMS staff regarding 

CMS’s oversight.

WHAT WE FOUND

CMS faces obstacles to overseeing the Medicare EHR incentive program that leave the 

program vulnerable to paying incentives to professionals and hospitals that do not fully 

meet the meaningful use requirements. Currently, CMS has not implemented strong 

prepayment safeguards, and its ability to safeguard incentive payments postpayment is 

also limited. The Office of the National Coordinator for Health Information Technology 

(ONC) requirements for EHR reports may contribute to CMS’s oversight obstacles.

WHAT WE RECOMMEND

We recommend that CMS: (1) obtain and review supporting documentation from 

selected professionals and hospitals prior to payment to verify the accuracy of their 

self-reported information and (2) issue guidance with specific examples of documentation 

that professionals and hospitals should maintain to support their compliance. CMS did 

not concur with our first recommendation, stating that prepayment reviews would 

increase the burden on practitioners and hospitals and could delay incentive payments. 

We continue to recommend that CMS conduct prepayment reviews to improve program 

oversight. CMS concurred with our second recommendation.

We recommend that ONC: (1) require that certified EHR technology be capable of 

producing reports for yes/no meaningful use measures where possible and (2) improve 

the certification process for EHR technology to ensure accurate EHR reports. ONC 

concurred with both recommendations.
TABLE OF CONTENTS

Objective ......................................................................................................1

Background..................................................................................................1

Methodology................................................................................................5

Findings........................................................................................................9

CMS does not verify the accuracy of professionals’ or hospitals’ 

self-reported meaningful use information prior to payment............9

CMS’s planned postpayment audits may not conclusively verify 

the accuracy of professionals’ and hospitals’ self-reported 

meaningful use information ...........................................................11

Conclusion and Recommendations............................................................16

Agencies’ Comments and Office of Inspector General

Response ........................................................................................18

Appendixes ................................................................................................20

A: Meaningful Use Measures for Professionals and Hospitals ....20

B: Centers for Medicare & Medicaid Services’Assessment of 

Data Sources To Verify the Accuracy of Self-Reported 

Meaningful Use Information, by Measure.....................................26

C: Agencies’ Comments................................................................30

Acknowledgments......................................................................................34
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)

 

1

OBJECTIVE

To conduct an early assessment of the Centers for Medicare & Medicaid 

Services’ (CMS) oversight of the Medicare electronic health record (EHR) 

incentive program.

BACKGROUND

The Medicare EHR Incentive Program 

The American Recovery and Reinvestment Act (ARRA) established EHR 

incentive programs for both Medicare and Medicaid to promote the use of 

EHR technology by health care professionals and hospitals.1 EHR

technology refers to computerized recordkeeping systems that store 

patients’ health-related information, including medical histories and 

procedure notes.

Only certain types of health care professionals and hospitals are eligible to 

participate in the Medicare EHR incentive program.2

 Eligible health care 

professionals include physicians, dentists, podiatrists, optometrists, and 

chiropractors. Eligible hospitals include acute care hospitals and critical 

access hospitals.

CMS began making Medicare EHR incentive payments in May 2011 and, 

as of September 2012, had paid about $4 billion to 82,535 professionals

and 1,474 hospitals.3 Per ARRA, CMS will continue to make Medicare 

EHR incentive payments to professionals and hospitals through 2016. 

CMS anticipates spending an estimated $6.6 billion in incentive payments 

between 2011 and 2016.4 Professionals can receive up to $44,000 each in

incentive payments over the duration of the program.5 Hospital incentive 

payments for each year of the program begin with a $2 million base 

amount that is adjusted by a number of hospital-specific factors and 

gradually decreased over the duration of the program.6

1 ARRA §§ 4101 and 4201, amending Titles XVIII and XIX of the Social Security Act (SSA).

2 SSA §§ 1848(o)(5)(C) and 1886(n)(6), as added by ARRA §§ 4101 and 4102; 

42 CFR § 495.100.

3 CMS, Data and Reports Page. Accessed at www.cms.gov on November 15, 2012.

4 CMS, Justification of Estimates for Appropriations Committees, Fiscal Year 2012. 

Accessed at www.cms.gov on July 5, 2011.

5 SSA § 1848(o)(1), as added by ARRA § 4101(a); 42 CFR § 495.102.

6 SSA § 1886(n)(2), as added by ARRA § 4102(a); 42 CFR § 495.104.
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)

 

2

Medicare EHR Incentive Program Requirements

To qualify for Medicare EHR incentive payments, professionals and 

hospitals must: (1) possess certified EHR technology; and 

(2) meaningfully use that certified EHR technology, in accordance with 

requirements defined by CMS, for a 90-day reporting period.7

Certified EHR Technology. The Office of the National Coordinator for 

Health Information Technology (ONC) defined EHR technology

certification requirements in Federal regulations.

8

 EHR technology must 

include certain functions in support of meaningful use requirements to 

receive certification.

9

 ONC requires certified EHR technology to be 

capable of producing reports (EHR reports) on meaningful use by 

aggregating information from records in the system.

ONC also defined the EHR technology certification process in Federal 

regulations.

10 According to this process, private entities (certification 

bodies) certify that EHR technology meets certification requirements

using vendor-supplied test data.

11 ONC lists all certified EHR technology 

in the Certified Health Information Technology Product List (CHPL), an 

online, publicly accessible database.

Meaningful Use. Professionals and hospitals must also meaningfully use 

their certified EHR technology to qualify for Medicare EHR incentive 

payments. To meaningfully use certified EHR technology, professionals 

and hospitals must use numerous EHR technology functions defined in 

Federal regulations as meaningful use measures. These measures 

encompass EHR technology functions meant to improve health care 

quality and efficiency, such as computerized provider order entry, 

electronic prescribing (e-prescribing), and exchange of key clinical 

information.

Each meaningful use measure has a specified criterion. Each criterion

involves performing a one-time action (yes/no measure) or performing a 

certain action for a specified percentage of unique patients, patient visits, 

or other events (percentage-based measure). For example, one yes/no 

measure requires professionals to enable drug interaction checks in their 

7 The 90-day reporting period applies to a professional’s or hospital’s first year of 

participation; in subsequent years of participation, professionals and hospitals must 

meaningfully use a certified EHR for the entire year. SSA §§ 1848(o)(1) and (2), as added by 

ARRA § 4101(a); SSA §§ 1886(n)(1) and (3), as added by ARRA § 4102(a); 42 CFR § 495.4.

8 45 CFR pt. 170, subpart C.

9 Ibid.

10 45 CFR pt. 170, subparts D and E.

11 Ibid.
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)

 

3

certified EHR technology.

