Skip to main content

Electronic Health Records: First Year of CMS's Incentive Programs Shows Opportunities to Improve Processes to Verify Providers Met Requirements

GAO-12-481 Published: Apr 30, 2012. Publicly Released: Apr 30, 2012.
Jump To:
Skip to Highlights

Highlights

What GAO Found

The Centers for Medicare and Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), and the four states GAO reviewed are implementing processes to verify whether providers met the Medicare and Medicaid EHR programs’ requirements and, therefore, qualified to receive incentive payments in the first year of the EHR programs. To receive such payments, providers must meet both (1) eligibility requirements that specify the types of providers eligible to participate in the programs and (2) reporting requirements that specify the information providers must report to CMS or the states, including measures that demonstrate meaningful use of an EHR system and measures of clinical quality. For the Medicare EHR program, CMS has implemented prepayment processes to verify whether providers have met all of the eligibility requirements and one of the reporting requirements. Beginning in 2012, the agency also has plans to implement a risk-based audit strategy to verify on a postpayment basis that a sample of providers met the remaining reporting requirements. For the Medicaid EHR Program, the four states GAO reviewed have implemented primarily prepayment processes to verify whether providers met all eligibility requirements. To verify the reporting requirement, all four states implemented prepayment processes, postpayment processes, or both. CMS officials stated that the agency intends to evaluate how effectively its Medicare EHR program audit strategy reduces the risk of improper EHR incentive payments, though the agency has not yet established corresponding timelines for doing this work. Such an evaluation could help CMS determine whether it should revise its verification processes by, for example, implementing additional prepayment processes, which GAO has shown may reduce the risk of improper payments. In addition, CMS has opportunities to improve the efficiency of verification processes by, for example, collecting certain data on states’ behalf.

CMS allows providers to exempt themselves from reporting certain measures if providers report that the measures are not relevant to their patients or practices. Measures calculated based on few patients may be statistically unreliable, which limits their usefulness as tools for quality improvement. CMS and others acknowledged that the availability of measures that are relevant to providers’ patients and practices and are statistically reliable is important to provide useful information to providers. Among participants in the first year of the Medicare EHR program, the majority of providers chose to exempt themselves from reporting on at least one meaningful use measure and many providers reported at least one clinical quality measure based on few—less than seven—patients.

Why GAO Did This Study

The Health Information Technology for Economic and Clinical Health (HITECH) Act established the Medicare and Medicaid electronic health records (EHR) programs. CMS and the states administer these programs which began in 2011 to promote the meaningful use of EHR technology through incentive payments paid to certain providers—that is, hospitals and health care professionals. Spending for the programs is estimated to total $30 billion from 2011 through 2019. Consistent with the HITECH Act, GAO (1) examined efforts by CMS and the states to verify whether providers qualify to receive EHR incentive payments and (2) examined information reported to CMS by providers to demonstrate meaningful use in the first year of the Medicare EHR program. GAO reviewed applicable statutes, regulations, and guidance; interviewed officials from CMS; interviewed officials from four states, which were judgmentally selected to obtain variation among multiple factors; and analyzed data from CMS and other sources.

Recommendations

GAO is making four recommendations to CMS in order to improve processes to verify whether providers met program requirements for the Medicare and Medicaid EHR programs, including opportunities for efficiencies. HHS agreed with three of GAO’s recommendations, but disagreed with the fourth recommendation that CMS offer to collect certain information on states’ behalf. GAO continues to believe that this action is an important step to yield potential cost savings.

