The First Anniversary of the Health Information Technology for Economic and Clinical Health (HITECH) Act: The Regulatory Outlook for Implementation

Introduction

Since the passage of the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions included in the American Recovery and Reinvestment Act (ARRA) in February 2009, the government has released three sets of statutorily required regulations: one addressing breach notification requirements for protected health information (PHI) and two addressing Medicare and Medicaid incentives for meaningful use of electronic health records (EHRs).¹ These regulations build on the framework and financial support authorized under ARRA for increased use of EHRs and enhanced privacy and security provisions for PHI.

The first rule, released by the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) on August 24, 2009, addresses notification requirements in the event of a breach of unsecured PHI.² The second rule, released by the HHS Centers for Medicare and Medicaid Services (CMS) on December 30, 2009, addresses incentive payments available under the Medicare and Medicaid programs for hospitals, physicians, and other healthcare providers that qualify as “meaningful users” of EHRs.³ The third rule, released by the HHS Office of the National Coordinator for Health Information Technology (ONC), details, among other things, the certification criteria for EHR technology.⁴ These rules strongly encourage greater use of EHRs and other types of health information technology (HIT) while protecting information privacy and security. However, as discussed below, there remain critical issues that will need to be addressed as providers and other stakeholders take the next steps toward secure electronic health information exchange.

Background

Over the past five years, federal policymakers have supported the increased use of HIT through executive orders, regulatory reforms, and legislation in recognition of its potential to decrease costs, improve health outcomes, coordinate care, and improve public health.^5–11 The passage of ARRA significantly changed the regulatory landscape by authorizing substantial financial and technical support for the adoption and use of EHRs and enhancing information privacy and security requirements.¹² One of the most comprehensive pieces of economic legislation ever enacted, ARRA provides hundreds of billions of dollars in healthcare spending, including more than $49 billion in discretionary appropriations and mandatory spending to support and promote the adoption of HIT generally and EHRs in particular.¹³ In addition, the legislation makes comprehensive reforms in health law and policy, particularly in the areas of health information privacy law and laws governing provider payments under Medicare and Medicaid.¹⁴ These provisions are included in HITECH.

Medicare and Medicaid Incentives for Meaningful Use of EHRs

HITECH employs both “carrots” and “sticks” to encourage the adoption and use of EHRs. It authorizes CMS to provide monetary incentives to eligible healthcare providers under Medicare and Medicaid to encourage the purchase and use of EHR systems, and it threatens financial penalties in the form of reduced Medicare payments for nonadopters. Incentive payments are conditioned on the ability of providers to demonstrate “meaningful use” of EHRs, defined by the statute as (1) use of certified EHR technology in a demonstrably meaningful manner, including e-prescribing; (2) use of certified EHR technology that allows for the electronic exchange of health information to improve the quality of healthcare, such as promoting care coordination; and (3) reporting on clinical quality measures and other measures selected by the Secretary using certified EHR technology.¹⁵

Medicare

HITECH's Medicare incentive payments are targeted at physicians practicing in fee-for-service settings, hospitals, and, in certain cases, Medicare Advantage (MA) organizations (see Table 1). Physicians are eligible for the incentive payments without regard to their Medicare patient load, except in the case of those practicing in MA organizations. Beginning in 2011, physicians who can demonstrate meaningful use of a certified EHR system can receive bonus Medicare payments for up to five years. The payment is equal to an additional 75 percent of the physician's allowable Medicare charges for the given year, subject to caps.¹⁶ Physicians who predominately serve beneficiaries in health professional shortage areas (HPSAs) are eligible for 10 percent higher payment caps.¹⁷ Beginning in 2015, physicians who are not meaningful users of EHRs will be penalized in the form of reduced Medicare fees at the rate of 1 percent per year. The Secretary retains authority to reduce Medicare payments by a total of 5 percent if fewer than 75 percent of eligible professionals (EPs) are meaningful EHR users by 2018.¹⁸

Table 1.