12 One percentage-based measure requires 

professionals to submit more than 40 percent of all prescriptions 

electronically.13

Professionals and hospitals must meet criteria for a specified number of 

meaningful use measures for CMS to deem them meaningful users. CMS 

established 25 measures for professionals—15 mandatory measures (core 

measures) and 10 additional measures (menu measures). From the 

10 menu measures, each professional must select and meet 5. Similarly, 

CMS established 24 measures for hospitals—14 core measures and 

10 menu measures. Like professionals, each hospital must select and meet 

5 menu measures. Professionals must meet criteria for 20 measures and 

hospitals must meet criteria for 19 measures for CMS to deem them 

meaningful users.

14

Table 1 illustrates the breakdown of yes/no and percentage-based 

meaningful use measures, as well as the total number of core and menu 

measures that CMS established for professionals and hospitals. For a 

complete list of professional and hospital meaningful use measures, see 

Appendix A.

Table 1: Number of Meaningful Use Measures by Type

Percentage-Based Yes/No Total

Professionals

Core 10 5 15

Menu 6 4 10

Hospitals

Core 9 5 14

Menu 5 5 10

 Total 30 19 49

Source: Office of Inspector General (OIG) analysis of Federal regulations, 2011.

Demonstrating Meaningful Use of Certified EHR Technology.

Professionals and hospitals must demonstrate meaningful use of certified 

EHR technology for each year that they wish to receive an incentive 

payment. As such, professionals and hospitals who received incentive 

payments for 2011 will have to demonstrate meaningful use of certified 

EHR technology anew in subsequent years to receive additional incentive 

payments.

12 42 CFR § 495.6(d)(2). 13 42 CFR § 495.6(d)(4).

14 Many measures for professionals involve objectives and EHR capabilities similar to 

measures for hospitals, although the precise measure definitions differ.
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)

 

4

Professionals and hospitals demonstrate meaningful use of certified EHR

technology through online self-reporting in the National Level Repository 

(NLR). The NLR is a CMS database that stores professionals’ and 

hospitals’ information relevant to the EHR incentive program.

Professionals and hospitals submit self-reported information for 

meaningful use measures to the NLR. For yes/no measures, professionals

and hospitals indicate that they have met the measure criteria by checking 

a box. For percentage-based measures, professionals and hospitals 

provide numerical totals for the numerator and denominator of each 

measure. For example, to fulfill the e-prescribing measure, professionals

must report both the number of prescriptions submitted electronically and 

the total number of prescriptions.

Professionals and hospitals also report their certified EHR technology to 

the NLR using an EHR certification code. They obtain an EHR 

certification code that corresponds to their certified EHR technology from 

the CHPL database.

CMS’s Oversight of the Medicare EHR Incentive Program

To oversee the Medicare EHR incentive program, CMS has authority to

review professionals’ and hospitals’ demonstrations of meaningful use.15 

CMS’s reviews consist of prepayment validation in the NLR and

postpayment audits.

Prepayment Oversight. CMS conducts prepayment validation of 

professionals’ and hospitals’ self-reported meaningful use information to 

ensure that it meets program requirements. To do so, the NLR runs

prepayment system edits to validate that self-reported information meets 

measure criteria. For example, for each percentage-based measure, the 

NLR divides the self-reported numerator by the self-reported denominator 

and determines whether the result meets the relevant percentage threshold. 

The NLR also automatically checks professionals’ and hospitals’ 

self-reported EHR certification codes against ONC’s CHPL database to 

confirm that they are valid. CMS does not approve incentive payments for 

professionals and hospitals whose self-reported information fails 

prepayment validation.

Postpayment Oversight. To verify that professionals’ and hospitals’

self-reported meaningful use information is accurate, CMS plans to audit 

selected professionals and hospitals after payment. It plans to conduct a 

risk assessment using data analyses to select audit targets (e.g., check that 

self-reported denominators are consistent across certain meaningful use 

15 42 CFR § 495.8(c).
CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250)

 

5

measures). At the time of our review, CMS had not yet completed any 

postpayment audits.

Professionals and hospitals selected for audit will first undergo a desk 

audit, during which they will provide documentation supporting their 

self-reported information to CMS. If CMS is unable to verify the 

accuracy of that information, it will proceed with an onsite audit. 

Professionals and hospitals must retain documentation supporting their 

self-reported meaningful use information for 6 years.16

Per its policy, CMS will recover incentive payments when audits find 

noncompliance.17 Federal regulations state that professionals and 

hospitals must meet all relevant meaningful use requirements to receive 

incentive payments.18 Partially meeting meaningful use requirements 

does not qualify professionals and hospitals to receive incentive payments.

Related Work

This is the second of two OIG studies on CMS’s and States’ oversight of 

the Medicare and Medicaid EHR incentive programs, respectively. The 

first study in this series reviewed 13 States’ oversight of their Medicaid 

EHR incentive programs.19 OIG found that all 13 States planned to verify 

compliance with at least half of eligibility requirements prior to making 

EHR incentive payments. OIG also found that data availability limits both 

the number of eligibility requirements that States plan to verify prior to 

payment and the completeness of those verifications.

OIG is also conducting a series of audits of Medicare and Medicaid EHR 

incentive payments. These audits will verify the accuracy of 

professionals’ and hospitals’ self-reported meaningful use information, as 

well as eligibility and payment amounts.

METHODOLOGY

Scope

We conducted an early assessment of CMS’s oversight of professionals’ 

and hospitals’ self-reported meaningful use information for 2011, the first 

year of the Medicare EHR incentive program. The goal of this assessment 

was to identify any potential vulnerabilities in CMS’s initial oversight 

design for the program.

16 Ibid.

17 CMS, Attestation Overview. Accessed at www.cms.gov on May 9, 2012.

18 42 CFR pt. 495, subpart B.

19 OIG, Early Review of States’ Planned Medicaid Electronic Health Record Incentive 

Program Oversight, OEI-05-10-00080, July 2011.
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

6

For our assessment, we reviewed Federal regulations in effect at the time 

of our data collection. CMS and ONC have recently issued updated 

regulations for meaningful use and certified EHR technology, respectively. 

Both CMS and ONC plan to issue additional regulatory updates in future 

years of the program.

We reviewed CMS’s current and planned activities to verify the accuracy 

of professionals’ and hospitals’ self-reported meaningful use information. 

We also analyzed self-reported meaningful use information for 

professionals and hospitals that CMS approved to receive incentive 

payments. 

We reviewed the components of ONC’s certification process and 

requirements for EHR technology that affect CMS’s oversight activities 

for the Medicare EHR incentive program. Because this study focuses on 

CMS oversight, we did not conduct a complete review of ONC’s 

certification process and requirements for EHR technology. 

We did not review the appropriateness of the meaningful use measures as 

defined by CMS in Federal regulations. We also did not review CMS’s

activities to verify that professionals and hospitals were among the types 

eligible for the Medicare EHR incentive program. Further, we did not 

review the accuracy of CMS’s calculated incentive payment amounts for 

professionals or hospitals. Finally, we did not audit professionals’ or 

hospitals’ self-reported meaningful use information to verify its accuracy. 

