ONC Publishes Gap Analysis Guidance for HIEs

Webinar Slides with Audio Recording to Come of Technical Assistance Session
Office of National Coordinator for Health IT published slide set of July 16, 2010 Technical Assistance Webinar for State Health Information Exchange and Health IT Coordinators.
Slide Set (PDF)
State HIE Leadership Forum Presentation Page which contains Slide Set, as well as audio recording once it becomes available.

“What is the State HIE Gap Analysis?
“The gap analysis analyzes state capacity and gaps in supporting key meaningful use requirements:
– % pharmacies accepting electronic prescribing and refill requests
– % clinical laboratories sending results electronically
– % health plans supporting electronic eligibility and claims transactions
– % health departments receiving immunizations, syndromic surveillance, and notifiable laboratory results”

“Why Do  a Gap Analysis Now?
–A gap analysis is a critical part of the environmental scan
–This is critical information to design viable strategies and approaches to address the gaps in your state
–Having a baseline will allow states to monitor and document progress made in addressing HIE gaps”

“Key Objectives for 2011
 The immediate priority of the State HIE program is to ensure that all eligible providers within every state have at least one option available to meet the MU HIE requirements for 2011
–States should have a concrete and operationally feasible plan to enable three HIE capabilities in the next year:
– e-Prescribing
– Receipt of structured lab results
– Sharing patient care summaries across unaffiliated organizations”

“What Information is Required in the State HIE Gap Analysis?
“An understanding of the health information exchange currently taking place in the state”
          – Baseline information, including specific measurements related to eprescribing, patient care summaries, and lab interoperability
“Gaps in HIE as identified in the environmental scan”
          – Identify areas where your baseline information does not match requirements for Stage 1 Meaningful Use
“A strategy and work plan to address the gap”
          – Identify solution strategies to close the identified gaps”

Webinar slides contain case studies from California and Kentucky.

CMS/ONC Release First Training Session Slides on EHR Incentive Programs, Meaningful Use, Certification

Final Rules Overview by CMS and ONC: Two Slide Sets
Training #1: CMS EHR Incentive Programs and Meaningful Use
Training #2: ONC Temp Certification Process and Certification Standards Final Rule
New Fact Sheets
On July 22, 2010, Centers for Medicare and Medicaid Services (CMS) sponsored its first educational event with the Office of the National Coordinator for Health IT on the EHR incentive program and the requirements for meaningful use. 

The session offered its audience to “Learn about the Medicare and Medicaid EHR incentive programs, certification standards, temporary certification process and the requirements for meaningful use in this public conference call. Also hear about local resources regarding EHR adoption.” 

Mary Stevens of CMIO, reported on the Webinar in an article published July 25, 2010, which quoted David Blumenthal, National Coordinator for Health IT, saying ““We’re beginning a revolution the way information is collected, managed, used and purposed for patients in the U.S. healthcare system.”

Training Slide Sets
July 22, 2010 Training CMS EHR Incentive Programs and Meaningful Use Final Rule Slides [PDF, 298KB]  

July 22, 2010 Training ONC Temp Certification Process and Certification Standards Final Rule Slides [PDF, 126KB] 

An audio recording for this educational session will be available in August 2010 according to CMS. Additional educational events are planned for August 2010 as well. 

Fact Sheets AND FAQs Released by CMS on July 16, 2010. 
Fact Sheet: Medicare EHR Incentive Program Final Rule Overview (July 16, 2010) 

Fact Sheet: Medicaid EHR Incentive Program Final Rule Overview (July 16, 2010) 

Fact Sheet: Meaningful Use Final Rule Overview (July 16, 2010) 

Health IT Frequently Asked Questions  

Fact Sheet: Electronic Health Records At-a-Glance (July 13, 2010)

Fact Sheet: Final Regulations Define Meaningful Use Standards for EHR Incentive Programs (July 13, 2010)

eHealth Initiative: 2010 Survey on Health Information Exchange

eHealth Initiative’s National Survey on Health Information Exchange (HIE) Shows Progress on Cost Savings and Patient Access; Government Mandates and Sustainability Cited as Concerns
–Tues, July 27 Webinar on Survey
(see end of this post)
eHealth Initiative Press Release produced in full:

WASHINGTON, DC – July 22, 2010 – Today, the eHealth Initiative (eHI) released a new report entitled The State of Health Information Exchange in 2010: Connecting the Nation to Achieve Meaningful Use. The report identifies significant growth in the industry, as well as rising concerns related to new government policies, and an increased focus on patients. The report was shared with several hundred state and industry leaders during the National Forum on Health Information Exchange in Washington, DC.

The eHealth Initiative has been tracking the progress of health information exchange initiatives for seven years. This year, eHI identified 234 active health information exchange initiatives across the country and 199 organizations responded to the annual survey.

Several key findings emerged from the survey results:
Despite recent funding, significant challenges exist to supporting provider attainment of meaningful use.
The survey revealed that despite expanding capabilities, the ability of HIEs to support
providers as they become Stage 1 meaningful user will be challenged by the current number of operational exchanges and current capacity of health information exchange initiatives.

“From the results, it is clear that health information exchange initiatives are focused on supplying the services that will help providers reach their targets,” Commented Micky Tripathi, PhD, President and CEO of Massachusetts eHealth Collaborative. “While we’re on the right track with the service offerings, we still haven’t achieved the necessary critical mass of participation.”

More research is needed to determine the key characteristics of sustainable systems.
The report confirms that sustainability remains one the key challenges before the initiatives. The State Designated Entities (SDEs) are new entrants in the field, and it is not clear what will be their impact on the initiatives.

“The State Designated Entities (SDEs) are poised to foster growth across the field of health information exchange,” said Dr. Marc Overhage, Director of Regenstrief Institute and CEO of Indiana Health Information Exchange. “Among other challenges, the SDEs are going to face the question how to keep the doors open once the federal funding ends. Failure to sustain the SDEs may hinder the overall advancement of health information exchange.”

New challenges are rapidly emerging related to federal policy and governance of the health information exchanges.
131 initiatives cited addressing government policy mandates as a major challenge.

More organizations are reporting cost savings through reductions in staff time and redundant testing through the use of health information exchange.
More initiatives reported health information exchange had reduced staff time spent on clerical administration and filing (33); reduced staff time spent on handling lab and radiology results (30); and decreased dollars spent on redundant tests (28).

Health information exchange initiatives have increased their focus on patients.
Initiatives are providing greater access to patients to not only view (44 in 2010 up from 3 in 2009), but to also update their health information (31 in 2010 up from 7 in 2009).

“There is definite progress here, but it doesn’t mean we can rest on our laurels,” noted Jennifer Covich Bordenick, CEO at eHealth Initiative. “More initiatives and providers need to document cost savings, and promote services that involve patients in their healthcare.”

The report and an interactive map of health information exchange activity are available on the eHI website at: www.ehealthinitiative.org

Printing and dissemination of the survey report was supported by: Axolotl, Microsoft, Navinet, Partners HealthCare and Thompson Reuters.

###

About eHealth Initiative
The eHealth Initiative (eHI) is an independent, non-profit, multi-stakeholder organization whose mission is to drive improvements in the quality, safety, and efficiency of healthcare through information and information technology (IT). eHI is the only organization that represents all of the stakeholders in the healthcare industry. eHI advocates for the use of HIT that is practical, sustainable and addresses stakeholder needs, particularly those of patients.

For more information, visit www.ehealthinitiative.org .
###

As the report notes “The survey data is self-reported and offers a non-scientific snapshot of the field.”  The methodology section also explains that “not all respondents answered each question, so a selection bias may exist.”

Front Page of Report
Go to front page of report to Download PDFs of “Full Report” and “Key Charts and Graphs” from left navigation bar.

Key components of report

  • Key Findings
  • Close-up Look at the SDEs
  • Close-up Look at the Sustainable Initiatives
  • Interviews with Spotlight HIEs (content to come as of 7/23/10)
  • FAQs
  • Financing and Sustainability (available in PDF version)
  • Privacy and Confidentiality (available in PDF version )
  • Looking Forward (available in PDF version)
  • Methodology (available in PDF version) 

    HIE Survey Webinar — Tuesday, July 27, 2010
    3:00pm to 4:00pm ET
    eHealth Initiative will present results of Seventh Annual Survey on HIE.
    Click here to register.

  • Health Information Exchange: From Princeton to Washington, DC Conferences

    July 22, 2010: HIE Day in Two Cities
    WASHINGTON, DC (July 22, 2010) — With more than 400 delegates to the National HIE Summit from 38 states meeting in the nation’s capital today and over 125 delegates to the New Jersey HIE Summit & Expo meeting in Princeton, NJ, you can see federalism at work in Health IT.

    In the Washington, DC Conference produced by the national eHealth Initiative, and hosted at the Omni Shoreham Hotel, the the topics of the day are:
    Getting Started: What to do first?
    Sustainability: What works?
    Getting to Meaningful Use
    Inter-State Coordination
    Understanding and Connecting to the NHIN
    Engaging Consumers in Health Information Exchange
    Measuring Your Progress: What Really Matters?
    Beyond Implementation: Planning for Privacy

    The Washington session ends with a networking reception.

    The Princeton, NJ Conference produced by NJTC (New Jersey Technology Council), and hosted at the New Jersey Hospital Association Conference Center, will cover:
    NJ Health IT Extension Center (NJ-HITEC)
    Colleen Woods, newly appointed Statewide Health IT Coordinator for New Jersey, will make a presentation.
    Components of a Successful HIE
                     Developing a Sustainable Business Model for HIE
                     Managing an Effective Procurement Process
                     Engaging and Supporting Physicians in the Adoption of Heath IT
                     Building Public Private Sector Partnerships for HIE
    HIPAA HITECH – Audits, Breaches & Fines
    Navigating the Winding Road
                     Know Your Obligations
                     Identify and Address Gaps
                     Security Rule Compliance
                     Test Your Program and Consider Lessons Learned now Your Obligations
    HIE Privacy, Security and Compliance
                     Understanding Meaningful Use Requirements
                     Understanding and Applying the New Standards Requirements
                     Developing and Implementing Strong Privacy and Security Policies
                     Advancing Administrative Simplification Efforts

    Technologies that Transform Patient Care    

    The Princeton session ends with an ice cream reception.   

    Personal Notes
    In Princeton, Vikas Khosla, President and CEO of  BluePrint Healthcare IT (and my boss), is participating in a panel discussion and focusing on  ”Developing and Implementing Strong Privacy and Security Policies” and joining two of my colleagues Gregory Michaels, Director, Security and Compliance; and Pam Kaur, Client Services Team Lead, who will be attending and working BluePrint’s exhibit table.

    In Washington, as VP, Strategic Development and Public Policy, for BluePrint (and as e-Healthcare Marketing blogger), I will be listening, learning, meeting, and greeting state HIE coordinators and Health IT folks from across the country. And we’ll compare notes when the day is done.

