March 15, 2010
Charlene Frizzera
Acting Administrator
Centers for Medicare and Medicaid Services
Department of Health and Human Services
200 Independence Avenue, SW
Washington, DC 20201
File Code: CMS-0033-P (Medicare and Medicaid Programs; Electronic Health Record
Incentive Program)
RE: Comments from Consumer and Patient Organizations on the Proposed Rule Detailing
Incentive Payments for the Meaningful Use of Certified EHR Technology
Dear Ms. Frizzera:
The 21 undersigned organizations are members of the Consumer Partnership for e-Health
(CPeH), a coalition of consumer, patient, and labor organizations working on both the national
and local levels that, since 2005, has served as a strong and diverse consumer voice advocating
for patient-centered policies related to health information technology (HIT).
Over the past year we have been greatly encouraged by the open and transparent process the
Department of Health and Human Services has undertaken to define “meaningful use” and
construct the incentive program. The Centers for Medicare & Medicaid Services (CMS), the
Office of the National Coordinator (ONC), and the National Committee on Vital and Health
Statistics (NCVHS) deserve praise for the numerous occasions they invited multi-stakeholder
input, including hosting several public hearings, listening sessions and creating an informal
public comment period on the HIT Policy Committee’s draft definition this summer. This has
led to a strong and thoughtful definition of “meaningful use” that lays important groundwork for
transforming our health care system.
We appreciate this additional opportunity to weigh in, and thank you for considering our
comments below on the Notice of Proposed Rule Making (NPRM) detailing incentive payments
for the meaningful use (MU) of certified Electronic Health Record (EHR) technology. For your
convenience, we have also included a catalogue of our specific recommendations in appendix A
and italicized them throughout this letter.
Ensuring Consumers and their Families Benefit from this Public Investment
HIT has the ability to address some of the most serious challenges patients and caregivers face in
the health care system – in particular a lack of communication and care coordination, and the
resulting medical errors, duplicative tests, and conflicting diagnoses. And better information,
1
supported and provided by electronic tools, can lead us toward better patient and family
engagement and ultimately toward more patient-centered care.
But for these benefits of HIT to be fully realized, the incentive payment program and the
definition of MU must be designed and implemented in a manner that improves health outcomes
and directly benefits consumers, patients, and their families.
These goals should not be given short shrift to other stakeholder interests. The purpose of
incentive payments for MU is not to reward and thus reinforce the status quo or simply the
digitization of paper health records. The role of public dollars is to accelerate the movement that
is already happening in the market place and ensure that it is focused on those things that make a
difference to patients and their families. For instance, there has been significant movement
around standards for facilitating provider to provider communication, but much less progress in
areas that are of most use to patients and their caregivers – such as access to drug and lab data
through PHRs or portals, and electronic discharge summaries. The MU program can and should
serve as a catalyst for stimulating innovation in these areas.
We believe the direction CMS has set with the NPRM supports this perspective. We urge you to
ensure the American public is seeing real benefits from this incredible federal investment and
resist pressure to weaken the definition by eliminating critical criteria.
Striking the Right Balance
Throughout the process of drafting this rule, ONC and CMS have made clear that their goal has
been to strike the right balance between accelerating the adoption of certified EHRs in a way that
drives significant gains in quality, safety and patient-engagement, and avoiding excessive burden
on eligible professionals (EPs) and eligible hospitals that would dampen participation. Overall
we believe that the NPRM is directionally correct – advancing key care goals while maintaining
achievability by offering significant flexibility, allowing providers to choose their starting
payment year according to the timeline that best suits their needs. In their first payment year,
providers are only required to show meaningful use for 90 consecutive days, affording them
additional time and flexibility. Providers who decide not to pursue the meaningful use incentives
in 2011 or 2012 will still have the opportunity for significant incentive payments in succeeding
years, while those that have already begun to make progress will be appropriately rewarded
(§495.4).
In addition, we believe achievability can be further buttressed by technical assistance and
alignment of the incentive program with other Federal programs and initiatives. The HITECH
Act provided for this, statutorily calling for the creation of multiple support programs and
providing for their funding. Now we must make sure these programs are administered and
implemented efficiently and effectively – a process we are pleased to see that ONC has already
begun. While Regional Extension Centers (RECs) and the national HIT Research Center
(HITRC) have figured most prominently and will certainly play a tremendous role in
implementation of the incentive program, we hope that the State Health Information Exchange
(HIE) grant program, Beacon communities, and the Strategic Health IT Advanced Research
2
Projects (SHARP) Program are utilized just as well. This will entail free, open, and rapid
sharing between and among them and the EPs and eligible hospitals they are meant to help.