Data Collection and Analysis

To address the study’s objective, we analyzed professionals’ and hospitals’ 

self-reported meaningful use information, CMS’s audit planning 

documents, and Federal regulations and guidance for the Medicare EHR 

incentive program. We also conducted structured interviews with CMS 

staff about current and planned oversight. 

Professionals’ and Hospitals’ Self-Reported Meaningful Use Information. 

We collected professionals’ and hospitals’ self-reported information from 

the NLR from the program’s inception in May 2011 through December 

2011. We requested all registration, meaningful use, and payment 

information from this period. This included self-reported meaningful use 

information for 26,653 professionals and 668 hospitals that CMS approved 

for about $1.7 billion in incentive payments. Professionals and hospitals 

that CMS approved for payments included those that had received 

incentive payments as well as those waiting to receive their payments. 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

7

We also collected certified EHR technology information from ONC’s 

CHPL database. We obtained a list of all valid EHR certification codes 

that were present in the CHPL database as of December 2011. 

We determined whether professionals’ and hospitals’ self-reported 

meaningful use information met meaningful use measure criteria. 

Specifically, we checked that self-reported numerators and denominators 

met the required thresholds for percentage-based measures, that 

professionals and hospitals selected “yes” for yes/no measures, and that 

they reported the correct number of core and menu measures. We also 

compared professionals’ and hospitals’ self-reported EHR certification 

codes to the list of valid EHR certification codes from the CHPL database.

We also replicated part of CMS’s risk analysis of professionals’ and 

hospitals’ self-reported meaningful use information. We compared 

denominator values across selected percentage-based measures that should 

have the same denominator to detect mismatches. We selected measures 

for comparison based on CMS’s audit planning documents. 

CMS’s Audit Plan, Staff Interviews, and Guidance to Professionals and 

Hospitals. We collected planning documents outlining CMS’s audit 

strategy for the Medicare EHR incentive program in December 2011, and 

obtained updates to these documents in April 2012. The documents 

included a comprehensive overview of CMS’s planned audit strategy and 

details on CMS’s audit plan for each meaningful use measure. 

In December 2011, we also conducted structured interviews with CMS 

staff about CMS’s prepayment and postpayment oversight. We 

interviewed staff responsible for implementation and oversight of the 

Medicare EHR incentive program, including staff from the Office of 

E-Health Standards and Services, the Office of Financial Management, the 

Office of Information Systems, and the Office of Clinical Standards and 

Quality. 

We analyzed the information from CMS’s audit planning documents and 

interviews to identify any limitations to CMS’s prepayment and 

postpayment oversight. First, we reviewed CMS’s audit planning 

documents to determine what data sources CMS had identified to verify 

the accuracy of professionals’ and hospitals’ self-reported meaningful use 

information. We then analyzed the interview results to determine what

current and planned prepayment and postpayment verification activities 

CMS conducts using those data sources. 

We also reviewed Federal regulations for the Medicare EHR incentive 

program, a list of frequently asked questions (FAQ) on the Medicare EHR 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

8

incentive program, and other information on the CMS Web site to 

determine what audit guidance CMS provided. 

Limitations 

This report is an early assessment of CMS’s oversight as it existed at the 

time of our data collection. We did not review completed audits 

conducted by CMS because, at the time of our data collection, CMS had 

not performed any. 

Standards

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency.
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

9

FINDINGS

CMS does not verify the accuracy of professionals’ or 

hospitals’ self-reported meaningful use information 

prior to payment

CMS determines that professionals and hospitals are meaningful users of 

certified EHR technology, and therefore qualify for incentive payments, 

based solely on self-reported information. CMS does not verify that 

self-reported information is accurate prior to payment. Although CMS is 

not required to verify the accuracy of this information prior to payment, 

doing so would strengthen its oversight of the anticipated $6.6 billion in 

incentive payments. Verifying self-reported information prior to payment 

could also reduce the need to identify and recover erroneous payments 

after they are made.

CMS’s prepayment validation functions correctly but does not 

verify the accuracy of self-reported information

CMS’s prepayment validation of professionals’ and hospitals’ self-reported 

meaningful use information functions correctly. We found that all 

self-reported information met meaningful use criteria for professionals and 

hospitals approved for payment as of December 2011. In addition, all

professionals and hospitals reported valid EHR certification codes and the 

correct number of core and menu measures.

Although CMS’s prepayment validation functions correctly, it does not 

verify that self-reported information is accurate. The validation checks 

that self-reported numerators and denominators calculate to required 

percentage thresholds and that all relevant yes/no measures were checked 

“yes.” However, it does not verify that numerators and denominators 

entered for percentage-based measures reflect the actual number of 

patients for a given measure or that professionals and hospitals possess 

certified EHR technology. 

Sufficient data are not available to verify self-reported 

information through automated system edits

CMS staff reported that CMS considered using automated NLR system 

edits to verify professionals’ and hospitals’ self-reported meaningful use 

information prior to payment, but found that sufficient data were not 

available to do so. Automated system edits in the NLR could compare 

self-reported meaningful use information to other data sources as a means 

of verification. 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

10

CMS did not identify any data sources it could use to verify any of the 

49 meaningful use measures. According to CMS staff, existing internal 

and external data sources are not comprehensive enough for verification 

and, in some cases, are not easily accessible. Further, no data sources 

exist for many of the meaningful use measures. Table 2 provides detail on 

CMS’s assessment of data sources for verification. For a measure-specific 

breakdown of the categories in Table 2, see Appendix B. 

Table 2: CMS’s Assessment of Data Sources To Verify the Accuracy of 

Self-Reported Meaningful Use Information

Assessment Number of Meaningful Use Measures

Internal CMS data sources are accessible but not 

comprehensive enough for verification (e.g., 

Medicare claims data). 

25

External data sources are not accessible for 

verification (e.g., privately held e-prescribing data, 

State public health agency data). 

6 

No data source exists (i.e., data for measure are

not currently collected by any entity). 19

Internal CMS data sources and external data 

sources exist but are not comprehensive or 

accessible for verification, respectively. 

(1)

 Total 49

Source: OIG analysis of CMS documents and interview data, 2012.

CMS has identified internal data sources for 25 meaningful use measures 

but does not use the data to verify the accuracy of self-reported 

information because they do not match measure definitions. For example, 

CMS cannot verify self-reported denominators using Medicare claims data 

because these data only cover the portions of the denominators associated 

with Medicare patients. To verify self-reported denominators, CMS would 

also need information about the non-Medicare patients.

CMS identified external data sources for six measures, but either did not 

have access to them or chose not to use them to verify self-reported 

information at the time of our data collection. For one measure, CMS 

staff reported that the cost of obtaining e-prescribing data from a private 

company, as well as the logistical difficulty of establishing real-time 

access, prevented CMS from using that source. For five measures, CMS 

identified public health data sources, such as State immunization 

registries, for potential use. CMS staff reported that CMS would attempt 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

11

to gain access to these State data sources but, at the time of our data 

collection, did not yet have access.

