AHIMA Issues Guidance on Appropriate Use of Copy and Paste in EHRs

April 4, 2014April 4, 2014 Kathie McDonald-McClure EHR Certification Standards, Electronic Health Records, Fraud and Abuse, Health Information Technology, HITECH Law, Meaningful Use AHIMA EHR documentation guidance, EHR Certification Standards, EHR copy and paste function, EHR fraud, Electronic Health Records, Health Information Technology, HITECH Act

As we have written about in previous posts, the Office of Inspector General (OIG) for the United States Department of Health and Human Services (HHS) has been critical of the copy/paste function that is available in electronic health record (EHR) technology developed by software vendors. (See “Electronic Health Records in OIG’s Sights for 2013“, October 20, 2012; “OIG recommends fraud safeguards in hospital EHR technology“, December 11, 2013; “OIG Report on CMS’ EHR Audit Practices Concludes The Practices Are Not Very Sophisticated“, February 11, 2014) As our February 11, 2014 post concludes, while turning off the copy/paste functionalities are not the immediate solution to preventing a misuse of the function, health care providers should implement standards for its use. The American Health Information Management Association (AHIMA) recently issued guidance, “Appropriate Use of the Copy and Paste Functionality in Electronic Health Records,” dated March 17, 2014, discussing the availability and appropriate use of the copy and paste function.

AHIMA supports maintaining the copy/paste functionality in ONC’s EHR certification standards and allowing for its use in CMS Conditions of Participation. AHIMA encourages CMS to augment provider education and training materials on the appropriate use of copy/paste in order to reduce the risk that it may pose to quality of care, patient safety and fraudulent documentation. Importantly, AHIMA recommends that health care providers implement policies and procedures to guide users of EHRs on the proper use of copy/paste functionalities. To read the AHIMA guidance, click here.

March 31st Attestation Deadline for Eligible Professionals

March 18, 2014 Margaret Young Levi Electronic Health Records, Health Information Technology, Meaningful Use EHR, Electronic Health Records, Health care reform, Health Information Technology, Meaningful Use, meaningful use of certified EHR

Reminder: The deadline for Medicare eligible professionals to attest to meaningful use of certified electronic health record technology for the 2013 program year is just two weeks away. Attestations are due on March 31, 2014 at 11:59 pm EST. Click here for addition information about the EHR incentive program as well as to register or attest to meaningful use.

CMS Issues EHR Meaningful Use Hardship Exceptions for Health Care Providers Subject to 2015 Medicare Reimbursement Reduction (Includes Automatic One-Year Reprieve for 2013 Meaningful Users)

March 11, 2014March 12, 2014 Margaret Young Levi EHR Certification Standards, Electronic Health Records, Eligible Professional Incentives, Health Information Technology, HITECH Law, Hospital EHR Incentives, Hospital EHR Stimulus, Meaningful Use, Physician EMR Stimulus CEHRT, EHR, hardship exception, hardship exemption, Meaningful Use

On February 28, 2014, we posted an article about ICD-10 and Stage 2 Meaningful Use (MU) announcements by the Centers for Medicare & Medicaid Services (CMS) at the 2014 HIMSS annual conference. At that conference, while CMS refused to extend the deadlines for ICD-10 and Stage 2 MU, it promised to be more flexible about providing hardship exemptions on Stage 2 MU for providers and vendors truly struggling to meet the incentive program’s requirements. CMS said that guidance would be forthcoming. Yesterday, March 10, 2014, CMS issued such guidance. The Guidance is directed solely at providers experiencing EHR vendor issues. Importantly, the Guidance gives an automatic, one-year reprieve for certain providers who demonstrated MU for 2013. Continue reading →

March 1, 2014 is Deadline to Report Breaches Affecting Less than 500

February 28, 2014March 12, 2014 Kathie McDonald-McClure Electronic Health Records, Federal Law Resources, Health Information Technology, HITECH Law HIPAA breach, HIPAA Omnibus Rule, linkedin, privacy and security of protected health information, reporting data breach to OCR

Saturday, March 1, 2014, is the deadline for entities covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to report to the U.S. Department of Health & Human Services Office for Civil Rights (OCR) all “small breaches” of unsecured protected health information that occurred during 2013. Entities subject to this deadline include a health care provider that conducts certain transactions in electronic form, health plans and health care clearinghouses. A “small breach” is a breach affecting less than 500 individuals.

Although affected individuals must be notified within 60 days of the breach’s discovery, the breach itself also must be reported to OCR within 60 days of the close of the calendar year in which it was discovered, or by March 1 of the following year. The notice must be submitted electronically. A separate breach notification form must be completed for each breach. To submit breach notification reports to OCR, click here.

Remember: HIPAA, as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 and the HIPAA Omnibus Rule, has a new definition of a “breach” that became effective March 26, 2013. It is OCR’s position that a breach is presumed—unless an entity can demonstrate that there is a Low Probability that the data has been Compromised (LoProCo). With any loss, theft or potential unauthorzed access to unsecured protected health information, entities should immediately perform a risk assessment and look at certain factors to decide whether there is a low probability of compromise or LoProCo. If a LoProCo analysis is not done, a breach is presumed and, even if under a LoProCo analysis it would not have been a breach, a loss, theft or unauthorized access of unsecured protected health information must be reported as a breach to OCR. For more information about the LoProCo analysis, see our previous post on December 1, 2013, here.

CMS Provides Detailed Instructions on Deadline Extension for 2013 MU Attestation

February 12, 2014March 12, 2014 Kathie McDonald-McClure Electronic Health Records, Eligible Professional Incentives, Health Information Technology, HITECH Law, Hospital EHR Incentives Electronic Health Records, Extension of 2013 Meaningful Use Attestation Deadline, HITECH Act, hospital incentives for EHRs, Meaningful Use, physician incentives for EHRs

On Friday, February 7, 2014, the Centers for Medicare and Medicaid Services (CMS) announced an extension until 11:59 pm on March 31, 2014 for Eligible Professionals to submit their 2013 EHR Meaningful Use (MU) attestation. In addition, Eligible Hospitals that had trouble submitting their 2013 MU attestation may be able to retroactively submit their attestation to avoid the 2015 payment adjustment but must contact CMS by March 15, 2014 at 11:59 pm to do so. Note that only the attestation deadline is being moved. The requirement to meet MU by September 30, 2013 for Eligible Hospitals and by December 31, 2013 for Eligible Professionals in order to avoid the 2015 payment adjustment is not affected.

What’s new from our previous post about this? Today, CMS published specific instructions on how to take advantage of the extensions of the 2013 MU attestation deadlines in its MLN Connects, Weekly Provider eNews dated Thursday, February 13, 2014. Scroll to the section titled “New EHR Attestation Deadline for Eligible Professionals: March 31” which provides instructions for both Eligible Professionals and Eligible Hospitals. CMS also updated the Eligible Professional 2013 attestation deadline on its EHR Incentive Programs home page.