Tag: Amy Leopard

Think Meaningful Use in 2014 Couldn’t Get Any More Complicated? Think Again

Amy Leopard
Amy Leopard

Guest post by Amy Leopard, partner, and Kevin Alonso, associate, Bradley Arant Boult Cummings LLP.

On Sept. 4, 2014, the Centers for Medicare and Medicaid Services (“CMS”) published a final rule that, effective Oct. 1, 2014, implements changes to the Medicare and Medicaid Electronic Health Record Incentive Program in light of industry-wide difficulties in transitioning to EHR technology certified to the 2014 Edition EHR certification criteria (“2014 Edition CEHRT”) during calendar year 2014 for eligible professionals and fiscal year 2014 for eligible hospitals and critical access hospitals. CMS makes no changes to the existing 2014 reporting periods or the requirement in future reporting periods to report for a full year.[1] This final rule also extends Stage 2 for an additional year for those providers first demonstrating meaningful use in 2011 or 2012. Instead of starting Stage 3 in 2016, those providers will now start Stage 3 in 2017. The timeframe for Stage 3 implementation by providers that first demonstrated meaningful use after 2012 is unchanged by this final rule.

Kevin Alonso
Kevin Alonso

Prior to these changes, providers were required to use 2014 Edition CEHRT to demonstrate either Stage 1 or Stage 2 meaningful use in 2014. The shortened 2014 attestation periods implemented in the 2012 final rule were aimed at helping providers make the transition from 2011 Edition CEHRT to 2014 Edition CEHRT, but delays affecting the availability of, and the ability of providers to implement, 2014 Edition CEHRT meant that many providers still might be unable to demonstrate meaningful use, despite their best efforts.

To provide some additional flexibility, CMS will now provide three alternatives routes to demonstrate meaningful use in 2014 for providers facing such difficulties: (1) using 2011 Edition CEHRT only, (2) using a combination of 2011 and 2014 Edition CEHRT, or (3) using 2014 Edition CEHRT for Stage 1 objectives and measures in 2014 for providers scheduled to begin Stage 2. These alternatives will also provide some flexibility in the objectives and measures that providers must meet to demonstrate meaningful use, as summarized in the chart below.[2]

Continue Reading

OCR Breach Reporting: 2013 “Small Breach” Report due Saturday and Recent Settlement for Lack of Breach Notification Procedures

Amy Leopard
Amy Leopard

Guest post by Amy Leopard, partner, Bradley Arant Boult Cummings in Nashville, Tenn.

Don’t forget that the end-of-the-year reporting of Health Insurance Portability and Accountability Act (HIPAA) breaches of unsecured protected health information (PHI) discovered in 2013 is due Saturday, March 1, 2014.

Healthcare providers and health plans that are covered entities under HIPAA must report breaches of unsecured PHI affecting fewer than 500 individuals annually to the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). These small breaches should already have been reported to each of the affected individuals, and reports to the OCR should include the actions to mitigate and remediate any breaches, even those affecting a single individual. Reports to the OCR of large breaches (those affecting 500 or more individuals) are made at the time of reporting to the affected individuals—that is, without unreasonable delay and in no case greater than 60 days.

Covered entities may report small breaches electronically at the OCR’s website: www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brinstruction.html.

Continue Reading