Key Health Provisions in the Stimulus Bill

On Feb. 17, President Obama signed into law H.R. 1, the American Recovery and Reinvestment Act of 2009 (economic stimulus package). This wide-ranging piece of legislation contains provisions affecting health care in general and physician practices in particular. Medicare and Medicaid providers, hospitals and others will be eligible for up to $17 billion in incentive payments to adopt health information technology (HIT). However, many specifics in this measure remain undefined and will be subject to Department of Health and Human Services (HHS) regulation. The government will publish details on the payment mechanism, requirements to qualify for payment and many of the privacy provisions in the Federal Register for public comment.

Following are the key areas of the bill affecting physician practices:

EHR Incentives
In an effort to increase the adoption rate of electronic health records (EHRs) in physician practices, the legislation includes a program of financial incentives modeled on the Physician Quality Reporting Initiative (PQRI). Eligible physicians can be reimbursed for up to $44,000 for adopting  a qualified EHR. The Centers for Medicare & Medicaid Services (CMS) uses the same definition of an eligible professional as that in section 1861 of the Social Security code. This includes medical doctors, dentists, podiatrists, optometrists and chiropractors.

Hospital-based physicians such as pathologists, anesthesiologists, emergency physicians or hospitalists who furnish substantially all of their services in a hospital setting using its facilities and equipment are not eligible for the incentive payments. However, the legislation also allows hospitals to receive incentive payments. Physical therapists are not eligible for the EHR incentives and are not subject to the penalties.

CMS will make Medicare Part B incentive payments to physicians who have demonstrated that they are "meaningful" EHR users. While the exact definition is to be determined by the HHS secretary, the legislation outlines three requirements:

• The physician must use certified EHR technology that includes electronic prescribing.
• The EHR technology must be connected to provide electronic exchange of health information.
• The eligible professional must submit information for the period on the clinical quality measures and other measures selected by the HHS secretary.

The secretary is empowered to accept individual state determinations of meaningful EHR usage with Medicaid as meeting these requirements. This provision allows practices that see relatively few Medicare patients but large Medicaid populations, such as pediatric offices, to qualify.

Amounts of Medicare Incentive
Medicare incentive payments will be based on an amount equal to 75 percent of the HHS secretary's estimate of allowable charges, up to $15,000 for the first payment year. Incentive payments would be reduced in subsequent years and end in 2015. Physicians who report using an EHR capable of e-prescribing will no longer be eligible for the e-prescribing bonuses established by the Medicare Improvements for Patients and Providers Act (MIPPA) thus preventing avoiding "double-dipping" of bonuses.

As set out in the legislation, the incentive payments will equal 75 percent of the amount paid to eligible professionals by Medicare. Payments will be made according to the following schedule: 

1. Year One:
a. Up to $18,000 if the first payment year is 2011 or 2012
b. $15,000 if the first payment year is 2013
c. $12,000 is the first payment year is 2014

2. Year Two: $12,000
3. Year Three: $8,000
4. Year Four: $4,000
5. Year Five: $2,000

Note: For eligible professionals in a health professional shortage area (HPSA), the incentive payment amounts will be increased by 10 percent.

Early adopters (including those who have already implemented HIT systems) whose first payment year is 2011 or 2012 will be eligible for an initial, larger incentive payment up to $18,000. In 2014, the payment limit for new adopters will be $12,000.

The HHS secretary decides on the method of payment. It may be made as a lump sum or by installments. As with the current PQRI and MIPPA ePrescribing incentive payments, providers must submit claims for a specific reporting year within two months of the end of the year to be eligible for EHR bonus payment.

Eligibility for the Medicare Incentive
According to the stimulus legislation, physician practices must be meaningful users of "certified" EHR technology to qualify for the Medicare incentives. The secretary will also determine the definition of "certified" EHR. However, under current (August 2006) HHS published rules providing an exception under the physician self-referral prohibition law (Stark) and safe harbor under the antikickback statute, an EHR system would qualify for the donation if a certifying body recognized by the secretary has certified the software no more than 12 months before the date it is provided to the physician/recipient.

