HHS Issues Final Regulations Setting Standards for EHR, Meaningful Use and Technology Certification Under the HITECH Act

On July 28, 2010, the Department of Health & Human Services (HHS) published two regulations related to implementation of the Health Information Technology for Economic and Clinical Health (HITECH) Act: (1) a final rule regarding the criteria that certain providers and hospitals must meet to qualify for payments; and (2) a final rule setting out the standards, criteria and implementation specifications that a health information technology (HIT) must meet in order to be certified.¹ These regulations, which become effective on September 27, 2010, finalize and make significant changes to the draft regulation and Interim Final Regulation that had been released on December 30, 2009. The regulations can be found at 42 CFR Parts 412, 413, 422 et al and 45 CFR Part 170. This alert briefly summarizes the key changes from the proposed rules.²

General Requirements

The regulations set out the requirements for certain hospitals and eligible professionals to qualify for EHR incentive payments under either Medicare or Medicaid. Critical Access Hospitals (CAHs) and Medicare Subsection (d) hospitals can qualify for Medicare payments. Children’s CAHs and acute care hospitals with at least a 10 percent Medicaid caseload can qualify for Medicaid payments. CAHs are paid on a cost basis whereas other qualifying hospitals are paid under Medicare, Medicaid or both based on a formula that includes a base payment amount, a discharge-related amount and a measurement of charity care. In regards to individual professionals, under Medicare, physicians can qualify for payments totaling up to $44,000 over five years and, under Medicaid, Eligible Professionals (EPs), including certain non-physician providers, can qualify for payments totaling up to $63,750 over six years. In addition, special rules allow Medicare Advantage organizations to qualify for payments as well.

In most cases, the payments are provided as an incentive or bonus for the provider demonstrating that they are a “meaningful user” of “Certified Electronic Health Records Technology.” Meaningful use is demonstrated by showing compliance with specified objectives and measures governing the use of a certified electronic health record (EHR). The regulations explicitly define these requirements for “Stage 1” of meaningful use.³ CMS has indicated that a final regulation on Stage 2, including more stringent requirements, will be issued by the end of 2011. Under the Medicaid program, however, hospitals and EPs can demonstrate compliance in their first payment year by showing only that they acquired, implemented, or upgraded certified EHR technology. They do not have to demonstrate meaningful use until the subsequent year.

Generally speaking, HHS substantially relaxed the requirements from those set out in the proposed rule, which should increase the likelihood that providers may qualify for incentive payments. Nonetheless, there are still some provisions of the new rules that may make it difficult for certain providers to qualify for incentive payments.

Significant Changes From the Proposed Regulation

Changes to the Meaningful Use Objectives and Measures

A central premise of the HITECH Act is that providers must not simply acquire EHR technology, but they must actually use that technology to accomplish certain objectives. Meaningful use of the technology is demonstrated by showing compliance with certain “objectives” and associated “measures.” The final regulations altered these requirements from the proposed rule in three main ways:

• First, the final regulations reduce the number of objectives and measures that a provider must comply with in order to demonstrate meaningful use. Instead of requiring providers to meet every one of approximately two dozen meaningful use objectives and measures, they are only requiring EPs to meet 15 core objectives/measures and hospitals to meet 14 objectives/measures. Providers are then required to select and comply with five additional objectives/measures from a “menu” list of 10 choices.⁴
• Second, a number of objectives, as well as their associated measures, were made less onerous. For example, the requirement that an eligible professional use computerized provider order entry (CPOE) for 80 percent of all orders of medications, radiology and lab tests was changed to 30 percent of only medication orders.
• Third, a new “exclusions” process was included for some objectives allowing providers to meet the requirement without complying with those objectives. For example, a provider who prescribes fewer that 100 prescriptions per year can claim an exclusion from the requirement to use CPOE for 30 percent of all medication orders.

Changes to Quality Reporting Requirements

One of the required meaningful use objectives is that hospitals and EPs report to CMS (or in the case of Medicaid to the state) on certain quality reporting measures. In the draft rule, CMS set forth a set of “core” quality measures and numerous sets of specialty-based reporting measures. It proposed that all EPs report on the core set and one of the specialty sets while also specifying a set of inpatient quality measures for hospitals.

While the final regulation maintains the reporting requirements on clinical quality measures, it reduces the required number. For hospitals, it requires reporting of 15 quality measures that were specified and posted at the time of the draft regulation. For EPs, the final rules require 44 of the original 90 proposed quality measures. EPs must report on three of these quality measures and must also report on 3 separately-specified “core” quality measures (or on three alternative core measures if the three core measures are inapplicable).