Also, CHIPRA initiatives focused on the development of a model EHR format for children
enrolled in Medicaid and CHIP and the core set of children’s healthcare quality measures for
voluntary use by Medicaid and CHIP programs should be integrated into the strategy.
Nonetheless, we are aware that for some providers, especially small practices, making the
changes necessary to successfully meet all of the requirements for demonstrating MU will be
challenging. To address these concerns, the HIT Policy Committee has recommended additional
flexibility by allowing some criteria in some categories to be deferred, while making certain
criteria mandatory. If you choose to follow the HIT Policy Committee recommendation, we feel
strongly that all the criteria in the Privacy & Security and Patient Engagement categories must
be mandatory. The strength of the NPRM in advancing key care goals does not have to be
sacrificed for the sake of a low bar of achievability. Privacy and security criteria are essential for
gaining and maintaining trust in the system, and patient engagement criteria require changes that
will make the most difference to patients and their families. These changes are not likely to
occur without clear incentives for providers.
Moving Towards Patient-Centered Care
As our nation debates how to reform our health care system, there is widespread agreement that
the end goal is a patient-centered health care system that, among other things, provides the
information, communication, and engagement that people need and want. HIT can move the
health care system in this direction by utilizing capabilities that do two things: help connect
patients and families to the health care system, and connect information across silos. From our
work with consumers across the country, we know that this is what they expect from their health
care system. This is what we must work to give them in return for the resources they are giving
us to create a system that better meets their needs through HIT.
Patient Access to Information
The current lack of meaningful, actionable information is a major barrier to achieving effective
patient and family engagement. Information can support a productive relationship between
patients and their health care team; facilitate communication; catalyze self-management and self
efficacy; and encourage a culture of transparency that offers patients both comprehensive
knowledge about their health status and a role in the effectiveness and overall quality of their
care, thereby increasing trust. And engaged patients and families make it possible to achieve the
health outcomes prioritized in the rule.
The NPRM opens the door to changing the paradigm and giving patients more real-time access
to their health information in a meaningful and actionable way. This is an important step
forward, and we are very encouraged by the strong criteria included under the Health Outcomes
Policy Priority “Engage patients and their families in their health care.” As stated previously, if
you opt to follow the HIT Policy Committee’s recommendation to designate some criteria as
3
mandatory and other criteria as optional, we firmly believe that all the criteria in this category
must be classified as mandatory in order to maintain the robustness and integrity of the rule.
It has become clear since publishing the NPRM that the distinction between copy and access is
confusing. While we do not want to retire the term copy – which plays an important role in
enabling patients to access historic medical information – CMS should clarify that copy refers to
instances where a patient requests a copy of their medical information under HIPAA. The
concept of copy was included in the NPRM to establish a time frame for how soon electronic
copies of medical information must be made available to patients once requested. Given that
medical information can be provided much more quickly in an electronic world than a paperbased world, we strongly support CMS’ decision to limit the time to 48 hours (§495.6(d)(5)(ii),
§495.6(e)(3)(ii)).
Going forward the primary focus of the NPRM should be on the important capability that
supports broader patient engagement – real-time, ongoing access to information that meets the
needs of patients and their caregivers. This means information that is:
•
•
•
•
•
Accurate and complete.
Understandable in the context of the patient or caregiver’s preferred language and culture
and tailored to their specific health status.
Timely within the context of the encounter.
Connected to resources that help patients use the information to take action and manage
their health and health care.
Portable, so that patients and caregivers can access it where and when they need it and
are able to share that information with whomever they choose.
With these principles in mind, we suggest that you design the Stage One criteria around the
circumstances in which a patient can and should be provided their health information, rather
than around the concepts of copy and access:
Circumstance One is in the context of an office or hospital visit, and aligns with the
clinical summary and discharge instructions requirements for EPs and eligible hospitals,
respectively, although we suggest minor modifications to the criteria. EPs should be
required to provide clinical summaries to patients or their caregivers at each office visit,
prior to the patient leaving the provider setting. We also recommend that CMS require
clinical summaries to include patient name, provider name, date and location of visit,
reason(s) for visit, an updated medication list, laboratory and other diagnostic test orders,
procedures and other instructions based on clinical discussions that took place during the
office visit, and vital signs (§495.6(d)(7)).1
Eligible hospitals should be required to offer all patients an electronic version of their
discharge instructions and procedures at the time of discharge. This takes the onus of
asking for electronic information off the patients and caregivers, who may not know that
1
For more information about what information should be included in an after visit clinical summary, please refer to
the Center for Information Therapy’s October 2009 white paper, “The Ix After-Visit Summary (AVS).”