If applied to the Medicare incentive program, this definition could be problematic for medical practices that have  EHRs certified more than 12 months before the Medicare incentive program and whose vendors have no plans to recertify. As with many provisions of this legislation, however, the HHS secretary will need to issue rules to clarify the eligibility requirements.

Physician practices may satisfy the requirements proving use of the EHR and electronic health exchange by methods to be determined by the HHS secretary. These could include:

• Attestation
• Submission of claims with a current procedural terminology (CPT) code indicating the use of certified EHR technology
• A survey response
• Submission of quality measure data and/or
• Other methods determined by the HHS secretary

The secretary is required to develop, through a public rule-making process, an initial set of standards, implementation specifications and certification processes by Dec. 31, 2009.

Public Reporting
CMS will post online the names, business addresses and business phone numbers of eligible professionals and group practices that are meaningful EHR users and receiving incentive payments.

Penalty for Not Using an EHR
Beginning in 2015, CMS will reduce Medicare payments for professional services furnished by in an eligible professional if that professional is not a meaningful EHR user. The schedule and amounts of Medicare payments (with some exceptions) will be:

• 2015 – 99 percent
• 2016 – 98 percent
• 2017 and beyond – 97 percent

HHS is authorized to increase penalties beginning in 2019, but penalties cannot exceed -5 percent. Exceptions will be made on a case-by-case basis for significant hardships (e.g., rural practices without sufficient Internet access). The e-prescribing penalties set out in MIPPA will sunset after 2014.

Medicare Advantage Plans
In general, the provisions also apply to physicians delivering most of their services through a Medicare Advantage plan. Eligible professionals in this category are those employed by the organization, are members or employees of an organization that furnishes 80 percent of its patient care services to a Medicare advantage plan and furnishes 75 percent of the services of the eligible professional to the organization and furnishes at least 20 hours per week of patient care services. There are limitations to avoid duplication of payment and the maximum number of physicians per organization is capped at 5,000.

Medicaid EHR Incentives
The stimulus legislation includes incentives for Medicaid providers to adopt EHRs. The incentive program is very different from the one developed for Medicare physicians, setting out a program of up-front payments for acquisition of the technology. A "Medicaid provider" is defined as:

• An eligible professional who is not hospital-based and has at least 30 percent of his/her patient volume (as estimated in accordance with a method established by the HHS secretary) attributable to individuals who are receiving medical assistance under this title.
• A pediatrician, who is not hospital-based and has at least 20 percent of his/her patient volume (as estimated in accordance with a method established by the HHS secretary) attributable to individuals receiving medical assistance under this title.
• An eligible professional who practices predominantly in a federally qualified health center or rural health clinic and has at least 30 percent of his/her patient volume (as estimated in accordance with a method established by the HHS secretary) attributable to needy individuals. 
• A children's hospital or an acute-care hospital and that has at least 10 percent of its patient volume (as estimated in accordance with a method established by the HHS secretary) attributable to individuals receiving medical assistance under this title.

Note: The term "eligible professional" for Medicaid incentives means a physician, dentist, certified nurse midwife, nurse practitioner; and physician assistant, insofar as the assistant is practicing in a rural health clinic that is led by a physician assistant or is practicing in a federally qualified health center that is so led.

Medicaid Incentive Amounts
The stimulus legislation allows up to $63,750 in federal contributions toward the adoption, implementation, upgrade, maintenance and operation of certified EHR technology for eligible professionals. Up to 85 percent of $25,000, or $21,250, subject to a cap on average allowable costs, would be provided to eligible professionals to help them adopt, implement and upgrade certified EHR systems. And up to 85 percent of $10,000, or $8,500, would be provided to eligible professionals to operate and maintain such systems for up to five  years. Physicians, nonphysician providers and midwives are eligible for 85 percent of costs to adopt an EHR up to $75,000 over six years. Hospitals, community health centers and rural health clinics are eligible for the full payments.