Medicare Incentive Payments for Meaningful Use of Certified EHRs by Eligible Professionals

Adoption Year	First Payment Year Amount and Subsequent Payment Amounts in Following Years (in thousands of dollars)	Reduction in Fee Schedule for Nonadoption/Nonuse
2011	$18, $12, $8, $4, $2	$0
2012	$18, $12, $8, $4, $2	$0
2013	$15, $12, $8, $4	$0
2014	$12, $8, $4	$0
2015	$0	−1% of Medicare fee schedule
2016	$0	−2% of Medicare fee schedule
2017 and following	$0	−3% of Medicare fee schedule
Incentive: Eligible providers may receive up to 75% of allowable Medicare Part B charges, to a maximum of $18,000 over a five-year period, ending in 2016. • Physicians practicing in rural health professional shortage areas are eligible to receive a 10% increase on the incentive payment amounts described above. • For 2018 and each subsequent year, if the proportion of eligible professionals who are meaningful EHR users is less than 75%, the fee schedule will be lowered by 1% from the applicable percent in the preceding year, up to 5%. • Eligible acute care and critical access hospitals have a similar incentive plan beginning in 2011 and phasing down over four years, available to new adopters only through 2015. Penalties for nonadoption begin in 2016. The incentive payment is calculated based on the product of (1) an initial amount of $2 million plus an amount based on the number of discharges for each eligible hospital; (2) an adjustment variable reflecting the proportion of the hospital's inpatient-bed days attributable to Medicare beneficiaries and an adjustment for charity and uncompensated care; and (3) a transition factor that phases down the incentive payments by 25% per year over the four-year period (i.e., 100%) for the first payment year, 75% for the second payment year, 50% for the third payment year, 25% for the fourth payment year, and zero thereafter). If hospitals are not meaningful users of certified EHR technology by FY2015, their market basket update to the inpatient prospective payment system (IPPS) payment rate will be reduced by 75% to 100%. • Qualifying critical access hospitals can apply for cost-based reimbursement for EHR technology capped at 101% of reasonable costs. In addition, 20 percentage points are added to the Medicare share portion of the incentive formula, provided that the Medicare share calculation does not exceed 100%. Instead of the annual or periodic payments in place for other hospitals, critical access hospitals may expense the costs in a single payment year. These hospitals can continue to receive cost-plus reimbursement for remaining costs, such as ongoing maintenance of the EHR systems.
Eligible physicians: Non-hospital-based physicians.a Medicare Advantage-affiliated professionals are eligible if affiliated with organizations that furnish at least 80% of their services to MA enroll ees; and furnish, on average, at least 20 hours per week of patient
care services. • Physicians cannot take advantage of the incentive payment programs under both the Medicare and Medicaid programs.

^aOn April 15, 2010, President Obama signed the Continuing Extension Act of 2010, Public Law 111-157, into law. The act clarifies that the term hospital-based eligible professional (who are ineligible for incentive payments under HITECH) includes only physicians who primarily work in inpatient and emergency room settings.

Sources: American Medical Association at http://www.ama-assn.org/amal/pub/upload/mm/399/arra-hit-provisions.pdf; CMS; ARRA Title IV Subtitle B § 4102 (a) (adding new section 1886 (n)(2) to the Social Security Act).

A similar incentive system is established for eligible acute care and critical access hospitals, with payments beginning in 2011 and phasing down by 25 percent per year over four years. Reduced incentive payments are available for hospitals that become meaningful users in 2013 or 2014, but incentives are unavailable for new adopters after 2015. Beginning in 2015, hospitals face penalties for nonadoption in the form of reduced reimbursements as well.^19–21

Medicaid

HITECH gives a dramatic and explicit boost to state funding efforts for HIT under Medicaid (see Table 2). The law provides for a 100 percent federal contribution to enable EHR adoption by several classes of Medicaid providers who serve a high volume of Medicaid patients and, in the case of Federally qualified health centers and rural health clinics, needy patients. Eligible providers must agree to waive any right to Medicare HIT incentive payments.^22,23

Table 2.

