The online version includes five separate appendixes, linked at the end of the brief:

• Appendix A excerpts portions of the HL7 EHR-System Records Management and Evidentiary Support Functional Profile Standard, which can be used to develop proposals for selecting an EHR system or as a checklist to evaluate current applications for basic record management functionality.
• Appendix B lists the various e-signature laws, regulations, and acts that organizations can refer to in developing and implementing e-signature functionality and policy.
• Appendix C outlines a sample e-signature model policy template, including important legal and compliance recommendations.
• Appendix D provides a glossary of terms that organizations can use in their e-signature policies.
• Appendix E provides practice guidance on making amendments, corrections, and deletions in transcribed reports.

Managing e-signatures is complex, but doing it correctly is critical  in supporting an organization’s legal health record. Successfully implementing and using e-signatures requires proper attention to individual system functionality, regulatory requirements, and organizational policy.

The funds are part of the $2 billion allotted to HHS’s Health Resources and Services Administration (HRSA) under the American Recovery and Reinvestment Act to expand healthcare services to low-income and uninsured individuals.

The $27.8 million will be used to expand and upgrade health IT systems, including electronic health records, and are related to other ARRA efforts to promote the adoption and use of health IT throughout healthcare.

Eighteen grants totaling more than $22.6 million will support EHR implementations. Grants totaling more than $2.6 million will help four grantees implement other health IT-related projects, including creation of health information exchange networks. Another five grants totaling more than $2.5 million will help health centers use existing EHRs to improve patient health outcomes.

HRSA-supported health centers treated 17 million patients in 2008, 40 percent of whom have no health insurance, according to HHS.

A list of grant recipients is available through the above link. More on ARRA provisions for community health centers is available through the HHS.gov/Recovery site.

The first applications from aspiring health IT resource centers are due in two weeks—September 8. The Office of the National Coordinator for Health Information Technology will award grants in two additional cycles with initial deadlines in December and June. ONC announced the deadlines in a press event last week.

Program details and the full application schedule appears in the funding opportunity announcement on the Health and Human Services health IT Web site. Applications will be screened in two phases. Successful preliminary applicants will be requested to submit a full application for merit review.

The centers are part of the HITECH Act in the American Recovery and Reinvestment Act (ARRA). ONC released a draft plan for public comment in late May.

The regional centers will furnish education, outreach, and technical assistance to help providers select, successfully implement, and meaningfully use certified EHR technology.  They will also help providers achieve, through appropriate available infrastructures, exchange of health information in compliance with applicable statutory and regulatory requirements, and patient preferences.

ONC expects to establish 70 or more centers supporting 100,000 primary care providers. Each center will serve a defined geographic area.

The breach notification requirement is not the only ARRA privacy provision shaking up healthcare organizations in California and across the country. It is just the most pressing—final rules appear this month, and organizations must be compliant within 30 days.

Three additional ARRA provisions around privacy and transparency have providers and vendors buzzing, because current electronic record systems cannot meet the requirements.

In many ways, the three provisions describe what EHR systems should be able to do, not what they can do. In the coming months it is up to the federal government to fill in the details. In the coming months and years, it will be up to providers and vendors to adapt and create systems that meet them.

Dimick’s conversations with privacy experts in California continue below, expanding to new provisions on accounting for disclosure, suppressing disclosure of treatment for services paid out-of-pocket, and providing electronic copies of electronic records.

* * *

Accounting for Disclosure

HIM professionals and others are concerned with ARRA’s new accounting for disclosures provision, which requires healthcare facilities using EHRs to provide an accounting or audit trail of all record disclosures. This represents a major change from the current HIPAA laws, which exempt disclosures for treatment purposes and routine healthcare operations. Most state laws do not address accounting for disclosures, and they rely on HIPAA to set the rules.

ARRA did not detail the exact content of the disclosures. The Department of Health and Human Services must deliver those requirements this month, advised by a federally appointed policy committee. Once HHS defines the required content, a second advisory committee will recommend the technical standards to enable the disclosures by the end of this year. By June 2010, HHS must promulgate the final rule on disclosures.

Providers are concerned that it is not technically possible to track every access to every patient record. Some feel such accounting would slow down access to records, time that could be spent treating a patient.