    BluePrint also issued a press release July 21, 2010 announcing two products that support secure health information exchange by lowering barriers to HIE interoperability and promoting patient confidence: HIE Secure and EMR Secure.

    While e-Healthcare Marketing independently collects and reports information on Health IT including EHRs, ONC, CMS, and public policy, a view of the blogger and his business colleagues seemed worth noting today. Thank you for reading.
    Mike Squires

    NJ Health IT Coordinator Colleen Woods Appointed

    Governor Christie Taps Colleen Woods as Statewide Health Information Technology Coordinator
    Press Release from NJ Governor Christies’ office.
    Trenton, NJ – (July 2, 2010) Governor Chris Christie today announced the appointment of Colleen M. Woods as New Jersey’s Statewide Health Information Technology (HIT) Coordinator.  Ms. Woods will be responsible for working with all state departments and agencies, the healthcare provider community, and other key stakeholders, to implement and facilitate the HIT movement across the State and in accordance with nationally recognized Federal standards. 

    “New Jersey has been at the forefront of promoting the meaningful use of heath information technology and exchange to help improve health care outcomes for our citizens,” said Governor Christie. “I am pleased to have an individual with Colleen’s caliber of expertise to spearhead New Jersey’s health information technology efforts.”

    Ms. Woods brings over 20 years of technology experience working for the State of New Jersey to the position.  She most recently served as the Chief Information Officer for the New Jersey Department of Human Services and recently received the IT Hero award from the New Jersey Mental Health Association.  She has a Masters degree from Rutgers University. 

    “It is an exciting time in the healthcare community, and I look forward to working with all of the stakeholders, both in the state and nationally, to improve the delivery and quality of healthcare,” Ms. Woods said.

    Nationally, health information technology is playing a critical role in achieving improved healthcare by reducing duplicative or unnecessary testing; strengthening disease management efforts; improving overall care coordination and reducing costs.

    Recently, New Jersey was awarded $5 million in federal funds to support the State’s Medicaid HIT Planning (SMHP) process that will implement an electronic health record (EHR) incentive program. In addition, the New Jersey Institute of Technology (NJIT) was awarded a federal grant of over $23 million to become a state designated Regional Extension Center (REC) to further promote HIT related training, innovation lab, awareness and education of the use of EHR technology. 

    New Jersey also is receiving $11.4 million in federal funds over the next four years to fund electronic health records projects that will create four regional Health Information Exchanges (HIEs) that will share information among health care providers around the state. 

    The Statewide Health Information Technology Coordinator will report directly to the Governor’s Office.
    #                         #                           #

    Daily message from New Jersey Hospital Association on Friday, July 9, 2010.
    Gov. Christie Appoints Woods to Lead Health Information Technology Initiative
    Gov. Chris Christie recently appointed Colleen Woods to the position of Health Information Technology (HIT) Coordinator.

    Woods will be responsible for working with all state departments and agencies, the healthcare provider community and all other industry stakeholders to implement and facilitate HIT adoption across the state and in accordance with nationally recognized federal standards.

    Woods has over 20 years of HIT experience and previously served as chief information officer for the state Department of Human Services. Woods also has been a member of the NJ HIT Commission since its inception and served on the New Jersey State Medicaid HIT Project Steering Committee.

    “For many years Colleen has provided a tremendous amount of technical leadership and served as a tireless advocate for the adoption of HIT. NJHA applauds Gov. Christie’s appointment, and we look forward to supporting her in this important work,” said Joe Carr, NJHA’s chief information officer.
    #                       #                      #

    Colleen Woods, newly appointed NJ State HIT Coordinatorm will share her vision of NJ’s plan to obtain the maximum stimulus dollars for HIT.

    Woods added to NJTC HIE Summit & Expo Agenda
    July 22 at NJHA, Princeton

    Final Rule on Meaningful Use, Certification, Standards Announced

    SECRETARY SEBELIUS ANNOUNCES FINAL RULES TO SUPPORT MEANINGFUL USE OF ELECTRONIC HEALTH RECORDS
    July 13, 2010 Press Release from Centers for Medicare and Medicaid Services

    Plus PDFs of Final Rules, Joint ONC/CMS Fact Sheet,
    ONC and CMS Fact Sheets and FAQs
    Blumenthal article from NEJM with Summary Matrix
    ————————————————————————————————
    KEY LINKS:
    Summary of
    The “Meaningful Use” Regulation for Electronic Health Records
    By David Blumenthal, MD, MPP, National Coordinator for Health IT
    and Marilyn Tavenner, RN, MHA, Principal Deputy Administrator of CMS
    New England Journal of Medicine, July 13, 2010
    Includes matrix with Summary Overview of Meaningful Use Objectives
    HTML Version               PDF Version 

    Finding My Way to Electronic Health Records
    By Regina Benjamin, MD, MBA, Surgeonn General, US Public Health Service
    New England Journal of Medicine, July 13, 2010
    HTML Version                 PDF Version 

    FINAL RULES
    Medicare and Medicaid Programs;
    Electronic Health Record Incentive Program [PDF]

    http://www.ofr.gov/OFRUpload/OFRData/2010-17207_PI.pdf 

    Health Information Technology:
    Initial Set of Standards, Implementation Specifications,
    and Certification Criteria
    for Electronic Health Record Technology [PDF]
    http://www.ofr.gov/OFRUpload/OFRData/2010-17210_PI.pdf 
    ———————————————————————————————
    July 13, 2010 Press Release from CMS:
    WASHINGTON – U.S. Department of Health and Human Services Secretary Kathleen Sebelius today announced final rules to help improve Americans’ health, increase safety and reduce health care costs through expanded use of electronic health records (EHR). 

    HHS Secretary Kathleen Sebelius

    HHS Secretary Kathleen Sebelius

    “For years, health policy leaders on both sides of the aisle have urged adoption of electronic health records throughout our health care system to improve quality of care and ultimately lower costs,” Secretary Sebelius said.  “Today, with the leadership of the President and the Congress, we are making that goal a reality.” 

    Under the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, eligible health care professionals and hospitals can qualify for Medicare and Medicaid incentive payments when they adopt certified EHR technology and use it to achieve specified objectives.  One of the two regulations announced today defines the “meaningful use” objectives that providers must meet to qualify for the bonus payments, and the other regulation identifies the technical capabilities required for certified EHR technology.  

    Announcement of today’s regulations marks the completion of multiple steps laying the groundwork for the incentive payments program.  With “meaningful use” definitions in place, EHR system vendors can ensure that their systems deliver the required capabilities, providers can be assured that the system they acquire will support achievement of “meaningful use” objectives, and a concentrated five-year national initiative to adopt and use electronic records in health care can begin. 

     “This is a turning point for electronic health records in America , and for improved quality and effectiveness in health care,” said David Blumenthal, M.D., National Coordinator for Health Information Technology.  “In delivering on the goals that Congress called for, we have sought to provide the leadership and coordination that are essential for a large, technology-based enterprise.  At the same time, we have sought and received extensive input from the health care community, and we have drawn on their experience and wisdom to produce objectives that are both ambitious and achievable.” 

    Two companion final rules were announced today.  One regulation, issued by the Centers for Medicare & Medicaid Services (CMS), defines the minimum requirements that providers must meet through their use of certified EHR technology in order to qualify for the payments.  The other rule, issued by the Office of the National Coordinator for Health Information Technology (ONC), identifies the standards and certification criteria for the certification of EHR technology, so eligible professionals and hospitals may be assured that the systems they adopt are capable of performing the required functions. 

    As much as $27 billion may be expended in incentive payments over ten years.  Eligible professionals may receive as much as $44,000 under Medicare and $63,750 under Medicaid, and hospitals may receive millions of dollars for implementation and meaningful use of certified EHRs under both Medicare and Medicaid. 

    The CMS rule announced today makes final a proposed rule issued on Jan, 13, 2010.  The final rule includes modifications that address stakeholder concerns while retaining the intent and structure of the incentive programs.  In particular, while the proposed rule called on eligible professionals to meet 25 requirements (23 for hospitals) in their use of EHRs, the final rules divides the requirements into a “core” group of requirements that must be met, plus an additional “menu” of procedures from which providers may choose.  This “two track” approach ensures that the most basic elements of meaningful EHR use will be met by all providers qualifying for incentive payments, while at the same time allowing latitude in other areas to reflect providers’ needs and their individual path to full EHR use. 

    “CMS received more than 2,000 comments on our proposed rule,” said Marilyn Tavenner, Principal Deputy Administrator of CMS.  “Many comments were from those who will be most immediately affected by EHR technology – health care providers and patients.   We carefully considered every comment and the final meaningful use rules incorporate changes that are designed to make the requirements achievable while meeting the goals of the HITECH Act.” 

    Requirements for meaningful use incentive payments will be implemented over a multi-year period, phasing in additional requirements that will raise the bar for performance on IT and quality objectives in later years.  The final CMS rule specifies initial criteria that eligible professionals (EPs) and eligible hospitals, including critical access hospitals (CAHs), must meet.  The rule also includes the formula for the calculation of the incentive payment amounts; a schedule for payment adjustments under Medicare for covered professional services and inpatient hospital services provided by EPs, eligible hospitals and CAHs that fail to demonstrate meaningful use of certified EHR technology by 2015; and other program participation requirements. 

     Key changes in the final CMS rule include:  

    • Greater flexibility with respect to eligible professionals and hospitals in meeting and reporting certain objectives for demonstrating meaningful use.  The final rule divides the objectives into a “core” group of required objectives and a “menu set” of procedures from which providers may choose any five to defer in 2011-2012.  This gives providers latitude to pick their own path toward full EHR implementation and meaningful use.
    • An objective of providing condition-specific patient education resources for both EPs and eligible hospitals and the objective of recording advance directives for eligible hospitals, in line with recommendations from the Health Information Technology Policy Committee.
    • A definition of a hospital-based EP as one who performs substantially all of his or her services in an inpatient hospital setting or emergency room only, which   conforms to the Continuing Extension Act of 2010
    • CAHs within the definition of acute care hospital for the purpose of incentive program eligibility under Medicaid.

    CMS’ and ONC’s final rules complement two other recently issued HHS rules.  On June 24, 2010, ONC published a final rule establishing a temporary certification program for health information technology. And on July 8, 2010 the Office for Civil Rights announced a proposed rule that would strengthen and expand privacy, security, and enforcement protections under the Health Insurance Portability and Accountability Act of 1996. 

    As part of this process, HHS is establishing a nationwide network of Regional Extension Centers to assist providers in adopting and using in a meaningful way certified EHR technology. 

    “Health care is finally making the technology advances that other sectors of our economy began to undertake years ago,” Dr. Blumenthal said.   “These changes will be challenging for clinicians and hospitals, but the time has come to act.  Adoption and meaningful use of EHRs will help providers deliver better and more effective care, and the benefits for patients and providers alike will grow rapidly over time.” 

