Can’t Complete the Stage 2 MU Summary of Care Measure 3 Test with a CMS Designated Test EHR? CMS Issues New FAQ on Alternative

HCP with stethoscope using phone while on laptopOn January 22, 2015, the Centers for Medicare and Medicaid Services (CMS) updated previously posted FAQ No. 11666 to help guide providers who are striving to meet Stage 2 Meaningful Use criteria under the Medicare and Medicaid EHR Incentive Programs implemented by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. The updated FAQ addresses the problem providers are having in meeting Measure 3 under the Stage 2 Summary of Care objective. The question posed is:

“When reporting on the Summary of Care objective in the EHR Incentive Programs, how can eligible professionals, eligible hospitals, and critical access hospitals (CAHs) meet measure 3 if they are unable to complete a test with the CMS Designated Test EHR (NIST EHR-Randomizer Application)?”

The CMS answer is as follows: Continue reading

THE HIPAA SECURITY RISK ANALYSIS

businessman looking over his glasses with clipboard on hand - frUnder the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH Act), eligible hospitals and critical access hospitals and eligible professionals must make a “meaningful use” of “certified electronic health technology” or face reductions in Medicare reimbursement. Conducting or reviewing a security risk analysis is a core objective in the meaningful use requirements of the Medicare and Medicaid electronic health record (“EHR”) incentive programs. These security risk analyses have been Continue reading

Federal Government Report Summarizes Health Care Privacy Compliance Efforts

government buildingThe U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has issued two reports to Congress required by Section 13402(i) of the Health Information Technology for Economic and Clinical Health (HITECH) Act:

–“Annual Report to Congress on Breaches of Unsecured Protected Health Information For Calendar Years 2011 and 2012” (the Breach Report); and

–“Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance For Calendar Years 2011 and 2012” (the Compliance Report).

Both of OCR’s reports (as well as previous annual reports) may be accessed here. This post discusses the Compliance Report. We summarized the Breach Report in a separate post entitled “Federal Government Report on Data Breaches in Health Care.”

OCR is the office responsible for administering and enforcing the HIPAA Privacy, Security, and Breach Notification Rules. The Compliance Report summarizes OCR’s compliance and enforcement activity with respect to the HIPAA Privacy, Security, and Breach Notification Rules.

Continue reading

Federal Government Report on Data Breaches in Health Care

government buildingThe U.S. Department of Health and Human Services, Office for Civil Rights (OCR) has issued two reports to Congress required by Section 13402(i) of the Health Information Technology for Economic and Clinical Health (HITECH) Act:

• “Annual Report to Congress on Breaches of Unsecured Protected Health Information For Calendar Years 2011 and 2012” (the Breach Report), and
• “Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance For Calendar Years 2011 and 2012” (the Compliance Report).

Both reports (as well as previous annual reports) may be accessed here.  This post discusses the Breach Report, and a separate article will be posted later addressing the Compliance Report.

The Breach Report offers valuable insight into OCR’s priorities with respect to healthcare data breaches and gives an excellent summary of many recent settlements. OCR (the office responsible for administering and enforcing the HIPAA Privacy, Security, and Breach Notification Rules) has prepared this Breach Report describing the numbers and types of healthcare data breaches occurring for calendar years 2011 and 2012.  The Breach Report is compiled from breach reports that HIPAA requires be provided to OCR by covered healthcare providers, health plans, healthcare clearinghouses and their business associates.  The raw data upon which these reports is based is available here. OCR also provides some cumulative data on breaches reported since the breach notification law went into effect on September 23, 2009. OCR then slices and dices this data in a variety of different and useful ways, sorting it by: cause, location of affected protected health information (PHI), types of entities involved, number of individuals affected, remediation steps taken, etc. Continue reading

KHIE issues June Newsletter

HCP with stethoscope using phone while on laptopThe Kentucky Health Information Exchange (KHIE) has issued its June 2014 Newsletter, The KHIE Connection.  This month’s issue includes a summary of the Centers for Medicare and Medicaid Services (CMS) Notice of Proposed Rule Making (NPRM) that, if finalized, would allow providers to meet Stage 1 or Stage 2 Meaningful Use with electronic health records (EHRs) that are certified to HHS ONC’s 2011 or 2014 Edition criteria or a combination of both Editions.  Comments to the NPRM must be received by July 21, 2014.  The newsletter also addresses Medicare’s scheduled payment adjustments for 2015 that will impact eligible hospitals and providers who do not timelyattest to Meaningful Use of certified EHRs.  Guidance on attesting to Meaningful Use also is included.