For 19 meaningful use measures, CMS did not identify any data sources it 

could use to verify the accuracy of self-reported information. CMS staff 

noted that these measures involve information that is not currently 

collected by any entity. 

CMS does not collect supporting documentation to verify 

self-reported information prior to payment

CMS does not direct professionals or hospitals to submit supporting 

documentation to substantiate their self-reported meaningful use 

information prior to payment. While collecting this documentation for all 

professionals and hospitals may not be feasible, CMS could feasibly 

conduct risk analyses to select a subset of professionals and hospitals from 

which to request supporting documentation. CMS could then review this 

documentation to verify those professionals’ and hospitals’ self-reported 

meaningful use information where possible. Conducting such prepayment 

reviews would be consistent with CMS’s stated objective of moving from 

a “pay and chase” model to a prevention-oriented approach focused on 

high-risk providers.20

Per OIG analysis, if prior to payment CMS had applied one of the risk 

analyses it proposes to use to select postpayment audit targets, it would 

have identified 14 percent of professionals (3,825 professionals) and 

17 percent of hospitals (111 hospitals) for potential prepayment review. 

These professionals and hospitals reported different denominator values 

across selected meaningful use measures that should have the same

denominator. 

CMS’s planned postpayment audits may not 

conclusively verify the accuracy of professionals’ and 

hospitals’ self-reported meaningful use information

In the event of an audit, CMS plans to rely on a combination of EHR 

reports and supporting documentation to verify that self-reported

information is accurate. CMS staff reported that they plan to use EHR 

reports to verify the accuracy of self-reported information where possible, 

and obtain supporting documentation from professionals and hospitals as 

necessary to verify measures not covered by those reports. 

20 CMS, Statement by Dr. Peter Budetti, JD, on Fighting Fraud and Waste in Medicare and 

Medicaid. Accessed at www.hhs.gov on July 18, 2012.
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

12

To determine compliance conclusively, CMS’s audits must verify that 

professionals’ and hospitals’ self-reported meaningful use information is 

accurate. As such, the EHR reports and other supporting documentation 

that CMS plans to rely on must be both sufficient (i.e., cover all aspects of 

each meaningful use measure) and accurate.

Reports from certified EHR technology are not sufficient for 

CMS to verify self-reported information and may not always be 

accurate

In the event of an audit, CMS plans to use EHR reports to verify 

professionals’ and hospitals’ self-reported meaningful use information. 

These reports aggregate information from individual records in the 

certified EHR technology to support the numbers that professionals and 

hospitals self-reported to CMS to qualify for incentive payments.

CMS Cannot Verify Self-Reported Information Using Only Reports From 

Certified EHR Technology. CMS cannot use EHR reports to verify all 

self-reported meaningful use information because ONC does not require 

certified EHR technology to be capable of producing reports for all 

meaningful use measures. ONC requires only that certified EHR

technology be capable of producing reports covering professionals’ and 

hospitals’ performance on the 30 percentage-based meaningful use 

measures.

21 ONC does not require certified EHR technology to be 

capable of producing reports for the 19 yes/no measures.22

EHR reports also do not contain information necessary for CMS to verify

all percentage-based measures. Specifically, the denominators for many 

percentage-based measures include both patients who have records in the 

certified EHR technology and patients who do not (i.e., those who have 

paper records only).23 Because EHR reports contain information only on 

patients with records in the certified EHR technology, CMS cannot use 

them to verify denominators for percentage-based measures that include

all patients. For a list of meaningful use measures that require all patients 

in the denominator, see Appendix A. 

21 45 CFR § 170.302(n).

22 Ibid.

23 Federal regulations require that denominators for 11 of the 30 percentage-based measures 

include all patients. For the remaining 19 percentage-based measures, professionals and 

hospitals may choose to include all patients or only those with records in the certified EHR 

technology for the denominator. 42 CFR § 495.6 (c)(1)(2).
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

13

Reports From Certified EHR Technology May Produce Inaccurate 

Information. One EHR technology vendor acknowledged that two of its 

certified products could produce inaccurate EHR reports for three 

percentage-based meaningful use measures.24 According to ONC staff, 

the certification process did not identify these potential inaccuracies 

because the vendor-supplied test data did not account for the manner in 

which some professionals use the products. Similar problems may exist 

with EHR reports in other certified EHR technology. 

The vendor is working to correct the problem and has notified CMS, 

professionals, and hospitals. As of December 2011, 1,079 professionals 

using the affected products (or 4 percent of all professionals receiving 

payment) had been approved for or received Medicare EHR incentive 

payments. 

Inaccurate EHR reports may also lead to inaccurate audit determinations. 

All 30 percentage-based meaningful use measures could potentially be 

affected by this problem.

CMS may not be able to obtain sufficient supporting 

documentation to verify self-reported information during 

audits

Although Federal law and regulations require professionals and hospitals 

to keep documentation supporting their demonstrations of meaningful use, 

supplementary guidance from CMS does not provide additional detail on 

the specific types of supporting documentation it expects. By law, 

professionals and hospitals must retain documentation sufficient to support 

all claims to Medicare, including claims for EHR incentive payments.25 

Federal regulations also state that professionals and hospitals “must keep 

documentation supporting their demonstration of meaningful use.”26 

CMS has issued additional guidance—including information posted on its 

Web site and EHR incentive program FAQs—that provides some further 

detail regarding documentation requirements.27, 28 However, none of this 

guidance details the types of supporting documentation that CMS plans to 

rely on for audits. 

24 GE Healthcare, February letter to customers. Accessed at www.gehealthcare.com on 

February 13, 2012.

25 SSA § 1833(e).

26 42 CFR § 495.8(c).

27 CMS, Attestation Overview. Accessed at www.cms.gov on May 9, 2012.

28 CMS, FAQs February 2012. Accessed at www.cms.gov on May 9, 2012.
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

14

According to CMS staff, professionals and hospitals should keep detailed 

supporting documentation to substantiate their self-reported meaningful 

use information. CMS staff indicated that CMS auditors will use 

supporting documentation to verify self-reported meaningful use 

information for measures not covered by required EHR reports (i.e., the 

19 yes/no measures and denominator values for percentage-based 

measures with all-patient denominators). CMS staff reported, for 

example, that they expect professionals and hospitals to maintain the 

following: 

• screen shots showing that required EHR technology functions were 

enabled on the first day of or at some point during the 90-day 

reporting period (yes/no measures), 

• documents showing that a security risk assessment was conducted 

(yes/no measures), and 

• evidence of the number of patients with paper records for 

percentage-based measures with all-patient denominators 

(percentage-based measures). 