    A CMS/ONC fact sheet on the rules is available at http://www.cms.gov/EHRIncentivePrograms/  

    Technical fact sheets on CMS’s final rule are available at http://www.cms.gov/EHRIncentivePrograms/ 

    A technical fact sheet on ONC’s standards and certification criteria final rule is available at http://healthit.hhs.gov/standardsandcertification

    RULES:
    Medicare and Medicaid Programs; Electronic Health Record Incentive Program [PDF]
    http://www.ofr.gov/OFRUpload/OFRData/2010-17207_PI.pdf 

    Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology [PDF]http://www.ofr.gov/OFRUpload/OFRData/2010-17210_PI.pdf  

    #  #  #  #  #  #  #
    ONC: Electronic Health Records and Meaningful Use
                  Information for Providers
                  Information for Consumers

     

    Information excerpted from ONC pages on July 13, 2010.
    Electronic health records can provide many benefits for providers and their patients: 

    • Complete and accurate information. With electronic health records, providers have the information they need to provide the best possible care.Providers will know more about their patients and their health history before they walk into the examination room.
    • Better access to information. Electronic health records facilitate greater access to the information providers need to diagnose health problems earlier and improve the health outcomes of their patients. Electronic health records also allow information to be shared more easily among doctors’ offices, hospitals, and across health systems, leading to better coordination of care.
    • Patient empowerment. Electronic health records will help empower patients to take a more active role in their health and in the health of their families. Patients can receive electronic copies of their medical records and share their health information securely over the Internet with their families.

    Currently, most health care providers still use medical record systems based on paper. New government incentives and programs are helping health care providers across the country make the switch to electronic health records. 

    Why Electronic Health Records?
    Electronic health records can improve care by enabling functions that paper medical records cannot deliver: 

    • EHRs can make a patient’s health information available when and where it is needed – too often care has to wait because the chart is in one place and needed in another. EHRs enable clinicians secure access to information needed to support high quality and efficient care
    • EHRs can bring a patient’s total health information together to support better health care decisions, and more coordinated care
    • EHRs can support better follow-up information for patients – for example, after a clinical visit or hospital stay, instructions and information for the patient can be effortlessly provided; and reminders for other follow-up care can be sent easily or even automatically to the patient.
    • EHRs can improve patient and provider convenience – patients can have their prescriptions ordered and ready even before they leave the provider’s office, and insurance claims can be filed immediately from the provider’s office.

    Background: Legislation and RegulationsThe Health Information Technology for Economic and Clinical Health (HITECH) Act provides HHS with the authority to establish programs to improve health care quality, safety, and efficiency through the promotion of health information technology (HIT), including electronic health records and private and secure electronic health information exchange.Under HITECH, eligible health care professionals and hospitals can qualify for Medicare and Medicaid incentive payments when they adopt certified EHR technology and use it to achieve specified objectives. Two regulations have been released, one of which defines the “meaningful use” objectives that providers must meet to qualify for the bonus payments, and the other which identifies the technical capabilities required for certified EHR technology. 

    • Incentive Program for Electronic Health Records: Issued by the Centers for Medicare & Medicaid Services (CMS), this final rule defines the minimum requirements that providers must meet through their use of certified EHR technology in order to qualify for the payments.
    • Standards and Certification Criteria for Electronic Health Records: Issued by the Office of the National Coordinator for Health Information Technology, this rule identifies the standards and certification criteria for the certification of EHR technology, so eligible professionals and hospitals may be assured that the systems they adopt are capable of performing the required functions.

    JOINT ONC/CMS FACT SHEET
    CMS AND ONC FINAL REGULATIONS DEFINE MEANINGFUL USE AND SET STANDARDS FOR ELECTRONIC HEALTH RECORD INCENTIVE PROGRAM

    Excerpted from CMS site on July 13, 2010.
    The Centers for Medicare & Medicaid Services (CMS) and the Office of the National Coordinator for Health Information Technology (ONC) today announced two complementary final rules to implement the electronic health records (EHR) incentive program under the Health Information Technology for Economic and Clinical Health (HITECH) Act. 

    Enacted as part of the American Recovery and Reinvestment Act (ARRA) of 2009, the HITECH Act supports the adoption of electronic health records by providing financial incentives under Medicare and Medicaid to hospitals and eligible professionals who implement and demonstrate “meaningful use” certified EHR technology.  The CMS regulations announced today specify the objectives that providers must achieve in payment years 2011 and 2012 to qualify for incentive payments; the ONC regulations specify the technical capabilities that EHR technology must have to be certified and to support providers in achieving the “meaningful use” objectives. 

    The final CMS rule:  

    • Specifies initial criteria that eligible professionals (EPs), eligible hospitals, and critical access hospitals (CAHs) must meet to demonstrate meaningful use and qualify for incentive payments. 
    • Includes both “core” criteria that all providers must meet to qualify for payments, while also allowing provider choice among a “menu set” of additional criteria.
    • Outlines a phased approach to implement the requirements for demonstrating meaningful use. This approach initially establishes criteria for meaningful use based on currently available technological capabilities and providers’ practice experience. CMS will establish graduated criteria for demonstrating meaningful use through future rulemaking, consistent with anticipated developments in technology and providers’ capabilities.

     The CMS rule finalizes a Notice of Proposed Rulemaking published on Jan 13, 2010. 

     The final ONC rule:  

    • Sets initial standards, implementation specifications, and certification criteria for EHR technology under the incentive program.
    • Coordinates the standards required of EHR systems with the meaningful use requirements for eligible professionals and hospitals
    • With these standards in place, providers can be assured that the certified EHR technology they adopt is capable of performing the required functions to comply with CMS’ meaningful use requirements and other administrative requirements of the Medicare and Medicaid EHR incentive programs. 

    ONC’s standards and certification criteria final rule completes the adoption of an initial set of standards, implementation specifications and certification criteria that was begun with publication of ONC’s on Jan. 13, 2010. 

    Timetable for Implementation
    The HITECH Act states that payments for Medicare providers may begin no sooner than October 2010 for eligible hospitals and January 2011 for EPs. The final rule aligns the Medicare and Medicaid program start dates.   Key steps in the implementation timeline include: 

    ONC began accepting applications from entities that seek approval as an ONC-Authorized Testing and Certification Body (ONC-ATCB) on July 1, 2010. 

    ONC projects that certified EHR software will be available for purchase by hospitals and eligible professionals by fall, 2010.  

    • Registration by both EPs and eligible hospitals with CMS for the EHR incentive program will begin in January 2011.  Registration for both the Medicare and Medicaid incentive programs will occur at one virtual location, managed by CMS.
       
    • For the Medicare program, attestations may be made starting in April 2011 for both EPs and eligible hospitals.
       
    • Medicare EHR incentive payments will begin in mid May 2011.
       
    • States will be initiating their incentive programs on a rolling basis, subject to CMS approval of the State Medicaid HIT plan, which details how each State will implement and oversee its incentive program.

    The “Meaningful Use” Model
    By focusing on the effective use of EHRs with certain capabilities, the HITECH Act makes clear that the adoption of records is not a goal in itself:   it is the use of EHRs to achieve health and efficiency goals that matters.  HITECH’s incentives and assistance programs seek to improve the health of Americans and the performance of their health care system through “meaningful use” of EHRs to achieve five health care goals: 

    • To improve the quality, safety, and efficiency of care while reducing disparities;
    • To engage patients and families in their care;
    • To promote public and population health;
    • To improve care coordination; and
    • To promote the privacy and security of EHRs.

    In the context of the EHR incentive programs, “demonstrating meaningful use” is the key to receiving the incentive payments. It means meeting a series of objectives that make use of EHRs’ potential and related to the improvement of quality, efficiency and patient safety in the healthcare system through the use of certified EHR technology. 

    Coordinated Approach to Support EHR Adoption
    CMS’ and ONC’s final rules complement two other rules that were recently issued.  On June 24, 2010, ONC published a final rule to establish a temporary certification program for health information technology.   And on July 8, 2010, the Office for Civil Rights announced a proposed rule that would strengthen and expand privacy, security, and enforcement protections under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). 

    Together the four rules are key components of the regulatory structure needed to administer the EHR incentive program and to meet the goals of the HITECH Act: 

    The assurance of privacy protections is fundamental to the success of EHR adoption.  The refinements and expansions of HIPAA provisions announced July 8 form an important base for EHR acceptance and use. 

    • The temporary certification process published June 24 establishes a process through which organizations can be approved as certifying entities to which vendors may submit their EHR systems for review and certification.
    • The ONC rule announced today identifies the technical standards which must be met in the certification process, and coordinates those requirements with the meaningful use objectives.
    • Finally, the CMS rule announced today establishes guidelines and requirements on achieving meaningful use in clinical settings and qualifying for incentive payments based on this meaningful use.

    Key Provisions of the Final Rule
    CMS’s final meaningful use rule incorporates changes from the proposed rule on meaningful use that are designed to make the requirements more readily achievable while meeting the goals of the HITECH Act.  For Stage 1, which begins in 2011, the criteria for meaningful use focus on electronically capturing health information in a coded format, using that information to track key clinical conditions, communicating that information for care coordination purposes, and initiating the reporting of clinical quality measures and public health information. 

    The final rule reflects significant changes to the proposed rule while retaining the intent and structure of the incentive programs.  Key provisions in the final rule include:   

    • For Stage 1, CMS’s proposed rule called on physicians and other eligible professionals to meet 25 objectives (23 for hospitals) in reporting their meaningful use of EHRs. The final rule divides the objectives into a “core” group of required objectives and a “menu set” of procedures from which providers can choose.  This “two track” approach ensures that the most basic elements of meaningful EHR use will be met by all providers qualifying for incentive payments, while at the same time allowing latitude in other areas to reflect providers’ varying needs and their individual paths to full EHR use.
       
    • In line with recommendations of the Health Information Technology Policy Committee, the final rule includes the objective of providing patient-specific educational resources for both EPs and eligible hospitals and the objective of recording advance directives for eligible hospitals.
       
    • With respect to defining hospital-based physicians, the final rule conforms to the Continuing Extension Act of 2010. That law addressed provider concerns about hospital-based providers in ambulatory settings being unable to qualify for incentive payments by defining a hospital-based EP as performing substantially all of his or her services in an inpatient hospital setting or emergency room only.
       
    • The rule makes final a proposed rule definition that would make individual payments to eligible hospitals identified by their individual CMS Certification Number.  The final rule retains the proposed definition of an eligible hospital because that is most consistent with policy precedents in how Medicare has historically applied the statutory definition of a ”subsection (d)” hospital under other hospital payment regulations.
       
    • Under Medicaid, the final rule includes critical access hospitals (CAHs) in the definition of acute care hospital for the purpose of incentive program eligibility.

    The final rule’s economic analysis estimates that incentive payments under Medicare and Medicaid EHR programs for 2011 through 2019 will range from $9.7 billion to $27.4 billion. 

