August 15, 2011

Successful Attestation: It’s All in the Details
By Elizabeth S. Roop
For The Record
Vol. 23 No. 14 P. 10

As more hospitals apply for meaningful use incentives, it’s becoming clearer what strategies work best.

On April 18, Beth Israel Deaconess Medical Center (BIDMC) became the first hospital in the nation to attest to the meaningful use of HIT, with Chief Information Officer (CIO) John Halamka, MD, completing the process just 30 minutes after the Centers for Medicare & Medicaid Services’ (CMS) website went live.

When asked about advice he’d give to others preparing to attest, Halamka points to his popular “Life as a Healthcare CIO” blog, where he outlined his experience with the six-step attestation process. In the April 18 posting, he noted that the entire process “should take 30-60 minutes to complete if you have all your data handy.”

However, there were some idiosyncrasies. For example, once a hospital is logged into the system, one of the first pieces of information that must be entered is the EHR certification number from the Office of the National Coordinator for Health Information Technology (ONC).

“This is an interesting concept because the EHR Certification number is not the same as the Certified Health IT Product List (CHPL) Product number assigned during the certification process,” wrote Halamka. It was necessary to manually search the CHPL website for each product needed to meet 100% of the certification criteria and add each to the shopping cart. Once that task was completed, the proper number could be obtained by clicking on “Get CMS EHR Certification ID” in the site’s “view cart” area.

The next step is to specify whether the hospital is using the observation services method for calculating emergency department (ED) visits or if all visits were counted, followed by attesting to the core criteria. The fourth step is attesting to the menu set criteria and then to the 15 hospital quality measures, including stratifications for admitted, observation, and psychiatric patients.

While the numerators for ED quality measures are conveyed in minutes, all other quality measures require numerators, denominators, and exclusion measures using patient counts. In 2012, the CMS will require these measures to be submitted electronically using Physician Quality Reporting Initiative XML, something Halamka says he looks forward to “since manually entering more than 50 numbers accurately was challenging.”

Finally, a series of questions is asked attesting to the accuracy of the submissions and the submitter’s authority to perform the attestation. “If you’ve met all the criteria successfully, your attestation is approved and a submission receipt page appears,” wrote Halamka, adding that the receipt should be printed or saved because it will not be e-mailed.

Halamka’s experience with BIDMC’s history-making attestation provides valuable insight into a process that had been shrouded by uncertainty. Since then, as others have followed suit, more information has emerged that can be used to avoid challenges and devise strategies that will help smooth the path to attestation for hospitals that have not yet taken the leap.

Know What You’ll Need
While the online attestation process is well defined and fairly straightforward, Halamka’s experience with the CMS EHR certification ID number illustrates that there are always potential stumbling blocks that can slow things down. That is why the CMS has created an Attestation User Guide and Attestation Worksheet for hospitals, both available on the CMS EHR Incentive Program website.

“The documents make it extremely clear what is expected to be input into the CMS Web-based forms during attestation,” says Jim Tate, a partner with HITECH Answers, which provides online educational resources to help provider organizations achieve meaningful use. “Notification of the success of the attestation occurs as soon as the attestation is submitted,” so a hospital will know immediately whether it can expect an incentive check in the future.

While most of the experts interviewed here agreed that it is too soon to have collected enough data from attestations to determine whether there are specific criteria or steps in the process that hospitals struggle with more than others, at least one indicated there are areas of confusion.

Specifically, there remains a level of uncertainty concerning the scope of the risk assessments as they relate to physicians working with a hospital, according to Ken Vander Wal, CISA, CPA, chief compliance officer at Health Information Trust Alliance (HITRUST) and international vice president of ISACA (formerly the Information Systems and Audit Control Association).

“Hospitals increasingly are providing their EHR solutions as a service to physician practices. However, the hospitals don’t have a clear understanding of whether those practices need to be assessed as part of the hospital’s overall risk assessment,” he says. “To clarify, in short, if the hospital has operating control over the practice, for example its policies apply, then yes. If the hospital is offering compliance with meaningful use as part of the service, then it needs to either include the practice within the scope or offer additional services to perform a separate assessment.”

Performing the assessment is challenging, in part because the security rule does not prescribe a specific methodology for doing so. However, it does describe the risk analysis as “an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.”

