6/8/2012
1
1
LoriLaubach,Partner,MossAdamsLLPCatherineWakefield,VicePresident,CorporateComplianceandInternalAudit,MultiCare
Cloning and Other ComplianceRisks in Electronic MedicalRecords
2
• Basicdefinitionsandstories• Identifywhereriskisassociatedwithspecificfunctionsinanelectronicmedicalrecord
• Presentmethodstoauditandmonitorthecontrolsoftheelectronicrecord
AGENDA
6/8/2012
2
3
“Forexample,electronichealthrecords(EHR)maynotonlyfacilitatemoreaccuratebillingandincreasedqualityofcare,butalsofraudulentbilling.TheveryaspectsofEHRsthatmakeaphysician’sjobeasier—cut‐and‐pastefeaturesandtemplates—canalsobeusedtofabricateinformationthatresultsinimproperpaymentsandleavesinaccurate,andthereforepotentiallydangerous,informationinthepatientrecord.Andbecausetheevidenceofsuchimproperbehaviormaybeinentirelyelectronicform,lawenforcementwillhavetodevelopnewinvestigationtechniquestosupplementthetraditionalmethodsusedtoexaminetheauthenticityandaccuracyofpaperrecords.“
FROM TESTIMONY OF LEWIS MORRIS, OIG
http://oig.hhs.gov/testimony/docs/2011/morris_testimony_07122011.pdf
4
CLONING
• Cloning• Cut & Paste = Blocks of text or even complete
notes from another MD
• Copy & Paste = Carry forward of prior notes
• Other terms used = • Copy forward,
• Re-use, and
• Carry forward
6/8/2012
3
5
FirstCoastServicesOptions,Inc.• Cloneddocumentationdoesnotmeetmedicalnecessityrequirementsforcoverage
ofservicesrenderedduetothelackofspecific,individualinformation.Alldocumentationinthemedicalrecordmustbespecifictothepatientandher/hissituationatthetimeoftheencounter.Cloningofdocumentationisconsideredamisrepresentationofthemedicalnecessityrequirementforcoverageofservices.Identificationofthistypeofdocumentationwillleadtodenialofservicesforlackofmedicalnecessityandrecoupmentofalloverpaymentsmade.
CahabaGovernmentBenefitAdministratorsLLC• Themedicalnecessityofservicesperformedmustbedocumentedinthemedical
recordandCahabawouldexpecttoseedocumentationthatsupportsthemedicalnecessity oftheserviceandanychangesandordifferencesinthedocumentationofthehistoryofpresentillness,reviewofsystemandphysicalexamination
TWO MACS’ POLICIES ON CLONING
6
• NoridianAdministrativeServices,LLCDocumentationtosupportservicesrenderedneedstobepatientspecificanddateofservicespecific.Theseauto‐populatedparagraphsprovideusefulinformationsuchastheetiology,standardsofpractice,andgeneralgoalsofaparticulardiagnosis.However,theyaregeneralizationsanddonotsupportmedicallynecessaryinformationthatcorrelatestothemanagementoftheparticularpatient.PartBMRisseeingthesameauto‐populatedparagraphsintheHPIsofdifferentpatients.Creditcannotbegrantedforinformationthatisnotpatientspecificanddateofservicespecific.