“It is very, very tough [technologically],” says Cassi Birnbaum, director of health information and privacy officer at Rady Children’s Hospital of San Diego. “We can require that everyone does a quick disclosure whenever they are handing information out to somebody outside of the organization. But when you are disclosing information to another clinician, that would be so disruptive to patient care.”

When disclosing information for treatment, HIM professionals will now have to also mind the “minimum necessary” provisions of HIPAA—which state that only the information necessary for an action to be carried out can be disclosed. Organizations have struggled with determining “minimum” since the day the HIPAA rule took effect. HHS is currently compiling guidance on what constitutes the minimum necessary for treatment disclosures in anticipation of the new provisions.

But privacy advocates like Deven McGraw, director of the Health Privacy Project at the Center for Democracy and Technology in Washington, DC, keep the end goal in site. McGraw, who serves on the advisory committee developing disclosure policy recommendations, feels that patients have a basic right to know who is accessing their medical records.

Gerry Hinkley, a healthcare lawyer and partner with Davis Wright Tremaine LLP, based in San Francisco, agrees. The provision helps give possession of a patient’s health record back to the patient, he says. “If your caregiver shares the information with somebody else, really for any purpose, it is your information and you should know to whom and when.”

The ARRA legislation may have underestimated the wide variance in today’s EHR systems, but legislators did recognize that most existing systems cannot meet the accounting of disclosures rule today. Organizations using EHR systems purchased before January 1, 2009, have until January 2014 to comply with the provision.

Purchasers of new systems are under a much tighter deadline. Healthcare entities that purchase a system after January 1 of this year must be compliant with the new provision as of January 1, 2011. Therefore, organizations currently in the market for an EHR should discuss the provision thoroughly with vendors.

Out-of-Pocket Costs

A separate ARRA provision gives patients the right to prevent the disclosure of health data to their health insurance plans if they paid for the treatment out of their own pockets. Complying with this request will require separating out records generated from treatment that was paid personally by the patient, a technically difficult task in the EHR. Previous state and federal law have not set these requirements, buyers never requested the functionality, and vendors have not incorporated it in their systems.

When payers evaluate a claim, typically they request the entire medical record to determine if the treatment was medically necessary, McGraw says. The ARRA provision comes out of some patients’ fears that insurance providers could use certain medical information to modify coverage. The segregated records most likely would be mental health records from psychotherapy sessions, or certain reproductive health services not covered by most insurance.

In addition to the technical challenges, the law raises administrative questions. Organizations will require policies establishing who can and cannot access segregated information. If files are masked from payers, the EHR would have to unmask information when it is needed for treatment.

Ideally, McGraw says, you don’t want to resort to keeping separate systems.

While this segregation of records is both technically and administratively challenging, Hinkley believes actual requests for this type of action will be uncommon. Usually when patients receive treatment they want their health insurance to pay for it, he notes.

Electronic Copies of Electronic Records

The limitations of current technology also complicates an ARRA provision that requires providers to give patients electronic copies of their electronic health records upon request. State law varies on this requirement, with most states, including California, defaulting to HIPAA regulations. Under HIPAA, providers are required to give a copy of a patient’s record in the format requested, but only if documents are “readily producible” in that format.

But ARRA removes the “readily producible” language and outright requires any facility using an EHR to provide an electronic copy of a patient’s health record. Many current EHR systems cannot directly produce an electronic copy of a record by burning it onto a disk or downloading it to a memory stick, Birnbaum says.

“There isn’t an exception for entities that have older legacy systems where you can’t produce an electronic copy,” McGraw notes. “There is no grandfather clause, no easing in.”

HIM professionals have already encountered this wrinkle at the state level. In Illinois, a bill proposing that patient information stored electronically must be produced electronically for release of information requests was amended after state healthcare associations argued that most current EHR systems were incapable of meeting the requirement. The subsequent law requires that a facility unable to produce its electronic documents in an electronic format as requested must send a letter to the requestor explaining why it cannot fulfill the request.

Again, entities shopping for EHR systems must discuss the requirement with vendors to ensure they will be compliant with the law. Birnbaum notes that the provision creates an opportunity for vendors and third-party developers to create add-ons that enable systems to reproduce records electronically.

