12 Introduction to Health Information Privacy and Security FIGURE 1.7. Service areas accredited by the National Committee for Quality Assurance (NCOA) Accountable care organizations Health plan accreditation Wellness and health promotion Managed behavioral healthcare organizations New health plans Disease management Source: NCQA 2012 more than 30 states exempt NCQA-accredited organizations from state audit requirements (NCQA 2012). The Healthcare Effectiveness and Data Information Set (HEDIS) is a tool offered by NCQA that measures the quality of health plans. Health plan purchasers- which are mostly employers-and consumers use it to compare health plan performances (Gregg Fahrenholz 2012). The service areas that NCQA accredits are listed in figure 1.7. ONC-Authorized EHR Certification Bodies The adoption of electronic health records (EHRs) among healthcare providers has been a continuous process. As this section will discuss, the federal government has propelled this process forward by creating guidelines and financial incentives for EHR adoption. EHR Adoption and Meaningful Use For several years the federal government has promoted the adoption of health information technology, specifically the EHR, by healthcare providers. The Office of the National Coordinator for Health Information Technology (ONC), an agency within HHS, was formed in 2004 via presidential executive order to guide this initiative. The agency was later codified ( established by statute) via ARRA. However, adopting an EHR has been daunting for many providers. The significant cost of adopting an EHR has been the greatest concern. There are also logistical concerns associated with implementing both a new product and a new workflow. Finally, many providers with little knowledge of technology have been overwhelmed with the prospect of selecting one EHR vendor from dozens of options. How do they discern good products from bad products, and reputable vendors from vendors that are not trustworthy or not likely to remain in business to provide technical supports and upgrades? One of the most important steps a provider can take is to select an electronic health record that has been certified by an ONC-authorized technology review body. These ONC designees, Office of the National Coordinator for Health Information Technology-Authorized Testing and Certification Bodies ( ONC-ATCBs) and Office of the National Coordinator for Health Information Technology-Authorized Certification Bodies (ONC-ACBs), test EHR systems to make sure they comply with HHS standards and certification criteria. If they do, the EHR systems are certified. By purchasing a certified product, a provider is ensured that the EHR meets key standards and is capable of performing the required functions (ONC 2012). The ONC-ATCB program will sunset when the permanent ONC-ACB certification program is in place. This was to occur no earlier than January 1, 2012, and it has been ...

1. 12 Introduction to Health Information Privacy and Security
FIGURE 1.7.
Service areas accredited by the National Committee for
Quality Assurance (NCOA)
Accountable care organizations
Health plan accreditation
Wellness and health promotion
Managed behavioral healthcare organizations
New health plans
Disease management
Source: NCQA 2012
more than 30 states exempt NCQA-accredited organizations
from state audit requirements
(NCQA 2012). The Healthcare Effectiveness and Data
Information Set (HEDIS) is a
tool offered by NCQA that measures the quality of health plans.
Health plan purchasers-
which are mostly employers-and consumers use it to compare
health plan performances
(Gregg Fahrenholz 2012). The service areas that NCQA
accredits are listed in figure 1.7.
ONC-Authorized EHR Certification Bodies
The adoption of electronic health records (EHRs) among
healthcare providers has been a
continuous process. As this section will discuss, the federal
government has propelled this
process forward by creating guidelines and financial incentives

2. for EHR adoption.
EHR Adoption and Meaningful Use
For several years the federal government has promoted the
adoption of health information
technology, specifically the EHR, by healthcare providers. The
Office of the National
Coordinator for Health Information Technology (ONC), an
agency within HHS, was
formed in 2004 via presidential executive order to guide this
initiative. The agency was
later codified ( established by statute) via ARRA. However,
adopting an EHR has been
daunting for many providers. The significant cost of adopting
an EHR has been the
greatest concern. There are also logistical concerns associated
with implementing both
a new product and a new workflow. Finally, many providers
with little knowledge of
technology have been overwhelmed with the prospect of
selecting one EHR vendor from
dozens of options. How do they discern good products from bad
products, and reputable
vendors from vendors that are not trustworthy or not likely to
remain in business to
provide technical supports and upgrades?
One of the most important steps a provider can take is to select
an electronic health record
that has been certified by an ONC-authorized technology review
body. These ONC designees,
Office of the National Coordinator for Health Information
Technology-Authorized
Testing and Certification Bodies ( ONC-ATCBs) and Office of
the National Coordinator

