1. Regulatory Roundtable Meaningful Use & HIPAA Kathy Branca Ray Harms

2. Meaningful Use & 2014 CEHRT What does it all mean?

3. MU Timeline Stage of Meaningful Use 1 st Year 20112012201320142015201620172018201920202021 20111112222/3TBD 2012 112222/3TBD 2013 11222/3TBD 2014 11223TBD 2015 11223TBD 2016 11223TBD 2017 11223 1st year of attestation has a 90-day reporting period Be on Stage 1 for 2 years before going to Stage 2, except if attested in 2011 (3 yrs.) For 2014, all stages have a 90-day reporting period (specific quarters) CLIENTS MUST BE LIVE ON 2014 CEHRT BY JULY 1, 2014 For 2015 and later, Medicare EP, EH and CAHs that have not successfully demonstrated MU will “experience a negative payment adjustment to their Medicare reimbursement”. Potential delay for Stage 3

4. SoftLab 4.0.7 received modular certification in January. SoftLab 4.5.4 received modular certification in April. Clients can now use SoftLab 4.0.7 or 4.5.4 to attest to MU Stage 1 or Stage 2. Use of 2014 Edition EHR Technology is good until 12/31/2015 (for now). 2014 CEHRT must be used to attest to any stage of MU in fiscal year 2014. Reporting period must start by July 1, 2014. 11/30/2014 – last day to attest for 2014. 2014 Edition EHR Technology

5. –(b)(5)(B) (Inpatient only) Incorporate lab tests & values/results –(f)(4) Transmission of reportable laboratory tests and values/results –(b)(6) Transmission of electronic laboratory tests and values/results to ambulatory providers. –(g)(1) Automated numerator recording –(g)(4) Quality management system NOTE: Modular EHRs do not need security criteria certification. SoftLab 4.0.7 & 4.5.4 2014 Ed. EHR Technology Criteria 45 CFR 170.314

6. Certification for the 2011 Edition EHR Technology expired on 12/31/2013. SCC can no longer refer to SoftLab 4.0.3, 4.0.4 or 4.0.6 as being certified. These products can no longer be used to attest to Meaningful Use. 2011 Edition EHR Technology

7. Published in the Fed. Reg. 2/26/14. Accepted comments thru 4/28/14 Voluntary CPOE will be split into 3 criteria: medication, lab, radiology Incorporate lab tests – updated standards to HL7 2.5.1 Transmission of lab tests to ambulatory providers - updated HL7 2.51 LRI standard. View, Download, and Transmit to Third Party –Patient can choose who to send their information to. (CLIA/HIPAA impact) Transmission of reportable lab tests - updated HL7 2.5.1 standards Non-percentage-based measures report –Requires EHR to generate report associated with a non-percentage- based MU measures during an EHR reporting period. Proposed 2015 Edition EHR Technology Criteria

8. Meaningful Use Objectives MU Stage 1 Attest to all 13 core objectives. Attest to 5 of 10 menu objectives (1 in Public Health). –Incorporate lab test results into EHR as structured data. –Submit electronic data on reportable lab results to public health agencies. MU Stage 2 Attest to all 16 core objectives. –Incorporate lab test results into CEHRT as structured data. –Submit electronic data on reportable lab results to public health agencies. Attest to 3 of 6 menu objectives. –Provide structured electronic lab results to ambulatory providers.

9. Use the Correct Terminology As easy as “finding x” Clients attest to stages of MU Vendors certify software to 2014 edition criteria Vendors do not have MU certified software Implementation/Upgrade to 2014 CEHRT is not only for MU2 projects.

10. CMS and ONC to publish rules every 12 – 18 months Recommendation – delay to 2017 Fall of 2014, CMS to release a notice of proposed rulemaking (NPRM) for Stage 3, and corresponding 2017 Edition of the ONC Standards and Certification Criteria Final rule with all requirements for Stage 3 would follow in the first half of 2015. Meaningful Use Stage 3

11. Federal Register 2/6/14 – Changes to HIPAA Privacy Rule & CLIA Labs to provide patients & designees access to lab results No lab interpretation CLIA changes effective 4/7/14 - allow labs to provide test results directly to patients HIPAA changes effective 10/6/14 - remove exemption for CLIA-certified labs, requires labs to provide test results to patients within 30 days of request. –Labs need to update privacy notices to “inform individuals of this right, include a brief description of how to access this right and must remove any statements to the contrary.” CLIA ‘88 & HIPAA Changes

12. Review of client business associate agreements Updating policies and procedures to address: –HIPAA Security Rule –HIPAA Privacy Rule –Breach notification Rule Procedures to address: –Clients documenting PHI –SCC documenting/forwarding PHI –SCC software defects leading to investigation –Access to client systems –TMS - Roles HIPAA Compliance & SCC

13. ICD-10 - Delayed until AT LEAST 10/2015 Federal Trade Commission and Data Security –FTC responsible for protecting consumers from deceptive and unfair commercial practices. (Section 5 of the FTC Act 15 U.S.C. § 45(a)) –Imposes civil penalties/sanctions against companies committing data breaches based on unfair and deceptive practices for failing to implement proper data security measures. –Alleged that inadequate data security is either deceptive because it contradicts promises made in company privacy policies; or unfair because it creates an unavoidable harm to consumers that is not outweighed by other benefits. –LabMD (uropathology lab in Atlanta) suspended operation due to the investigation Other Regulatory Issues

14. Questions? Share experiences Discuss best practices Discussion/Best Practices/Q&A