Medicaid Incentive Payments for Meaningful Use of Certified EHRs by Eligible Professionals (in thousands of dollars)

	Payment Year
Adoption Year	2011	2012	2013	2014	2015	2016	2017	2018	2019	2020	2021	Total Payment
2011	21.25	8.5	8.5	8.5	8.5	8.5	0	0	0	0	0	63.75
2012		21.25	8.5	8.5	8.5	8.5	8.5	0	0	0	0	63.75
2013			21.25	8.5	8.5	8.5	8.5	8.5	0	0	0	63.75
2014				21.25	8.5	8.5	8.5	8.5	8.5	0	0	63.75
2015					21.25	8.5	8.5	8.5	8.5	8.5	0	63.75
2016						21.25	8.5	8.5	8.5	8.5	8.5	63.75
Incentive: Eligible professionals may receive up to 85% of the net average allowable costs for certified EHR technology, including support and training (determined on the basis of studies that the Secretary will undertake), up to a maximum level of $25,000 for the first year and $10,000 for each subsequent year, over a six-year period. • After the initial start-up payment, subsequent payments are conditioned on “meaningful use” of EHR technology. • Non-hospital-baseda pediatricians with at least 20% patient volume attributable to Medicaid can receive a reduced incentive payment per year, totaling up to $42,500 over a six-year period. • Other non-hospital-baseda physicians with at least 30% patient volume attributable to Medicaid, and eligible professionals who practice predominantly in a Federally qualified health center or rural health clinic and have at least 30% patient volume attributable to needy individuals (including Medicaid, SCHIP, those paying on sliding scale basis, and uncompensated care), could receive up to $63,000 over a six-year period. • Acute care and hospitals with at least 10% patient volume attributable to Medicaid would also be eligible for payments, as would children's hospitals of any Medicaid patient volume.
Eligible providers: Physicians, dentists, certified nurse-midwives, nurse practitioners, and physician assistants who are practicing in Federally qualified health centers or rural health clinics led by a physician assistant. • Physicians cannot take advantage of the incentive payment programs under both the Medicare and Medicaid programs.

^aOn April 15, 2010, President Obama signed the Continuing Extension Act of 2010, Public Law 111-157, into law. The act clarifies that the term hospital-based eligible professional (who are ineligible for incentive payments under HITECH) includes only physicians who primarily work in inpatient and emergency room settings.

Source: CMS; ARRA Title IV Subtitle B § 4201(a) (amending Section 1903 of the Social Security Act, 42 U.S.C.A. § 1396b

The Medicaid incentive program makes financing available for implementation or technology upgrades to providers who might not have funds of their own to invest.²⁴ Following an initial start-up payment, subsequent payments are conditioned on meaningful use of the EHR technology as defined by each individual state. While the Secretary of Health and Human Services is obligated to implement HITECH's Medicare HIT incentives, Medicaid implementation is an optional state undertaking.

In order to qualify for the Medicaid incentive payments, a provider's patient load must be at least 30 percent Medicaid; providers practicing “predominately” in rural health clinic or Federally qualified health center settings are accorded broader eligibility criteria that allow payment if at least 30 percent of their patients are “needy individuals” (which includes Medicaid, State Children's Health Insurance Program [SCHIP] beneficiaries, and those receiving uncompensated care or paying on a sliding-scale basis).²⁵ Pediatricians can qualify for a reduced incentive payment if 20 percent of their patients are Medicaid beneficiaries.²⁶

As with the Medicare incentive program, Medicaid incentives begin in 2011 and phase down thereafter. Eligible providers may receive up to 85 percent of net average allowable costs, up to a maximum level of $25,000 for the first year and $10,000 for each subsequent year. An initial payment to cover the cost of purchasing or upgrading certified technology including training and other support services can therefore equal up to $21,250. Eligible providers may then receive up to $8,500 per year for five years for operation and maintenance, as long as they continue to demonstrate meaningful use.²⁷ Providers receiving payments must cover any additional costs incurred in setting up and maintaining their HIT systems. Acute care hospitals with more than 10 percent of their patients on Medicaid and children's hospitals of any Medicaid patient volume can receive incentive payments for the purchase of EHR technology up to the amount allowed under the Medicare incentive program for hospitals.²⁸ Providers who adopt EHRs after 2016 will not be eligible for incentive payments.

