CCHIT Certification | EMR and HIPAA

Healthcare Groups Want Meaningful Use Evaluated Before Stage 3

Though the final rules for Meaningful Use Stage 3 aren’t due to take effect until 2016, ONC has already made the draft rules available for public comment. And comments, to be sure, the agency is getting.

While various groups have chosen their own details to critique, the general consensus seems to be that ONC is getting ahead of itself and ought to give Meaningful Use Stage 1 and 2 a good hard look first.

Accordng to a nice summary from iHealthBeat, here’s where some of the major healthcare groups stand:

* The American Hospital Association is recommending that ONC fund a comprehensive evaluation of MU generally, and while it does, hold off on finalizing Stage 3 recommendations.

* CHIME, too, is asking ONC to evaluate the existing Meaningful Use program to decide whether achieving stage 3 is realistically possible by 2016.

* The Federation of American Hospitals is also arguing that ONC needs to evaluate current Meaningful Use requirements. Also, in its letter to ONC, the group argues that the existing structure of two years per stage doesn’t cut it.

* The AMA weighed in with its own recommendation that ONC evaluate Meaningful Use as is before moving ahead. It also suggested changing some thresholds to make them more reachable; greater flexibility in program requirements; change the certification process to address usability; and improve HIT’s capability to share patient data.

Personally, I think the idea of doing an extensive Meaningful Use evalulation sounds like a good one, and I hope ONC actually does so. When you’re setting new standards that affect so many providers, why not gather some data on how existing standards work?

Final EHR Certification Bodies – Meaningful Use Monday

Written by: John Lynn

This seems mostly like a formality, but NIST has published the list of Accredited Testing Laboratories (ATLs), that are qualified to test EHR technology under the Permanent EHR Certification Program. You might remember that the permanent EHR certification program was delayed.

Here are the list of companies that are part of the final EHR certification bodies:

Drummond Group
Certification Commission for Health Information Technology (CCHIT)
ICSA Laboratories, Inc.
InfoGard Laboratories, Inc.
SLI Global Solutions

All of them are familiar names and ones that have been doing work with EHR certification the whole time. I think this is generally good for consistency of EHR certification. Can you imagine if you’d certified your EHR using one of the bodies and then that body didn’t get approved for the permanent EHR certification. Sure, the criteria are still the same, but there’s some differences in the processes each EHR certification body uses.

As most of you know, I’ve been a long opponent to EHR certification. I think it’s pointless and provides no value to physicians. However, someone in Washington put it in the HITECH legislation, so we’re stuck with the idea of a certified EHR. The good thing is that ONC and CMS have basically rendered it meaningless since every EHR vendor has basically become a certified EHR or will be soon. Of course, that also illustrates how pointless the EHR certification really is.

All in all, the EHR certification bodies are going to be around for a number of years more. I’m not sure if they’ll survive post HITECH. I just wish they were providing something “meaningful” (pun intended.

Few Doctors Ready To Qualify for Meaningful Use

Written by: Katherine Rourke

A new study published in Health Affairs has confirmed what I, at least, have suspected for some time about physicians and their EMRs. The study, which surveyed 3,996 physicians, found that while 91 percent were eligible for Medicare or Medicaid Meaningful Use programs, only 11 percent of those intending to apply had their act together.

Researchers, who analyzed data from the 2011 mail survey supplement to the annual National Ambulatory Medicare Care Survey, found that 51 percent of respondents were planning to apply for MU Stage 1 incentive programs. However, it seems that only 11 percent of doctors planning to apply have a capable enough EMR set-up to support up to two-thirds of Medicare Stage 1 core objectives.

Now, this was not completely unexpected. In the final Stage 1 MU rule, CMS had estimated that 10 to 36 percent of Medicare eligible pros, and 15 to 47 percent of Medicaid eligibles, would end up meeting the agency’s criteria.

And it should be noted, the HealthAffaits authors remind us, that about 124,000 eligibles had registered in 2011, and that CMS had paid out $275 million to 15,000 participants. Also, Medicaid programs paid out about $220 million to about 10,500 physicians.

Still, you can’t bury poor performance like this in a pile of data. Clearly, a program is lacking something important just over 1 in 10 physicians manage to set themselves up for Meaningful Use cash — especially if they were trying hard to do so.

The problem with news items like these is that they don’t get into what’s holding physicians back. It’s actually a bit disappointing that the HealthAffairs study didn’t offer any red meat on the “Why Can’t Doctors Qualify?” issue, as we all know that talking about problems doesn’t make them go away. (I do admit that in the world of public policy at least, simply underscoring a problem gives rulemakers ammunition to dig deeper into an issue.)

