Feds aim to audit 5% of participants in EHR program

About one in 20 participants in the federally funded electronic health-record incentive payment program can expect to be audited for compliance with meaningful use and other program criteria, a federal official said Monday.

In January, the CMS extended a second arm to its audit program for the EHR incentive payment program under the American Recovery and Reinvestment Act, adding payment applicants to an audit target list that since October 2012 has included only providers whose payments already have been received.

Pre-payment and post-payment audits will garner roughly equal amounts of federal attention going forward, with a goal of auditing 5% of program participants overall, Robert Anthony, deputy director of the HIT Initiatives Group at CMS, said in a telephone update of federal audit efforts thus far.

“It's only recently that some of the adverse-finding letters have gone out,” Anthony said. So far, there have not been many, “although some of that may be timing,” since it's still early in both programs. A few providers with adverse audit determinations are just beginning the appeal process, he said. Several providers have been referred for possible fraud enforcement investigation and action.

“We didn't find them in the process of going through an audit, but we've had them reported to us from other folks,” he said.

Most of the reviews will be “desk audits” conducted by the CMS' audit contractor, Figliozzi and Co., with information exchanged electronically, although a few on-site audits could be conducted, Anthony said.

One of the most common problem areas turned up by auditors thus far has been noncompliance with the requirement that providers complete a data security risk assessment, also a requirement under the Health Insurance Portability and Accountability Act of 1996. A finding of non-compliance with HIPAA could be shared with the Office for Civil Rights at HHS, Anthony said. The civil rights office wrapped up its own series of 115 random HIPAA privacy and security audits in December. A final report on those audits is expected soon, according to a civil rights office spokeswoman.

“We're certainly seeing some instances where people haven't done them or people just aren't sure what they're supposed to be doing,” Anthony said. “There are not additional requirements here beyond HIPAA.” But, he said, “They need to have something in their risk analysis that is specific to their EHR. It doesn't have to be all about the EHR. It needs to be stated and indicated that it's about your practice.”

Another common problem area in the audits thus far has been a lack of adequate documentation for responses to some of the “yes or no” meaningful use criteria, such as, whether the system has been tested for the exchange of clinical information, or the electronic submission of data to a public health agency. Documentation must be available whether or not those actual transmissions were successful.

“There are some EHR systems that have an audit log that can show that for an entire reporting period,” Anthony said, but other systems cannot, so if not, other arrangements—such as capturing a computer screen shot or receiving a letter from a public health agency—must be made to document the required test or transfer was accomplished.

These records need to be retained for six years, according to a two-page guidance (PDF) about the audit program and a six-page audit fact sheet about needed supporting documentation posted on the CMS web site (PDF).

In December, HHS' Inspector General issued a report critical of CMS' oversight of the EHR incentive payment program, particularly noting that CMS was not conducting pre-payment audits.

At the time, acting CMS Administrator Marilyn Tavenner, in a letter responding to a draft of the OIG report, said pre-payment audits were unnecessary and would “significantly delay payments to providers.”

Some of the time lag, “really depends on the providers,” Anthony said. Many audits “can be fairly routine” and “can be processed fairly quickly,” he said.

Typically, an EHR incentive payment can be made within eight to 12 weeks of attestation by the provider that they've met meaningful use criteria. “Those who respond quickly,” to their audit notification and provide the requested information, “it really should delay payment by about four to six weeks,” he said. But, “there are others who have asked for considerable time” to respond, he said.

Through February, 234,065 organizations—3,781 hospitals and 229,684 physicians and other “eligible professionals”—have received EHR incentive payments totaling nearly $12.7 billion, according to the latest CMS data.

Follow Joseph Conn on Twitter: @MHJConn