4
this is available. It will also increase awareness and be an effective catalyst for patient
engagement (§495.6(e)(4)).
Circumstance Two is outside the context of an office or hospital visit, for example
when a patient wants to access diagnostic test and lab results or wants to look back on old
information to track progress. Having consistent, timely access to information is critical
to supporting patients in care coordination, self management and self efficacy. This
circumstance aligns with the criterion that EPs provide patients with timely electronic
access to their health information, although we again suggest modifications. EPs should
be required to make available electronic access to health information to 50 percent of
patients within 96 hours of the information being available to the EP (§495.6(d)(6)). This
information needs to be portable – consumers and patients should have the ability to
download the information. If tethered to a Personal Health Record or other format that is
owned and controlled by a provider or insurers, they must be able to take it with them if
they end their relationship with the provider or insurer.
Information in both circumstances should be made available in the format preferred by
the patient, which could include email or external media device. Given that in an
electronic environment information should be available in much shorter timeframes than
have been reasonable in a paper environment, we believe the long-term goal should be
real-time availability of information. This is already being offered by a number of
providers, from which federal support programs could glean lessons learned. We urge
CMS to consider the merits of decreasing the lag time for making electronic information
available to patients from 96 to 48 hours.
We disagree with CMS’ decision to exclude patient education resources from the proposed rule
(Preamble Section II.A.2.d). Patients and caregivers need patient-specific education and
resource materials to help them understand their health information and facilitate selfmanagement and efficacy. Having access to information without resources that help patients
understand what it means will likely result in calls and emails to providers, something our
overburdened health care system is ill-equipped to manage. It is more effective for providers to
work with patients in the context of an office or hospital visit to identify reliable information that
meets their needs.
HIT systems can already provide patient specific information through linkages with Medline
Plus and with other well-vetted content providers. If HIT systems are not capable of generating
educational content based on this contextual information, the individual providers could use
information already gathered by the EHR to manually generate educational information for their
patients in the context of their visit, and therefore provide access to patient-specific information
by providing the materials themselves.
EHRs that support the use of contextual awareness are in fact common today.2 We do recognize,
though, that this capability is still in the pipeline for certification. We strongly encourage ONC
to include its certification in time for the 2012 rule.
2
One example is the Health Level 7 (HL-7) Clinical Context Object Workgroup (CCOW) standard, used in many
HIT systems. CCOW compliant systems today share context to generate single sign on applications and
5
For 2010, we urge CMS to reconsider requiring EPs and eligible hospitals to give patients
educational information that is specific to their health needs as identified by information
contained in their EHR technology (such as diagnoses and demographic data), and setting a
threshold of 80% of appropriate patients and/or caregivers receiving patient-specific
educational materials. To address provider concerns about accessing appropriate materials, this
criterion should be coupled with the stipulation that RECs be called on to help identify these
resources.
Communication and Care Coordination
Consumers want a health care system that facilitates communication among providers. This
includes making sure that all relevant clinical information is communicated to other members of
the care team when patients transition between facilities or get referrals. Patients, especially the
increasing number of patients with multiple chronic conditions and their caregivers, need a
health care system that protects them from problems like dangerous drug interactions,
duplicative tests and procedures, and conflicting diagnoses. Communication and coordination
are key to these goals.
The NPRM makes headway in this area – we strongly support the requirements that EPs and
eligible hospitals perform medication reconciliation at relevant encounters and each transition
of care and provide summary care records for each transition of care or referral (§495.6(c)(13),
§495.6(c)(14)). But, the Stage One criterion requiring EPs and eligible hospitals to perform a
single test of their EHR system’s capacity to electronically exchange key clinical information
to facilitate this communication and coordination is very weak. In order to require meaningful
criteria that advance the goal of having information sent and received so that it can be used to
coordinate care, rather than lower priority processes such as testing exchange, we suggest that
CMS require attestation that the criteria to perform medication reconciliation and provide
summary care records for transitions of care mentioned above were executed electronically at
least once. We would also encourage CMS to raise the threshold from one successful
transmission to a higher number of successful transmissions (§495.6(d)(8)(ii), §495.6(e)(5)(ii)).