Still, I’d love to know what you’re seeing out there in terms of unprepared physicians. Are we talking practices that got fast-talked into buying inappropriate or junky technology? Lack of understanding what they bought? Slow-moving practices that are on the right track?

Despite Focus On Security Compliance, Provider Data Still Isn’t Secure

Written by: Katherine Rourke

It looks like we’ve got a billion-dollar mismatch between rules and reality here. An established security research firm has released a study suggesting that while providers are working hard on meeting HIPAA and other security regs, their data isn’t any more secure than when it was before.

Kroll’s 2012 HIMSS Analytyics Report: Security of Patient Data, concludes that the rate of provider data breaches has been rising over the past six years, despite pressure on providers to conduct more security audits and otherwise tighten up their data ship.

What’s scary about this trend is that the healthcare institutions surveyed by Kroll don’t seem to be aware of the problem. Health IT execs rated themselves at 6.4 out of 7 (seven being “extremely prepared’) on their readiness to address data security. That’s up from 6.06 in 2010 and 5.88 in 2008.

But the data Kroll gathered suggests that they’re overconfident at best. It found that 27 percent of respondents had reported a breach during the past twelve months, up from 19 percent in 2010 and 13 percent in 2008. Worse, of those who saw breaches, 69 percent of providers had seen more than one breach.

Now, it would be easy to say that regs like HIPAA, Meaningful Use standards and the Red Flags rules are malformed, and that this is just another case of government getting it wrong to industry’s detriment. If there’s any truth to this notion, I do hope CMS leaders take notice and adjusts some of its requirements; Heaven knows they’d get plenty of credible, carefully thought-out feedback if they ask.

Unfortunately, though, I suspect far from being that easy. We’d all love it if we could just follow the rules, get government approval then say “stick a fork in it, security’s done.” But as readers know, security is such a complex mix of implementing technologies and changing inappropriate behaviors that it’s hard to tease out just what went wrong sometimes.

Still, it’s good to have an organization like Kroll remind us that meeting HIPAA requirements isn’t the be all and end all. Unfortunately, it’s really just the beginning.

New mHealth App Certification – The Next CCHIT Like Mistake

Written by: John Lynn

I first heard about the new Secure, Branded App Store for Hospitals and Healthcare called Happtique in early December on Techcrunch. At its core, I think it’s an interesting idea to try and filter through what the article claims are “23,000 mobile health apps available for iOS and Android.” Helping physicians and hospital administrators filter through these apps could be valuable. Plus, most hospital administrators would love a way to have a phone that was limited on which apps it could download.

Well, it seems that the company has shifted gears a little bit. As Brian Dolan from Mobi Health News reported, Happtique is taking the first steps to setting up a certification for mobile health apps.

Happtique, a healthcare-focused appstore, announced plans to create a certification program that will help the medical community determine which of the tens of thousands of health-related mobile apps are clinically appropriate and technically sound. The company has tapped a multi-disciplinary team to develop the “bona fide mHealth app certification program” within the next six months. The program is open to all developers and will be funded by developer application fees.

It will certify apps intended to be used by both medical professionals and patients.

While I think that providing some way for people to filter through the large number of mobile apps, I think certification is a terrible way to go about it. Many people know I’ve written many an article about CCHIT pre-EHR incentive money and how screwed up the CCHIT EHR certification was for the industry. I think it’s just as bad news for Happtique to create a certification for the mobile health industry.

Turns out that Happtique seems to have agreed with this idea back in October 2010 where they said in a MobiHealthNews interview, “We are not in the business of opining whether an app is ‘good’ or ‘bad’ though. That’s not our role. Apple doesn’t do that and others don’t either. If the FDA indicates that an app is a medical device and needs to be regulated, well, that’s a different situation and we can take it out of the store.” Seems they’ve seen a different business opportunity.

They have a couple recognizable names on their board to create their certification including Howard Luks and Dave deBrokart (better known as e-Patient Dave), but I believe they’re going to find that it’s an impossible task. First, because they won’t have the breadth of knowledge needed to create certification requirements for every type of mHealth app. Second, what value will the certification really provide? Third, how do you make the certification broad enough to apply to all 20,000+ apps while still providing meaning to those using a very specific mHealth app? Plus, I’m sure there are many other issues I haven’t thought of yet.