    Development of the Rules 
    CMS and ONC worked closely to develop the two rules and received input from hundreds of technical subject matters experts, health care providers, consumers, and other key stakeholders. Numerous public meetings to solicit public comment were held by three Federal advisory committees: the National Committee on Vital and Health Statistics (NCVHS), the HIT Policy Committee (HITPC), and the HIT Standards Committee (HITSC). HITSC presented its final recommendations to the National Coordinator in August 2009.   

    CMS published its proposed rule on Jan. 13, 2010.  The agency actively solicited comments on its proposal and received more than 2,000 submissions by the close of the 60-day comment period.  These comments, along with the input from advisory groups and outreach activities, were given careful consideration in developing the regulations announced today.
    #                                 #                               # 

    ELECTRONIC HEALTH RECORDS AT A GLANCE
    CMS FACT SHEET
     With Frequently Asked Questions
    Excerpted from CMS site on July 14, 2010.

    “Our recovery plan will invest in electronic health records and new technology that will reduce errors, bring down costs, ensure privacy and save lives.”
    -  President Obama, Address to Joint Session of Congress, February 2009 

    Background
    As promised by the President, the American Recovery and Reinvestment Act of 2009 included under which, according to current estimates, as much as $27 billion over ten years will be expended to support adoption of electronic health records (EHRs). While there has been bipartisan support for EHR adoption for at least half a decade, this is the first substantial commitment of federal resources to support adoption and help providers identify the key functions that will support improved care delivery. 

    Under the Health Information Technology for Economic and Clinical Health Act (HITECH), federal incentive payments will be available to doctors and hospitals when they adopt EHRs and demonstrate use in ways that can improve quality, safety and effectiveness of care.   Eligible professionals can receive as much as $44,000 over a five-year period through Medicare.  For Medicaid, eligible professionals can receive as much as $63,750 over six years.  Medicaid providers can receive their first year’s incentive payment for adopting, implementing and upgrading certified EHR technology but must demonstrate meaningful use in subsequent years in order to qualify for additional payments. 

    Since enactment of HITECH in February 2009, the Office of the National Coordinator for Health Information Technology (ONC), the Centers for Medicare & Medicaid Services (CMS) and other HHS agencies have been laying the groundwork for the massive national investment in EHRs:  

    • Creation of Regional Extension Centers (RECs) to support providers in adopting EHRs
    • Developing workforce training programs
    • Identifying “Beacon Communities” that lead the way in adoption and use of EHRs
    • Developing capabilities for information exchange, including building toward a Nationwide Health Information Network
    • Improving privacy and security provisions of federal law, to bolster protection for electronic records
    • Creating a process to certify EHR technology, so providers can be assured that the EHR technology they acquire will perform as needed
    • Identifying standards for certification of products, tied to “meaningful use” of EHRs
    • Identifying the “meaningful use” objectives that providers must demonstrate to qualify for incentive payments.
    • Supporting State Medicaid Agencies in the planning and development of their Medicaid EHR Incentive programs with 90/10 matching funds. 

    Why EHRs?
    Electronic health records improve care by enabling functions that paper records cannot deliver:  

    • EHRs can make a patient’s health information available when and where it is needed – it is not locked away in one office or another.
    • EHRs can bring a patient’s total health information together in one place, and always be current – clinicians need not worry about not knowing the drugs or treatments prescribed by another provider, so care is better coordinated.
    • EHRs can support better follow-up information for patients – for example, after a clinical visit or hospital stay, instructions and information for the patient can be effortlessly provided; and reminders for other follow-up care can be sent easily or even automatically to the patient.
    • EHRs can improve patient and provider convenience – patients can have their prescriptions ordered and ready even before they leave the provider’s office, and insurance claims can be filed immediately from the provider’s office.
    • EHRs can link information with patient computers to point to additional resources – patients can be more informed and involved as EHRs are used to help identify additional web resources.
    • EHRs don’t just “contain” or transmit information, they also compute with it – for example, a qualified EHR will not merely contain a record of a patient’s medications or allergies, it will also automatically check for problems whenever a new medication is prescribed and alert the clinician to potential conflicts.
    • EHRs can improve safety through their capacity to bring all of a patient’s information together and automatically identify potential safety issues — providing “decision support” capability to assist clinicians.
    • EHRs can deliver more information in more directions, while reducing “paperwork” time for providers –for example, EHRs can be programmed for easy or automatic delivery of information that needs to be shared with public health agencies or quality measurement, saving clinician time.
    • EHRs can improve privacy and security – with proper training and effective policies, electronic records can be more secure than paper.
    • EHRs can reduce costs through reduced paperwork, improved safety, reduced duplication of testing, and most of all improved health through the delivery of more effective health care. 

    Why “meaningful use” requirements?
    EHRs do not achieve these benefits merely by transferring information from paper form into digital form.  EHRs can only deliver their benefits when the information and the EHR are standardized and “structured” in uniform ways, just as ATMs depend on uniformly structured data.  Therefore, the “meaningful use” approach requires identification of standards for EHR systems.  These are contained in the ONC Standards and Certification regulation announced on July 13, 2010. 

    Similarly, EHRs cannot achieve their full potential if providers don’t use the functions that deliver the most benefit – for example, exchanging information, and entering orders through the computer so that the “decision support” functions and other automated processes are activated.  Therefore, the “meaningful use” approach requires that providers meet specified objectives in the use of EHRs, in order to qualify for the incentive payments.  For example: basic information needs to be entered into the qualified EHR so that it exists in the “structured” format; information exchange needs to begin; security checks need to be routinely made; and medical orders need to be made using Computerized Provider Order Entry (CPOE).  These requirements begin at lower levels in the first stage of meaningful use, and are expected to be phased in over five years.  Some requirements are “core” needs, but providers are also given some choice in meeting additional criteria from a “menu set.” 

    Identification of the “meaningful use” goals and standards is the keystone to successful national adoption of EHRs.  The announcement of final “meaningful use” regulations on July 13, 2010, marks the launch of the Nation’s push for EHR adoption and use. 

    Looking ahead
    What is the timetable for approving the organizations that will certify EHR systems as qualifying for “meaningful use?”  

    • ONC anticipates that the first entities will be authorized as ONC-ATCBs before the end of summer.

    How soon can we expect certified EHR systems to be available?  

    • We anticipate that certified EHR systems will be available later in the fall.

    How will be the CMS EHR incentive program registration process work?  

    • Medicare: Hospitals and eligible professionals can register for the program starting in January 2011. Once the programs begin, a link on the Registration web page on http://cms.gov/EHRIncentivePrograms/ will be available. Providers can use this central website to get information about the program and link to the programs’ online registration system.
       
    • Medicaid: The registration process will be the same for the Medicaid Incentive Program as for Medicare.  A link on the Registration web page on http://cms.gov/EHrIncentivePrograms/ will be available when the program begins. Eligible Providers under the Medicaid Incentive Program can register at this site whether or not their state has initiated their program yet and CMS will pass their information on the state once the state initiates their program. 

    How will providers demonstrate that they have achieved the “meaningful use” objectives required by the regulation?  

    • For 2011, CMS will accept provider attestations for demonstration of all the meaningful use measures, including clinical quality measures. Starting in 2012, CMS will continue attestation for most of the meaningful use objectives but plans to initiate the electronic submission of the clinical quality measures. States will also support attestation initially and then subsequent electronic submission of clinical quality measures for Medicaid providers’ demonstration of meaningful use.

    How and when will incentive payments be made?  

    • CMS expects to initiate Medicare incentive payments nine months after the publication of the final rule. For Medicaid, States are determining their own deadlines for launching their Medicaid EHR Incentive programs but are required to make timely payments, per the CMS final rule. CMS expects that the majority of States will have launched their programs by the summer of 2011.

     #  #  #  #  # 

    Standards and Certification Criteria Final Rule:
    Fact Sheet

    Excerpted from ONC site on July 14, 2010 

    The Health Information Technology for Economic and Clinical Health (HITECH) Act provides HHS with the authority to establish programs to improve health care quality, safety, and efficiency through the promotion of health information technology (HIT), including electronic health records (EHRs) and private and secure electronic health information exchange. 

    The HITECH Act directs the Office of the National Coordinator for Health Information Technology (ONC) to support and promote meaningful use of certified EHR technology nationwide through the adoption of standards, implementation specifications, and certification criteria as well as the establishment of certification programs for HIT. 

    About the Standards and Certification Criteria Final Rule
    Two companion regulations were announced today. ONC’s final rule complements a final rule announced by the Centers for Medicare & Medicaid Services (CMS) that defines the minimum requirements that providers must meet through their use of EHRs in order to qualify for payments under the Medicare and Medicaid EHR incentive programs. The ONC rule establishes the required capabilities and related standards and implementation specifications that Certified EHR Technology will need to include to, at a minimum, support the achievement of meaningful use Stage 1 by eligible health care providers under the Medicare and Medicaid EHR Incentive Program regulations.  

    What Standards and Certification Criteria Mean for Health Care Providers
    Both the Medicare and Medicaid EHR incentive programs include a requirement related to certified EHR technology. Under the Medicare EHR incentive program, eligible health care providers may receive incentive payments if they adopt and meaningfully use certified EHR technology (Complete EHR or EHR Modules that have been certified by an Office of the National Coordinator for Health Information Technology-Authorized Testing and Certification Body (ONC-ATCB)). Under the Medicaid EHR incentive program, eligible health care providers may first adopt, implement, or upgrade to certified EHR technology in their first year of the program and receive an incentive payment before having to meaningfully use certified EHR technology. The standards and certification criteria final rule specifies the necessary technological capabilities EHR technology will need to include, for the EHR technology to be certified by an ONC-ATCB.  Additionally, it specifies how eligible health care providers will need to use the certified EHR technology to meet applicable meaningful use requirements.

    What Standards and Certification Criteria Mean for Developers of EHR Technology
    Developers of EHR technology who design their EHR technology in accordance with this final rule and subsequently get their EHR technology tested and certified by an ONC authorized testing and/or certified entity are assured that their EHR technology can be adopted by eligible health care providers who seek to achieve meaningful use Stage 1.For other questions related to the standards and certification criteria, please email onc.request@hhs.gov 

    Standards and Certifications Criteria Final Rule:
    Frequently Asked Questions

    Excerpted from ONC site on July 14, 2010.

    A. Background/GeneralKey Messages 

    Health Care Providers: Key Points
    Both the Medicare and Medicaid electronic health record (EHR) incentive programs include a requirement related to certified EHR technology.  Under the Medicare EHR incentive program, eligible health care providers must adopt and meaningfully use certified EHR technology (Complete EHR or EHR Modules that have been certified by an Office of the National Coordinator for Health Information Technology-Authorized Testing and Certification Body (ONC-ATCB)). Under the Medicaid EHR incentive program, eligible health care providers may first adopt, implement, or upgrade to certified EHR technology in their first year of the program and receive an incentive payment before having to meaningfully use certified EHR technology. The standards and certification criteria final rule specifies the necessary technological capabilities EHR technology will need to include in order be certified by an ONC-ATCB and subsequently used by eligible health care providers to meet applicable meaningful use requirements. 