To make this more feasible for EPs and eligible hospitals, though, we recommend a broad
interpretation of “exchange.” Recognizing that transmissions can occur through secure email,
health information exchange, or other electronic means would ensure EPs and eligible hospitals,
and, indirectly, patients and their caregivers, begin to benefit from the exchange of health
information sooner rather than later.
Consumers also want a health care system that supports providers communicating with them.
On this front, recording advance directives is one of the most direct examples of active
engagement of patients and their families in decision-making about their health care. We
disagree with the decision not to include the objective “Record Advance Directives” as
recommended by the HIT Policy Committee (Preamble Section II.A.2.d). We strongly urge you
interoperability between biomedical, telemetry and EHR systems. This same contextual awareness is used as the
cornerstone for the HL7 Infobutton standards. This contextual foundation combined with the Infobutton Standard
allow, through the push of one button, the generation of the right information for the right patient and presented in
the patient’s language.
6
to include this objective and require the documentation of the presence or absence of an advance
directive in Stage One for, at a minimum, all Medicare beneficiaries. This will not only provide
information vital to following a patient’s wishes for his or her care, but also will create
opportunities to have these important discussions with patients and families. Given that other
HIT functionality criteria include elements specific to particular providers (such as pediatricians
recording growth charts), to address concerns that recording advance directives may be less
appropriate for some specialists we suggest that this measure should apply to all eligible
hospitals and only appropriate providers (e.g. primary care providers, cardiologists, etc.).
Another important way that providers communicate with patients and caregivers is through
reminders, and requiring EPs to send reminders to patients for preventive and follow up care
is important to improving the health of our nation (§495.6(d)(4)). But, we disagree with limiting
reminders only to patients 50 years of age and older in the associated measure. Patients of all
ages need preventive care, and many have conditions that require follow up care. Reminders
should be sent based on clinical appropriateness, and patient preference (which may be receipt in
non-electronic formats or no reminders at all) – not an arbitrary age. If there is a need to more
strictly define parameters for these reminders, we would suggest that they be required for
conditions that are associated with quality measures that the EP is required to report, but our
preference remains that reminders go to all patients who need and want them. Patient
preferences for receiving reminders should be ascertained and respected.
Another essential component of communication is asking patients about their experience of
care. Patients will be the ultimate judge of whether or not EHR technology is being
meaningfully used and whether or not HIT more broadly is being used to advance patientcentered care. If the public does not notice a difference, or, worse, are unhappy with the changes
they do notice, this program and all of the resources put into it cannot be deemed a success –
regardless of adoption rates.
Thus, it is essential that in 2010 we begin to lay the groundwork for asking patients about their
experience of care. As a first step, we recommend that in 2011 EPs and eligible hospitals attest
to the percentage of their patients they have asked about their experience of care subsequent to
their adoption and use of HIT. This will lay the groundwork for the collection of patient
experience information in 2013 as recommended by the HIT Policy Committee.
Improving Care for Vulnerable Populations
Collection and Use of RELG Data
HIT has the potential to greatly improve care for vulnerable populations. The first step is
acquiring better information, which can then be used to identify what disparities exist where and
to develop strategies to reduce those disparities.
Congress clearly signaled their interest in addressing health care disparities in the HITECH Act,
and CMS appropriately followed through by requiring the collection and reporting of
standardized data on race, ethnicity, primary language, and gender as a component of MU. We
7
strongly endorse the requirement that EPs and eligible hospitals record patient demographic
data, including race, ethnicity, preferred language and gender, and encourage you to maintain
the 80 percent threshold (§495.6(c)(5)). A lower threshold may allow providers to avoid
collecting this data from particular population groups which would undermine efforts to better
understand health disparities.
We would recommend, though, that CMS clarify how data on preferred language should be
categorized and coded, to ensure uniformity in compliance. In addition, CMS should refer to a
recently released report by the Institute of Medicine called “Race, Ethnicity and Language Data:
Standardization for Health Care Quality Improvement” which makes recommendations for how
to ask questions to collect language information. This report builds on the OMB Standards, and
should be considered when implementing the collection of race and ethnicity data.
Once this information is collected, we can and must move quickly to the next step – looking at
that information. The objective “Generate lists of patients by specific conditions to use for
quality improvement, reduction of disparities, research, and outreach” and its associated measure
do not require EPs and eligible hospitals take this step. We urge you to add to this criterion that
these lists must be stratified by race, ethnicity, preferred language, and gender (§495.6(c)(9)).
Without this component the information will not actually aid in the reduction of disparities.
Future iterations of the MU definition should also require the analysis of this data.