The problem with these certification ideas is that they start with great intentions, but always end up bad.

Meaningful Use Numbers from 2011 and Looking Towards 2012 – Meaningful Use Monday

Written by: John Lynn

HITECH Answers recently posted a great post that gives a run down of the EHR Incentive program’s progress in 2011. Here’s their list with my own analysis and commentary of each point.

123,921 Eligible Professionals have registered for EHR Incentives, 15,255 have successfully attested to meaningful use in the Medicare program.
This seems like such a HUGE difference in numbers. That’s just over 12% of Eligible Professionals that registered attested to meaningful use. Does this mean that we’re going to see a tidal wave of meaningful use attestation in 2012? Possibly.

I believe that we’ll see more eligible professionals attesting to meaningful use in 2012. However, the question is how many of those other 108,666 will attest to meaningful use in 2012 and how many are like the Happy EMR Doctor who just registered to see the MU process. I wonder how many first hand meaningful use experiences by doctors will scare doctors away from MU attestation.

3.077 Eligible Hospitals have registered EHR Incentives and 604 of those have successfully attested to meaningful use.
This is almost 20% of hospitals that have registered that have attested to meaningful use. It’s not surprising that this number is a lot higher than eligible professionals. I still believe that the wave of meaningful use attestation will come from these other 2473 hospitals and probably many more that still haven’t registered. I haven’t seen a good number of how many hospitals are in the US. Does anyone know that number? The EHR incentive money that goes to hospitals will dwarf those of eligible professionals.

$2,533,689,145 has been paid out in Medicare and Medicaid Incentives.
$2.5 billion sent out in 2011. I just went back to the first time I tagged meaningful use on this site on April 3, 2009 (coincidentally I have 19 pages of 10 posts each tagged with Meaningful Use). Amazing to think that it’s taken basically 3 years to spend $2.5 billion on EHR.

277 hospitals have received payments under both Medicare and Medicaid and of those 12 were CAHs.
That’s about half of the hospitals that have attested to meaningful use under Medicare are also getting the Medicaid EHR incentive money as well.

22% of eligible professionals that have been paid EHR incentives are Family Practitioners and 20% are Internal Medicine.
I must admit that I would have thought that the percentage of family doctors that got paid EHR incentive money would have been a lot higher. I guess when you have so many other specialty areas I shouldn’t be that surprised. I also wonder why the internal medicine number is so high. These numbers actually make me believe that a lot of family practice doctors are sitting out when it comes to meaningful use.

41 States Medicaid programs were open for registration. Two additional States launched in January of 2012.
I wonder what’s holding back the other 7 states. From what I’ve seen all the states will eventually get there.

More than 1500 EHR products have been certified by ONC-ATCBs.
That’s a lot of EHR software. I still put the EHR company list at about 300 EHR vendors. 1500 includes multiple versions of the same software, partial EHR certification for products like data warehouses, ePrescribing, etc. The best thing that’s come from the ONC-ATCB program is that it has made EHR certification basically irrelevant in the EHR selection process. Every EHR vendor is certified now. This is much better than the false assurances that EHR certification provided before. I still dislike what EHR certification has done to the industry, but at least it’s not misleading doctors the same way it was before.

CCHIT Has Become Irrelevant

Written by: John Lynn

For those of you that are relatively new to EMR and HIPAA, you might not appreciate this post as much as long time readers of EMR and HIPAA. A few years back, I admit that I was pretty harsh on CCHIT and their EHR certification. I remember one guy stopping me at a conference and after realizing who I was asked, “so what’s your issue with CCHIT?” I was happy to answer that I thought they misled the industry (doctors in particular) by saying that the CCHIT certification provided an assurance that the EHR was a good EHR. They never came outright and said this, but that’s what EMR sales people would communicate during the sales process.

In fact, EHR certification was incorrectly seen by many doctors and practice managers as the stamp of approval on an EHR being of higher quality, more effective, easier to use, and was more likely to lead to a successful EHR implementation. EHR certification today still has some of these issues. However, the fact is that the EHR certification doesn’t certify any of the great list above. If EHR certification of any kind (CCHIT or otherwise) could somehow assure: a higher implementation success rate, a better level of patient care, a higher quality user experience, a financial benefit, or any other number of quality benefits, then I’d support it wholeheartedly. The problem is that it doesn’t, and so they can’t make that assurance.

So, yes, I do take issue with an EHR certification which misleads doctors. Even if it’s the EHR salespeople that do the misleading.