Source:https://www.noridianmedicare.com/shared/partb/bulletins/2011/271_jul/Evaluation_and_Management_Services_‐_Documentation_and_Level_of_Service_.htm
LCD GUIDANCE ON TEMPLATES
6/8/2012
4
7
http://library.ahima.org/xpedio/groups/public/documents/ahima/bok1_033097.hcsp
Guidelines for EHR Documentation to Prevent Fraud
• Authorshipintegrityrisk:Borrowingrecordentriesfromanothersourceorauthorandrepresentingordisplayingpastascurrentdocumentation,andsometimesmisrepresentingorinflatingthenatureandintensityofservicesprovided
• Auditingintegrityrisk:Inadequateauditingfunctionsthatmakeitimpossibletodetectwhenanentrywasmodifiedorborrowedfromanothersourceandmisrepresentedasanoriginalentrybyanauthorizeduser
DOCUMENTATION RISKSAHIMA AREAS OF CONCERN
8
• Documentationintegrityrisk:Automatedinsertionofclinicaldataandvisitdocumentation,usingtemplatesorsimilartoolswithpredetermineddocumentationcomponentswithuncontrolledanduncertainclinicalrelevance
• Patientidentificationanddemographicdatarisks:Automateddemographicorregistrationentriesgeneratingincorrectpatientidentification,leadingtopatientsafetyandqualityofcareissues,aswellasenablingfraudulentactivityinvolvingpatientidentitytheftorprovidingunjustifiedcareforprofit
DOCUMENTATION RISKSAHIMA AREAS OF CONCERN
http://library.ahima.org/xpedio/groups/public/documents/ahima/bok1_033097.hcspGuidelines for EHR Documentation to Prevent Fraud
6/8/2012
5
9
• Twovarieties:– Word(CtrlC)– Computergenerated
• Concern:– Copyingandpastingisnot noncompliant.Itishowthe
informationisusedor“counted.”– Forexample,perTrailblazer'sSeptember30,2002,
bulletin,Medicareisalsoconcernedthattheprovider'scomputerizeddocumentationprogramdefaultstoamoreextensivehistoryandphysicalexaminationthanistypicallymedicallynecessarytoperform,anddoesnotdifferentiatenewfindingsandchangesinapatient'scondition.”
COPY AND PASTE
10
• Realexamples:o Nursewasupdatingherresume(usingWord)andcopiedaportionofherresumeintoapatientchart
o EDnursehadtworecordsopen.ShecopiedpartofPatientA’srecordintoPatientB’srecord—druguseandbi‐polardiagnosesshowedonPatientB’smedicalrecordandbillinginformation
COPY AND PASTE
In an EMR, the error never truly goes away
6/8/2012
6
11
COPY AND PASTE EXAMPLES
• Anotewascopied"intotal"toincludethePREVIOUSperformingprovider'sname
• NOoriginaldocumentationbythe'today'provider;justanelectronicsignaturewith'today'sdateandtime'.
• Reviewed10visitsoverayearperiodforaprovider....everyexamfindingwasthesamedespitecurrentcomplaintstothecontrary.Foundtobecopyingandpastingexam......forgotto'edit'fortoday'sfindings.
12
• Remindersforimportant“redflag”questions• Forexample,strepthroattemplatewouldhave
thepromptsbelow:o Fever?HA?Rash?HeartValve?KidneyProblem?o Consistencyandmedical/legalliabilitycoverage
• Despitethewell‐intendedquestions,allthevisitslookexactlythesame
TEMPLATES: A NECESSARY EVIL
6/8/2012
7
13
• Generatecannedphrases,mayloseuniqueness.• Multipleconsecutivecannedstatementscausesapoorread
thatmaymisconstruetheintendedmeaning.• One‐size‐fits‐alltemplatesareincomplete,not
comprehensiveenough,andonlyworkforoneproblem.• Subjectiveobservationsgoundocumented.• Templatesdrivemoreunnecessarydocumentation.Many
timestheycannotbecloseduntilallboxesarechecked,whichthendriveshigherE&Mlevelsthanmedicallynecessary.
TEMPLATES: CHALLENGES
14
StructuredData• Advantages:Enablesstatedvaluestobesupportedforspecificvariablessoastoprovidestandardmeaningforreportingpurposes(allentriesarereportabledata).
• Disadvantages:Predetermineddisplaynamesandconsistentlystructuredphrasesappearthesameinallcharts;doesnotallowfordescriptionsinthecliniciansownthoughtsorstyle.
o Theclassiccompletely“cannedtext”note
OTHER RISK AREAS
6/8/2012
8
15
FreeText• Advantages:Preservesthenarrativecomponentofthemedicalrecord.Eachvisitappearsdifferentbecausethecliniciancreateditspecificallyfortheindividualpatient.