Non-hospital-based physicians (including pediatricians) are therefore eligible to receive up to $63,750 if they have at least 30 percent Medicaid patient volume under the program. An alternative payment schedule and patient-mix criteria are provided for non-hospital-based pediatricians who have at least 20 percent Medicaid patient volume, who may receive up to $42,500. The choice for physicians between the two incentive programs is significant: for early adopters, potential Medicaid incentive payments could be significantly higher than under the Medicare program.²⁹

Attaining Meaningful Use

Critical to the implementation of the Medicare and Medicaid incentive payment programs is the concept of “meaningful use.” As required by HITECH, CMS released a notice of proposed rulemaking (NPRM) on December 30, 2009, defining the terms and conditions under which an EP or hospital can qualify for Medicare or Medicaid incentive payments.³⁰ Although HITECH gives state Medicaid agencies flexibility to develop a definition of meaningful use that may differ from that used by Medicare, CMS proposes using the same criteria for both the Medicare and Medicaid programs. However, the proposed rule does allow state Medicaid agencies to add additional requirements.

CMS proposes a three-stage approach for the implementation and development of “meaningful use” criteria to allow for the development of an infrastructure for health information exchange.³¹ Stage 1 criteria, which are proposed in the current NPRM, primarily address the capture of health information.³² Stage 2 criteria, which will be proposed by the end of 2011, will expand upon the initial criteria to include more robust requirements for health information exchange, such as continuous quality improvement at the point of care and structured information exchange (e.g., electronic transmission of orders entered using computerized provider order entry (CPOE) and electronic transmission of diagnostic test results).³³ Stage 3 criteria, which will be proposed by the end of 2013, will include even more robust requirements, designed to focus on improving population health and promoting improvements in quality, safety, and efficiency; decision support for national high-priority conditions; patient access to self-management tools; and access to comprehensive patient data.³⁴

The proposed Stage 1 “meaningful use” criteria include a set of 25 objectives and measures to be met by EPs and a set of 23 objectives and measures to be met by hospitals.³⁵ These objectives and measures are categorized by care goals (which in turn are grouped under broader health-outcome policy priorities) that are focused on improving quality, safety, and efficiency and reducing health disparities; engaging patients and families; improving care coordination; improving population and public health; and ensuring adequate privacy and security protections for personal health information.³⁶ Within these priorities, Stage 1 criteria include electronic capture of health information in a coded format; tracking of key clinical conditions; communication of tracked information for care coordination purposes; implementation of clinical decision support tools to facilitate disease and medication management; and reporting of clinical quality measures and public health information. The Stage 1 criteria will serve as the complete criteria for meaningful use until the further phases have been defined by subsequent rulemaking.

The Stage 1 “meaningful use” objectives primarily reflect the recommendations of the HIT Policy Committee, with certain exceptions (e.g., CMS does not propose to include “Record Advance Directive” as an objective, which would have required EPs and hospitals to record in an EHR the presence or absence of advance directives for patients over the age of 65).^37,38 Moreover, unlike the HIT Policy Committee, CMS has paired each objective with a measure so that an EP or hospital can demonstrate having fulfilled a particular “meaningful use” criterion.³⁹ On February 17, 2010, the HIT Policy Committee provided additional recommendations to CMS that, among other things, would allow EPs and hospitals to defer compliance with up to five “meaningful use” criteria from Stage 1 to Stage 2.⁴⁰

To address the final prong of HITECH's definition of “meaningful use,” which requires reporting on clinical quality measures, the NPRM also includes a set of proposed quality measures for EPs and hospitals to use to qualify for an incentive payment.⁴¹ More specifically, EPs must report a core group of four clinical quality measures regarding tobacco use, blood pressure management, and drugs to be avoided in the elderly and one applicable specialty group of clinical quality measures.^42,43 The vast majority of the quality measures are currently being used by the Physician Quality Reporting Initiative (PQRI) and are endorsed by the National Quality Forum (NQF) or approved by the AQA (formerly the Ambulatory Care Quality Alliance). A separate set of clinical quality measures is included for hospitals.⁴⁴ Some of the hospital quality measures included in the NPRM are currently in use for the Reporting Hospital Quality Data for Annual Payment Update (RHQDAPU) program, but many are not. In addition, CMS proposes additional alternative clinical quality measures for hospitals participating in the Medicaid incentive program.