Supporting Documentation That CMS Obtains Will Not Be Sufficient for 

CMS To Verify Self-Reported Information for Six Measures. Even if 

professionals and hospitals retain the types of supporting documentation 

that CMS staff expect, it will not be sufficient to verify self-reported 

meaningful use information for six measures. These six yes/no measures 

(three for professionals and three for hospitals) require that professionals 

and hospitals enable certain EHR technology functions for the entire 

90-day reporting period. Specifically, they require professionals and 

hospitals to implement: 

• drug-drug and drug-allergy interaction checks, 

• one clinical decision support rule, and 

• drug formulary checks. 

Per CMS’s audit plan, CMS will accept screen shots or in-person 

demonstrations as supporting evidence to verify the accuracy of 

self-reported meaningful use information. However, screen shots or 

demonstrations will only verify that professionals and hospitals enabled 

the required EHR technology functions at a specific time—not that they 

enabled them for the entire 90-day reporting period. 

These six meaningful use measures may be particularly vulnerable to 

noncompliance. They require use of clinical decision support tools, which 

physicians often view as onerous or unnecessary. Several studies show 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

15

that physicians frequently develop “alert fatigue” with clinical decision 

support tools, especially with medication alerts.29, 30 As a result, 

professionals and hospitals may disable clinical decision support tools for 

all or part of their 90-day reporting period. 

29 T. Isaac, et al., “Overrides of Medication Alerts in Ambulatory Care,” Archives of Internal 

Medicine. 2009; 169(3):305–311. Accessed at www.archinte.ama-assn.org on 

March 6, 2012.

30 H. Van der Sijs, et al.,“Overriding Drug Safety Alerts in CPOE,” Journal of American 

Medical Information Association. 2006; 13:138–147. Accessed at www.jama.org on 

March 6, 2012.
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

16

CONCLUSION AND RECOMMENDATIONS

CMS faces obstacles to overseeing the Medicare EHR incentive program

that leave the program vulnerable to paying incentives to professionals and 

hospitals that do not fully meet the meaningful use requirements. Absent 

changes to the definition of meaningful use, CMS should consider ways to 

strengthen its program oversight to protect the $4 billion in Medicare EHR 

incentive payments that it has paid, as well as billions of dollars in future 

incentive payments. 

Currently, CMS has not implemented strong prepayment safeguards. 

CMS does not verify the accuracy of professionals’ and hospitals’ 

self-reported information prior to payment because data necessary for 

verifications are not readily available. CMS also does not direct high-risk 

professionals and hospitals to submit supporting documentation for 

prepayment review.

CMS’s ability to safeguard incentive payments postpayment is also 

limited. CMS’s planned postpayment audits may not conclusively verify 

the accuracy of professionals’ and hospitals’ self-reported information 

because supporting documentation may not be available. ONC’s

requirements for EHR reports may affect the availability of supporting 

documentation. If CMS cannot conclusively verify the accuracy of a 

professional’s or hospital’s self-reported information during a postpayment 

audit, it will be unable to determine whether the professional or hospital 

was a meaningful user and thereby qualified for the disbursed incentive 

payment. 

The following recommendations to CMS and ONC will help strengthen 

oversight of the Medicare EHR incentive program. Our recommendations 

to CMS focus on immediate changes that CMS can make to improve 

safeguards, and our recommendations to ONC focus on changes to 

enhance EHR reports in support of CMS’s oversight activities.

We recommend that:

CMS Obtain and Review Supporting Documentation From 

Selected Professionals and Hospitals Prior to Payment To 

Verify the Accuracy of Their Self-Reported Information

CMS should direct selected high-risk professionals and hospitals to submit 

documentation supporting their self-reported meaningful use information 

for prepayment review. To identify high-risk professionals and hospitals, 

CMS could use some of the risk analyses it plans to use to select 

postpayment audit targets. CMS could then collect supporting 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

17

documentation and conduct desk or onsite reviews, similar to its planned 

postpayment audit process, prior to making payments. 

CMS Issue Guidance That Details the Types of Documentation 

It Expects Professionals and Hospitals To Maintain To Support 

Their Compliance

CMS should bolster its current guidance by detailing the types of 

supporting documentation it expects professionals and hospitals to 

maintain for specific meaningful use measures. To do this, CMS could 

issue an FAQ, conduct provider education, or issue other forms of 

guidance. This guidance could explain, for example, that CMS expects 

professionals and hospitals to keep documentation such as screen shots 

and proof that a security risk assessment was performed. 

ONC Require Certified EHR Technology To Be Capable of 

Producing Reports for Yes/No Meaningful Use Measures, 

Where Possible

ONC could do this by updating its current regulations on the standards and 

functions required of certified EHR technology, or by including such a 

requirement in planned future regulations for the program. OIG 

acknowledges that producing reports may not be possible for some 

measures that include information not contained in the certified EHR

technology (e.g., that a security risk assessment was conducted).

EHR reports for yes/no measures could help professionals and hospitals 

prove compliance in the event of an audit and simplify CMS’s oversight. 

In particular, these reports could help CMS conclusively verify that 

professionals and hospitals had the relevant EHR technology functions 

enabled for the entire 90-day reporting period. 

ONC Improve the Certification Process for EHR Technology To 

Ensure Accurate EHR Reports

ONC should ensure that certification bodies comprehensively test EHR 

reports for accuracy as part of the certification process. For example, 

ONC could require certification bodies to use standardized test data for 

EHR reports instead of relying on vendor-supplied test data. While 

recreating every manner of using EHR technology for testing purposes is

not be possible, more comprehensive testing may increase the reliability of 

EHR reports for CMS’s postpayment audits.
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

18

AGENCIES’ COMMENTS AND OFFICE OF INSPECTOR GENERAL

RESPONSE 

We made four recommendations—two to CMS and two to ONC. CMS 

did not concur with our first recommendation, but did concur with our 

second recommendation. ONC concurred with both our third and fourth 

recommendations. 

CMS did not concur with our first recommendation that it obtain and 

review supporting documentation from selected professionals and 

hospitals prior to payment to verify the accuracy of their self-reported 

information. CMS stated that the Medicare EHR incentive program is an 

attestation-based program, and that prepayment reviews would impose an 

increased up-front burden on practitioners and hospitals. CMS further 

stated that conducting prepayment reviews would be difficult for 

practitioners and hospitals beyond their first year of participation, due to 

timing constraints, and could delay incentive payments. 

We continue to recommend that CMS conduct prepayment reviews of 

selected professionals and hospitals. While we recognize that doing so 

would impose an increased burden on the professionals and hospitals 

selected by CMS, that burden would be justified by the reduced likelihood 

of making improper incentive payments to high-risk professionals and 

hospitals. We note that the timing constraints CMS raised do not apply to 

all practitioners and hospitals, and therefore do not justify forgoing 

prepayment reviews altogether. We further note that our recommendation 

leaves the decision of how to select high-risk professionals and hospitals 

to CMS’s discretion; as such, CMS can select a methodology that 

appropriately accounts for the logistical and timing constraints it faces.