Privacy Provisions
The federal privacy and security rules have been significantly modified for the health care industry's handling of medical records. Most of the privacy and security provisions apply to both electronic and paper records. Following are the key provisions.

Accounting for Disclosures
Practices using EHR must track all disclosures of patient information made for treatment, payment and health care operations. That information must be made available to patients upon request. Patients have the right to ask for disclosures for up to three previous years. The legislation directs the HHS secretary to promulgate regulations with six months of the enactment of this legislation.

Extension of Privacy Requirements to Business Associates and PHR Vendors
The bill extends the privacy and security mandates for practices and other covered entities to the business associates that process records on their behalf. Business associates will also be subject to the same civil and criminal penalties as covered entities. All vendors of personal health records (PHRs) must comply with the privacy and security requirements. Neither of these entities were previously covered under the existing HIPAA regulations.

Breach Notification Mandate
The stimulus legislation generally requires covered entities and business associates to disclose to patients all security breaches that expose their information to unauthorized people outside the covered entity. If the breach discloses the data of 10 or more patients, a medical practice would have to post the news on its Web site. If the breach affects 500 or more patients, the practice would have to disclose the breach to prominent local media outlets and report the breach immediately to HHS.
 
Minimum Necessary
The new provisions will require that any patient information disclosed be restricted "to the degree practicable" and to "limited code sets" (de-identified records similar to those used for research purposes). HHS is required to issue within 18 months guidance on what constitutes the "minimum necessary" amount of data.

Patient Control of Records
Provisions of the legislation increasing patients' control over the sale of their health information include:

• A prohibition on covered entities and businesses associates selling individuals' identifiable medical records without their specific authorization 
• An extension of key HIPAA privacy rules to currently uncovered companies that offer individuals' personal health records
• A new provision that allows individuals to block their doctors from sending their insurance companies any information from a visit, if the patient pays the cost of the appointment in full

Patient Access to Information in Electronic Format
Should a medical group use an EHR, the patient has a right to obtain from the practice a copy of the information in an electronic format and, if the patient chooses, to direct the practice to transmit a copy  to a designated entity or person, provided that any such choice is "clear, conspicuous and specific." The legislation states that any fee that the practice may impose for providing the patient with a copy of such information (or a summary or explanation of such information) cannot be greater than the practice's labor costs in responding to the request.

State Attorneys General Enforcement
The stimulus legislation will increase civil and criminal penalties for privacy rule violations and allow state attorneys general to take enforcement action – including the launching of civil suits – when a citizen believes his/her medical privacy has been violated by a health care industry organization in that state.

To help the health care industry come into compliance with the new provisions, the bill requires the appointment of regional privacy advisers in HHS's 10 regional offices. The privacy adviser will offer guidance and education to covered entities, business associates and individuals on their rights and responsibilities under the Health Insurance Portability and Accountability Act's (HIPAA's) privacy and security rules.

These rules will continue to set a nationwide regulatory floor and not preempt more restrictive state laws.

Additional Provisions in the Legislation

• Comparative effectiveness research (CER): The stimulus bill includes $1.1 billion in funding for CER to be used "to conduct or support research to evaluate and compare the clinical outcomes, effectiveness, risk, and benefits of two or more medical treatments and services that address a particular medical condition." This research will be coordinated by the Federal Coordinating Council for Comparative Effectiveness Research, which will consist of at least 15 representatives from various federal agencies. At least half of these individuals must be physicians or have clinical expertise.
  
  MGMA and other national medical associations support clinical research that does not interfere with a physician's clinical decision-making authority and/or the patient-physician relationship. Congress specified in the conference report that the CER funding is not intended "for the comparative effectiveness research funding included in the conference agreement to be used to mandate coverage, reimbursement, or other policies for any public or private payer."
  