    Developers of EHR Technology: Key Points
    Developers of EHR technology who design their EHR technology in accordance with this final rule and subsequently get their EHR technology tested and certified by an ONC-ATCB are assured that their EHR technology can be adopted by eligible health care providers who seek to achieve meaningful use Stage 1. 

    B.  Standards and Certification
    B1. What is the standards and certification criteria final rule?
    The final rule establishes the required capabilities and related standards and implementation specifications that Certified EHR Technology will need to include to, at a minimum, support the achievement of meaningful use Stage 1 by eligible health care providers under the Medicare and Medicaid EHR Incentive Programs.  

    B2. What are the major differences between the standards and certification interim final rule and the final rule?  
    In large part, the final rule is very similar to the interim final rule.  However, in response to public comments, the final rule clarifies or revises certain standards and certification criteria.  As noted in the final rule, some of the adopted certification criteria were revised to realign with changes to the Medicare and Medicaid EHR Incentive Programs final rule. 

    B3. What is the difference between a Complete EHR and an EHR Module?
    Complete EHR
    refers to EHR technology that has been developed to meet, at a minimum, all applicable certification criteria adopted by the Secretary.  For Complete EHRs designed for an ambulatory setting this means all of the certification criteria adopted at 45 CFR 170.302 and 45 CFR 170.304.  For Complete EHRs designed for an inpatient setting this means all of the certification criteria adopted at 45 CFR 170.302 and 45 CFR 170.306.  These certification criteria represent the minimum capabilities EHR technology needs to include and have properly implemented in order to achieve certification.  They do not preclude Complete EHR developers from including additional capabilities that are not required for the purposes of certification. 

    EHR Module refers to any service, component, or combination thereof that meets at least one certification criterion adopted by the Secretary. EHR Modules, by definition, must provide a capability that can be tested and certified in accordance with at least one certification criterion adopted by the Secretary.  Therefore, if an EHR Module does not provide a capability that can be tested and certified at the present time, it is not HIT that would meet the definition of EHR Module.  We stress “at the present time,” because as new certification criteria are adopted by the Secretary, other HIT could be developed and then tested and certified in accordance with the new certification criteria as EHR Modules. An EHR Module could provide a single capability required by one certification criterion or it could provide all capabilities but one, required by the certification criteria for a Complete EHR.  In other words, we would call HIT tested and certified to one certification criterion an “EHR Module” and HIT tested and certified to nine certification criteria an “EHR Module,” where ten certification criteria are required for a Complete EHR.      

    B4. CMS has specified a number of clinical quality measures for meaningful use. What clinical quality measures must EHR technology include in order to be certified?
    In order to be certified, a Complete EHR or EHR Module designed for an ambulatory setting must be tested and certified as including at least nine clinical quality measures specified by CMS – all six of the core (three core and three alternate core) clinical quality measures specified, and at least three of the additional measures.  Complete EHR and EHR Module developers may include as many clinical quality measures above that requirement as they see fit.A Complete EHR or EHR Module designed for an inpatient setting must include and will be required to be tested and certified to all of the clinical quality measures specified by CMS. 

    B5. Does EHR technology need to include administrative transactions capabilities?
    No, we have removed these capabilities as conditions of certification for EHR technology in support of meaningful use Stage 1, but intend to revisit their inclusion for Stage 2. 

    C. Certification Process

    C1.  Where can I find out about the certification process?
    For more information on the temporary certification program and the certification process, visit http://healthit.hhs.gov/tempcert

    D. Comments on the Interim Final Rule

    D1. Where can I learn about how my comments on the interim final rule on standards and certification criteria, issued in January, were addressed in the final rule?
    ONC staff carefully reviewed and considered each of the approximately 400 timely comments received on the standards and certification criteria interim final rule. Section III of the standards and certification criteria final rule discusses how the comments were addressed and incorporated into the final rule. 

    E. Related Rules

    E1. How is this final rule related to the Medicare and Medicaid EHR Incentive Programs final rule?This final rule completes the adoption of an initial set of standards, implementation specifications, and certification criteria, and more closely aligns such standards, implementation specifications, and certification criteria with final meaningful use Stage 1 objectives and measures.  Adopted certification criteria establish the required capabilities and specify the related standards and implementation specifications that certified EHR technology will need to include to, at a minimum, support the achievement of meaningful use Stage 1 by eligible professionals, eligible hospitals, and/or critical access hospitals.

    ONC: Building Trust in HIE, Changes to HIPAA Privacy/Security Proposed

    Blumenthal, ONC; and Verdugo, HHS Office of Civil Rights Release
    “Statement on Privacy and Security”
     
    Plus New Web site, FAQs, HHS Press Release, Blog Post

    Joint ONC/OCR Statement on Privacy and Security
    David Blumenthal
    , M.D., M.P.P., National Coordinator for Health Information Technology, U.S. Department of Health and Human Services (HHS); and
    Georgina Verdugo, Director, Office for Civil Rights, HHS

    As the Department of Health and Human Services (HHS or The Department) continues its efforts to improve the health and care of all Americans by promoting the advancement of health information technology (IT), one of the Department’s guiding principles is that the benefits of health IT can only be fully realized if patients and providers are confident that electronic health information is kept private and secure. HHS’s goal, as directed by the 2009 Health Information Technology for Clinical and Economic Health (HITECH) Act, is to improve the nation’s health care system by enabling health information to follow the patient wherever and whenever it is needed. The HHS Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights (OCR) are working jointly on a number of projects to ensure that this electronic exchange of health information is built on a foundation of privacy, and security.

    On July 8, 2010, HHS announced proposed regulations under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 that would expand individuals’ rights to access their information and restrict certain disclosures of protected health information to health plans, extend the applicability of certain of the Privacy and Security Rules’ requirements to the business associates of covered entities, establish new limitations on the use and disclosure of protected health information for marketing and fundraising purposes, and prohibit the sale of protected health information without patient authorization. In addition, the proposed rule is designed to strengthen and expand OCR’s ability to enforce HIPAA’s Privacy and Security provisions. This rulemaking will strengthen the privacy and security of health information, and is an integral piece of the Administration’s efforts to broaden the use of health information technology in health care today. We urge consumers, providers, and other stakeholders to read these proposals and offer comments during the 60-day comment period, which will officially open on July 14, 2010. Information about posting comments will be available at http://www.regulations.gov.

    Additionally, over the past few months, ONC and OCR have embarked on a number of other initiatives that serve to integrate privacy and security into the nation’s health IT efforts. As directed by HITECH, ONC established a new Chief Privacy Officer (CPO) position to provide critical advice to the National Coordinator in developing and implementing ONC’s privacy and security programs. The new CPO, Joy Pritts, JD, will play a key role in helping ONC design new policies to address privacy and security issues in every phase of health IT development and implementation.

    On August 24, 2009, OCR issued an interim final breach notification regulation, which improves transparency and acts as an incentive to the health care industry to improve privacy and security by requiring HIPAA covered entities to promptly notify affected individuals, the HHS Secretary and, in some cases the media, of a breach. This new federal law holds covered entities and business associates accountable to the Department and to individuals for proper safeguarding of the private information entrusted to their care.

    ONC is coordinating with the Centers for Medicare & Medicaid Services (CMS) on CMS’s development of a final regulation on the Medicare and Medicaid Electronic Health Record Incentives Programs. The incentives programs promote critical privacy and security measures and business practices. ONC also is developing a final regulation on standards and certification criteria to ensure that electronic health records (EHRs) contain the capabilities to support needed privacy and security requirements.

    With respect to security, the Department also embarked on a number of initiatives. OCR coordinated with the National Institute of Standards and Technology to host a conference focused on the HIPAA Security Rule. OCR also issued draft guidance in conducting a HIPAA Security Risk Analysis to assist organizations in identifying and implementing the most effective and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information. Additionally, an advisory committee on HIT standards held hearings to better understand security priorities, the effectiveness of security procedures, and vulnerabilities.

    All these activities only serve as a prelude to our ongoing efforts to ensure that electronic health information is private and secure. In addition:

    • ONC and OCR are working together with representatives of consumer and industry groups to promote the adoption of privacy and security safeguards as essential components of implementing health information technology.
    • ONC is ensuring that the technical and policy foundations of the nationwide health information network will demonstrate methods for achieving trust among entities exchanging information while integrating best practices for privacy and security. A privacy and security workgroup (known as a “Tiger Team”) of the Health Information Technology Policy Committee (HITPC) was convened with strong consumer representation to hold public deliberations and make recommendations related to patient choice in how health information is exchanged; consumer access to health information; personal health records (PHRs); segmentation of health information; and transparency about information sharing and protections.
    • ONC staff is working with the President’s cybersecurity initiative and other Federal partners to solicit input from the best security minds in the federal government. Based on these activities, ONC will provide direction on security best practices and standards to technical and policy decision makers for inclusion in health information exchange programs.
    • Finally, the Department is working to provide the private sector with greater resources for improving privacy and security. Regional Extension Centers will educate providers about necessary privacy and security measures. Curriculum Development Centers Programs will incorporate necessary information into standard curricula for Community College Consortia, where a new cadre of HIT professionals will be trained, and for University-Based Training Programs, where health professionals will learn about HIT. State Health Information Exchange Cooperative Agreements and Beacon Communities grants will provide living examples of how privacy and security are successfully implemented and brought to scale.
    Our Nation is poised to harness the power of information technology to improve health care. Transforming our health care system into a 21st century model is a bold agenda. As we enter into a new age of electronic health information exchange, it is more important than ever to ensure consumer trust in the privacy and security of their health information and in the industry’s use of new technology.
    #                                 #                                  #

    Excerpted from ONC Health IT Buzz Blog on July 8, 2010:
    Privacy and Security

    Thursday, July 8th, 2010 | Posted by: Joy Pritts, Chief Privacy Officer on Health IT Buzz Blog and republished here by e-Healthcare Marketing.
    Privacy and security are the bedrock of building trust in health information exchange. The proposed modifications to the HIPAA Privacy & Security Rules, announced today, are a significant step forward in HHS’s efforts to protect patient privacy rights while encouraging the adoption of electronic health information exchange.  The next phase of this process is just as important—obtaining public feedback and suggestions concerning the proposed rules.   The comment period will begin once the rule is published in the Federal Register on July 14.  You can  submit your comments electronically through http://www.regulations.gov/ or via mail (original and 2 copies) to the Office for Civil Rights at: Office for Civil Rights, Attention: HITECH Privacy Rule Modifications, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue, S.W., Washington, D.C. 20201.  HHS is looking forward to receiving your input.
    #                                 #                                  #

    HHS Press Release on July 8, 2010:
    HHS Strengthens Health Information Privacy and Security through New Rules
    New health privacy website launched

    HHS Secretary Kathleen Sebelius today announced important new rules and resources to strengthen the privacy of health information and to help all Americans understand their rights and the resources available to safeguard their personal health data.  Led by the Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights (OCR), HHS is working with public and private partners to ensure that, as we expand the use of health information technology to drive improvements in the quality and effectiveness of our nation’s health care system, Americans can trust that their health information is protected and secure.