The ARRA provision that will pay Medicare and Medicaid bonuses to providers who are “meaningful users” of health IT has put heightened focus on certification. Meaningful use has yet to be fully defined, but it will certainly include certified products.

The workgroup presented its recommendations at the policy committee’s July 16 meeting, suggesting that the government widen certification to include more system types than CCHIT currently covers, assume responsibility for establishing certification criteria, and create a process for accrediting multiple organizations to perform certification testing. ARRA established the committee to advise the Office of the National Coordinator for Health IT, part of Health and Human Services, which is responsible for refining and managing the incentive program.

The workgroup’s recommendations are based on its review of existing processes and two days of invited testimony from both software developers and purchasers.

The group offered five basic recommendations:

• Focus certification on meaningful use requirements
• Leverage the certification process to improve progress on security, privacy, and interoperability. Certification would address all privacy and security policies described in ARRA and promote interoperability among systems, something that current CCHIT certification does not, according to the testimony.
• Improve objectivity and transparency of the certification process, in part by separating the process of establishing criteria from actual testing of it. The Office of the National Coordinator should manage certification criteria, the group recommended, and develop a process for accrediting and selecting multiple organizations to perform testing. 
• Expand certification to include a range of software sources. This would include open-source and self-developed systems and extend to system components. 
• Create a short-term term transition plan to the new process. 

The policy committee delayed accepting the recommendations in full, instead requesting clarification on details. The revisions are expected by the committee’s August meeting.

Once approved by the full committee, the recommendations will go out for public comment. Final recommendations will be submitted to the Office of the National Coordinator.

The committee’s revision of its earlier recommendations features modified criteria for use of computerized physician order entry and faster adoption of clinical decision support and personal health records among the score of major and minor tweaks.

The committee also offered new recommendations on the rollout of the program’s objectives and measures, which evolve from 2011 to 2015.

ARRA structured the incentives program to encourage providers to get started early. However, with the revisions the committee recommends that the evolving criteria be based on “adoption year” rather than a calendar year. That is, an organization that first seeks to become eligible for the program in 2012 would use the first-year criteria (2011). Otherwise, the committee felt, the “rising tide” of criteria could be a deterrent.

The Health IT Policy Committee, established under the American Recovery and Reinvestment Act, advises the Office of the National Coordinator for Health Information Technology. It released its first draft of meaningful use recommendations June 16. ONC received nearly 800 public comments in the two week review period.

Comments generally approved of the focus on outcomes and quality and the need to base meaningful use on existing measures, ONC reported during yesterday’s policy committee meeting.

Under ARRA the meaningful use definition will in part determine which providers are eligible to receive incentive payments for the use of health IT. Providers who are “meaningful users” of health IT can receive up to $44,000 in increased Medicare and Medicaid payments over five years.

The policy committee’s recommendations next go to the Health IT Standards Committee, which advises Office of the National Coordinator on standards, implementation specifications, and certification criteria. The committee will compare the policy committees recommendations against existing industry standards that could be applied against them.

ONC and the Centers for Medicare and Medicaid Services will ultimately determine the final meaningful use definition and the incentive program details. Those regulations are expected in the fall and will be open to public comment.

While ONC’s draft description rightly stressed the delivery of IT assistance, the centers and their clients will require a wider range of expertise for the full preparation, deployment, and management of health information communications and technology. Different phases of EHR implementation and use require differing skills.

In its comments on the draft description, AHIMA recommended that the final program define core services that include a range of services to assist in EHR use throughout a system’s lifecycle.

This range of services includes workflow analysis, transition planning, data analysis, and training. The sample phases of an EHR lifecycle shown below illustrate the differing core services that users may require over the entire lifecycle.

In its proposal, ONC indicated it could begin requesting applications from potential regional centers as early as this summer, with grants awarded this fall.

 Sample EHR Lifecycle and Possible Core Services

AHIMA’s comments were in response to a draft description of the program published May 28 by the Office of the National Coordinator for Health IT. Specified under the American Recovery and Reinvestment Act, the program calls for a central Health IT Research Center with affiliated regional extension centers that provide direct assistance to providers. The centers will help providers meet requirements for receiving bonus Medicare and Medicaid payments under a separate ARRA provision.