We also recommend that EPs and eligible hospitals be required to report a demographic profile
(including race, ethnicity, preferred language and gender data) of their patients, using
aggregate data. These profiles should be used by ONC as it analyzes provider adoption rates to
see what population groups are being served by participating providers. CMS should then
analyze this information nationally to know whether or not, and to what degree, a digital divide
is mounting.
Medicaid
If HIT is implemented unevenly, disparities could increase. For this reason it is crucial that
Medicaid providers participate in the incentive program. If they do not, we could see a growing
digital divide where low-income and other underserved populations are stuck in a paper-based,
uncoordinated, error-prone system as the rest of the population reaps all the benefits of a more
connected and coordinated system.
We are largely supportive of the tack CMS has taken with Medicaid. The HITECH provision
allowing Medicare EPs and eligible hospitals to get funding in year one for adopting,
implementing, or upgrading certified EHR technology will go far in encouraging early
participation (§495.314(a)). In addition, in subsequent years having the Medicare definition
serve as the floor for the Medicaid definition will encourage basic alignment across States and
participating providers in both the Medicare and Medicaid programs (§495.4).
We are concerned, though, that Medicaid EPs and eligible hospitals that qualify for incentive
payments in their first year by adopting, implementing or upgrading certified EHR technology
are not afforded the same flexibility as Medicare EPs and eligible hospitals in their second
8
payment year. It appears that they will be required to demonstrate meaningful use for the full
year rather than 90 days in their second payment year (even though it will be their first year
demonstrating meaningful use according to the same criteria as Medicare providers) (§495.4).
This could place an unfair burden on Medicaid providers, and is inconsistent with Section
II.A.2.C of the preamble where the NPRM states CMS’ intention that:
“Medicaid EPs and eligible hospitals who qualify for an incentive payment for
adopting, implementing, or upgrading in their first payment year would follow the same
meaningful use progression outlined below as if their second payment year was their
first payment year. For instance a Medicaid EP who received an incentive for his or her
first payment year in 2010 for adopting, implementing, or upgrading would follow the
same guidance starting in their second payment year (2011) as a Medicare EP who
received an incentive for their first payment year in 2011 for meaningful use of
certified EHR technology.”
We recommend that you consider having Medicaid EPs and eligible hospitals be granted the
same 90 day reporting period in their second payment year when it is the first year they are
responsible for meeting the meaningful use criteria.
The success of the Medicaid incentive program will hinge on the support going to States and
providers. We are concerned that, even though they will get a 90 percent match (§495.322), the
Medicaid provisions rely on States to expend time and resources during an extremely difficult
economic period. While this is appropriate given that Medicaid is a state-administered program,
it could effectively exacerbate disparities if some States do not participate. We strongly
encourage CMS to monitor closely the number of states who are creating programs for their
providers – and if States are not engaging, the Federal government should be prepared to reach
out to encourage and support them. At a minimum, CMS should also publish by Fall 2010 a list
of states that are planning to participate, so that stakeholders may also reach out and encourage
their states to participate.
Drawing upon the efforts of Federal and State programs and initiatives will be especially
important to shore up implementation of the Medicaid incentive program. The Medicaid
Transformation Grant Program and other federal programs – both past and present – should be
leveraged by tasking the HITRC with disseminating lessons learned and identifying ways to
build on previous efforts. Federal programs (such as HIE grant programs, HITRC, BEACON
communities, etc.) should, like RECs, prioritize supporting providers serving rural communities
and underserved populations, which tend to have higher Medicaid populations. These options
have been considered to varying degrees, but more planning needs to go into how these programs
and initiatives will be coordinated to maximize benefits.
Measuring and Reporting Clinical Quality
Quality measurement and reporting is foundational to reforming the health care system. It
allows patients to have confidence that new delivery and payment models will not skimp on care
to cut costs. It keeps providers informed about how they are performing, what their strengths
9
and weaknesses are, and how they fare compared to their peers. And, in a time of
transformation, quality measures will let us know if we are making progress, if the changes we
are implementing are delivering on their promise to improve the quality of our health care
system.
We strongly believe the rule should retain the requirement that EPs and eligible hospitals report
summary information on clinical quality measures in 2011, an essential part of achieving the
HITECH goal of improving health care quality through the meaningful use of technology
(§495.6(d)(3), §495.6(e)(2), and as elaborated on in Preamble Section II.A.3). Requiring EPs
and eligible hospitals to report on clinical quality in 2011 will incentivize them to begin
evaluating their performance in order to make changes necessary to improve. This is an
important step in ensuring the ability for providers to participate fully and effectively in future
value-based purchasing or pay for performance programs.
