Core measure 15 of the Meaningful Use standards requires that an organization do a HIPAA risk assessement, begin remediation ot the risks discovered and have an on-going risk management program in place. In discussions with our partner ACR2 Solutions we have observed that a number of CEs were confused about what a HIPAA risk assessment entailed and that even if they did the risk assessment correctly they often thought that they were done and did not move on to remediation and the on-going risk management portions.
When audited by CMS contractor Figliozzi and Company, Forty-seven (80%) of 59 providers failed audits conducted in April 2012. Now we see the first report of a CE having to return millions of stimulus funds.
Group wrongly claims $31M EHR payments
Healthcare IT News
Reports two-and-a-half years of bad finance statements
NAPLES, FL | November 6, 2013
One Florida-based hospital management group is now in a rush to revise its financial statements after realizing it owes the government more than $31 million because the group recorded the hospitals' Medicare and Medicaid electronic health record payments as income.
Health Management Associates, which operates 71 hospitals across 15 states, announced late Tuesday it would amend "as soon as possible" two-and-a-half years of inaccurate financial claims.
Officials say that 11 of the hospitals enrolled in EHR incentive programs did not actually meet meaningful use criteria, despite being awarded the payments. In October 2013, based on the results of an internal review, HMA determined it had made an error in applying the requirements for certifying its EHR technology under these programs.
[See also: Mostashari: No cap on EHR incentive payouts.]
The Centers for Medicare and Medicaid Services,the government agency responsible for administering federal EHR incentive programs, as well as the agencies that administer the various relevant state Healthcare IT programs, were notified.
Of these $31 million payments, "HMA recognized as income some $8.3 million in 2011, approximately $17.3 million in 2012 and $5.4 million in the first six months of 2013. HMA withdrew the 11 hospitals from the HCIT programs Oct. 30 and has repaid the majority of the funds to CMS," according to a company news release. HMA is currently in the process of repaying the balance of the funds to the relevant state programs, officials say.
CMS has paid out more than $15.2 billion in EHR incentive payments to eligible providers and hospitals demonstrating meaningful use since 2011.
[See also: EHR copy and paste? Better think twice.]
Just last year, the OIG conducted a study on CMS' oversight of the EHR incentive programs and found that the program has been left "vulnerable to paying incentives to professionals and hospitals that do not fully meet the meaningful use requirements," the report says. "CMS has not implemented strong prepayment safeguards, and its ability to safeguard incentive payments postpayment is also limited."
OIG subsequently put forth recommendations to CMS, urging the agency to "obtain and review supporting documentation" of eligible hospitals and providers before payments are paid out, for verification purposes. They also recommended that CMS provide guidance with examples of compliance documents that eligible groups should maintain.
CMS did not follow the first recommendation, OIG officials said, "stating that prepayment reviews would increase the burden on practitioners and hospitals and could delay incentive payments."