An investigation into whether the Centers for Medicare and Medicaid Services is adequately overseeing the federally funded Medicare electronic health record incentive program suggests the program could be susceptible to abuse.

According to a report from the Office of the Inspector General at the Department of Health and Human Services, CMS has not put in place strong prepayment safeguards, and its ability to safeguard incentive post-payments has also been limited.

"CMS faces obstacles to overseeing the Medicare EHR [Electronic Health Record] incentive program that leave the program vulnerable to paying incentives to professionals and hospitals that do not fully meet the meaningful use requirements," the report, issued Nov. 29, stated.

The incentive program, which will pay $6.6 billion in incentive payments to eligible participants between 2011 and 2016 and is said to cost taxpayers as much as $27 billion, was established under President Obama's American Recovery and Reinvestment Act of 2009. CMS began administering payments to providers and hospitals for implementing EHRs under meaningful use stage 1 rules in 2011. The meaningful use rules specify the criteria that eligible hospitals and providers must meet in order to qualify for an incentive payment. The main criterion under meaningful use stage 1 is to make sure participants in the program store, record, and report clinical quality measures.

Determining meaningful users

Hospitals and providers who are participating in the EHR incentive program must show meaningful use of certified EHR technology to CMS through an online self-reporting system in the National Level Repository (NLR), which is supposed to validate if a participant's self-reported information meets the right criteria for prepayment. It's not required that CMS conduct an evaluation for these prepayments.

Based on the terms spelled out in the American Recovery and Reinvestment Act, hospital incentive payments for each year of the program begin with a $2 million base amount that is adjusted by a number of hospital-specific factors.

During its review of self-reported information from NLR between May 2011 and December 2011, OIG found that while CMS's prepayment validation functions as it should, it does not verify that self-reported information is accurate, and that reports from EHR technology may not always be correct. Even if they were, the report said they might not be sufficient for CMS to verify the self-reported information.

Further analysis along with personal CMS staff interviews found that CMS does not collect supporting documentation to verify self-reported information prior to payment.

In its recommendations, OIG said that CMS should "obtain and review supporting documentation from selected professionals and hospitals prior to payment to verify the accuracy of their self-reported information."

In a response to DOTmed News, Brian Cook, a spokesperson for CMS, said the prepay audit before giving out incentive payments would be too burdensome for taxpayers and to providers. "We think that we can achieve the same goal that OIG is aiming for by adopting the OIG's other recommendations and doing auditing," he said.

Other recommendations in the report include more guidance on specific examples of documentation that providers and hospitals should maintain to prove their compliance with the meaningful use rules.

Since OIG states in the report that the Office of the National Coordinator for Health Information Technology (ONC) requirements for EHR reports is said to contribute to CMS's oversight obstacles, it recommends that the ONC require EHR technology to be able to produce more specific meaningful use measures, as well as improve the certification process for EHR systems to make sure reports are more accurate.