We also very much support the requirement that EPs and eligible hospitals submit aggregate
data, rather than individually-identifiable patient-level data, for clinical quality measures.
Aggregate data is just as effective in measuring and reporting on clinical quality, yet without the
privacy risks inherent in transmitting patient-level identifiable data.
We agree with CMS that the long list of clinical quality measures presented in the rule needs to
be streamlined to be effective, especially for hospitals (Preamble Section II.A.3). Quality
measures selected for use by providers should advance measures that matter to patients and their
families. Such measures include:
•
•
•
•
•
Outcomes measures (such as functional health status, morbidity, mortality, and health
care acquired conditions);
Care coordination measures;
Patient experience measures;
Measures that show gaps in equity (disparities); and
Efficiency measures (such as the percentage of orders for high-cost imaging services with
specific indications recorded through the use of CPOE, and the percentage of medications
ordered as generics).
With some of these measures still in the development phase, we recommend that in the mean
time CMS retain robust process measures that are associated with outcomes (a.k.a. intermediate
outcomes measures) and support the ongoing process to develop measures appropriate in an
electronic environment.
To further minimize the burden on EPs and eligible hospitals, CMS should drop redundant and
non-high yield measures. CMS should give precedence to exemplar measures that require the
processes we want to occur with the support of HIT. Priority should also be given to measures
that require clinical rather than administrative data, given that this capability is one of the main
benefits of EHRs. Similarly, measures selected for demonstrating meaningful use of information
technology should not require manual tallying. In addition, chosen measures should
complement proposed alignment of clinical measures with other federal initiatives, such as PQRI
and RHQDAPU. We are also in favor of the intention to support all-payer reporting.
10
Moving forward, measures for additional clinical areas, such as pediatrics, long-term care,
obstetrics, dental/oral health, mental health and substance abuse will be critical to achieving
widespread gains in clinical quality. We encourage their inclusion in the Stage Two definition.
Establishing and Maintaining Trust
Privacy and Security
For patients to support the use of HIT, it is critical that their personal health information be
protected. While the proposed rule includes some provisions, we are concerned that it does not
go far enough to ensure that providers are using appropriate safeguards. We endorse the HIT
Policy Committee’s recommended changes to the Privacy & Security criteria to shore up these
provisions.
The requirement that EPs and eligible hospitals conduct risk assessments of their EHR system is
vitally important (§495.6(c)(17)(ii)), but CMS should make it clear that for EPs and eligible
hospitals who have never conducted a HIPAA security risk analysis, the requirement is to
conduct such an analysis (not review). The option to review risk analyses should only be for
those entities that have recently conducted a security risk analysis and have not added new HIT
capabilities. EPs and eligible hospitals should also be given guidance on how to conduct an
appropriate security risk assessment, preferably issued by the Office of Civil Rights.
In addition, CMS should clarify what is meant by “implement security updates as necessary”
(§495.6(c)(17)(ii)). Preferably, EPs and eligible hospitals should be required to have a written
policy regarding how they will handle security updates, and they should also address any
deficiencies identified in the security risk assessment. Attestation on the risk assessment should
indicate that a risk analysis was conducted AND that the entity has mitigated any risks that were
identified. CMS should then perform audits of a random sample of attestation surveys.
CMS should also require EPs and eligible hospitals to certify by attestation that they are using
the privacy and security capabilities outlined in the initial set of standards, implementation
specifications, and certification criteria issued on December 30, 2009 by the Office of the
National Coordinator. The rule should also make clear that MU criteria regarding uses of health
information do not override existing state or federal law setting parameters around access, use
and disclosure of health information.
We strongly support the HIT Policy Committee’s recommendation that CMS rule that EPs and
Hospitals have not met MU privacy and security objectives if they have been found liable (or
guilty) and fined for a significant civil or criminal HIPAA violation. With respect to civil
penalties, this provision should apply only in instances of willful neglect (top two penalty tiers) –
not in cases of lack of knowledge or reasonable cause. In cases where the appeals process is not
resolved until years later, and payment of incentives has already been made, the entity should be
subject to overpayment recoupment if the fine is upheld. The bottom line should be clear: EPs
and eligible hospitals fined for significant HIPAA violations should not be eligible for
meaningful use payments.