Comments were due on the proposed “meaningful use” rule by March 15, 2010, and CMS expects to release a final rule in summer 2010.

Standards and Certification Criteria for EHRs

Since 2005, ONC has contracted with a private organization, the Certification Commission for Health Information Technology (CCHIT), to certify EHRs as having specific basic capabilities.⁴⁵ Many of the EHRs certified thus far are difficult to use, however, and are not designed to meet ARRA's goals of improving quality and efficiency in the healthcare system. Not only must the standards developed by ONC for a “certified EHR” be designed to meet those goals, but physicians and hospitals also will have to use the EHRs effectively in order to do so.⁴⁶

On the same day that CMS released the “meaningful use” NPRM, ONC released an interim final regulation describing the standards and certification criteria that EHRs must meet for EPs and hospitals to receive “meaningful use” payments.⁴⁷ This initial set of standards reflects many of the recommendations made by the HIT Standards Committee in August 2009.⁴⁸ They are intended to begin the process of defining a common language to enable the accurate and secure exchange of health information across EHR systems. In particular, the rule describes formats for clinical summaries and prescriptions; terms to describe clinical problems, procedures, laboratory tests, medications, and allergies; and standards for the secure transmission of information on the Internet. The rule also provides guidance on criteria that will be required for an EHR technology to be deemed certified.

Use of a certified EHR is one of the key requirements of “meaningful use” as defined in HITECH and the NPRM for providers to receive available incentive payments. This set of standards became effective 30 days after publication in the Federal Register (February 15, 2010); however, comments were accepted through March 15, 2010, and a final rule is expected later in 2010.

Privacy and Security Reforms

In response to concerns related to the perceived ease of access to electronic data, and in recognition of the fact that protecting individuals' health information is necessary in order to build public trust in electronic health information systems, Congress crafted HITECH to significantly revise health information privacy and security law, particularly the Health Insurance Portability and Accountability Act (HIPAA).^49,50 The statute broadens HIPAA's reach and strengthens its privacy and security standards, in addition to adding new provisions related to enforcement and entities not covered by HIPAA. To date, only regulations addressing breach notification requirements have been released. Regulations are expected later this year addressing new requirements for business associates, including the direct application of HIPAA penalties to all business associates.

The regulations that have been released address privacy and security breach notices. Although a number of states have enacted laws requiring businesses to notify consumers of breaches of the security of their personal information in electronic databases, HIPAA has no strict notification requirement. HITECH established the first national data security breach notification law by requiring covered entities to notify individuals whose unsecured PHI has been disclosed as a result of a privacy or security breach.⁵¹ In certain cases, the covered entity must also notify the Secretary of HHS and the general public. If a breach is discovered by a business associate, the business associate is required to notify the covered entity and identify each individual who is reasonably believed to have been affected. Unlike many state notification laws, the new federal law is not limited to breaches of the security of online information or restricted to financially sensitive information, such as Social Security numbers. HITECH does not preempt state requirements that are more restrictive and does not apply to certain unintentional disclosures of PHI.⁵²

The statute applies similar breach notification requirements to vendors of PHRs, businesses that offer products or services through the Web site of a PHR vendor or a covered entity that offers PHRs, and entities that access information in or send information to a PHR.⁵³ As required by HITECH, the HHS OCR and the Federal Trade Commission (FTC) issued rules implementing the breach notification requirements for both covered and noncovered entities respectively in August 2009.^54,55 The regulations largely reflect the provisions in HITECH and became effective September 23, 2009, although HHS indicated that no penalties would be imposed prior to February 22, 2010. Also, as required by HITECH, the government has posted the initial lists of covered entities that have reported breaches of unsecured protected health information affecting more than 500 individuals.⁵⁶