CMS concurred with our second recommendation that it issue guidance 

detailing the types of documentation it expects professionals and hospitals 

to maintain to support their compliance. CMS indicated that it is currently 

developing an FAQ document, to be posted online, that will bolster 

existing guidance to professionals and hospitals. We note that as detailed 

in our recommendation, the guidance that CMS provides should include 

examples of the types of documentation professionals and hospitals should 

retain for specific meaningful use measures.

ONC concurred with our third recommendation that it require certified 

EHR technology to be capable of producing reports for yes/no meaningful 

use measures, where possible. ONC stated that it will request 

recommendations on the scope and feasibility of such a requirement from 

its two Federal advisory committees. While we support ONC’s decision to 

seek input from its advisory committees, we reiterate that requiring 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

19

certified EHR technology to be capable of producing EHR reports for 

yes/no meaningful use measures would improve CMS’s ability to oversee 

the Medicare EHR incentive program. As such, we continue to 

recommend that ONC require certified EHR technology to be capable of 

producing reports for all meaningful use measures, where possible, in its 

future rulemaking. 

ONC also concurred with our fourth recommendation that it improve the 

certification process for EHR technology to ensure accurate EHR reports. 

ONC stated that its most recent rulemaking includes more rigorous testing 

requirements for certified EHR technology, and that it will continue to 

work with stakeholders to develop more comprehensive test procedures 

and reduce its reliance on vendor-supplied test data. 

CMS provided one technical comment, which we have incorporated into 

the report. 

For the full text of CMS and ONC comments, see Appendix C. 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

20

APPENDIX A

Meaningful Use Measures for Professionals and Hospitals

Table A-1: Professional Meaningful Use Measures

Measure Criterion Type Measure Criterion

All-Patient 

Denominator 

Required 

Core Measures

1. Computerized 

provider order 

entry (CPOE)

Percentage-based

More than 30 percent of all unique patients 

with at least one medication in their 

medication lists have at least one 

medication order entered using CPOE.

No

2. Drug interaction 

checks Yes/no 

The professional enables drug-drug and 

drug-allergy check functionality for the 

entire reporting period.

N/A

3. Problem lists Percentage-based

More than 80 percent of all unique patients 

have at least one entry (or an indication 

that no problems are known for the patient) 

recorded as structured data.

Yes

4. Electronic 

prescribing Percentage-based

More than 40 percent of all permissible 

prescriptions written by the professional 

are transmitted electronically using 

certified electronic health record (EHR) 

technology.

No

5. Active medication 

lists Percentage-based

More than 80 percent of all unique patients 

have at least one entry (or an indication 

that the patient is not currently prescribed 

any medication) recorded as structured 

data.

Yes

6. Medication allergy 

lists Percentage-based

More than 80 percent of all unique patients 

have at least one entry (or an indication 

that the patient has no known medication 

allergies) recorded as structured data.

Yes

7. Demographics Percentage-based

More than 50 percent of all unique patients 

have demographics recorded as structured 

data.

Yes

8. Vital signs Percentage-based

More than 50 percent of all unique patients 

age 2 and over have height, weight, and 

blood pressure recorded as structured 

data.

No

continued on next page
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

21

Table A-1: Professional Meaningful Use Measures (Continued)

Measure Criterion Type Measure Criterion

All-Patient 

Denominator 

Required 

Core Measures (continued)

9. Smoking status Percentage-based

More than 50 percent of all unique patients 

13 years old or older have smoking status 

recorded as structured data.

No

10. Ambulatory clinical 

quality measures 

(CQM)

Yes/no

The professional successfully reports 

ambulatory CQMs selected by the Centers 

for Medicare & Medicaid Services (CMS) 

in the manner specified by CMS.

N/A

11. Clinical decision 

support rule Yes/no The professional implements one clinical decision support rule. N/A

12. Electronic copy of 

health information Percentage-based

More than 50 percent of all patients who 

request an electronic copy of their health 

information are provided it within 

3 business days.

No

13. Clinical summaries Percentage-based

Clinical summaries are provided to 

patients for more than 50 percent of all 

office visits within 3 days.

No

14. Electronic 

exchange of 

clinical information

Yes/no

The professional performs at least one test 

of certified EHR technology's capacity to 

electronically exchange key clinical 

information.

N/A

15. Protection of

electronic health 

information

Yes/no

The professional conducts or reviews a 

security risk analysis in accordance with 

the requirements under 45 CFR 

164.308(a)(1), implements security 

updates as necessary, and corrects 

identified security deficiencies as part of its 

risk management process.

N/A

Menu Measures

1. Drug formulary 

checks Yes/no

The professional enables drug-formulary

check functionality and has access to at 

least one internal or external formulary for 

the entire EHR reporting period.

N/A

2. Clinical lab test 

results Percentage-based

More than 40 percent of all clinical lab test 

results ordered by the professional during

the EHR reporting period whose results 

are either in a positive/negative or 

numerical format are incorporated in 

certified EHR technology as structured 

data.

No

continued on next page
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

22

Table A-1: Professional Meaningful Use Measures (Continued)

All-Patient 

Measure Criterion Type Measure Criterion Denominator 

Required 

Menu Measures (continued)

3. Patient lists Yes/no

The professional generates at least one 

report listing patients with a specific 

condition.

N/A

4. Patient reminders Percentage-based

More than 20 percent of all patients 

65 years old or older or 5 years old or 

younger are sent an appropriate reminder 

during the EHR reporting period.

No

5. Patient 

access

electronic Percentage-based

At least 10 percent of all unique patients 

are provided timely (available to the 

patient within 4 business days of being 

updated in the certified EHR technology) 

electronic access to their health 

Yes

information subject to the professional’s 

discretion to withhold certain information.

6. Patient-specific 

education Percentage-based

More than 10 percent of all unique patients 

are provided patient-specific education Yes

resources resources.

7. Medication 

reconciliation Percentage-based

The professional performs medication 

reconciliation for more than 50 percent of 

transitions of care.

No

8. Transition of care 

summaries Percentage-based

The professional who transitions or refers 

a patient to another setting of care or 

provider of care provides a summary of 

care record for more than 50 percent of 

transitions of care and referrals.

No

9. Immunization 

registries data 

submission

Yes/no

The professional performs at least one test 

of certified EHR technology’s capacity to 

submit electronic data to immunization 

registries and a follow up submission if the 

test is successful.

N/A

10. Syndromic 

surveillance data 

submission

Yes/no

The professional performs at least one test 

of certified EHR technology's capacity to 

provide electronic syndromic surveillance 

data to public health agencies and a follow

up submission if the test is successful 

(unless none of the public health agencies 

to which a professional submits such 

information has the capacity to receive the 

information electronically).