• Disadvantages:Typingand/ordictationmustbedoneforeachpatientbyaclinicianwhowouldratherbeseeingpatientsthantyping.Thistyping,dictatingorfillingouttemplatescanbeoneroustotheprovider.
OTHER RISK AREAS
16
• MonitoringofcodingbyEMRisnotdone• AssumeEMRcodingmatchesbillingsystem• Coding“assistance”viatheEMRproductitself(CPT&ICD)
• CodinginEMRisvalidalthoughbasedonpre‐determineddesign
• My“99214”template• Mystandardproceduretemplate
OTHER RISK AREAS
6/8/2012
9
17
• Trackingofuser’schanges,deletionsormodificationtoaspecificsubsystem
• LackofpoliciesandproceduresrelatedtocodinganddocumentationrelatedtoEHR
• LackofEHRretentionpolicies• Lackofcontinuousmonitoringwithfeedbacktoproviders• Whoownsthis—Coding?MedicalDirectors?Quality?
OTHER RISK AREAS
18
FOLLOWING YOUR ORGANIZATION’S COPY AND PASTE POLICY AND PROCEDURE
• Ifyouhaveapolicyandprocedureinplaceandyouarenotfollowingitwhataretheconsequences?o MHShasaPhysicianHandbookwiththeindustrybestpracticesforourmedicalstafftofollow
o Ourauditfoundthatwewerenotfollowingourownhandbookpolicyandprocedures
o Interviewswereconductedwithkeystakeholdersandendusers
o TheinformationgatheredwasmeasuredagainsttheMHSPhysicianHandbookandtheAHIMACopyFunctionalityToolkit
6/8/2012
10
19
MULTICARE IDENTIFIED EXCELLENT PROCESSES IN PLACE
• Collaborationbetweenphysiciansintheambulatorysettingisoccurring
• Thecodingteamisattendingthenewphysicianorientationandprovidingtraining
• Codingauditsthedocumentationofnewlyhiredphysicians
• Codinghelpsphysicianswithdevelopmentofsmartphrases
• Revenuecycleclinicalappealshasawelldefinedprocessforhandlingadditionaldocumentationrequestsformedicalnecessityrequirements
• Identifiedserviceswhohavestandardizedtheirtemplates
20
• Auditdifficulty:o Identifyingiffunctionwasused
• Documentationintegrityrisks:o Bringingforthinformationwhichisnotspecifictopatiento Failuretoeditinformationnotapplicabletosubsequentencounter
• Canusesoftwareoriginallydesignedtodetectplagiarismatuniversities
• Usingencounterdata,comparedthefollowingEHRo Sameprovider,sameprimarydiagnosiso AllvisitsforonedayforaproviderPlagiarismsoftwaredownload:http://plagiarism.phys.virginia.edu/AHIMAarticle:http://library.ahima.org/xpedio/groups/public/documents/ahima/bok3_005520.hcsp
CUT & PASTE / COPY & PASTE
6/8/2012
11
21
MAKE ME THE AUTHOR
• AuditDifficulty:Identifyingwhenthisfunctionwasused
• TestEMRsystemcontrolsbycreatingapatientencounterusinganotherprovideruserID(orRN)andcreatedocumentation
• ReviewEHRdocumentation&auditlogstoensurethattestdocumentationisattributabletothecorrectprovider
• Turnoff/removethisfunctionalityiftheEHRdoesnothavethecapabilitytoattributeanentry,modificationordeletiontoaspecificindividual
22
• Identifyasampleofpatientencounterswhereatemplatewasselectedfortheencounterdocumentation(frequenttemplateusers– GI,cardiology,urology,respiratory,andprimarycare)
• ReviewEMRdocumentationtoensurethatanydefaultinformationwasverifiedorupdated(patientname,symptoms,medication,etc.)
• ReviewtheEMRauditlogstoensurethatthedefaultedinformationwasedited(inquirehowthisshouldlookpriortoexamination)
TEMPLATES
6/8/2012
12
23
EHR TOOLKIT – TESTING POLICY
• Testingforcopyfunctionalityinyourexistingelectronichealthrecord
• Comprehensivetestingintestenvironmentorusing“dummy”patients
• WorkwithyourEHRvendorandtheinformationservicesdepartmenttodeterminecopyfunctionalityoptions,e.g.,copyforward,blockingordisabling,auditrecords,date/timeofentry,attributions,etc.
