Although the Medicare and Medicaid EHR programs are generally similar, there are some differences related to the types of providers that are permitted to participate, the duration and amount of incentive payments and penalties, and information providers must submit to satisfy the programs’ requirements. The types of providers eligible to participate in the Medicare and Medicaid EHR programs—referred to as permissible providers—differ. See figure 1 below. Beginning in 2011, the first year of the Medicare and Medicaid EHR programs, the programs have provided incentive payments to eligible providers that met program requirements. Beginning in 2015, the Medicare EHR program is generally required to begin applying a penalty for hospitals and professionals that do not meet the Medicare EHR program requirements. Figure 2 below provides information on the years that incentive payments are available and that penalties, if applicable, will be assessed for professionals and hospitals under the Medicare and Medicaid EHR programs. The amount of incentive payment varies depending on the type of provider (professionals or hospitals) and the program in which the provider participates (Medicare EHR program or Medicaid EHR program). For example, in the Medicare EHR program, professionals cannot earn more than $18,000 in incentive payments in their first year, and, over a 5-year period, payments cannot exceed a total of $44,000. In contrast, in the Medicaid EHR program, professionals cannot earn more than $21,250 in incentive payments in the first year and $8,500 during each of 5 subsequent years for a total of $63,750. (See app. II for more information on the amounts of incentive payments available under both programs and how the amounts are calculated.) To receive incentive payments from either the Medicare or Medicaid EHR To programs, providers must meet eligibility and reporting requirements.do so, providers report certain information to CMS, the states, or to both—a process referred to as “attestation”—by entering certain information into CMS’s or the states’ EHR program web-based attestation tools. Providers that, based on information submitted to CMS and the states, meet the requirements receive incentive payments. Some of the eligibility and reporting requirements for the Medicare EHR program differ from those in the Medicaid EHR program. To receive Medicare EHR incentive payments in 2011, professionals had to meet three eligibility and three reporting requirements, while hospitals had to meet two eligibility and two reporting requirements. (See table 1.) One noteworthy reporting requirement for 2011 was that providers were required to demonstrate meaningful use of certified EHR technology by collecting and reporting information to CMS on various measures established by CMS. Specifically, in 2011, professionals had to report on a total of 20 meaningful use measures, and hospitals had to report on a total of 19 meaningful use measures. This information had to be collected over 90 consecutive days during 2011. Professionals. Of the 20 meaningful use measures for professionals, 15 are mandatory. Of those 15 mandatory measures, 6 measures allow professionals to claim exemptions—that is, they may report to CMS that those measures are not relevant to their patient populations or clinical practices. measures—“report clinical quality measures to CMS”—requires professionals to report on at least 6 clinical quality measures identified by CMS. Professionals have the flexibility to choose the remaining 5 meaningful use measures from a menu of 10 measures. One of the mandatory meaningful use Hospitals. Of the 19 meaningful use measures hospitals must report, 14 are mandatory. Of those 14 mandatory measures, 3 measures allow hospitals to claim exemptions. Similar to professionals, to satisfy the mandatory meaningful use measure “report clinical quality measures to CMS,” hospitals must report on 15 clinical quality measures identified by CMS. Hospitals have the flexibility to choose the remaining 5 meaningful use measures from a menu of 10 measures. See appendix III for a listing of the meaningful use measures and clinical quality measures for 2011. In order to meet the definition of meaningful use, eligible professionals and hospitals must report on measures specified by CMS. An exclusion for a nonapplicable measure is permitted if the provider meets certain requirements specified in the regulation. 42 C.F.R. § 495.6. In this report we use the term “exemption” to refer to the exclusion of a nonapplicable measure. To receive Medicaid EHR incentive payments during 2011, professionals had to meet seven eligibility requirements, hospitals had to meet six eligibility requirements, and both hospitals and professionals had to meet one reporting requirement. (See table 2.) Compared to the Medicare EHR program, the Medicaid EHR program requirements had two noteworthy differences in 2011. Providers had to meet a patient volume requirement. This requirement was established to ensure that providers that receive incentive payments from the Medicaid EHR program serve a minimum volume of Medicaid patients, or, for certain professionals, a minimum volume of needy patients. Specifically, professionals must have a Medicaid patient volume of at least 30 percent unless they are pediatricians or practice predominantly in a federally qualified health center or rural health center; hospitals generally must have a Medicaid patient volume of at least 10 percent. Providers only had to adopt, implement, or upgrade to a certified EHR system in 2011 and did not have to demonstrate meaningful use during the first year they participate in the Medicaid EHR program. However, in subsequent years, they must demonstrate meaningful use. individual or group primary care practices with 10 or fewer professionals; public, rural, and critical access hospitals; community health centers and rural health clinics; collaborative networks of small practices; and other settings that predominantly serve medically underserved populations, as defined by each Regional Extension Center. ONC also provides funding for Regional Extension Centers to provide assistance to certain hospitals—critical access and rural hospitals—to ensure that centers’ services are available in those settings. ONC’s overall goal for the Regional Extension Center program is to help 100,000 professionals meet the EHR programs’ requirements for meaningful use by 2014 and to help a total of 1,777 critical access and rural hospitals meet the EHR programs’ requirements for meaningful use by 2014. In its agreement with ONC, each Regional Extension Center established its own goal for the number of providers it would assist to help the program meet its overall goal. CMS and the four states we reviewed are implementing processes to verify whether providers met the Medicare or Medicaid EHR programs’ eligibility and reporting requirements and, therefore, qualified to receive incentive payments in the programs’ first year. Although CMS is taking some steps to improve the processes CMS and states use to verify whether providers have met Medicare and Medicaid EHR program requirements, we