N/A

Source: Office of Inspector General (OIG) analysis of Federal regulations, 2011.
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

23

Table A-2: Hospital Meaningful Use Measures

Measure Criterion Type Measure Criterion

All-Patient 

Denominator 

Required 

Core Measures

1. CPOE Percentage-based

More than 30 percent of all unique 

patients with at least one medication in 

their medication lists have at least one 

medication order entered using CPOE.

No

2. Drug interaction

checks Yes/no

The hospital enables drug-drug and 

drug-allergy check functionality for the 

entire EHR reporting period.

N/A

3. Problem lists Percentage-based

More than 80 percent of all unique 

patients have at least one entry (or an 

indication that no problems are known for 

the patient) recorded as structured data.

Yes

4. Active medication 

lists Percentage-based

More than 80 percent of all unique 

patients have at least one entry (or an 

indication that the patient is not currently 

prescribed any medication) recorded as 

structured data.

Yes

5. Medication allergy 

lists Percentage-based

More than 80 percent of all unique 

patients have at least one entry (or an 

indication that the patient has no known 

medication allergies) recorded as 

structured data.

Yes

6. Demographics Percentage-based

More than 50 percent of all unique 

patients have demographics recorded as 

structured data.

Yes

7. Vital signs Percentage-based

More than 50 percent of all unique 

patients age 2 and over have height, 

weight, and blood pressure recorded as 

structured data.

No

8. Smoking status Percentage-based

More than 50 percent of all unique 

patients 13 years old or older have 

smoking status recorded as structured 

data.

No

9. Hospital CQMs Yes/no

The hospital successfully reports hospital 

CQMs selected by CMS in the manner 

specified by CMS.

N/A

10. Clinical decision 

support rule Yes/no The hospital implements one clinical decision support rule. N/A

11. Electronic copy of 

health information Percentage-based

More than 50 percent of all patients who 

request an electronic copy of their health 

information are provided it within 

3 business days.

No

continued on next page
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

24

Table A-2: Hospital Meaningful Use Measures (Continued)

Measure Criterion Type Measure Criterion

All-Patient 

Denominator 

Required 

Core Measures (continued)

12. Electronic copy of 

discharge 

instructions

Percentage-based

More than 50 percent of all patients who 

are discharged from a hospital and who 

request an electronic copy of their 

discharge instructions are provided it.

No

13. Electronic exchange 

of clinical 

information

Yes/no

The hospital performs at least one test of 

certified EHR technology's capacity to 

electronically exchange key clinical 

information.

N/A

14. Protection of

electronic health 

information

Yes/no

The hospital conducts or reviews a 

security risk analysis in accordance with 

the requirements under 45 CFR 

164.308(a)(1), implements security 

updates as necessary, and corrects 

identified security deficiencies as part of 

its risk management process.

N/A

Menu Measures

1. Drug formulary 

checks Yes/no

The hospital enables drug-formulary

check functionality and has access to at 

least one internal or external formulary for 

the entire EHR reporting period.

N/A

2. Advance directives Percentage-based

More than 50 percent of all unique 

patients 65 years old or older have an 

indication of an advance directive status 

recorded as structured data.

No

3. Clinical lab test 

results Percentage-based

More than 40 percent of all clinical lab test 

results ordered by the hospital during the 

EHR reporting period whose results are 

either in a positive/negative or numerical 

format are incorporated in certified EHR 

technology as structured data.

No

4. Patient lists Yes/no

The hospital generates at least one report 

listing patients of the hospital with a 

specific condition.

N/A

5. Patient-specific 

education resources Percentage-based

More than 10 percent of all unique 

patients are provided patient-specific 

education resources.

Yes

6. Medication 

reconciliation Percentage-based

The hospital performs medication 

reconciliation for more than 50 percent of 

transitions of care.

No

continued on next page
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

25

Table A-2: Hospital Meaningful Use Measures (Continued)

Measure Criterion Type Measure Criterion

All-Patient 

Denominator 

Required 

Menu Measures (continued)

7. Transition of care 

summaries Percentage-based

The hospital that transitions or refers its

patient to another setting of care or 

provider of care provides a summary of 

care record for more than 50 percent of 

transitions of care and referrals.

No

8. Immunization 

registries data 

submission

Yes/no

The hospital performs at least one test of 

certified EHR technology’s capacity to 

submit electronic data to immunization 

registries and a follow up submission if the 

test is successful.

N/A

9. Reportable lab 

results to public 

health agencies

Yes/no

The hospital performs at least one test of 

certified EHR technology’s capacity to 

provide electronic submission of 

reportable lab results to public health 

agencies and a follow up submission if the 

test is successful.

N/A

10. Syndromic 

surveillance data 

submission

Yes/no

The hospital performs at least one test of 

certified EHR technology’s capacity to 

provide electronic syndromic surveillance 

data to public health agencies and a 

follow up submission if the test is 

successful.

N/A

Source: OIG analysis of Federal regulations, 2011.
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

26

APPENDIX B

Centers for Medicare & Medicaid Services’ Assessment of Data Sources To 

Verify the Accuracy of Self-Reported Meaningful Use Information, by 

Measure

Table B-1: Professional Meaningful Use Measure Data Sources

Measure Type of Data Source

Core Measures

1. Computerized provider order entry (CPOE) Internal data source 

2. Drug interaction checks No data source

3. Problem lists Internal data source 

4. Electronic prescribing (e-prescribing)

Internal data source 

External data source: privately held e-prescribing data

5. Active medication lists Internal data source 

6. Medication allergy lists No data source

7. Demographics Internal data source 

8. Vital signs Internal data source 

9. Smoking status Internal data source 

10. Ambulatory clinical quality measures 

(CQM) Internal data source 

11. Clinical decision support rule No data source

12. Electronic copy of health information No data source

13. Clinical summaries Internal data source 

continued on next page
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

27

Table B-1: Professional Meaningful Use Measure Data Sources (Continued)

Measure Type of Data Source

Core Measures (continued)

14. Electronic exchange of clinical information No data source

15. Protection of electronic health information No data source

Menu Measures

1. Drug formulary checks Internal data source 

2. Clinical lab test results Internal data source 

3. Patient lists No data source

4. Patient reminders No data source

5. Patient electronic access Internal data source 

6. Patient-specific education resources Internal data source 

7. Medication reconciliation No data source

8. Transition of care summaries No data source

9. Immunization registries data submission External data source: public health agency 

10. Syndromic surveillance data submission External data source: public health agency 

Source: Office of Inspector General (OIG) analysis of CMS documents and interview data, 2012.
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

28

Table B-2: Hospital Meaningful Use Measure Data Sources

Measure Type of Data Source

Core Measures

1. CPOE Internal data source 

2. Drug interaction checks No data source

3. Problem lists Internal data source 

4. Active medication lists Internal data source 

5. Medication allergy lists Internal data source 

6. Demographics Internal data source 

7. Vital signs Internal data source 

8. Smoking status Internal data source 

9. Hospital CQMs No data source

10. Clinical decision support rule No data source

11. Electronic copy of health information No data source

12. Electronic copy of discharge instructions No data source

13. Electronic exchange of clinical information No data source

14. Protection of electronic health information No data source

Menu Measures

1. Drug formulary checks No data source

2. Advance directives Internal data source 

3. Clinical lab test results Internal data source 

continued on next page
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

29

Table B-2: Hospital Meaningful Use Measure Data Sources (Continued)