11
Protecting Against Fraud and Abuse
While we expect to see a much more robust method of validating meaningful use in the future,
we recognize the need to utilize attestation in the initial year of incentives (§495.8). To ensure
that public dollars are not wasted on fraud, though, we believe that attestation should be
accompanied by additional authentication and enforcement provisions. CMS ought to perform
audits of a random sample of attestation surveys. These audits could be performed by any one of
a number of organizations, such as Regional Extension Centers, the HHS Office of Inspector
General, or the Government Accountability Office. Any providers found to be making false
claims should be penalized and listed in a public report posted on CMS’ website.
Meaningful Use Must Benefit Patients & Families
As consumer representatives, we particularly appreciate the opportunity to have our voices heard
throughout the design of this program. We are at a moment of incredible opportunity – all
stakeholders recognize that our health care system is broken and unsustainable, and there is
significant federal funding at the table through the American Recovery and Reinvestment Act of
2009 to begin transforming our system through the use of health information technology. We
can realize the common vision of a patient-centered health care system that delivers the right
care, at the right time, in the right setting, if consumers’ needs, preferences, and values are heard
and incorporated into the design, of which the definition of meaningful use is a critical
component.
The NPRM builds a foundation for change. It strikes the right balance between transformative
and achievable. We strongly urge you to maintain this robust direction for MU and address
concerns that it is too challenging by offering ample support in the form of technical and other
assistance. Rather than weakening the rule, and thus undermining much needed progress, we can
take full advantage of this opportunity by harnessing and aligning the efforts of the numerous
State and Federal programs at our disposal and make great strides towards a patient-centered
health care system backed by HIT.
Thank you for considering our comments. We look forward to working with you to ensure the
evolving definition of MU delivers on the promise to transform our health care system into one
that puts patients and families first.
Sincerely,
AARP
American Federation of State, County and Municipal Employees (AFSCME)
American Hospice Foundation
Asian & Pacific Islander American Health Forum
Center for Advancing Health
Center for Democracy & Technology
Center for Medical Consumers
12
Center for Medicare Advocacy
Childbirth Connection
Consumers Union
“e-Patient” Dave deBronkart, Founding Co-chair, Society for Participatory Medicine
Healthwise
International Union, United Automobile, Aerospace & Agricultural Implement Workers of
America (UAW)
Mental Health America
National Consumers League
National Family Caregivers Association
National Health Law Program
National Partnership for Women & Families
SEIU
Summit Health Institute for Research and Education, Inc. (SHIRE)
The Children’s Partnership
13
APPENDIX: Catalogue of Specific Recommendations
§495.4
• Retain provision defining the EHR Reporting Period for incentive payments as any
continuous 90-day period within the first payment year and the entire payment year for
all subsequent payment years, but add stipulation that Medicaid EPs and eligible
hospitals be granted a 90 day reporting period in their second payment year when it is the
first year they are responsible for demonstrating MU.
• Retain provisions basing the payment year on the first calendar or Federal fiscal year for
which an eligible provider (EP) or eligible hospital, respectively, demonstrates MU (or in
the case of Medicaid, adopts, implements, or upgrades certified EHR technology).
§495.6(c)
• If you choose to follow the HIT Policy Committee recommendation to provide for
additional flexibility by allowing some criteria in some categories to be deferred, while
making certain criteria mandatory, all the criteria in the Privacy & Security and Patient
Engagement categories must be mandatory.
• Adopt criterion requiring EPs and eligible hospitals to give patients educational
information that is specific to their health needs as identified by information contained in
their EHR technology, with a threshold of 80% of appropriate patients and/or caregivers
receiving patient-specific educational materials. Couple this criterion with the stipulation
that RECs be called on to help identify these resources.
• Adopt criterion requiring appropriate EPs (e.g. primary care providers, cardiologists) and
all eligible hospitals to record the presence or absence of an advance directive for, at a
minimum, all Medicare beneficiaries.
• Adopt criterion that EPs and eligible hospitals attest to the percentage of their patients
they have asked about their experience of care, subsequent to HIT adoption and use.
• Adopt criterion that EPs and eligible hospitals report a demographic profile (including
race, ethnicity, preferred language and gender data) using aggregate data, to be used to
address disparities.
§495.6(c)(5)
• Retain requirement that EPs and eligible hospitals record patient demographic data,
including race, ethnicity, preferred language and gender for 80 percent of all unique
patients.
• Incorporate recommendations from the Institute of Medicine report “Race, Ethnicity and
Language Data: Standardization for Health Care Quality Improvement” on how to ask
questions to collect REL data.