To help, HITRUST developed guidance for companies around meaningful use risk assessments centered on three key messages: demonstrate reasonable practices, be efficient by dedicating sufficient resources for remediation efforts, and take remediation seriously.

Now or Later?
In addition to knowing the exact information needed, hospitals should have a clear understanding of how the timing of attestation will impact their ability to collect the full amount to which they are entitled and how it may affect future stages of meaningful use.

First, it is important to note that the act of attestation does not trigger any additional deadlines as far as the CMS is concerned.

“Attestation is a required step to demonstrate meaningful use and qualify for an EHR incentive payment, so it doesn’t really trigger any deadlines within the program,” says CMS press spokesman Joseph Kuchler.

However, when a hospital attests will affect the timing of incentive payments and could also impact when it must attest for stage 2. That assumes the CMS delays stage 2, though that is expected.

“For Medicare incentives, you must qualify in consecutive years or you miss that year’s payment. So the year you first qualify affects the schedule for qualifying in future years. Medicaid doesn’t have this requirement, so there is no impact,” says Erica Drazen, managing partner of the Emerging Practices Group for CSC, who notes that, under the current schedule, a hospital that attests for stage 1 in 2011 would be required to attest for stage 2 in 2013. However, the meaningful use workgroup has recommended that stage 2 attestation be pushed back to 2014 for facilities that attest for stage 1 in 2011.

If the CMS does as most expect and delays stage 2 requirements, “That would make attesting in 2011 a clear advantage. With the current schedule, it is a trade-off between getting the money early and moving up the deadline for stage 2,” Drazen says. “If the schedule changes, the disadvantage of waiting is that you could only get two payments based on stage 1 rather than three. The money is very front-end loaded. In the first two years, you get 70% of the money and in the first three years, [you get] 90%.”

Tate concurs that there is no clear financial benefit to delaying stage 1 attestation. Indeed, he notes that many hospitals have already successfully completed the process and have begun receiving both Medicare and Medicaid payments.

“The entire registration and attestation process has been fully defined, and there are no benefits in waiting if the hospital meets the requirements for the incentives,” he says. “Many hospitals are concerned that the tight timeline between now and stage 2 would make it difficult to prepare for stage 1 and then be ready to move to stage 2. Because of this, there is an almost certainty that a one-year delay in stage 2 will be announced this summer. With this extra year of stage 1 being added, there should be plenty of time for a hospital to move forward and successfully achieve stage 1 and plan for stage 2.”

The one exception to the “don’t delay” mindset is if a hospital is truly not ready to attest for stage 1 in 2011. Doing so too soon could jeopardize a facility’s chances of receiving the full amount of incentive monies to which it is entitled.

Early attestation “will only impact them if they submit too soon, before they are fully prepared, in which case they may find that they do not fully meet the requirements and may miss out on incentive dollars,” says Vander Wal, pointing out that hospitals participating under the Medicare program have until 2012 to attest for stage 1 and still receive full incentive payments.

“Thus it may be advisable that an organization wait until 2012 to attest to ensure they are fully prepared. This will also give them the benefit of better understanding the stage 2 requirements,” he says.

Don’t Skip Stage 1
Some hospitals may be considering skipping stage 1 attestation and instead focusing their resources on qualifying for stage 2 and beyond. Most agree that this is a flawed strategy.

According to Kuchler, the program requirements “are an escalator, with stage 1 being the beginning step. As the program moves into stages 2 and 3, the number of requirements and the thresholds for meeting those requirements will increase. We believe that many hospitals will find it easier to begin the program with the lower stage 1 requirements, then add the capabilities that … stages 2 and 3 will require.”

Vander Wal concurs, noting that each subsequent stage of meaningful use builds off the previous, “meaning the clearest, simplest path is to focus on the next stage the organization needs to meet.”

Drazen notes that hospitals will need to review their approach to stages 1 and 2 once the ONC policy committee makes its final recommendation for stage 2 requirements, which is expected to take place sometime this summer.

Until then, “The best advice is to proceed ASAP to achieve meaningful use. Then you can decide when to attest based on your assessment of the risk,” she says.

— Elizabeth S. Roop is a Tampa, Fla.-based freelance writer specializing in healthcare and HIT.