Recommendations for Executive Action

Agency Affected Recommendation Status
Centers for Medicare & Medicaid Services In order to improve the efficiency and effectiveness of processes to verify whether providers meet program requirements for the Medicare and Medicaid EHR programs, the Administrator of CMS should establish time frames for expeditiously implementing an evaluation of the effectiveness of the agency's audit strategy for the Medicare EHR program.
Closed – Implemented
As part of our report on the first year implementation of the Medicare and Medicaid Electronic Health Record (EHR) Programs, we found the EHR programs may be at greater risk of improper payments than other, more established Centers for Medicare & Medicaid Services (CMS) programs because they are new programs with complex requirements that providers must meet to qualify for incentive payments. Therefore, we recommended that CMS establish time frames for expeditiously implementing an evaluation of the effectiveness of the agency's audit strategy for the Medicare EHR program. CMS officials concurred with the recommendation and told us that they have made adjustments to their audit strategy. Specifically, while they told us that they have not conducted a formal evaluation of the Medicare EHR program's audit strategy, they noted that they evaluate the audit strategy by routinely identifying lessons learned during regular discussions with the audit contractor, and making modifications to focus more on high-risk providers, thereby increasing the effectiveness of the audit strategy. For example, CMS officials told us that when an audit finds that a provider-that is, hospital or professional-did not meet program requirements, they will audit the provider for two additional years?the years prior to and subsequent to when the provider did not meet requirements. Additionally, when an audit finds that a professional did not meet requirements, CMS officials noted that they conduct additional audits of other professionals who are in the same practice. CMS has taken action on our recommendation by making changes to its audit strategy based upon findings and lessons learned from audits conducted to date.
Centers for Medicare & Medicaid Services In order to improve the efficiency and effectiveness of processes to verify whether providers meet program requirements for the Medicare and Medicaid EHR programs, the Administrator of CMS should evaluate the extent to which the agency should conduct more verifications on a prepayment basis when determining whether providers meet Medicare EHR program's reporting requirements.
Closed – Implemented
In written responses to GAO regarding open recommendations received in June 2013, CMS noted that it satisfied our recommendation by beginning prepayment audits for the Medicare EHR program in January 2013. We reviewed CMS's audit documentation and concur that the audits address our recommendation.
Centers for Medicare & Medicaid Services In order to improve the efficiency and effectiveness of processes to verify whether providers meet program requirements for the Medicare and Medicaid EHR programs, the Administrator of CMS should collect the additional information from Medicare providers during attestation that CMS suggested states collect from Medicaid providers during attestation.
Closed – Not Implemented
As part of our report on the first year implementation of the Medicare and Medicaid Electronic Health Record (EHR) Programs, we found that the Centers for Medicare & Medicaid Services (CMS) had opportunities to improve the efficiency of processes to verify whether providers met requirements for the Medicare and Medicaid EHR programs. Ensuring program efficiency is consistent with federal internal control standards. Therefore, we recommended that CMS collect additional information from Medicare providers during attestation that CMS suggested states collect from Medicaid providers during attestation. Although CMS officials concurred with the recommendation and told us that they would explore the feasibility of addressing our recommendation, in June 2014, the agency told us that it concluded that collecting the same information from Medicare providers that states are suggested to collect from Medicaid providers would not meet federal paperwork reduction requirements.
Centers for Medicare & Medicaid Services In order to improve the efficiency and effectiveness of processes to verify whether providers meet program requirements for the Medicare and Medicaid EHR programs, the Administrator of CMS should offer states the option of having CMS collect meaningful use attestations from Medicaid providers on their behalf.
Closed – Not Implemented
In written responses to GAO regarding this recommendation received in August 2013, CMS noted that the agency will not implement our recommendation because most states have already received funding for systems to accept attestation data and implementing our recommendation would result in a changes to the attestation process for providers and would require new funds, both for CMS and states, to develop a new attestation system. CMS provided additional reasons that it would not implement our recommendation, including its concerns that doing so may present challenges to states to the extent that the states have aligned their attestation systems with other system and policy goals.

Full Report

GAO Contacts

Office of Public Affairs

Topics

Electronic health recordsMedicareHealthMedicaidReporting requirementsEligibility criteriaCommerceHealth information technologyHealth careHospitals