AHIMA offered recommendations around four main comments:

Establish a clear and consistent set of goals:

• Define what constitutes a “region” for the regional centers
• Clarify the relationship among the regional centers and between the regional centers and the central Health IT Research Center
• Reconsider the proposed plan to issue multiple, closely spaced requests for proposals from organizations seeking to become regional centers 
• Consider mechanisms that ensure all providers are covered by qualified regional centers and that they are not penalized by any delay in accessing the services

Define a consistent set of core services delivered by an interdisciplinary team:

• Further define the minimum level of services the regional centers must supply
• Provide a consistent and uniform approach toward core services that addresses different functional components during each phase of an EHR implementation
• Consider critical areas of health IT implementation that are not just technical in nature and require specialized skills, such as workflow analysis, transition planning, data analysis, training, and customization (see related story for sample core services)

Clarify the governance and management structure:

• Define a clear and uniform structure for governance and management of the overall program, the regional centers, and the corresponding research center
• Discuss a coordinated, consistent, and standard approach toward program planning and service delivery of the regional centers and their relationship to the resource center
• Separate the research center’s research function from any management of the regional centers (the proposal seems to suggest that the research center will serve both roles)

Develop a sound program evaluation process that creates a learning community for sharing best practices with the resource center and among the regional centers:

• Create a uniform and consistent approach toward evaluating the program
• Develop a uniform measurement process that enables ONC to assess, evaluate, and make decision regarding future award programs, determining successful and unsuccessful regions, and defining areas that may need additional resources
• Provide detail on the evaluation process

In the draft program proposal, the Office of the National Coordinator indicated it could begin requesting applications from potential regional centers this summer, with grants awarded as early as the fall.

The extension program is called for under the HITECH Act in ARRA, the American Recovery and Reinvestment Act. It authorizes creation of a National Health Information Technology Research Center and affiliated regional extension centers to assist providers in selecting and implementing certified electronic health records.

The program also will assist providers in becoming “meaningful users” of the systems, a prerequisite to receiving bonus Medicare and Medicaid payments under a separate ARRA provision.

The extension program is to give preference to providers serving uninsured, underinsured, underserved, and special-needs populations.

The HITECH Act also calls for the regional centers to participate “to the extent practicable” in health information exchanges and to integrate health IT into the initial and ongoing training of health professionals and others in the industry. They will be encouraged to seek broad industry, academic, and state government participation and use federal expertise where appropriate.

ONC proposes that the regional extension centers will form a consortium coordinated and facilitated by the research center. The research center’s primary function will be to produce best practices, and the regional centers will be responsible for disseminating them.

The draft proposes that the regional centers’ key service will be on-site assistance, with an established minimum level of service that would include unbiased information on appropriate exchange of health information and information on integrating health IT into practice workflow.

HITECH specifies that the regional centers will be organizations “affiliated with any United States-based nonprofit organization, or group thereof.” ONC’s proposal includes draft required criteria as well as its own preferred criteria, which include “multi-stakeholder collaborations that leverage local resources,” as well as applicants that identify viable matching funds.

ONC is proposing two-year awards based on the size of the population served. It expects awards to range $1-2 million per year, with a maximum of $10 million.

ONC anticipates that applicants will require 2 months or more to prepare their proposals. It expects to make awards as early as the first quarter of 2010 and continue through that year. The timing is intended to enable the centers to help providers be eligible for the bonus payments in 2011 (hospitals) and 2012 (physicians), when the incentives are greatest.

HHS will also use this year to plan necessary support for the program, including a national outreach program.

In 2010 HHS plans to conduct outreach to eligible professionals, develop the final program rules, and create systems to monitor and evaluate the payments.

Medicare incentive payments to hospitals will begin no sooner than October 2010; payments to eligible professionals will begin no sooner than January 2011. Medicaid incentives to professionals and hospitals both will also begin no sooner than January 2011.

The American Recovery and Reinvestment Act provides $17 billion in Medicare bonus payments for eligible individuals and hospitals that adopt certified electronic health record systems. The Medicare payments run until 2016. The Medicaid payments extend until 2021.

In 2015 a series of Medicare payment reductions will begin for eligible professionals and hospitals that are not meaningful EHR users.