    “To improve the health of individuals and communities, health information must be available to those making critical decisions, including individuals and their caregivers,” said HHS Secretary Kathleen Sebelius. “While health information technology will help America move its health care system forward, the privacy and security of personal health data is at the core of all our work.”

    Through the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, current health information privacy and security rules will now include broader individual rights and stronger protections when third parties handle individually identifiable health information.

    The proposed rule announced today would strengthen and expand enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Enforcement Rules by:

    • expanding individuals’ rights to access their information and to restrict certain types of disclosures of protected health information to health plans. 
    • requiring business associates of HIPAA-covered entities to be under most of the same rules as the covered entities;
    • setting new limitations on the use and disclosure of protected health information for marketing and fundraising; and
    • prohibiting the sale of protected health information without patient authorization.

    “The benefits of health IT can only be fully realized if patients and providers are confident that electronic health information is kept private and secure at all times,” said Georgina Verdugo, OCR director at HHS. “This proposed rule strengthens the privacy and security of health information, and is an integral piece of the administration’s efforts to broaden the use of health information technology in health care today.”

    HHS is also looking more closely at entities that are not covered by HIPAA rules to understand better how they handle personal health information and to determine whether additional privacy and security protections are needed for these entities.

    “Giving more Americans the ability to access their health information wherever, whenever and in whatever form is a critical first step toward improving our health care system,” said HHS’ national coordinator for health information technology, David Blumenthal, M.D., M.P.P. “Empowering Americans with real-time and secure access to the information they need to live healthier lives is paramount.”

    HHS also launched today a privacy website at http://www.hhs.gov/healthprivacy/index.html to help visitors easily access information about existing HHS privacy efforts and the policies supporting them. The site emphasizes HHS’ deep commitment to privacy in the collection, use, and exchange of personally identifiable information. This new resource provides Americans with confidence that their personal information is secure and underscores HHS’ goal of greater openness and transparency in government.

    The HITECH Act established the position of Chief Privacy Officer in ONC. Joy Pritts recently assumed the new position and is leading HHS efforts to develop and implement privacy and security programs and polices related to electronic health information.

    “HHS strongly believes that an individual’s personal information is to be kept private and confidential and used appropriately by the right people, for the right reasons,” said Pritts.  “Without such assurances, an individual may be hesitant to share relevant health information.”

    For more information about the proposed rule announced today visit http://www.ofr.gov/OFRUpload/OFRData/2010-16718_PI.pdf  

    For other HHS Recovery Act programs, see
    http://www.hhs.gov/recovery/programs/index.html#Health.

    #                      #                               #
    New HHS Web Site:
    Health Data Privacy and Security Resources
    http://www.hhs.gov/healthprivacy
    The contents of the Health Data Privacy and Security Resources section have been excerpted below on July 8, 2010.
    HHS respects the privacy of your personal information, and this page will help you find privacy resources throughout HHS.

    This page provides key messages and access to resources emphasizing HHS’ commitment to privacy as a fundamental consideration in its collection, use, and exchange of personally identifiable information. This central resource helps visitors easily access information about existing HHS privacy efforts and the policies supporting them.

    In support of HHS’ vision for Open Government and Transparency, this resource is to provide further confidence in the expectations Americans have for the privacy of their personal information and is to inspire added trust in HHS’ efforts to improve our nation’s health through safe and secure health information exchanges. HHS strongly believes that an individual’s personal information is to be kept private, confidential and used appropriately by the right people, for the right reasons. Without such assurances, an individual may be hesitant to share relevant health information.

    More information about HHS’ commitment to health data privacy can be found in the notice of proposed rulemaking (NPRM) issued July 8, 2010; in the Frequently Asked Questions (FAQs); and the OCR/ ONC Joint statement on the NPRM.

    You can access more information on health data privacy through the links provided below.

    Privacy Policies

    HHS Privacy Impact Assessments

    The Privacy Act

    Your Right to Federal Records: Questions and answers on the Freedom of Information Act and Privacy Act.

    Health Information Portability and Accountability Act

    Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules

    Electronic Health Information Exchange Privacy and Security

    Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information

    Department Privacy Resources

    Privacy Protection for Research Subjects: Certificates of Confidentiality

    National Center for Health Statistics

    HHS Privacy Committee

    #                                #                               #
     
    1.  What is the role of the Chief Privacy Office in the Office of the National Coordinator for Health Information Technology (ONC)?
    Section 13101 of the HITECH Act (2009) required that a new Chief Privacy Officer (CPO) position be established in ONC.  The CPO will advise the National Coordinator on critical privacy and security policies and will play a key role in the design of new policies to assure that privacy and security is addressed in every phase of health IT development and implementation.  The Chief Privacy Officer will also coordinate with other federal agencies, states and regions, and international efforts.  
    2.  What are respective roles of ONC and OCR regarding privacy and security?
    The Office for Civil Rights (OCR) within the Department of Health and Human Services has the regulatory authority for the HIPAA Privacy and Security rules.  OCR also issues guidance and interpretations on HIPAA Privacy and Security rules, including how these rules apply to electronic health records, personal health records, and health information technology.  OCR has enforcement authority to ensure compliance with the HIPAA Privacy and Security Rules through investigation and the ability to impose civil monetary penalties. The HITECH Act of 2009 enhanced many of the Privacy Rule provisions, including extending certain requirement to business associates; limiting uses and disclosure of protected health information for marketing; prohibiting the sale of protected health information (PHI) without patient authorization; expanding individuals’ rights to access their information and restrict certain PHI disclosures to health plans; and providing greater enforcement authority to OCR.  The Office of the National Coordinator (ONC) for Health Information Technology is charged with the development of a nationwide health information technology infrastructure that allows for the electronic use and exchange of health information.  This includes examining and recommending policy,  technology, and practices that protect privacy and promote security. In addition, ONC  develops regulations for the certification of electronic medical records, engages public input, and implements grant programs, such as those to initiate state health information exchanges, the Regional Extension Centers that provide technical assistance to provided to reach meaningful use of EHRs, and Beacon Communities grants that will establish and demonstrate best practices for middle and later adopters of HIT.

    3.  What are the roles of the HITPC and HITSC in privacy and security?
    HITECH (Section 13101) required the establishment of a Health Information Technology Policy Committee (HITPC) to make recommendations on the policies needed to enable the electronic exchange and use of health information.  The HITPC recently formed a privacy and security work group (called a “Tiger Team”) with strong consumer representation to make recommendations on patient choice in health information exchange; consumer access to their health information; personal health records; segmentation of health information; and transparency about information sharing practices.  The Health Information Technology Standards Committee (HITSC) deliberates on the technical HIT standards required for electronic exchange.  HITSC held hearings to better understand security priorities, the effectiveness of security procedures, vulnerabilities, and is currently soliciting information related to data segmentation and privacy.  The Committees submit their recommendations to the National Coordinator. The National Coordinator evaluates the Committees’ recommendations and advises the Secretary of Health and Human Services.

    4.  What is ONC doing to promote privacy in health information exchange (HIE)?
    ONC is working with the federal Health Information Technology Policy Committee (HITPC) and HIT Standards Committee (HITSC) to explore policy and technical methods for enabling patient choice in health information exchange, including a one-day conference on available technical capabilities to support patient consent.  White papers on patient consent models and state consent laws were issued and a paper on data segmentation is underway.  A study of the privacy and security practices of entities not subject to HIPAA will support a report to Congress in which ONC will, in consultation with the Federal Trade Commission, make recommendations on the privacy and security requirements for non-covered entities, with an emphasis on personal health records.  A Request for Information on the same topic is being released to solicit information from the public.  ONC is organizing a series of listening sessions to engage the public in a national dialogue about health information exchange.  The Office of the Chief Privacy Officer is working with ONC divisions to assure the integration of privacy into all facets of ONC activities and projects.  In addition, ONC is working to ensure that the technical and policy foundations of the nationwide health information network will demonstrate methods for achieving trust among entities exchanging information while integrating best practices for privacy and security.

    5.  What ONC activities are targeted to assure sufficient security capabilities in HIE?
    ONC federal advisory committees have been active in collecting information, deliberating on key issues, and making recommendations to the National Coordinator on measures related to security of health information exchange.  In addition to the activities of the Health Information Technology Policy Committee (HITPC), the Health Information Technology Standards Committee held hearings to better understand security priorities, the effectiveness of security procedures, and vulnerabilities.  ONC also embarked on a multi-phase cybersecurity program that includes an assessment of HIT risks and threats and the development of a multi-pronged approach to combating them.  ONC also is collaborating with the President’s cybersecurity initiative along with other federal partners to solicit input from the best security minds in the government on security best practices and standards.  Meaningful use requirements for Medicare and Medicaid incentive payments include measures to protect security and privacy, and ONC’s interim final rule certification standards for EHRs includes the technical capabilities required to assure that information is adequately protected.

    ONC Issues Guidance for State HIEs

    State HIE Program Information Notice from ONC 
    Reproduced below from ONC’s State HIE Toolkit as of 7/7/2010. This is the first official ONC Guidance, called Program Information Notice, documenting ONC advice based on initial strategic and operational plans submitted to ONC.
    Table of State HIE Program Requirements (PDF)

    Program Information Notice
    Document Number: ONC-HIE-PIN-001
    Date: July 6, 2010
    Document Title:  Requirements and Recommendations for the State Health Information Exchange Cooperative Agreement Program
    TO:  State Health Information Exchange Cooperative Agreement Program Award Recipients

    As stated in the State Health Information Exchange Cooperative Agreement Program Funding Opportunity Announcement (FOA), the Office of the National Coordinator for Health Information Technology (ONC) may offer program guidance to provide assistance and direction to states and State Designated Entities (SDEs) that receive awards under the program.  The purpose of this Program Information Notice (PIN) is to clarify the FOA with respect to state and SDE responsibilities under the program, recommended roles for the State HIT Coordinators, and elements of the state strategic and operational plans. 

    If you have any questions or require further assistance, please contact your project officer or the State Health Information Exchange Cooperative Agreement Program at statehiegrants@hhs.gov

    Sincerely,
    David Blumenthal
    National Coordinator
    Attachment:

    Introduction
    This PIN provides direction to state level efforts under the State Health Information Exchange Cooperative Agreement Program (State HIE Program).  Specifically, this PIN clarifies the State Health Information Exchange Cooperative Agreement Program Funding Opportunity Announcement, EP-HIT-09-001, CFDA 93.719, with respect to state/SDE1 responsibilities under the program, recommended roles for the HIT Coordinators, and elements of the state strategic and operational plans.  Success of this program is dependent on a strong and productive collaboration between states/SDEs and ONC.     