CMS expects to update the quality reporting requirements in the Stage 2 rulemaking, and indicates that they intend to re-institute the proposed breakdown of reporting requirements by specialty set, to add the measures from the proposed rule that were excluded in the final rule, and to develop Medicaid-specific reporting measures.

Other Changes

CMS clarified certain issues and made other modifications to the proposed rules that include the following:

• changed the definition of “hospital-based” physician
• retracted all discussion of when Stage 1, Stage 2 and Stage 3 requirements would apply to various providers after 2014
• indicated that for Stage 2, it will require CPOE for medications for 60 percent of patients
• declined to alter its position that a hospital is defined by its CMS Certification Number (CCN); thus, multiple campus hospitals operating under a single CCN need to jointly meet the program requirements and would only qualify for one base payment
• modified and reinstated the meaningful use requirement directing EPs and hospitals to identify and provide patient-specific education resources
• required certified EHR technology to include the capability to calculate various measures and quality reporting parameters
• required subsequent payment years to be consecutive years following the first payment year under the Medicare program, but not under the Medicaid program
• allowed a provider under the Medicaid program to qualify in the first year by only indicating that they have acquired, implemented or upgraded certified EHR technology without demonstration and in the second year by demonstrating meaningful user status, but need only do so for one representative 90-day consecutive time period
• restricted the authority of states to add meaningful use criteria for Medicaid programs
• eliminated an exact alignment between the meaningful use requirements and the requirements for certified EHR technology; instead, requiring providers to acquire certain technical capabilities that will not be relevant to achieving Stage 1 meaningful use (but will presumably be needed for subsequent stages)

Conclusion

The final HITECH Act regulations made a variety of changes from the proposed rules. While these changes clarify some matters that were unclear in the draft regulations, they do not address all of the questions presented by HITECH Act implementation. Some issues will therefore presumably be addressed by guidance, program instructions, “Dear Medicaid Director” letters and other sub-regulatory methods. Some of the major remaining issues, questions and problems will likely include the following.

• Mapping HITECH Requirements to Medical Specialty Practices. Many medical specialties still face requirements that are either irrelevant to their practice or problematic with respect to the scope of practice limitations. While the final rules make changes that will be helpful to specialists in meeting the requirements of the Act, they do not appear to solve all of the problems that such providers will experience with the objectives.
• The Multi-Campus Hospital Problem. Many multi-campus hospitals operate under a single CCN and, as a result, are faced with two problems under the final rules: (1) the entire hospital system receives only one base payment and a system-wide limit on other payments and thus may qualify for significantly smaller payments than if compliance and payment were determined on a campus-by-campus basis; and (2) the entire system has to meet the applicable objectives and measures.
• Waiting for Certification. Only those certifying organizations that are approved will be charged with reviewing and certifying EHRs (or EHR modules). As of right now, however, no certifying bodies have been identified and there is no provision in the law for “grandfathering” of existing EHR systems. Accordingly, providers and HIT vendors are currently left waiting for HHS to identify the parties to whom they may apply for certification.
• Getting Paid for Outfitting Physicians. The final rule alters the definition of a “hospital based” EP such that many more practitioners working with hospitals should be able to qualify for EP payments and also clarifies the ability of EPs to voluntarily reassign those payments. Hospitals that have or will incur costs to outfit their EPs with Certified EHR Technology need to pay close attention to potential issues under the Anti-Kickback, Stark, False Claims and other statutes with potential relevance to these matters.
• Medicaid Challenges. EPs and hospitals who seek incentive payments under Medicaid will have to navigate their state Medicaid bureaucracy and the differences in how the Medicaid and Medicare programs work related to payment timeframes and calculations, requirements for showing compliance, average cost concepts and other issues.

¹ A third regulation, issued in June 2010, set forth the process by which HHS will approve entities that want to serve as certification bodies to certify EHR technology as complying with applicable requirements.

² For an in-depth discussion of the proposed regulations, see Holland & Knight’s alert, “HHS Issues Proposed Regulations to Implement HITECH Act.”

³ Stage 1 requirements will apply for the first two years for providers who initially qualify for incentive payments in 2011, 2012 or 2013 and for at least the first year for providers who initially comply in 2014.

⁴ There are a total of 12 menu options but some only apply to EPs and some only apply to hospitals.