I still remember the kickback I got on this post I did where I said CCHIT Was Marginalized and the post a bit later where I said that the CCHIT process was irrelevant. Today, I came across an article on CMIO with some interesting quotes from CCHIT Chair, Karen Bell. Here’s a quote from that article.

In addition, the Office of the National Coordinator for Health IT’s (ONC) new program has provided two new reasons for certification: proof that an EHR can do the things that the government wants it to do, and to enable eligible providers and hospitals to get EHR incentive money.

“The idea is not to assure the product will do all things that are desired for patient care, instead, the idea is to stimulate innovation,” said Bell. As a result, the program is considered a major success because more than 700 certified health IT products are now on the ONC website. “The idea was to get a lot of new products started. This is a very different reason for certification than what we began doing several years ago,” she said.

However, just because CCHIT or another ONC-Authorized Testing and Certification Body (ONC-ATCB) doesn’t test and certify for a particular ability, that doesn’t mean the EHRs don’t have it. “It’s just up to [the provider] to make sure the vendors have it,” said Bell.

I first want to applaud Karen Bell and CCHIT for finally describing the true description of what EHR provides a clinic assurance that:
1. The EHR does what the government wants
2. You are eligible for the EHR incentive money
Then, she even goes on to say that it’s up to the providers to make sure the vendors have the right capabilities for their clinic.

I imagine Karen and CCHIT would still probably say that the CCHIT “complete” EHR certification provides assurance that…< fill in the blank >, which the ONC-ATCB EHR certification doesn’t provide. The happy part for me is that even if CCHIT says this, no one is really listening to that message anymore.

Yes, CCHIT has essentially become irrelevant.

I can’t remember anyone in the past year asking me about CCHIT certification. From my experience, many people care about ONC-ATCB EHR certification, but they really couldn’t care less if it comes from CCHIT, Drummond Group, ICSA Labs, SLI Global, or InfoGuard (That’s all of them right?). Have any of you had other experiences?

I also do enjoy the irony of this post coming right after my post about differentiation of EMR companies (Jabba vs Han Solo). CCHIT is the reason that I know so much about the challenge of EHR differentiation. CCHIT’s efforts provided some very valuable (and lengthy) discussions over the past 5 years about ways to help doctors differentiate between the 300+ EHR vendors. As you can see from my comments above, I was just never satisfied with CCHIT being the differentiating factor. As you can see from my post yesterday, I’m still searching for a satisfactory alternative for differentiating EHRs. Until then, we’ll keep providing an independent voice a midst all the noise.

Healthcare IT Certifications that Matter

Written by: John Lynn

If you’ve been following this blog for a while, then you probably remember my many rants about the lack of value in EHR certification. In fact, Jim Tate asked me at HIMSS where my dislike of CCHIT came from. I think I told him that I probably got it from EMRUpdate. Certainly that’s where I learned a lot about EMR and EHR and certification in general. However, as I consider his question, my real distaste with CCHIT and quite frankly EHR certification is that it provides little to no value to doctors.

Looking back at all the discussions I had last week with those attending HIMSS, I’m really happy to say that EHR certification was almost never a discussion. Pretty much everyone either was a certified EHR or was almost done with the EHR certification process (which is in line with ONC’s desire that all EHR software be certified).

I still feel that certification provides little value, but I’m really happy to see that EHR certification has basically left the discussion. If everyone has it, then doctors don’t and won’t look to it as a way to select an EHR. I think that’s a very good thing.

As I’ve thought more about EHR certification, it’s funny that someone hasn’t come out with some healthcare IT certifications that would actually provide value to doctors and healthcare. Here’s just a few ideas off the top of my head of items that could be meaningfully certified:

Privacy
Security
Data portability
Freedom of data
SaaS hosting services

The interesting thing is that many of these certifications could be provided well beyond EMR software and into other healthcare IT products (and even beyond if someone so desired). Certainly the existing EHR certifications try and provides some of these items, but they’re so general and non specific that they aren’t very useful.

For example, the privacy certification could include not only that the data is encrypted but could specify which type and level of encryption is used. Plus, the certification could actually test the encryption to make sure it was implemented properly. I know some eFax vendors that would love this type of certification.

A certification that provides value wouldn’t likely be a simple pass fail certification. Maybe you do set a bar for each requirement that allows you to place a certification badge on that product. However, users should be able to dig into the details of the certification and see what was found during the process. For example, if you make sure they handle passwords correctly, a certification should provide a list of protections that are built into the software that’s being certified (ie. minimum characters, required characters, 2 factor authentication, number of failed passwords before lockout, etc).