found that CMS has additional opportunities to assess and improve these processes. For the first program year, CMS is implementing a combination of pre- and postpayment processes to verify whether providers have met all of the Medicare EHR program eligibility and reporting requirements. In addition, the four states we reviewed have implemented or plan to implement a combination of pre- and postpayment processes to verify whether providers have met Medicaid EHR program eligibility and reporting requirements. CMS has developed and begun to implement processes to verify whether providers participating in the Medicare EHR program have met all of the program’s eligibility and reporting requirements and thereby qualify to receive incentive payments. In 2011, CMS implemented prepayment processes to verify whether providers have met all three of the Medicare EHR program’s eligibility requirements. These processes consist of automatic checks that are built into CMS’s databases to verify the information submitted by providers when they register for the program. CMS also implemented a process to verify, on a prepayment basis, whether providers have met one of the Medicare EHR program’s reporting requirements—to use a certified EHR system. Specifically, CMS built an automatic check to compare the EHR certification numbers for the systems providers reported using during attestation against a list of EHR systems that have been certified by ONC. In 2012, according to CMS officials, the agency plans to implement additional processes to verify, on a postpayment basis, whether a sample of providers has met all three of the Medicare EHR program’s reporting requirements. To conduct these verifications, CMS has developed a risk- based approach that will be used to identify a sample of about 10 percent of professionals and 5 percent of hospitals for audits. planned audit strategy, the agency may request that providers selected for postpayment audits submit documentation, such as patient rosters, EHR screenshots, and reports generated by the EHR system to support data the providers reported to CMS during attestation. If CMS determines during the audits that a provider has failed to meet any one of the reporting requirements, it plans to take steps to recoup incentive payments. CMS officials said that they decided to wait until 2012 to begin conducting audits of providers that received incentive payments in 2011, the first payment year, to ensure that the agency does not unfairly target a disproportionate number of early participants in the Medicare EHR program. For an overview of CMS’s processes to verify whether providers met the Medicare EHR program’s eligibility and reporting requirements, see table 3. In addition, according to CMS officials, the agency plans to conduct a separate audit, beginning in 2012, to verify that providers had the certified EHR systems they attested to using. For these audits, CMS anticipates sampling roughly 20 percent of professionals and 10 percent of hospitals, identified through random sampling as well as some targeted selection. Three of the states we reviewed—Iowa, Kentucky, and Pennsylvania— have implemented processes to verify whether providers have met all the Medicaid EHR program’s eligibility and reporting requirements and thereby qualify to receive incentive payments. The fourth state, Texas, has implemented processes to verify whether providers met most of the program’s eligibility and reporting requirements and is in the process of developing additional verification processes as part of its postpayment audit strategy. Because CMS allows states flexibility in determining how they verify compliance with these requirements, the states vary in terms of whether they use prepayment or postpayment verification processes. In order to verify whether providers have met the Medicaid EHR program’s eligibility requirements, all four states have primarily implemented prepayment processes, some of which are automated checks built into their databases. Iowa, Kentucky, and Pennsylvania also conduct postpayment audits of samples of providers to verify whether they have met requirements that were not checked on a prepayment basis. These states identify samples of providers to be audited using various risk-based approaches. Texas intends to conduct postpayment audits as well, but has not finalized its audit strategy. Three states—Iowa, Kentucky, and Pennsylvania—use a combination of pre- and postpayment processes to verify whether providers have met the eligibility requirement regarding the Medicaid patient volume threshold, which is determined by dividing a professional’s number of Medicaid patient visits by their total number of patient visits. For example, they use Medicaid claims data to verify, on a prepayment basis, the professionals’ number of Medicaid patient visits over the reporting period. Then, on a postpayment basis for a sample of professionals, the states use documentation submitted by professionals, such as patient billing reports, to verify their total number of patient visits. Most states, including these three, must rely on provider self-reported information to verify compliance with this requirement, because states typically do not collect data on some of the professionals’ patient visits, such as visits paid for by private insurance. To verify whether providers have met the Medicaid EHR program’s reporting requirement to adopt, implement, or upgrade to a certified EHR system, the four states we reviewed use prepayment processes, postpayment processes, or both. The four states we reviewed have implemented processes, on a prepayment basis, that check the EHR certification numbers reported by providers against a list of EHR systems that have been certified by ONC.steps to verify, on a prepayment basis, compliance with this requirement by reviewing documentation, such as EHR invoices. Iowa and Pennsylvania include a similar verification process as part of their postpayment audits. Texas has not yet determined whether it will conduct additional postpayment verifications. For an overview of the four selected states’ processes to verify whether providers met the Medicaid EHR program’s eligibility and reporting requirements, see table 4. Most providers participating in the first year of the Medicare EHR program through December 8, 2011, exercised program flexibility to exempt themselves from reporting on at least one mandatory meaningful use measure. In addition, many providers also reported at least one clinical quality measure based on few patients. During the first year of the Medicare EHR program through December 8, 2011, most participating providers exercised flexibility allowed under the program to claim an exemption from reporting at least one mandatory meaningful use measure. Specifically, 72.4 percent of professionals and 79.6 percent of hospitals claimed such an exemption. Providers may exempt themselves from reporting certain mandatory meaningful use measures—up to six measures for professionals and up to three measures for hospitals—if they report to CMS that those measures are not relevant to their patient populations or clinical practices. We