Measure Type of Data Source

Menu Measures (continued)

4. Patient lists No data source

5. Patient-specific education resources Internal data source 

6. Medication reconciliation Internal data source 

7. Transition of care summaries Internal data source 

8. Immunization registries data submission External data source: public health agency 

9. Reportable lab results to public health 

agencies External data source: public health agency 

10. Syndromic surveillance data submission External data source: public health agency 

Source: OIG analysis of CMS documents and interview data, 2012.
APPENDIXC 

Agencies' Comments 

,.'fP."'IC..., 

{ DEPARTMENT OF HEALlH & HUMAN SERVICES Centers for Medicare & Medicaid Services 

'~~ Administrator 

Washington, DC 20201 

OCT 09. 2tili 

TO: 	 Daniel R. Levinson 

klspector..Qeneral 

FROM: 	 Mlrl\yrr'flt91l00er 

Acting Atminlftrator 

SUBJECT: 	 Office ofInspector General (OIG) Draft Report- Early Assessment Finds That 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program, 

OEI-05-11-00250 

Thank you for the opportunity to review and comment on the OIG draft report "Early 

Assessment Finds That CMS Faces Obstacles in Overseeing the Medicare EHR Incentive 

Program" (OEI-05-11-00250). The Centers for Medicare & Medicaid Services (CMS) 

appreciates the contributions and valuable input by the OIG. The draft report assessed CMS's 

oversight ofthe Medicare Electronic Health Record (EHR) Incentive programs. The information 

in the report will help inform our administration ofthe Medicare and Medicaid EHR Incentive 

Programs. 

The CMS continues to work with the Office ofNational Coordinator for Health Information 

Technology (ONC) to maximize the success of the Medicare and Medicaid EHR Incentive 

Programs and the related Health Information Technology for Economic and Clinical Health 

(HITECH) Act provisions. The draft report contained four recommendations: two for CMS and 

two for ONC. We are addressing the CMS recommendations in this response. 

OIG Recommendation 

The CMS obtain and review supporting documentation from selected professionals and hospitals 

prior to payment to verify the accuracy of their self-reported information. 

CMS Response 

The CMS does not believe prepayment audit is necessary at this juncture. CMS has 

implemented a number ofprepayment verification edits to ensure that providers are eligible to 

participate in the Medicare EHR Incentive Program. In addition, CMS validates all of the EHR 

certification numbers that are provided by providers. The EHR incentive program is an 

attestation-based program and our systems have been designed to accommodate this process. It 

would be particularly difficult to implement for providers after their firSt year of participation 

because the reporting period is an entire year and all attestations are received in a two-month 

period during which CMS would have to review supporting documentation. To change this 

process and implement pre-payment audits could significantly delay payments to providers. 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11 -00250) 30 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

31
DEPARTMENT OF HEALTH & HUMAN SERVICES 	 Office of the Secretary 

Office ofthe Natiooal Coordinator 

fur Health lnfonnalion Technology 

Washington, D.C. 20201 

DATE: September 25, 2012 

TO: 	 Daniel R. Levinson 

Inspector General 

FROM: 	Farzad Mostashari 

National Coordinator 

SUB.JECT: The Office of the National Coordinator for Health Information Technology's 

Comments to the Office of Inspector General's Draft Report, Early Asse.'iSment Finds That CMS 

Faces Obstacles in Over!feeing the Medicare EHR Incentive Program, OEI-05-11-00250 

Thank you for the opportunity to review and comment on the findings and recommendations in the Office 

ofinspector General's (O!G) Draft Report, Early Assessment Finds That CMR Faces Obstacles in 

Overseeing the Medicare EHR Incentive Program, OEI-OS-11-00250. The draft report includes 

recommendations for the Office ofthe National Coordinator for Health Information Technology (ONC) 

to enhance reports produced by EHRs to strengthen program oversight of the Medicare EHR incentive 

program. ONC concurs and has already taken steps to address both recommendations. ONC appreciates 

the OIG's efforts to improve program integrity. We will continue to collaborate with the Centers for 

Medicare and Medicaid (CMS) to strengthen the Medicare and Medicaid EHR Incentive Programs and 

the related Health Information Technology for Economic and Clinical Health (HITECH) Act provisions. 

OIG Recommendation 

ONC Require Certified EHR Technology to Be Capable ofProducing Reports for Yes/No Meaningful 

Use Measures, Where Possible 

ONC Response 

ONC concurs with this recommendation and appreciates that the OIG recognizes the difficulty with 

requiring EHR technology to produce a "yes/no" report for some measures that include information not 

contained in the certified EHR technology (e.g., that a security risk assessment Wll$ conducted). As 

stated in the 20 !4 Edition Standards and Certification Criteria Final Rule, we will request ONC's two 

Federal advisory committees, the HIT Policy Committee and HIT Standards Committee, to provide 

recommendations on the appropriate scope and feasibility of a certification criterion focused on "yes/no" 

reports for meaningful usc measure. Once we get their recommendations, we will determine appropriate 

certification criterion in future rulemaking. 

OIG Recommendation 

ONC Improve the Certification Process for EHR Technology to Ensure Accurate EHR Reports 

ONC Response 

ONC concurs with OIG's recommendation and has already taken steps to address this recommendation. 

In response to the HITECH Act, ONC rapidly established the Temporary Certification Program to ensure 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 32 
 

CMS Faces Obstacles in Overseeing the Medicare EHR Incentive Program (OEI-05-11-00250) 

 

33
 

Early Review of CMS Oversight of the Medicare EHR Incentive Program (OEI-05-11-00250) 34 

ACKNOWLEDGMENTS 

This report was prepared under the direction of Ann Maxwell, Regional 

Inspector General for Evaluation and Inspections in the Chicago regional 

office, and Tom Komaniecki and Laura Kordish, Deputy Regional 

Inspectors General. 

Kelly Waldhoff served as the team leader for this study. Other principal 

Office of Evaluation and Inspections staff from the Chicago regional 

office who contributed to the report include Adam Freeman and Brian 

Jordan; central office staff who contributed include Debra Roush, Kevin 

Manley, and Tasha Trusty. 
 

 

Office of Inspector General

http://oig.hhs.gov

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of beneficiaries served by those 

programs. This statutory mission is carried out through a nationwide network of audits, 

investigations, and inspections conducted by the following operating components:

Office of Audit Services

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS.

Office of Evaluation and Inspections

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and beneficiaries. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties.

Office of Counsel to the Inspector General

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.