    The HITECH Act authorized the award of funds to states/SDEs to facilitate and expand health information exchange (HIE) among organizations.  These resources, which should be viewed as a one-time investment, can provide a critical impetus to facilitate state HIE efforts including those meeting HIE meaningful use requirements, but substantial challenges face ONC and states/SDEs in developing the robust exchange infrastructure that we all seek.  The amount of funding and timeline will in many cases make it challenging for states to implement and operate comprehensive statewide health information exchange services.  States, therefore, should carefully consider the advantages and disadvantages of using limited HITECH funds — without substantial other sources of support and/or a strong existing infrastructure — to immediately deploy a robust, fully developed statewide exchange.  Similarly, the alternative of deploying a series of local pilots of exchange, while useful for the long-term, may not enable the levels of exchange necessary to meet the requirements for meaningful use, especially as these requirements become more demanding in later stages.  Furthermore, ONC is concerned that HIE sustainability models that rely on mandated provider or hospital participation in specific HIE services offered by the state or SDE might inappropriately limit provider choices in the full array of information exchange alternatives, thereby threatening the ability of providers to achieve meaningful use, particularly where state-designated services are still limited or nonfunctional. 

    While states have the responsibility to determine HIE strategies that may be accomplished through a variety of approaches, ONC will work with states to be creative and resourceful, identifying ways to use these critical but scarce resources to fill gaps in a thoughtful and reality-based way while leveraging existing information exchange activities and engaging trading partners to encourage and sustain health information sharing.  We encourage states to focus on targeted actions to ensure that all eligible providers have options to meet meaningful use information exchange requirements.

    A common set of principles shapes ONC’s work in health information exchange including the state HIE program:

    • Support privacy and security
    • Focus on desired outcomes, especially meaningful use of EHRs 
    • Support HIE services and adoption for all relevant stakeholder organizations, including providers in small practices, across a broad range of uses and scenarios
    • Be operationally feasible and achievable, building on what is already working
    • Remain vigilant and adapt to emerging trends and developments
    • Foster innovation

    Please note that the terms “shall” and “should” are used in very specific ways in this document.  “Shall” equals a mandatory action while “should” equals a recommended course of action within the State HIE Program.

    Key Deliverables and Objectives for State HIE in 2011

    The immediate priority of the State HIE Program is to ensure that all eligible providers within every state have at least one option available to them to meet the HIE requirements of meaningful use in 2011.  The Centers for Medicare & Medicaid Services (CMS) issued a proposed rule that sets forth proposed Stage 1 criteria for meaningful use to include objectives and associated measures for the exchange of health information.  75 Fed. Reg. 1844 (Jan. 13, 2010).  References to meaningful use requirements in this PIN are based on the proposed rule.  In the event that the proposed rule is finalized and/or additional rules or guidance are issued related to meaningful use, ONC may update this PIN or issue further guidance as appropriate.  Therefore, in support of this program priority related to meaningful use in 2011, states and SDEs shall outline in their State Strategic and Operational Plans (state plans) a concrete and operationally feasible plan to address and enable these three HIE capabilities in the next year2:

    1. E-prescribing
    2. Receipt of structured lab results
    3. Sharing patient care summaries across unaffiliated organizations

     State and SDE Responsibilities under the State HIE Program in 2011

    States and SDEs are given discretion to determine how best to enable these HIE capabilities in their health care delivery and market environments and how to ensure that options will be available to satisfy the increasingly robust exchange requirements for meaningful use.  However, consistent with the description of program requirements in the FOA, states and SDEs shall fulfill the following six responsibilities for continued funding as part of their participation in the State HIE Program.  Specifically, states and SDEs shall use their authority, programs, and resources to:

    1. Initiate a transparent multi-stakeholder process—Convene a representative group of relevant stakeholders, including consumers, to set clear goals for state HIE efforts and assess how those efforts can link to and support care delivery and payment reforms.  Additionally, states and SDEs shall analyze and fully understand the health information exchange currently taking place within the state, complete a gap analysis, and determine how the state or SDE needs to address these gaps to ensure options are available to eligible providers in the state who seek to meet the Stage 1 meaningful use requirements for HIE, with a focus on delivery of structured lab results, e-prescribing, and sharing patient care summaries across unaffiliated organizations. 

    2. Monitor and track meaningful use HIE capabilities in the state-Set the baseline, monitor, and report on the following measures as required by the State HIE Program, which will be finalized in additional program guidance:

      • % health plans supporting electronic eligibility and claims transactions
      • % pharmacies accepting electronic prescribing and refill requests
      • % clinical laboratories sending results electronically
      • % health departments electronically receiving immunizations, syndromic surveillance, and notifiable laboratory results

     3. Assure trust of information sharing—Ensure the state has a privacy and security framework for state health information exchange efforts that is consistent with and clearly addresses the elements of the HHS HIT Privacy and Security Framework found at http://healthit.hhs.gov/portal/server.pt/gateway/PTARGS_0_10731_848088_0_0_18/NationwidePS_Framework-5.pdf.

    4. Set Strategy to Meet Gaps in HIE Capabilities for Meaningful Use—Develop and implement a strategy and work plan to address the gaps in HIE capabilities as identified in the environmental scan with a focus on delivery of structured lab results, e-prescribing and sharing patient care summaries across unaffiliated organizations.

    Gap-filling strategies might include:

    • Policy, purchasing and regulatory actions, such as requiring e-prescribing or electronic sharing of lab results in state or Medicaid contracts with pharmacies and clinical labs.
    • Core services to reduce the cost and complexity of exchange including authoritative provider and plan directories and authentication services that would support both simplified and comprehensive interoperability.
    • Targeted infrastructure for gap areas such as shared services for small labs or pharmacies, or to serve rural providers, which could utilize both simplified and comprehensive interoperability solutions.

    In filling these gaps, the state is not required to directly provide or construct technology infrastructure or services. A key role for states can be to provide leadership and direction to public and private stakeholders.  States may also use policy and purchasing levers to extend and enhance existing HIE activities in the state so as to encourage key trading partners such as pharmacies and clinical laboratories to participate in electronic service delivery and to enable providers to meet meaningful use requirements.  

    States shall also establish a strategy and immediate next steps to address the following over the course of the project:

    • Building capacity of public health systems to accept electronic reporting of immunizations, notifiable diseases and syndromic surveillance reporting from providers.
    • Enabling clinical quality reporting to Medicaid and Medicare.

    5. Ensure consistency with national policies and standards—States and SDEs shall ensure that any HIE services that are funded through this program are consistent with national standards, NHIN specifications, federal policies and guidelines, and are based on technologies that are adaptable and flexible for future requirements, including exchange of information across state boundaries.

    6. Align with Medicaid and public health programs—States and SDEs shall coordinate with Medicaid and public health programs to establish an integrated approach including having both programs represented in the state’s governance structure and processes.

    Federal Government Participation

    As stated in the FOA, the ONC will work with states to advance interoperability and health information exchange through a variety of activities, including:

    • Collaborate with states and SDEs to promote, monitor and share efficient, scalable and sustainable mechanisms for HIE within and across states.
    • Help to coordinate and share information regarding federal health IT investments and programs across agencies (e.g., CDC, CMS, HRSA, AHRQ, ONC and non-HHS federal agencies).
    • Conduct a national program evaluation and offer technical assistance for state-level evaluations.
    • Adopt standards and certification criteria to enable interoperability and HIE.
    • Provide technical assistance to states and SDEs.
    • Coordinate information sharing across states.
    • Advance standards-based HIE through Nationwide Health Information Network (NHIN) standards, services and policies.

    Recommended Roles for HIT Coordinator

    ONC requires each state to have an HIT Coordinator who will provide HIT leadership and coordination across the federally funded state programs including supporting the efforts of the State Medicaid Directors (SMDs) in developing the state’s Medicaid EHR incentive program.  We expect the Coordinator to fulfill two main roles while realizing that states have flexibility in how these roles are fulfilled:

    • The HIT Coordinator should develop and advocate for HIT policy to achieve statewide goals.  The Coordinator will need to focus and prioritize activities to make rapid progress to help state providers meet stage 1 meaningful use requirements.  Key activities may include:
      • Collaborate with state health policy makers in establishing HIT strategies for reaching shared health care goals.
      • Leverage state purchasing power such as establishing requirements for entities reimbursed by the state to participate in e-prescribing, electronic labs results delivery or electronically sharing care summaries across transitions in care.  
      • Address legal or policy issues to ensure the information may be shared securely and with appropriate privacy protections.
      • Lead efforts to enable interstate HIE, such as harmonizing privacy policies and consent laws with neighboring states where appropriate.
      • The HIT Coordinator should coordinate HIT efforts with Medicaid, public health and other federally funded state programs. Examples of the Coordinator fulfilling this role include:
        • Advance operationally viable strategies that accelerate the success of the EHR incentive program in meeting shared meaningful use goals.
        • Ensure state program participation in planning and implementation activities including, but not limited to Medicaid, behavioral health, public health, departments of aging.
        • Ensure that State Medicaid HIT Plans and State HIE plans are coordinated. 
        • Leverage various state program resources such as immunizations registries, public health surveillance systems, and CMS/Medicaid funding to ensure resources are being maximized (e.g., ARRA authorized Medicaid 90/10 match leverage to support HIE activities).
        • Assure integration of other relevant state programs into the state’s HIT governance structure.
        • Identify, track and convene the various federal HIT grantees for cross-program coordination and to leverage program resources.  Examples: RECs, Beacon Communities, Community Colleges involved in HIT workforce efforts, HRSA HIT adoption projects, federally supported broadband programs, CHIPRA HIT grantees.

    Conclusion

    Based on the above program guidance including state/SDE responsibilities and HIT Coordinator roles, and also based on issues that have arisen in the first wave of state plans that have been submitted to ONC, the following attachment contains additional guidance on developing state strategic and operational plans for a successful program.  Additional resources to assist in the development of state plans, including a new chart showing requirements of the FOA and this PIN, can be found at http://www.statehiereources.org/

    End Notes

    1 References to states and SDEs throughout this PIN are used interchangeably unless inconsistent with the context or otherwise indicated.

    2 Administrative transactions with health plans and Medicaid, and public health reporting will be the subject of future operational plans.

    Attachment

    Guidance on State Strategic and Operational Plans (State Plans)

    In an effort to support the success of states and SDEs participating in the State Health Information Exchange Cooperative Agreement Program, ONC has compiled this planning guidance to highlight and clarify an important subset of plan requirements. Detailed guidance on state plans, including a chart with requirements for plan content, can be found at http://www.statehiereources.org/

    Environmental Scan

    Within the strategic plan, the environmental scan shall include an overview of the current HIE activities within the state including the penetration of electronic lab delivery, e-prescribing networks and other existing HIE solutions.   The environmental scan should include the following measures or similar measures to determine the health information exchange taking place with these important data trading partners:

    • % pharmacies accepting electronic prescribing and refill requests
    • % clinical laboratories sending results electronically
    • % health plans supporting electronic eligibility and claims transactions
    • % health departments receiving immunizations, syndromic surveillance, and notifiable laboratory results

    Strategy to Meet Meaningful Use

    Strategic plans shall describe the state’s overall strategy for supporting Stage 1 meaningful use including how to fill gaps identified in the environmental scan.  Specifically, states and SDEs shall describe how they will invest federal dollars and associated matching funds to enable eligible providers to have at least one option for each of these Stage 1 meaningful use requirements in 2011:

    1. E-prescribing
    2. Receipt of structured lab results
    3. Sharing patient care summaries across unaffiliated organizations

    As part of the Strategic Plans, states and SDEs should also describe a strategy and plan to address the other required information sharing capabilities specified in the FOA over the course of the project, including, but not limited to:

    • Building capacity of public health systems to accept electronic reporting of immunizations, notifiable diseases and syndromic surveillance reporting from providers;
    • Enabling electronic meaningful use and clinical quality reporting to Medicaid and Medicare.