found that a greater percentage of some professionals reported at least one exemption than other professionals. Specifically, we found that a greater percentage of chiropractors, dentists, optometrists, specialists, and other eligible physicians reported at least one exemption compared to generalists; and a greater percentage of professionals with 2010 Medicare Part B charges at or below the 75th percentile reported at least one exemption compared to those with charges above the 75th percentile. We also found that among specialists, the largest specialty group of participating professionals, over three-quarters claimed at least one exemption. (See table 5.) We found that a greater percentage of some hospitals reported at least one exemption than other hospitals. Specifically, we found that a greater percentage of critical access hospitals reported at least one exemption compared to acute care hospitals, and a greater percentage of hospitals with less than 200 beds reported at least one exemption compared to hospitals with 200 beds or more. We also found that among acute care hospitals, the largest type of participating hospital, slightly over three-quarters claimed at least one exemption. (See table 6.) Of the mandatory meaningful use measures for which providers may claim exemptions, we found that the majority of providers claimed an exemption from the mandatory measure “provide patients with an electronic copy of their health information.” Providers may claim an exemption from this measure if they receive no requests from patients for an electronic copy of their health information. This measure was the least frequently reported mandatory measure for both professionals (32.7 percent) and hospitals (30.3 percent). In contrast, the most frequently reported mandatory measure for which exemptions were permitted was “record smoking status for patients 13 years old or older” for both professionals (99.4 percent) and hospitals (99.5 percent). Our finding that a majority of providers claimed exemptions from reporting at least one mandatory meaningful use measure is consistent with comments made by stakeholders in response to CMS’s Rule on the Electronic Health Record Incentive Program. Specifically, those stakeholders stated that certain providers, including specialists and small hospitals, would not be able to report all mandatory meaningful use measures, since some measures would be outside the scope of their practice. While CMS currently allows providers the flexibility to claim exemptions from reporting certain mandatory meaningful use measures, in future years of the EHR programs, CMS stated that it may not allow providers the same flexibility. It is unclear what effect, if any, such a change would have on participation levels in future program years. Our analysis of clinical quality measures found that many providers reported at least one such measure based on few patients—less than seven—during the first year of the Medicare EHR program through December 8, 2011. Providers were required to report these measures to satisfy one of the mandatory meaningful use measures—”report clinical quality measures to CMS.” Specifically, 41.3 percent of professionals and 86.9 percent of hospitals reported at least one clinical quality measure based on few patients. Clinical quality measures calculated using few patients may be statistically unreliable, which, according to the American Hospital Association and others, could detract from providers’ abilities to use those measures as meaningful tools for quality improvement. We found that a greater percentage of some professionals reported measures based on few patients than other professionals. Specifically, we found that a greater percentage of chiropractors, dentists, optometrists, specialists, podiatrists, and other eligible professionals reported at least one clinical quality measure that was calculated using few patients compared to generalists; a greater percentage of professionals practicing in urban locations reported at least one clinical quality measure that was calculated using few patients compared to those practicing in rural locations; and a greater percentage of professionals with 2010 Medicare Part B charges at or below the 50th percentile or above the 75th percentile reported at least one clinical quality measure that was calculated using few patients compared to those with charges above the 50th percentile, but at or below the 75th percentile. We also found that about half of specialists, the largest specialty group of participating professionals, reported at least one clinical quality measure based on few patients. (See table 7.) We found that a greater percentage of some hospitals reported measures based on few patients than other hospitals. Specifically, we found that a greater percentage of critical access hospitals reported at least one clinical quality measure that was calculated using few patients compared to acute care hospitals, a greater percentage of government-owned and proprietary hospitals reported at least one clinical quality measure that was calculated using few patients compared to nonprofit hospitals, a greater percentage of hospitals with less than 200 beds reported at least one clinical quality measure that was calculated using few patients compared to hospitals with 200 beds or more, and a greater percentage of hospitals located in rural areas reported at least one clinical quality measure that was calculated using few patients compared to hospitals located in urban areas. We also found that among acute care hospitals, the largest type of participating hospital, more than 80 percent reported at least one clinical quality measure based on few patients. (See table 8.) The American Medical Association and others stated that some providers may experience challenges selecting clinical quality measures to report. CMS has acknowledged that the availability of clinical quality measures that are relevant to providers’ patient populations and clinical practices is important to inform providers’ efforts to improve quality of care and to measure potential impacts of the EHR programs. In an effort to increase the availability of such measures, officials from the Health Information Technology Policy Committee and the Health Information Technology Standards Committee, which advise ONC on the development of meaningful use reporting requirements, noted that additional clinical quality measures may be added to the EHR programs over time. This action would help to ensure that there are a sufficient number of measures that providers can report on. Providers identified challenges to participating in the first year of the Medicare and Medicaid EHR programs and strategies used to help providers participate. Numerous professionals and hospitals have signed agreements with Regional Extension Centers for technical assistance, which includes services to facilitate providers’ participation in the Medicare and Medicaid EHR programs. Acquiring and implementing a certified EHR system are among the first challenges providers face as they take steps to qualify for a Medicare or Medicaid EHR incentive payment. Challenges to