  Additionally, Congress recognized that a "'one-size-fits-all' approach to patient treatment is not the most medically appropriate solution to treating various conditions and included language to ensure that subpopulations are considered when research is conducted or supported with the funds provided in the conference agreement."
  
• Consolidated Omnibus Budget Reconciliation Act (COBRA): The legislation authorizes a 65 percent temporary COBRA premium subsidy for workers who have been involuntarily terminated between Sept. 1, 2008, and Dec. 31, 2009. This subsidy is available for up to nine months and would not be considered income for purposes of other federal/state program eligibility. To be eligible for the subsidy, an individual must have a modified adjusted gross income below $145,000 (or $290,000 for joint filers); if the taxpayer's income exceeds this threshold, the premium subsidy must be repaid. Taxpayers with adjusted gross income between $125,000 and $145,000 ($250,000 and $290,000 for joint filers) must repay a proportionately reduced amount of the premium subsidy.
  
• Training of primary care providers: The legislation allocates $500 million to address shortages by training primary health-care providers under Titles VII and VIII of the Public Health Service Act, including physicians, dentists and nurses, as well as helping pay medical school expenses for students who agree to practice in underserved communities through the National Health Service Corps.
  
• Three percent provider withholding tax: The legislation delays, from Dec. 31, 2010, to Dec. 31, 2011, implementation of the 3 percent withholding tax on government contractors (including Medicare providers) that was enacted under section 511 of the Tax Prevention and Reconciliation Act of 2005. 
  
• National Institutes of Health (NIH) research and facilities: The legislation earmarks $10 billion in NIH funding for research grants, renovations and construction at the NIH campuses.

Creation of HIT Office and Advisory Committees
The stimulus legislation codifies the Office of the National Coordinator for Health Information Technology (ONCHIT) and provides a budget of $2 billion. ONCHIT is authorized to develop an HIT system to be made available to physician practices at a nominal cost. ONCHIT will also provide competitive grants to states for HIT loans to medical practices. In addition, the national coordinator is to create policy to develop a nationwide health information technology infrastructure that:

• Allows for the electronic use and exchange of information and ensures that each patient's health information is secure and protected, in accordance with applicable law
• Improves health care quality, reduces medical errors, reduces health disparities, and advances the delivery of patient-centered medical care
• Reduces health care costs resulting from inefficiency, medical errors, inappropriate care, duplicative care and incomplete information
• Provides appropriate information to help guide medical decisions at the time and place of care
• Ensures the inclusion of meaningful public input in such development of such infrastructure
• Improves the coordination of care and information among hospitals, laboratories, physician offices and other entities through an effective infrastructure for the secure and authorized exchange of health care information
• Improves public health activities and facilitates the early identification and rapid response to public health threats and emergencies, including bioterror events and infectious disease outbreaks
• Facilitates health and clinical research and health care quality
• Promotes early detection, prevention and management of chronic diseases
• Promotes a more effective marketplace, greater competition, greater systems analysis, increased consumer choice and improved outcomes in health care services
• Improves efforts to reduce health disparities

The legislation also creates three new entities to develop HIT policy and assist in enforcing the nation's privacy regulations:

1. HIT Policy Committee – A public/private entity comprising representatives from each health-care stakeholder group, including providers, whose duty it is to make recommendations in a wide variety of HIT areas.
2. HIT Standards Committee – Established to recommend to the national coordinator standards, implementation specifications and certification criteria for the electronic exchange and use of health information.
3. Chief privacy officer of the ONCHIT – An adviser to the national coordinator on privacy, security and data stewardship of electronic health information. This person is also responsible for coordinating with other federal agencies (and similar privacy officers in such agencies), with state and regional efforts and with foreign countries regarding the privacy, security and data stewardship of electronic, individually identifiable health information.