3. for Health Information Technology-Authorized Certification
Bodies (ONC-ACBs), test
EHR systems to make sure they comply with HHS standards and
certification criteria. If they
do, the EHR systems are certified. By purchasing a certified
product, a provider is ensured
that the EHR meets key standards and is capable of performing
the required functions (ONC
2012). The ONC-ATCB program will sunset when the
permanent ONC-ACB certification
program is in place. This was to occur no earlier than January 1,
2012, and it has been delayed.
How Health Information Is Regulated I 13
In addition to required privacy and security features, an
important element of certification
is meaningful use, which describes a government-prescribed
level of effective EHR use.
According to ARRA, "three components of meaningful use are:
( 1) use of a certified EHR
in a meaningful manner, (2) use of certified EHR technology for
electronic exchange
of health information to improve quality of healthcare, and (3)
use of certified EHR
technology to submit clinical quality and other measures" (CMS
2012). Three meaningful
use time periods have been established. Under Stage 1, hospitals
must meet 14 required
core objectives and must select five menu set objectives from
10 options to achieve
meaningful use. Eligible professionals (including physicians,
dentists, optometrists,
chiropractors, and podiatrists) must meet 15 required core

4. objectives and must select
five menu set objectives from 10 options to achieve meaningful
use. Figures 1.8 and 1.9
list the required core objectives and the menu set objectives for
hospitals and eligible
professionals, respectively. To be staged in over five years,
Stage 1 (years 2011 and 2012)
sets meaningful use baseline criteria. Stage 2 ( with the final
administrative rule published
in August 2012) and Stage 3 (expected for year 2015) will
expand on the baseline
criteria (CMS 2012). Without providing functionalities that
enable a hospital or eligible
provider to meet meaningful use criteria, an EHR product
cannot be certified. Although
the ultimate goal of EHR use is improved patient care, Stage 1
is designed primarily to
motivate providers to implement EHRs (Dimick 2011).
Elements of Stage 2 include:
• "Allowing patients to view online, download, and transmit
their health information from
participating physicians within four business days of the
information being available"
• Requiring eligible hospitals to "allow patients the ability to
view online, download,
and transmit their health information within 36 hours of
discharge"
• Requiring physicians and hospital staff to "track how many
patients access their
health records during the program reporting period" ( to meet
meaningful use
requirements, greater than five percent of patients seen by a
physician or discharged

5. by a hospital must access their records)
• Requiring healthcare providers to "offer and use secure
electronic messaging to
communicate with patients on relevant health information'' ( to
meet meaningful
use requirements, five percent of patients must use this feature)
• Aligning "clinical quality measures with other reporting
programs to reduce burden
and duplication of efforts" and
• Transitioning "all HIT Menu Set measures to Core Set of
measures except for
electronic syndromic surveillance data and advance directives"
FIGURE 1.8.
Hospital core objectives and menu set objectives for
Stage 1 meaningful use
1
2
Co re Objectives
Use computerized provider order entry (CPOE) for medication
orders directly
entered by any licensed healthcare professional who can enter
orders into the
medical record per state, local, and professional guidelines.
Implement drug-drug and drug-allergy interaction checks .

6. (Continued on nex t page)
"··
14 Introduction to Health Information Privacy and Security
FIGURE 1.8. (Continued)
Core Objectives
3 Maintain an up-to-date problem list of current and active
diagnoses.
4 Maintain active medication list.
5 Maintain active medication allergy list.
6 Record all of the following demographics : preferred
language; gender; race;
ethnicity; date of birth ; date and preliminary cause of death in
the event of
mortality in the eligible hospital or critical access hospital.
7 Record and chart changes in the following vital signs : height;
weight; blood
pressure; calculate and display body mass index (BMI) ; plot
and display growth
charts for children 2 to 20 years, including BM!.
8 Record smoking for patients 13 years old or older.
9 Report hospital clinical quality measures to CMS or, in the
case of Medicaid

7. eligible hospitals, the states.
10 Implement on clinical decision support rule related to a high
priority hospital
condition along with the ability to track compliance with that
rule .
11 Provide patients with an electron ic copy of their health
information (including
diagnostic tests results, problem list, medication lists,
medication allergies,
discharge summary, procedures), upon request.
12 Provide patients with an electron ic copy of their discharge
instructions at time of
discharge, upon request.
13 Capability to exchange key clinical information (for
example, problem list,
medication list, medication allergies, and diagnostic test
results), among
providers of care and patient authorized entities electronically.
14 Protect electronic health information created or maintained
by the certified
EHR technology through the implementation of appropriate
technical
capabilities .
Menu Set Objectives
1 Implement drug formulary checks .

8. 2 Record advance directives for patients 64 years old or older.
3 Incorporate clinical lab-test results into EHR as structured
data .
4 Generate lists of patients by specific conditions to use for
quality improvement,
reduction of disparities, research, or outreach .
5 Use certified EHR technology to identify patient-specific
education resources and
provide those resources to the patient if appropriate .
How Health Information Is Regulated
i:.:~ l=tb!u~J ~ . (Continued)
6
7
8
9
10
Menu Set Objectives
1 The eligible hospital or critical access hospital that receives a
patient from
I another setting of care or provider of care or believes an
encounter is relevant