acquiring EHR systems described by providers and officials from the American Medical Association and American Hospital Association we interviewed included the following: the cost of purchasing or upgrading to a certified EHR system; obtaining sufficient broadband access, which can affect providers’ abilities to exchange health information; and obtaining buy-in from professionals. Challenges to implementing EHR systems described by providers we interviewed included needing to train staff on how to use the EHR systems and getting professionals to use the systems. Officials we interviewed from hospitals described strategies providers used to overcome some of the challenges related to acquiring and implementing EHR systems. For example, one hospital official stated that, in order to implement a certified EHR system, hospital officials designated “super users” as a strategy to help their professionals transition to the EHR system. For instance, one hospital appointed a nurse as a “super user” who assisted others in learning how to use the EHR system. Additionally, the chief information officer of another hospital stated her organization obtained buy-in from professionals and encouraged them to use the system by presenting the EHR system as a way to improve patient safety and quality of care rather than as only an information technology project. Once a certified EHR system is acquired and implemented, ensuring the system is effectively used to meet the Medicare meaningful use reporting requirements can also be challenging for some providers. Specifically, providers and others we interviewed identified challenges related to capturing data needed to demonstrate meaningful use, such as lacking a workflow that allowed the needed data to be collected electronically at the right time by the right staff member. Providers we interviewed noted several strategies they used to capture data in ways which helped them demonstrate meaningful use, including the following: understanding which fields of the EHR system must be completed and collecting additional data, as necessary; revising forms, retraining staff so they knew how to complete the forms, and conducting quality assurance training to ensure that the appropriate data were being captured consistently; and analyzing workflow, including understanding which staff members are to enter information into the EHR system and when data entry must occur. One provider we interviewed elaborated on the strategy she used to change the workflow in her practice so that she could satisfy the meaningful use measure—”provide patients with clinical summaries for each office visit.” She decided that to meet this meaningful use measure she would provide the clinical summary to her patients before they left her office. To do so, she changed her workflow by spending an additional 45 minutes each morning preparing parts of her patient notes in advance of the patient visit and by scheduling additional time in between patient visits in order to complete the clinical summaries. As of December 2011, about 115,000 professionals and about 1,000 hospitals have signed agreements to receive technical assistance from one of the 62 Regional Extension Centers. This assistance includes services to facilitate providers’ participation in the Medicare and Medicaid EHR programs. Of these professionals, 54,241 had implemented an EHR system, of which 4,072 had demonstrated meaningful use. The professionals assisted by the Regional Extension Center program work in targeted settings, such as individual primary care practices or rural health clinics. See figure 4, which illustrates the practice settings of professionals who have agreements with the Regional Extension Centers. In addition, 1,001 rural hospitals and critical access hospitals have signed agreements with a Regional Extension Center for technical assistance, through December 19, 2011. Of these hospitals, 243 had implemented an EHR system and of those, 41 had demonstrated meaningful use. For more information on each Regional Extension Center’s progress in assisting providers to demonstrate meaningful use, see appendix IV. Regional Extension Centers offer various services to providers with whom they have agreements to facilitate the providers’ participation in the EHR programs by helping them meaningfully use EHR systems. Providers trying to demonstrate meaningful use generally follow a four-step process, throughout which Regional Extension Centers may provide assistance to providers. These steps are: (1) prepare to participate in the CMS EHR programs, (2) select a certified EHR system, (3) implement the selected EHR system, and (4) demonstrate meaningful use. Examples of the services offered by the Regional Extension Centers during each of these steps are described in figure 5. During the first step, Regional Extension Center officials can help providers prepare to participate in the EHR programs by explaining those programs’ requirements and helping providers identify how their workflow and processes may change with the introduction of an EHR system. For example, officials from one Regional Extension Center told us they helped providers determine whether they would qualify for the Medicare or Medicaid EHR programs. During the second step, the Regional Extension Centers can help providers select a certified EHR system. For example, officials from one Regional Extension Center told us they shared a vendor evaluation tool with providers, which helped providers evaluate factors such as EHR systems’ capabilities and cost. During the third step, Regional Extension Center officials can help providers implement an EHR system by, for example, suggesting best practices for securing and protecting the privacy of personal health information stored and processed by the EHR system. During the fourth step, the Regional Extension Centers provide services that help providers to meet the EHR programs’ meaningful use criteria. For example, the Regional Extension Centers may help their clients identify approaches for satisfying certain program reporting requirements by helping providers capture and exchange health data. The aim of the Medicare and Medicaid EHR programs is not just to increase EHR adoption, but to support the meaningful use of EHR technology to improve quality and reduce the cost of care. As a result, the programs have the potential to affect the millions of people who receive care through Medicare or Medicaid. Since the programs began in 2011, CMS has issued $3.1 billion in incentive payments to providers. As a new program with particular complexities—such as the number and types of measures providers must report—there are risks to program integrity, and CMS could take steps, beyond those already taken, to assess and mitigate the risk of improper payments and to improve program efficiency. It is encouraging that CMS has awarded contracts to evaluate states’ implementation of the Medicaid EHR program, including their efforts to prevent improper payments. However, CMS, while planning to assess its audit strategy for the Medicare EHR program, has not yet specified time frames for implementing this assessment. As CMS moves forward, it is important that the agency assess whether verifying additional reporting requirements on a prepayment basis could improve the integrity of the Medicare EHR program. Conducting prepayment verifications may be more effective in minimizing improper payments because CMS’s planned postpayment audits will be conducted for only a small sample of providers, whereas CMS’s prepayment verification processes are conducted for all providers that apply for incentive payments. In addition, prepayment verifications help to avoid the difficulties associated with the “pay and chase” aspects of recovering improper payments. We identified two opportunities for CMS to improve the efficiencies of the Medicare and Medicaid EHR programs. First, CMS identified and took action to improve the efficiency of audits under the Medicaid EHR program but did not take a similar action in the Medicare EHR program. Specifically, although CMS suggested that states collect additional information from providers at the time of attestation to improve the efficiency of the postpayment audit process, CMS has not done so for the Medicare EHR program, but acknowledged that this action would be beneficial. Doing so would improve the efficiency of the postpayment audit process for the Medicare EHR program. Second, CMS could offer states the option of having CMS collect Medicaid providers’ meaningful use attestations on their behalf rather than requiring states to collect this information on their own. CMS, by offering to collect this information from all Medicaid providers on behalf of states, as the agency currently does for some Medicaid providers, could alleviate the need for many states to create and maintain similar web-based attestation tools and could potentially yield cost savings at both the federal and state levels. In order to improve the efficiency and effectiveness of processes to verify whether providers meet program requirements for the Medicare and Medicaid EHR programs, we recommend that the Administrator of CMS take the following four actions: Establish time frames for expeditiously implementing an evaluation of the effectiveness of the agency’s audit strategy for the Medicare EHR program. Evaluate the extent to which the agency should conduct more verifications on a prepayment basis when determining whether providers meet Medicare EHR program’s reporting requirements. Collect the additional information from Medicare providers during attestation that CMS suggested states collect from Medicaid providers during attestation. Offer states the option of having CMS collect meaningful use attestations from Medicaid providers on their behalf. We provided a draft of this report to HHS for comment. In its written comments (reproduced in app. V), HHS concurred with three of our recommendations to CMS. Specifically, we are encouraged that HHS said that to help implement these recommendations, CMS will evaluate the effectiveness of the audit strategy for the Medicare EHR program on an ongoing basis and document results quarterly, beginning approximately 3 months after the audits begin. In addition, CMS will evaluate the feasibility of conducting additional prepayment verifications under the Medicare EHR program. Further, CMS will explore collecting additional information from Medicare providers during attestation that CMS has suggested that states collect under the Medicaid EHR program. HHS disagreed with our fourth recommendation that CMS offer to collect meaningful use attestations data from Medicaid providers on behalf of the states, citing two reasons. First, HHS does not believe there are significant barriers to states implementing attestation tools. It stated that the 43 states participating in the Medicaid EHR program have established a means for providers to attest to eligibility requirements and the adoption, implementation, or upgrade of their EHR. In HHS’s view, incorporating the meaningful use attestations tools into the states’ existing systems does not pose a barrier in part because HHS says CMS has taken steps to help the states design their attestation tools and has approved designs developed by vendors that the states can use. Second, HHS does not believe that implementing this recommendation would create a streamlined attestation process for Medicaid providers. It states that Medicaid providers would have to provide certain information to CMS and other information to the states, requiring providers to submit data to multiple sites. HHS believes this change could result in confusion and payment delays. In addition, HHS believes a more compelling challenge is designing a way for providers to report clinical quality measures electronically from their EHRs to the states and CMS. HHS stated that CMS established pilots that are intended to help providers leverage existing infrastructure to electronically exchange data on clinical quality measures directly from their EHRs to CMS. Despite HHS’s objections, we continue to believe that our recommendation should be implemented. In response to HHS’s first reason, we believe that while some states have created tools to collect Medicaid attestation data, over the long run implementing our recommendation could improve the efficiency of the Medicaid EHR program and thereby minimize additional administrative costs, especially in the program’s future years. Currently, both CMS and states create and maintain meaningful use attestation tools. The Medicaid EHR program requirements in the second year of the program and through the rest of the decade will become increasingly similar to the requirements for the Medicare EHR program as will the information collected from providers by the states and CMS. Having both CMS and states design and maintain systems to collect much of the same information is inefficient. Further, it is expected that in future years, to demonstrate meaningful use, Medicare and Medicaid providers will be required to report additional information, and both CMS and the states will need to expend resources to update the attestation tools used to collect this information, a point we clarified in our report. By collecting meaningful use attestations on behalf of some states and U.S. insular areas, CMS could help ensure effective use of the $300 million that Congress provided for administrative costs of the Medicaid EHR program from 2009-2016. In response to HHS’s second reason, the report notes that under the current process for registering for the Medicaid EHR program, providers must already submit information on eligibility to both CMS and the states. Therefore, providers are familiar with submitting information to multiple sites. Furthermore, CMS currently collects meaningful use attestations for some Medicaid providers and has not reported that the transfer of this information to the states has delayed payments. We agree with CMS that designing a means to electronically transmit meaningful use information, including clinical quality measures, directly from providers’ EHRs to CMS and the states may present challenges. It is encouraging that the agency is attentive to electronic data exchange issues and is working with providers in the Medicare program to identify ways to leverage existing infrastructure to accomplish this goal. However, it is important for CMS to consider all approaches, including collecting meaningful use data on behalf of states, to ensure the Medicare and Medicaid EHR programs are administered as efficiently as possible. As part of HHS’s written response, the department also provided other general comments, which we incorporated as appropriate. We are sending copies of this report to the Secretary of Health and Human Services, the Administrator of CMS, the National Coordinator for Health Information Technology, and other interested parties. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at kohnl@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. Other major contributors to this report are listed in appendix V. This appendix provides additional details regarding our analysis of (1) measures providers reported to the Centers for Medicare and Medicaid Services (CMS) to demonstrate meaningful use and (2) Regional Extension Center data. Analysis of measures providers reported to CMS to demonstrate meaningful use. We conducted several analyses of data from CMS’s National Level Repository that providers reported to CMS to demonstrate meaningful use under the Medicare electronic health records (EHR) program in 2011. We analyzed data submitted by providers from April 18, 2011, the date CMS began collecting these data, through December 8, 2011.information because they were required to report these data by November 30, 2011, to receive a Medicare EHR incentive payment for 2011. In contrast, the data we analyzed for professionals did not include full-year information because CMS permitted them to submit these data through February 29, 2012, to receive a Medicare EHR incentive payment for 2011. We included all hospitals and professionals that, according to data from CMS’s National Level Repository, had successfully demonstrated meaningful use even though some of those providers had not received Medicare EHR program incentive payments from CMS as of December 8, 2011. As a result, the data we analyzed for hospitals included full-year Specifically, we analyzed meaningful use and clinical quality measures providers reported to CMS and which we obtained from CMS’s National Level Repository to identify the following: Frequency of measures reported. We identified the frequency with which providers reported the mandatory meaningful use measures for which providers may claim exemptions. Six measures allow professionals to claim exemptions and three measures allow hospitals to claim exemptions if, according to the providers, those measures are not relevant to their patient populations or clinical practices. Extent to which providers claimed allowable exemptions from reporting certain mandatory measures. We determined the percentage of providers that claimed an exemption from reporting at least one mandatory meaningful use measure. As part of this analysis, we examined whether a greater percentage of certain types of providers reported at least one exemption compared to other types of providers. Extent to which providers had patients who could be included in the calculation of clinical quality measures. We examined the extent to which providers had few patients who could be included in the calculation of at least one clinical quality measure. Measures that capture a small number of patients may be unreliable measures of quality because relatively small changes in the number of patients who experienced the care processes or outcomes targeted by the measure can generate large shifts in the calculated percentage for the measure. CMS has recognized in other programs that including a small number of patients in the calculation of a measure is a reliability issue. For example, on the agency’s Hospital Compare website, which publicly reports clinical quality measures by hospital, CMS indicates whether the number of patients included in a particular measure calculation was based on less than 25 patients and thus too small to reliably tell how well the hospital was performing. For our analysis, we identified clinical quality measures as unreliable if fewer than seven patients met inclusion criteria for the calculation. The reporting period for the first year a provider demonstrates meaningful use is any 90 consecutive days during the year; for subsequent years, the reporting period is the full year. Assuming a steady patient population, providers that had fewer than seven patients meet inclusion criteria for calculating clinical quality measures during the 90-day reporting period would have fewer than 25 patients meet these criteria during the full-year reporting period. As part of this analysis, we examined whether a greater percentage of certain types of providers reported at least one clinical quality measure based on few patients compared to other types of providers. We also analyzed other data sources to determine whether the reporting of meaningful use and clinical quality measures varied based on providers’ characteristics, such as whether critical access hospitals were more likely than acute care hospitals to claim an exemption from reporting at least one mandatory meaningful use measure. We used Chi-square likelihood tests to determine whether differences in provider characteristics were statistically significant. In particular, we analyzed data from the following sources: CMS’s Online Survey, Certification, and Reporting System (downloaded May 2011); CMS’s National Plan and Provider Enumeration System Downloadable File (downloaded October 2011); the Health Resources and Services Administration’s 2009-2010 Area Resource File (released August 2010); and CMS’s 2010 Medicare Part B claims (downloaded February 2012). Using these data, we examined the following provider characteristics: Hospital type. We obtained data on hospital type—acute care or critical access hospital—from CMS’s Online Survey, Certification, and Reporting System. Hospital ownership type. We obtained data on hospital ownership type from CMS’s Online Survey, Certification, and Reporting System. We created the ownership type of proprietary by selecting proprietary; the ownership type of nonprofit by combining voluntary nonprofit – church, voluntary nonprofit – private, and voluntary nonprofit – other; and the ownership type of government-owned by combining the four government designations (federal, state, local, and hospital district or authority). Hospital number of beds. We obtained data on the number of beds in hospitals, which includes beds that are certified for payment for Medicare and/or Medicaid, from CMS’s Online Survey, Certification, and Reporting System. Using those data, we created four categories for the number of beds: (a) 1 to 49 beds, (b) 50 to 99 beds, (c) 100 to 199 beds, and (d) 200 or more beds. Professional specialty. We obtained data on professionals’ primary specialty from CMS’s National Plan and Provider Enumeration System Downloadable File. Then, with the assistance of a crosswalk that we obtained from CMS that aggregates specialty taxonomy codes into a smaller number of specialties, we created the following seven professional specialty categories: (a) chiropractor, (b) dentist, (c) generalist, (d) optometrist, (e) podiatrist, (f) specialist, and (g) other eligible physician. Of those professionals who demonstrated meaningful use in the Medicare EHR program in 2011, we were unable to identify a primary specialty for 164 professionals (less than 0.7 percent) using the CMS downloadable file. The 900 professionals that were classified as “other eligible physicians” (about 3.8 percent) includes physicians for whom the information on professional specialty needed to classify them into one of the other professional specialty categories was not available in CMS’s National Plan and Provider Enumeration System; however, we determined that those professionals had specialty types that were eligible to receive incentive payments using other CMS databases. Professionals’ Medicare Part B charges. We obtained all 2010 Medicare Part B charges from CMS. For each professional (identified by National Provider Identifier), we summed the amount of Medicare Part B charges over the year. Subsequently, we created four categories by aggregating total charges by professional: (a) less than or equal to the 25th percentile, (b) greater than the 25th percentile and less than or equal to the 50th percentile, (c) greater than the 50th percentile and less than or equal to the 75th percentile, and (d) greater than the 75th percentile. Of those professionals who demonstrated meaningful use in the Medicare EHR program in 2011, information on the amount of Part B charges was missing for 359 professionals (about 1.5 percent). Provider location. We obtained zip codes for facility or practice locations for hospitals and professionals from CMS’s Online Survey, Certification, and Reporting System and CMS’s National Plan and Provider Enumeration System, respectively. Then, with the assistance of a zip code to Federal Information Processing Standard code crosswalk file we obtained from CMS, we used the Health Resources and Services Administration’s Area Resource File to identify whether providers were located in a metropolitan area—an area that has at least one urbanized area of 50,000 people. We then categorized providers located in metropolitan areas as being located in urban areas and providers that were not as being located in rural areas. We were unable to match 20 providers’ zip codes to the Area Resource File (which is less than 0.1 percent of participating professionals). To ensure the reliability of the data we analyzed, we interviewed officials from CMS, reviewed relevant documentation, and conducted electronic testing to identify missing data and obvious errors. On the basis of these activities, we determined that the data we analyzed were sufficiently reliable for our analysis. Analysis of Regional Extension Center data. We analyzed data we obtained from the Office of the National Coordinator for Health Information Technology (ONC) in December 2011. The data, which the agency collects from Regional Extension Centers, contains information about the providers to whom the centers provided technical assistance. We determined the number of providers assisted by the Regional Extension Center program as well as the percentage of those providers overall and for each center that had (1) signed an agreement with a center, (2) implemented an EHR, and (3) demonstrated meaningful use. In addition, we determined the types of professionals who had signed an agreement for technical assistance with a center. We made some adjustments to the data we obtained for professionals based on information obtained from officials at ONC. Specifically, we limited our analysis to professionals identified by a Regional Extension Center as being priority primary care providers, which are types of professionals for which ONC reimburses centers for providing technical assistance. This excluded 7,019 professionals (about 5.7 percent) from our analysis. We also excluded from our analysis professionals whose data we determined were unreliable based on information obtained from ONC officials. Specifically, we excluded any professionals who were missing or had anomalous entries for both an individual national provider identifier and an organizational national provider identifier. This excluded 355 professionals (about 0.3 percent) from the analysis. We also excluded another 2 professionals (less than 0.1 percent) who were identified in the data as being a type of professional that was not considered to be a priority primary care provider even though the professional was designated as such in the ONC data. We also made some adjustments to the data we obtained for hospitals based on information obtained from officials at ONC. Specifically, we limited our analysis to hospitals identified by a Regional Extension Center as being a type of hospital targeted for outreach—that is, a critical access hospital or rural hospital. This excluded four organizations (about 0.4 percent) from the analysis. To ensure the reliability of the data we analyzed, we interviewed officials from ONC, reviewed relevant documentation, and conducted electronic testing to identify obvious errors. On the basis of these activities, we determined that the data we analyzed were sufficiently reliable for our analysis. Appendix II: How Medicare and Medicaid EHR Program Incentive Payments Are Calculated Provider type EHR program Professionals Medicare EHR program The amount of incentive payment in any given year is equal to 75 percent of the professional’s Medicare Part B charges for the year, subject to an annual limit which varies by year. The amount of the incentive payment in the first year cannot exceed $18,000 and the total over a 5-year period cannot exceed $44,000. Medicaid EHR program The amount of incentive payment that a professional receives in any given year is, in general, a fixed amount; $21,250 in the first year and $8,500 in up to 5 subsequent years and the total amount over a 6-year period cannot exceed $63,750. Professionals must receive an incentive payment by calendar year 2016 in order to receive incentive payments in subsequent years. Medicare EHR program For acute care hospitals, the amount of incentive payment in any given year is generally based on the hospital’s annual discharges and Medicare share (i.e., percentage of inpatient days at the hospital in a given year attributable to Medicare patients). Incentive payments are awarded over periods of up to 4 years. To earn the maximum amount, acute care hospitals must first demonstrate meaningful use in fiscal year 2011, 2012, or 2013. For critical access hospitals, the incentive payment amount is generally based on the hospital’s Medicare share and the reasonable costs incurred for the purchase of depreciable assets necessary to administer certified EHR technology, such as computers and associated hardware and software. Critical access hospitals can earn payments for up to 4 years. To earn the maximum amount, critical access hospitals must first demonstrate meaningful use in fiscal year 2011 or 2012. Medicaid EHR program The amount of incentive payment that a hospital receives in any given year is generally based on the hospital’s annual discharges and Medicaid share. The number of years over which incentive payments are awarded (between 3 to 6 years) is at the discretion of the state. CMS will increase the incentive payments that would otherwise apply by 10 percent each year for Medicare professionals that predominantly furnish services in geographic areas designated as health professional shortage areas, such as areas that have a shortage of primary medical care. To demonstrate meaningful use in the first year of the Medicare EHR program, professionals must report on a total of 20, and hospitals must report on a total of 19, meaningful use measures. For certain meaningful use measures, providers may report to CMS that the measures are not relevant to them; this is referred to as claiming an exemption. Furthermore, to satisfy the requirement for one of the meaningful use measures “report clinical quality measures to CMS,” providers must report on clinical quality measures identified by CMS.the number of meaningful use measures and clinical quality measures providers must report for the first year of the Medicare EHR program. Table 10 describes the meaningful use measures, and table 11 and table 12 describe the clinical quality measures for professionals and hospitals, respectively. Regional Extension Centers report to the Office of the National Coordinator for Health Information Technology (ONC) data that describes the progress they have made in providing technical assistance to professionals or hospitals to help those providers meaningfully use EHRs. The data the Regional Extension Centers report to ONC describe the following three milestones in the technical assistance provided: The professional or hospital signs an agreement with a Regional Extension Center to receive technical assistance. The professional or hospital implemented an EHR which has electronic prescribing and measure reporting functionality. The professional or hospital demonstrated meaningful use, consistent with the Medicare and Medicaid EHR programs’ requirements. When the program was established, ONC also required each of the 62 Regional Extension Centers to set a targeted numbers of professionals and hospitals each center would assist—that is, the center’s goal for the number of providers it would help meaningfully use EHRs. ONC uses the data the Regional Extension Centers report for each of the three milestones in the technical assistance process as well as the goals each center established to evaluate the effectiveness of individual Regional Extension Centers and of the program as a whole. Tables 13 and 14 list the goals and number of professionals and hospitals, respectively, assisted towards meaningful use by each center. In addition to the contact named above, E. Anne Laffoon, Assistant Director; Julianne Flowers; Krister Friday; Melanie Krause; Shannon Legeer; Monica Perez-Nelson; Amanda Pusey; and Stephen Ulrich made key contributions to this report.

Summary: The Health Information Technology for Economic and Clinical Health (HITECH) Act established the Medicare and Medicaid electronic health records (EHR) programs. CMS and the states administer these programs which began in 2011 to promote the meaningful use of EHR technology through incentive payments paid to certain providersthat is, hospitals and health care professionals. Spending for the programs is estimated to total $30 billion from 2011 through 2019. Consistent with the HITECH Act, GAO (1) examined efforts by CMS and the states to verify whether providers qualify to receive EHR incentive payments and (2) examined information reported to CMS by providers to demonstrate meaningful use in the first year of the Medicare EHR program. GAO reviewed applicable statutes, regulations, and guidance; interviewed officials from CMS; interviewed officials from four states, which were judgmentally selected to obtain variation among multiple factors; and analyzed data from CMS and other sources. The Centers for Medicare and Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), and the four states GAO reviewed are implementing processes to verify whether providers met the Medicare and Medicaid EHR programs requirements and, therefore, qualified to receive incentive payments in the first year of the EHR programs. To receive such payments, providers must meet both (1) eligibility requirements that specify the types of providers eligible to participate in the programs and (2) reporting requirements that specify the information providers must report to CMS or the states, including measures that demonstrate meaningful use of an EHR system and measures of clinical quality. For the Medicare EHR program, CMS has implemented prepayment processes to verify whether providers have met all of the eligibility requirements and one of the reporting requirements. Beginning in 2012, the agency also has plans to implement a risk-based audit strategy to verify on a postpayment basis that a sample of providers met the remaining reporting requirements. For the Medicaid EHR Program, the four states GAO reviewed have implemented primarily prepayment processes to verify whether providers met all eligibility requirements. To verify the reporting requirement, all four states implemented prepayment processes, postpayment processes, or both. CMS officials stated that the agency intends to evaluate how effectively its Medicare EHR program audit strategy reduces the risk of improper EHR incentive payments, though the agency has not yet established corresponding timelines for doing this work. Such an evaluation could help CMS determine whether it should revise its verification processes by, for example, implementing additional prepayment processes, which GAO has shown may reduce the risk of improper payments. In addition, CMS has opportunities to improve the efficiency of verification processes by, for example, collecting certain data on states behalf. CMS allows providers to exempt themselves from reporting certain measures if providers report that the measures are not relevant to their patients or practices. Measures calculated based on few patients may be statistically unreliable, which limits their usefulness as tools for quality improvement. CMS and others acknowledged that the availability of measures that are relevant to providers patients and practices and are statistically reliable is important to provide useful information to providers. Among participants in the first year of the Medicare EHR program, the majority of providers chose to exempt themselves from reporting on at least one meaningful use measure and many providers reported at least one clinical quality measure based on fewless than sevenpatients. GAO is making four recommendations to CMS in order to improve processes to verify whether providers met program requirements for the Medicare and Medicaid EHR programs, including opportunities for efficiencies. HHS agreed with three of GAOs recommendations, but disagreed with the fourth recommendation that CMS offer to collect certain information on states behalf. GAO continues to believe that this action is an important step to yield potential cost savings.