If I weren’t so busy with my healthcare IT blog network, I’d consider doing some of this myself. Not only is it a great business, but could really provide value to healthcare. If you start it, just save me a spot as an advisor.

Providers Awareness of EHR Certification Bodies

Written by: John Lynn

One of my readers recently linked me to an article from back in July that talks about providers lack of understanding of EHR certification and the possibility of EHR certification bodies beyond CCHIT. Here’s an excerpt from the article:

The Office of the National Coordinator for Health Information Technology has made it clear that it wants multiple EHR certification bodies, but that message apparently has not made it out to many physician practices. According to a survey by Burlington, Vt.-based consulting firm CapSite, 69 percent of healthcare providers are unaware that there will be alternatives to the Certification Commission for Health Information Technology in terms of certifying ambulatory EHR systems.

Additionally, 52 percent of the 850 providers surveyed incorrectly believe that CCHIT certification is a prerequisite to receiving Medicare and Medicaid bonus payments for meaningful use of EHRs. In reality, ONC will designate authorized testing and certification bodies, which then will test and certify EHRs on behalf of vendors.

As most of you know I have a real disdain for misinformation. I’m all about exposing the truth and spreading the knowledge as far as possible. So, you can imagine my reaction to providers not understanding that there are multiple EHR certification bodies and that all of the EHR certification bodies can provide doctors access to the EMR stimulus money.

The only problem is that I’m guessing that most readers of this blog already know this information. I like to think that readers of this blog are smarter and more informed than those who don’t. I was going to do a poll to see who knew what. Only problem is that reading above you’d know the answers.

Either way, if readers of this blog work to inform the people around them that there are multiple EHR certifying bodies (Drummond Group and InfoGuard with others on the way) and that it doesn’t matter which EHR certifying body you use then I think we’d have some impact for good on the EHR world!

Another Possible ONC-ATCB EHR Certifying Organization

Written by: John Lynn

One of my more interesting meetings at AAFP was with a company called SLI Global Solutions. The meeting was so interesting, because SLI Global Solutions plans to apply to become an ONC-ATCB organization very soon. This coming after the announcement of the first ONC-ATCB certified EHR from Drummond Group and CCHIT along with the announcement of InfoGard as an ONC-ATCB and Weno Healthcare’s plans to become an ONC-ATCB.

We obviously had a long conversation about the EHR certification, but suffice it to say that SLI Global Solutions is going full steam ahead to become an ONC-ATCB. It sounds like they’ve been doing a number of other certifications previously. They’ve even done some consulting work in healthcare.

When I asked SLI Global Solutions what they thought would help them to differentiate themselves from the other ONC-ATCB, one response was that they were really good at providing feedback and helping organizations through the certification process. I personally think that many EHR vendors and other healthcare organizations that need to certify for the EMR stimulus money are nervous about the unknown issues related to certification. If SLI Global Solutions can provide them a feedback loop then it could go a long way to relieving the nerves. This is the main suggestion Jim Tate makes in his post about selecting an ATCB.

I asked SLI Global Solutions how much they planned to charge for the EHR certification. Here was their response, “We have not finalized the pricing yet because we are contemplating ancillary services pre and post certification but we will likely be in the $20,000 USD ballpark.”

With SLI Global Solutions, that would make 5 ONC-ATCB and I’m guessing there are other companies like this that will become certifying bodies as well. I’m all about competition and so the more ONC-ATCB the merrier.

It does make me wonder how many ONC-ATCB the market can support. Not to mention, there’s the interesting question of whether they’re a bit late to the party. I guess time will tell.

Healthcare Groups Want Meaningful Use Evaluated Before Stage 3

Final EHR Certification Bodies – Meaningful Use Monday

Few Doctors Ready To Qualify for Meaningful Use

Despite Focus On Security Compliance, Provider Data Still Isn’t Secure

New mHealth App Certification – The Next CCHIT Like Mistake

Meaningful Use Numbers from 2011 and Looking Towards 2012 – Meaningful Use Monday

CCHIT Has Become Irrelevant

Healthcare IT Certifications that Matter

Providers Awareness of EHR Certification Bodies

Another Possible ONC-ATCB EHR Certifying Organization

Top EMR & HIPAA Posts

Calendar

Recent Posts

EMR & HIPAA Resources

Recent Comments

Categories

May 2013
M	T	W	T	F	S	S
« Apr
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31