9. I should perform medication reconciliation.
I
1 The eligible hospital or critical access hospital that transitions
their patient to
I another setting of care or provider of care or refers their
patient to another
provider of care should provide summary care record for each
transition of care
I or referral.
Capability to submit electronic data to immunization registries
or immunization
I
information systems and actual submission according to
applicable law and
practice.
I
Capability to submit electronic data on reportable (as required
by state or local
law) lab results to public health agencies and actual submission
according to
applicable law and practice.
I Capability to submit electronic syndromic surveillance data to
public
I
health agencies and actual submission according to applicable
law and

10. practice .
I
Source: CMS 2012
FIGURE 1.9.
Eligible professional core objectives and menu set
objectives for Stage 1 meaningful use
Core Objectives
1 Use computerized provider order entry (CPOE) for medication
orders directly
entered by any licensed healthcare professional who can enter
orders into the
medical record per state, local, and professional guidelines .
2 Implement drug-drug and drug-allergy interaction checks.
3 Maintain an up-to-date problem list of current and active
diagnoses .
4 Generate and transmit permissible prescriptions electronically
(eRx).
5 1 Maintain active medication list.
6 I Maintain active medication allergy list.
7 I Record all of the following demographics: preferred
language; gender; race;
1 ethnicity; date of birth.
15

11. (Continued on nex t page)
16 Introduction to Health Information Privacy and Security
I
l::llC'l.11:i ~ (Continued)
8 Record and chart changes in the following vital signs: height;
weight; blood
pressure; calculate and display body mass index (BMI); plot and
display growth
charts for children 2 to 20 years, including BMI.
9 Record smoking status for patients 13 years old or older.
10 Report ambulatory clinical quality measures to CMS or, in
the case of Medicaid
eligible professionals, the states .
11 Implement on clinical decision support rule relevant to
specialty or high clinical
priority along with the ability to track compliance with that
rule.
12 Provide patients with an electronic copy of their health
information (including
diagnostic tests results, problem list, medication lists,
medication allergies) upon
request.
13 Provide clinical summaries for patients for each office visit.

12. 14 Capability to exchange key cl ini ca l information (for
example, problem list,
medication list, allergies, and diagnostic test results) , among
providers of care
and patient authorized entities electronically.
15 Protect electronic health informat ion created or maintained
by the certified
EHR technology through the implementation of appropriate
technical
capabilities.
Menu Set Objectives
1 Implement drug formulary checks.
2 Incorporate clinical lab-test results into EHR as structured
data .
3 Generate lists of patients by specific conditions to use for
quality improvement,
reduction of disparities, research, or outreach.
4 Send patient reminders per patient preference for preventive
or follow-up care.
5 Provide patients with timely electronic access to their health
information
(including lab results, problem list, medication lists, and
allergies) within
four business days of the information being available to the
eligible

13. professional.
6 Use certified EHR technology to identify patient-specific
education resources and
provide those resources to the patient if appropriate .
7 The eligible professional who receives a patient from another
setting of care or
provider of care or believes an encounter is relevant should
perform medication
reconciliation.
8 The eligible professional who transitions their patient to
another setting of care or
provider of care or refers their patient to another provider of
care should provide
summary care record for each transition of care or referral.
How Health Information Is Regulated
FIGURE 1.9. (Continued)
9
10
Menu Set Objectives
Capability to submit electronic data to immunization registries
or immunization
information systems and actual submission according to

14. applicable law and
practice.
Capability to submit electronic syndromic surveillance data to
public health
agencies and actual submission according to applicable law and
practice.
So urce: CMS 2012
FIGURE 1.10.
Description of EHR adoption incentive plan timelines for
eligible professionals
Qualifies to Receive First Medicare Incentive Payment in ...
Payment Amount I 2011 2012 2013 2014 2015
by Year
2011 I $1s.ooo
-
2012 I $12,000 $18,000
-
2013 I $8,000 $12,000 $15,000
-
2014 I $4,000 $8,000 $12,000 $12,000
-
2015 $2,000 $4,000 $8,000 $8,000
2016 $2,000 $4,000 $4,000

15. Total payment $44,000 $44,000 $39,000 $24,000
Source: Dimick 2011
The compliance date for Stage 2 meaningful use is 2014.
(AHIMA 2012)
17
Payments from the federal government have already begun for
those who have
demonstrated Stage 1 meaningful use. Eligible professionals in
the Medicare EHR
Incentive Program must achieve meaningful use of a certified
product by 2014 to be
eligible to receive the government's incentive payments. Funds
for incentive payments
were established in ARRA. A final rule by CMS in July 2010
established the details of
the incentive program, which was developed in conjunction with
ONC. The first EHR
products were certified for the incentive programs in autumn
2010. Registration for the
Medicare program began in January 2011. For demonstrating
meaningful use of certified
health IT systems, physicians in the Medicare program are
eligible to earn up to $44,000.
If they qualify for the first payment in 2011 or 2012, they can
receive the full amount. The
meaningful use incentive plan timeline for eligible professionals
is detailed in figure 1.10.
It shows that providers who enter the incentive program early
earn the greatest amount
of money (Dimick 2011).