    Coordination with Medicaid

    Because of the importance of the Medicaid program in setting state level HIT policy, states and SDEs are required to describe their coordination with Medicaid in their Strategic Plans.   The following activities are either required or highly encouraged and the activities adopted shall be reflected in the state HIE plan.

    Required Activities:

    1. The state’s governance structure shall provide representation of the state Medicaid program.
    2. The grantee shall coordinate provider outreach and communications with the state Medicaid program.
    3. The grantee and the state Medicaid program shall identify common business or health care outcome priorities.
    4. The grantee, in collaboration with the Medicaid program, shall leverage, participate in and support all Beacon Communities, Regional Extension Centers and ONC funded workforce projects in its jurisdiction.
    5. The grantee shall align efforts with the state Medicaid agency to meet Medicaid requirements for meaningful use.

    Encouraged Activities:

    1. The state‘s HIE program is encouraged to obtain a letter of support from the Medicaid Director.  If a letter of support is not provided, ONC will inquire as to why one was not provided and the lack of a letter may impact the approval of a state plan, depending on circumstances.
    2. Conduct joint needs assessments.
    3. Conduct joint environmental scans.
    4. Collaborate with the Medicaid program and the ONC-supported Regional Extension Centers to provide technical assistance to providers outside of the federal grant for Regional Extension Centers’ scopes of work.
    5. Leverage public help desk/call center contracts and services between the State HIE Program, Medicaid and the REC.
    6. Conduct joint assessment and alignment of privacy policies at the statewide level and in the Medicaid program.
    7. Leverage existing Medicaid IT infrastructure when developing the health information exchange technical architecture.
    8. Determine whether to integrate systems to accomplish objectives such as making Medicaid claims and encounters available to the health information exchange and information from non-Medicaid providers available to the Medicaid program.
    9. Determine which specific shared services and technical services will be offered or used by Medicaid.
    10. Determine which operational responsibilities the Medicaid program will have, if any.
    11. Use Medicaid HIT incentives to encourage provider participation in the health information exchange.
    12. Collaborate during the creation of payment incentives, including Pay for Performance under Medicaid, to encourage participation by additional provider types (e.g. pharmacies, providers ineligible for incentives).

    HIE Sustainability Plans

    ONC recognizes the importance and challenges of developing a sustainable health information exchange capability.  It is essential, therefore, that for the initial submittal of the Strategic Plan, that states and SDEs shall describe initial thoughts for sustaining HIE activities during and after the cooperative agreement period. It is important to consider how to achieve sustainability based on the model being pursued and to incorporate any work that has been done to test the market acceptance of revenue models. The primary focus of sustainability should be on sustaining information sharing efforts, and not necessarily the persistence of government-sponsored health information exchange entities.  ONC anticipates that annual updates to the state plans will provide further developed approaches and activities for long-term HIE sustainability.
    Facilitating Services – If the state HIE effort is facilitating the statewide coverage of HIE services using a variety of exchange methods, the state plan shall describe preliminary plans for how sustainability of the HIE market in the state may be enhanced by state or SDE actions including any state policy or regulation. Specific plans for sustainability of any directories or authentication services offered at the state level by the grantee must be addressed during the course of the four-year program.

    Directly Offering Services – If the state HIE effort is directly providing the services, the state plans shall provide preliminary but realistic ideas on who will pay for the services and under what mechanisms (e.g., per transaction fees, subscription models, payers receiving a percentage allocation based on their covered base)  The state plan should also consider how program sustainability can be supported by state policy or regulation including payment reforms to incentivize demand for information sharing or contracting requirements to ensure participation of key partners such as labs and pharmacies.  

    Executing Strategy for Supporting Meaningful Use

    Operational plans shall describe how the state will execute the state’s overall strategy for supporting Stage 1 meaningful use including how to fill gaps identified in the environmental scan.  Specifically, states and SDEs shall describe how they will invest federal dollars and associated matching funds to enable eligible providers to have at least one option for each of these Stage 1 meaningful use requirements in 2011:

    1. E-prescribing
    2. Receipt of structured lab results
    3. Sharing patient care summaries across unaffiliated organizations

    For each of these areas, the Operational Plans shall:

    • Outline a clear and viable strategy to ensure that all eligible providers in the state have at least one viable option in 2011;
    • Include a project timeline that clearly illustrates when tasks and milestones will be completed;
    • Provide an estimate of all the funding required, including all federal funding and state funding,  used to enable stage one meaningful use requirements;
    • Indicate the role both in funding and coordination of the state Medicaid agency in achieving the state strategy;
    • Identify potential barriers and risks including approaches to mitigate them; and,
    • Identify desired technical support and coordination from ONC to support the state strategy.

    Project Management Plans
    State Operational Plans shall include a robust project management plan with specific timelines, milestones, resources and interdependencies for all the activities in the state’s HIE project.  States and SDEs shall explain their project management approach including the project plan tasks that are managed by vendors in order for ONC to judge the comprehensiveness and the feasibility of the plans.  State plans should also describe the change management and issue escalation processes that will be used to keep projects on schedule and within budget.

    Risk Assessment
    Managing risk is an important element of successfully building HIE capacity to support meaningful use. Within their Operational Plans, States and SDEs shall identify known and potential risks and describe their risk mitigation strategies. Risks should be prioritized using risk severity and probability. Examples of risks that may be included are: changes in the HIE marketplace, evolving EHR and HIE standards, lack of participation of large stakeholders including Medicaid, breach of personal health information.

    HIE Architecture and Standards

    Within the operational plans, States and SDEs shall describe the technical approach taken to facilitate data exchange services within the state based on the model being pursued. 

    Facilitating Services – If the state HIE effort is facilitating the statewide coverage of HIE services using a variety of exchange methods, the state plans shall describe the approach of obtaining statewide coverage of HIE services to meet meaningful use requirements and also the processes or mechanisms by which the state or SDE will ensure that the HIE services comply with national standards.   

    Directly Offering Services – If the state HIE effort is directly providing or provisioning services (including shared directories or provider authentication services) the state plans shall provide either the detailed specifications or describe the process by which the detailed specifications will be developed.  For those plans that don’t have a detailed architecture, the updated Notice of Award for implementation will have a requirement to provide the detailed plans at a later date. 

    When developing strategies for their state plans, states may be eligible to participate in the development, testing and implementation of various standards and services including those offered by the NHIN:

    •  
      • Authoritative directories that are web-enabled and support standards-based queries, including:   
        •  
          •  
            • Health care provider directories
            • Health plan directories
            • Directories of licensed clinical laboratories
      • Identity Assurance and Authentication Services: These services should meet relevant state and federal privacy and security requirements and be appropriate to the exchange approach selected. They should include: 1) ability to ensure the provider receiving the record is authorized and is who they claim to be and, 2) ensure the provider sending the information is an authorized recipient of the information.
      • Secure Routing
      • NHIN Direct specifications to enable simplified interoperability between two known endpoints
      • NHIN Exchange services for robust information exchange, such as:
        • Master Patient Index
        • Patient locator services
        • Document lookup and retrieval

    The use of standards to support HIE enabling technology is a critical aspect of this program and needs to be part of a longer-term framework to support interoperability.  Due to the evolving nature of health information technology, standards, requirements related to meaningful use, and standards adoption, there should be an explicit mechanism specified in state plans that ensures adoption and use of standards adopted or approved by the Department of Health and Human Services (HHS) as well as the appropriate engagement with ONC in the ongoing development and use of the NHIN specifications and national standards to support meaningful use.  The plans should also explain how the states will encourage any vendors or service providers to follow national standards, address system modularity, data portability, re-use of interfaces, and vendor transition provisions. 

    Privacy and Security

    Within the Operational Plans, States and SDEs shall develop and fully describe their privacy and security framework including the specific policies, accountability strategies, architectures and technology choices to protect information. The state privacy and security framework shall be consistent with applicable federal law and policies. To assist the states, ONC will provide guidance on security and privacy policies and programs in the near future.  The state plan shall contain a description of the analysis of relevant federal and state laws as related to HIE and the plans for addressing any issues that have been identified.  If an analysis hasn’t been done, the state or the SDE shall provide a description of the process and the timeline for completion.  Furthermore, states should describe the methods used to ensure privacy and security programs are accomplished in a transparent fashion.   If a complete framework is not available, the state or the SDE shall describe the process they will use to fully develop such a framework. The framework must address all the principles outlined in the HHS HIT Privacy and Security Framework, including:

    - Disclosure Limitation
    - Individual Access
    - Correction
    - Openness and Transparency
    - Individual Choice
    - Collection and Use
    - Data Quality and Integrity
    - Safeguards
    - Accountability

     

    AHRQ Presents: Sustainable HIEs, Patient Empowerment, Transitions in Care

    PDFs of Three Webinars Produced by AHRQ
    and Released on Web June 18, 2010
    These are all large files and take time to open.

    Building and Maintaining a Sustainable Health Information Exchange: Experience from Diverse Care Settings: [PDF-1.49MB]
    May 14, 2010

    The Vanderbilt HIE Experience in Memphis
    Mark Frisse, Vanderbilt University Medical Center

    Health Information Exchange in Small Primary Care Practices: Someone Needs Needs to Say “Do It”
    Patricia Fontaine, University of Minnesota

    Delaware Health Information Network: Better Communicaation for Better Healthcare
    Gina Perez, Advances in Management

    A National Web Conference on Patient Empowerment: Leveraging Health IT for Patient Empowerment [PDF-3.73MB]
    April 8, 2010

    Leveraging Health Information Technology for Patient Empowerment
    Christine A. Sinsky, Medical Associates Clinic and Health Plans

    A Personalized Portal to Promote Patient-Centered Prevntive Care
    Alex Krist, Virginia Commonwealth University

    e-Coaching: Interactive Voice Response (IVR)-Enhanced Care Transition Support for Complex Patients
    Christine S. Ritchie, University of Alabama at Birmington

    A National Web Conference on Transitions in Care [PDF-1.07MB]
    February 24, 2010

    Transitional Care and Rehospitalization: Information Technology
    Stephen Jencks, Independent Consultant In Health Care Safety

    Project RED: The ReEngineed Discharge
    Brian Jack, Boston University School of Medicine

    Transitions in Care
    Terry Field, University of Massachusetts Medical School