• Clarify how data on preferred language should be categorized and coded.
§495.6(c)(9)
• Require that lists be stratified by race, ethnicity, preferred language and gender.
§495.6(c)(13)
• Retain medication reconciliation criterion.
14
§495.6(c)(14)
• Retain summary care record criterion.
§495.6(c)(17)
• Clarify that for EPs and eligible hospitals who have never conducted a HIPAA security
risk analysis, the requirement is to conduct such an analysis (not review). The option to
review risk analyses should only be for those entities that have recently conducted a
security risk analysis and have not added new HIT capabilities.
• Clarify what is meant by “implement security updates as necessary.” Preferably, EPs and
Hospitals should be required to have a written policy regarding how they will handle
security updates, and they should also address any deficiencies identified in the security
risk assessment.
• Require EPs and eligible hospitals to attest that the risk analysis was conducted and the
entity has mitigated any risks that were identified.
• Clarify that this criteria does not override existing state or federal law setting parameters
around access, use and disclosure of health information.
• Require EPs and eligible hospitals to certify by attestation that they are using the privacy
and security capabilities outlined in the initial set of standards, implementation
specifications, and certification criteria issued on December 30, 2009 by the Office of the
National Coordinator.
• Rule that EPs and Hospitals have not met MU privacy and security objectives if they
have been found liable (or guilty) and fined for a significant civil or criminal HIPAA
violation.
§495.6(d)(4)(ii)
• Change measure to “Reminder sent to at least 50 percent of all unique patients seen by
the EP per patient preference” (removing stipulation the reminders are only required for
patients 50 years of age and over).
• If there is a need to more strictly define parameters for these reminders, require reminders
only for conditions that are associated with quality measures that the EP is required to
report.
§495.6(d)(5)(ii), §495.6(e)(3)(ii)
• Clarify that copy refers to instances where a patient requests a copy of their medical
information under HIPAA.
• Retain measure requiring that at least 80 percent of all patient requests for an electronic
copy of their health information are provided it within 48 hours.
§495.6(d)(6)
• Change measure to “Make available electronic access to health information (including
diagnostic test results, problem list, medication lists, and allergies) within 96 hours of the
information being available to the EP).
• Change objective to “Make available electronic access to health information (including
diagnostic test results, problem list, medication lists, and allergies) to 50 percent of
patients within 96 hours of the information being available to the EP.”
• Consider merits of decreasing time frame from 96 hours to 48 hours.
15
§495.6(d)(7)
• Clarify that EPs should be required to provide clinical summaries to patients or their
caregivers at each office visit prior to the patient leaving the provider setting.
• Require the following information to be included in a clinical summary: patient name,
provider name, date and location of visit, reason(s) for visit, updated medication list,
laboratory and other diagnostic test orders, procedures and other instructions based on
clinical discussions that took place during the office visit, and vital signs.
§495.6(d)(8)(ii), §495.6(e)(5)(ii)
• Replace the criteria requiring the test of electronic exchange with a requirement that EPs
and eligible hospitals attest that the criteria to perform medication reconciliation and
provide summary care records for transitions of care were executed electronically at least
once.
§495.6(e)(4)
• Change measure to “Offer all patients an electronic version of their discharge instructions
and procedures at time of discharge.”
• Change objective to “An electronic version of discharge instructions and procedures are
available and offered to at least 80 percent of all patients who are discharged from an
eligible hospital or CAH.”
§495.8
• Perform audits of a random sample of attestation surveys. These audits could be
performed by any one of a number of organizations, such as Regional Extension Centers,
the HHS Office of Inspector General, or the Government Accountability Office. Any
providers found to be making false claims should be penalized and listed in a public
report posted on CMS’ website.
Subpart D (Requirements Specific to the Medicaid Program)
• CMS should closely monitor the number of states who are creating programs for their
providers – and if States are not engaging, the Federal government should be prepared to
reach out to encourage and support them.
• CMS should publish by Fall 2010 a list of states that are planning to participate.
Preamble Section II.A.3 (implemented by §495.6(d)(3), §495.6(e)(2))
• Retain requirement that EPs and eligible hospitals report summary information on
clinical quality measures in 2011.
• Retain robust process measures that are associated with outcomes (a.k.a. intermediate
outcomes measures).
• Give precedence to exemplar measures and those that require clinical rather than
administrative data.
• Drop redundant and non-high-yield measures, and measures that require manual tallying.
• Support the ongoing process to develop measures that matter to patients and their
families that are appropriate in an electronic environment.
16