24
EHR TOOLKIT – CHECKLIST OF ORGANIZATIONAL QUESTIONS
• Dutytoensuretheintegrityofthehealthrecord• Questionsyouneedtoask…
o Isthereabettermeansthancopyfunctionalitytoaccomplishtheclinicalobjectives,suchasthroughtheuseofformsortemplatesthataremorereadilystandardizedandauditable?
o IfyourEHRusessmarttools,thenyourprovidershavetheoptiontocreatesmartphrasesandsmartlistsbasedontheirindividualpreferences.Whatisthescopeofthis?
6/8/2012
13
25
EHR TOOLKIT – QUESTIONS…
• Canyoubeassuredthattheongoingtrainingandeducationyouhaveprovidedtoyourmedicalstaffissufficienttoaddresscloningrisks?
• Howdoyoumonitortoensureprovidersarefollowingtheorganization’scopyandpastepoliciesandprocedures?
26
EHR TOOLKIT – QUESTIONS…
• DoestheorganizationknowhowitssystemscopyfunctionscanbeusedwithintheEHR?
• Doestheorganizationhaveaprocessforidentifyingandmitigatingunacceptablefunctionsoruses?
• HastheorganizationidentifiedhowcopywillbeutilizedwithintheEHR?
• Hasthemedicalstaffapprovedcopypolicyandprocedures?
6/8/2012
14
27
EHR TOOLKIT – QUESTIONS…
• Whoisresponsibleforensuringthatallcopypoliciesandproceduresareenforced?
• Whowillperformongoingauditsofproviderdocumentationforappropriateuseofcopy?
• Whataudittrailsareavailable?
28
EHR TOOLKIT – SAMPLE PROCEDURE
• Providersareresponsiblefortheentirecontentoftheirdocumentation,whetherthecontentisoriginal,copied,pasted,importedorreused
• Theproviderisresponsiblefortheaccuracyandmedicalnecessityofthenotewhetheritiscopied,pasted,etc.
• ProvidersareresponsibleforcorrectinganyerrorsidentifiedandalertingtheHIMprofessional
• Providersmustreferenceorattributeanydocumentationbroughtforward
• Whenreferencingpriordocumentationtheprovidermustattributewhoandwherehe/shebroughtinformationforward
• Providersarerequiredtofollowallstate,federal,andlocallaws,includingthemedicalstaffbylaws,rulesandregulations
• Failuretocomplywillresultindisciplinaryactionbeingtaken
6/8/2012
15
29
EHR TOOLKIT – SAMPLE SANCTION POLICY
• Title:CopyFunctionSanctionPolicy
• Purpose:ToprovideguidanceforactionintheeventofinappropriateuseofcopyfunctionalityintheEHR
• Policy:ProviderdocumentingintheEHRmustavoidindiscriminatelycopyingandpastinganotherprovider’sdocumentation.Theprocessofcopyingforwardinformationfrompreviousnotes,withoutclearattributioninanefforttoincreasedocumentationinacurrentvisitisprohibited.
30
EHR TOOLKIT – SANCTION PROCEDURE
• Procedure:“Who”isresponsibleforreferringcasesofinappropriatecopyingandpastingto“whom”forcorrectiveaction,review,andfacilitywidetrending.
• “Who”isresponsibleforreviewingthecorrectiveactionandfacilitywidetrendingreport.“Who”shallmakerecommendationsondisciplinaryactioninwhichcontinuedinappropriateuseofcopytechnologyisidentified.
• Failuretocomplywiththeorganizationalpolicyregardingcopyfunctionalitymaybedeemedasviolatinghospitalpolicy.
• Disciplinaryactionmaybetaken.
6/8/2012
16
31
COPY FUNCTIONALITY AUDIT PROCEDURE EXAMPLE
• Identifyresponsibleparty• Determinehowandwhenauditswillbeconducted• