Although the Medicare and Medicaid EHR programs are generally similar, there are some differences related to the types of providers that are permitted to participate, the duration and amount of incentive payments and penalties, and information providers must submit to satisfy the programs’ requirements. The types of providers eligible to participate in the Medicare and Medicaid EHR programs—referred to as permissible providers—differ. See figure 1 below. Beginning in 2011, the first year of the Medicare and Medicaid EHR programs, the programs have provided incentive payments to eligible providers that met program requirements. Beginning in 2015, the Medicare EHR program is generally required to begin applying a penalty for hospitals and professionals that do not meet the Medicare EHR program requirements. Figure 2 below provides information on the years that incentive payments are available and that penalties, if applicable, will be assessed for professionals and hospitals under the Medicare and Medicaid EHR programs. The amount of incentive payment varies depending on the type of provider (professionals or hospitals) and the program in which the provider participates (Medicare EHR program or Medicaid EHR program). For example, in the Medicare EHR program, professionals cannot earn more than $18,000 in incentive payments in their first year, and, over a 5-year period, payments cannot exceed a total of $44,000. In contrast, in the Medicaid EHR program, professionals cannot earn more than $21,250 in incentive payments in the first year and $8,500 during each of 5 subsequent years for a total of $63,750. (See app. II for more information on the amounts of incentive payments available under both programs and how the amounts are calculated.) To receive incentive payments from either the Medicare or Medicaid EHR To programs, providers must meet eligibility and reporting requirements.do so, providers report certain information to CMS, the states, or to both—a process referred to as “attestation”—by entering certain information into CMS’s or the states’ EHR program web-based attestation tools. Providers that, based on information submitted to CMS and the states, meet the requirements receive incentive payments. Some of the eligibility and reporting requirements for the Medicare EHR program differ from those in the Medicaid EHR program. To receive Medicare EHR incentive payments in 2011, professionals had to meet three eligibility and three reporting requirements, while hospitals had to meet two eligibility and two reporting requirements. (See table 1.) One noteworthy reporting requirement for 2011 was that providers were required to demonstrate meaningful use of certified EHR technology by collecting and reporting information to CMS on various measures established by CMS. Specifically, in 2011, professionals had to report on a total of 20 meaningful use measures, and hospitals had to report on a total of 19 meaningful use measures. This information had to be collected over 90 consecutive days during 2011. Professionals. Of the 20 meaningful use measures for professionals, 15 are mandatory. Of those 15 mandatory measures, 6 measures allow professionals to claim exemptions—that is, they may report to CMS that those measures are not relevant to their patient populations or clinical practices. measures—“report clinical quality measures to CMS”—requires professionals to report on at least 6 clinical quality measures identified by CMS. Professionals have the flexibility to choose the remaining 5 meaningful use measures from a menu of 10 measures. One of the mandatory meaningful use Hospitals. Of the 19 meaningful use measures hospitals must report, 14 are mandatory. Of those 14 mandatory measures, 3 measures allow hospitals to claim exemptions. Similar to professionals, to satisfy the mandatory meaningful use measure “report clinical quality measures to CMS,” hospitals must report on 15 clinical quality measures identified by CMS. Hospitals have the flexibility to choose the remaining 5 meaningful use measures from a menu of 10 measures. See appendix III for a listing of the meaningful use measures and clinical quality measures for 2011. In order to meet the definition of meaningful use, eligible professionals and hospitals must report on measures specified by CMS. An exclusion for a nonapplicable measure is permitted if the provider meets certain requirements specified in the regulation. 42 C.F.R. § 495.6. In this report we use the term “exemption” to refer to the exclusion of a nonapplicable measure. To receive Medicaid EHR incentive payments during 2011, professionals had to meet seven eligibility requirements, hospitals had to meet six eligibility requirements, and both hospitals and professionals had to meet one reporting requirement. (See table 2.) Compared to the Medicare EHR program, the Medicaid EHR program requirements had two noteworthy differences in 2011. Providers had to meet a patient volume requirement. This requirement was established to ensure that providers that receive incentive payments from the Medicaid EHR program serve a minimum volume of Medicaid patients, or, for certain professionals, a minimum volume of needy patients. Specifically, professionals must have a Medicaid patient volume of at least 30 percent unless they are pediatricians or practice predominantly in a federally qualified health center or rural health center; hospitals generally must have a Medicaid patient volume of at least 10 percent. Providers only had to adopt, implement, or upgrade to a certified EHR system in 2011 and did not have to demonstrate meaningful use during the first year they participate in the Medicaid EHR program. However, in subsequent years, they must demonstrate meaningful use. individual or group primary care practices with 10 or fewer professionals; public, rural, and critical access hospitals; community health centers and rural health clinics; collaborative networks of small practices; and other settings that predominantly serve medically underserved populations, as defined by each Regional Extension Center. ONC also provides funding for Regional Extension Centers to provide assistance to certain hospitals—critical access and rural hospitals—to ensure that centers’ services are available in those settings. ONC’s overall goal for the Regional Extension Center program is to help 100,000 professionals meet the EHR programs’ requirements for meaningful use by 2014 and to help a total of 1,777 critical access and rural hospitals meet the EHR programs’ requirements for meaningful use by 2014. In its agreement with ONC, each Regional Extension Center established its own goal for the number of providers it would assist to help the program meet its overall goal. CMS and the four states we reviewed are implementing processes to verify whether providers met the Medicare or Medicaid EHR programs’ eligibility and reporting requirements and, therefore, qualified to receive incentive payments in the programs’ first year. Although CMS is taking some steps to improve the processes CMS and states use to verify whether providers have met Medicare and Medicaid EHR program requirements, we found that CMS has additional opportunities to assess and improve these processes. For the first program year, CMS is implementing a combination of pre- and postpayment processes to verify whether providers have met all of the Medicare EHR program eligibility and reporting requirements. In addition, the four states we reviewed have implemented or plan to implement a combination of pre- and postpayment processes to verify whether providers have met Medicaid EHR program eligibility and reporting requirements. CMS has developed and begun to implement processes to verify whether providers participating in the Medicare EHR program have met all of the program’s eligibility and reporting requirements and thereby qualify to receive incentive payments. In 2011, CMS implemented prepayment processes to verify whether providers have met all three of the Medicare EHR program’s eligibility requirements. These processes consist of automatic checks that are built into CMS’s databases to verify the information submitted by providers when they register for the program. CMS also implemented a process to verify, on a prepayment basis, whether providers have met one of the Medicare EHR program’s reporting requirements—to use a certified EHR system. Specifically, CMS built an automatic check to compare the EHR certification numbers for the systems providers reported using during attestation against a list of EHR systems that have been certified by ONC. In 2012, according to CMS officials, the agency plans to implement additional processes to verify, on a postpayment basis, whether a sample of providers has met all three of the Medicare EHR program’s reporting requirements. To conduct these verifications, CMS has developed a risk- based approach that will be used to identify a sample of about 10 percent of professionals and 5 percent of hospitals for audits. planned audit strategy, the agency may request that providers selected for postpayment audits submit documentation, such as patient rosters, EHR screenshots, and reports generated by the EHR system to support data the providers reported to CMS during attestation. If CMS determines during the audits that a provider has failed to meet any one of the reporting requirements, it plans to take steps to recoup incentive payments. CMS officials said that they decided to wait until 2012 to begin conducting audits of providers that received incentive payments in 2011, the first payment year, to ensure that the agency does not unfairly target a disproportionate number of early participants in the Medicare EHR program. For an overview of CMS’s processes to verify whether providers met the Medicare EHR program’s eligibility and reporting requirements, see table 3. In addition, according to CMS officials, the agency plans to conduct a separate audit, beginning in 2012, to verify that providers had the certified EHR systems they attested to using. For these audits, CMS anticipates sampling roughly 20 percent of professionals and 10 percent of hospitals, identified through random sampling as well as some targeted selection. Three of the states we reviewed—Iowa, Kentucky, and Pennsylvania— have implemented processes to verify whether providers have met all the Medicaid EHR program’s eligibility and reporting requirements and thereby qualify to receive incentive payments. The fourth state, Texas, has implemented processes to verify whether providers met most of the program’s eligibility and reporting requirements and is in the process of developing additional verification processes as part of its postpayment audit strategy. Because CMS allows states flexibility in determining how they verify compliance with these requirements, the states vary in terms of whether they use prepayment or postpayment verification processes.