It is notable, however, that several provisions of the OCR regulations have been interpreted as more relaxed than HITECH's requirements in defining new substantive standards for breach notification. For example, the regulations establish a harm threshold that relieves covered entities and business associates of the responsibility to notify individuals of improper disclosures that pose little or no risk of harm.⁵⁷ This relaxation of the statute's requirements, however, is accompanied by a new requirement for these organizations to conduct and document risk assessments of all improper uses or disclosures.⁵⁸ In addition, the OCR regulations clarify that improper uses or disclosures of limited data sets (a data set, defined by the HIPAA Privacy Rule, that is stripped of a number of categories of patient-identifying information and can be used pursuant to a data use agreement for research, public health, and healthcare operations purposes) do not trigger breach notification requirements.^59,60 The regulations also expand the statutory exception for disclosures by authorized persons who work at the same facility by defining “facility” to mean any covered entity, business associate, or organized healthcare arrangement.⁶¹ This language effectively broadens the exception to include inadvertent, improper data exchanges within the same organization, even if they do not occur within the same physical facility.⁶² The regulations also take steps to harmonize FTC and OCR requirements for PHR vendors that may be subject to both FTC and OCR regulations.⁶³ Finally, the regulations reinforce the OCR guidance released April 17, 2009, that provides a safe harbor by specifying encryption and other methods for securing PHI, thereby eliminating notification requirements in the event of a breach of such information.⁶⁴ An annual update to this guidance on the safe harbor for encryption and other methods of securing PHI will be released in the near future.⁶⁵

The Future Outlook: Anticipated Rulemaking, Challenges, and Opportunities

ARRA's HITECH provisions reflect a shared conviction among the presidential administration, Congress, and many healthcare experts that electronic information exchange is essential to improving health and healthcare. HIT, however, is not an end in itself but a means of improving the quality of healthcare, the health of populations, and the efficiency of healthcare systems.

As the current proposed and interim final rules illustrate, a number of implementation challenges lie ahead. With significant financial support comes a new set of complex statutory and regulatory requirements that will require financial and technical assistance for providers and federal and state agencies to implement. Furthermore, these requirements will require changes in workflow processes and systems that will depend upon both resources and time to modify and implement. ONC has begun the process of assisting these developments by issuing a range of HITECH grantmaking and policy guidance on, for example, the State Health Information Exchange Cooperative Agreement Program, the Health Information Technology Extension Program, the Strategic Health IT Advanced Research Projects Program, and a series of educational and training programs.⁶⁶

In addition, the regulations discussed in this article represent merely the first phase of HITECH-related rulemaking. For example, CMS has provided only guidance on Stage 1 criteria for meaningful use with nominal mention of what can be expected from future rulemaking for Stages 2 and 3. Future rulemaking is also expected to clarify the application of new HITECH requirements to business associates later in 2010. An annual update to the guidance addressing encryption and other methods to secure PHI and new guidance addressing the application of the minimum necessary standard to the disclosure of PHI are also anticipated later in 2010.^67,68

Finally, a number of other HITECH provisions that did not require regulatory rulemaking became effective on February 17, 2010. These include application of HIPAA requirements and penalties directly to business associates; expansion of the definition of business associate to include certain entities not previously covered by HIPAA, including health information exchanges, regional health information organizations, and other organizations that transmit PHI to a covered entity or its business associate and require routine access to PHI; and defining safe-harbor status for limited data sets as meeting the minimum necessary standard.^69–71 These changes also require resources and technical support to implement and represent a significant shift in current practices.

Providers, vendors, and other stakeholders should continue to pay close attention to these and related requirements as the implementation of HITECH gathers speed. Taken in their entirety, the provisions of HITECH and implementing regulations represent a transformational shift in the delivery of healthcare in America from a paper-based to an electronic system that supports improvements in the quality and efficiency of care.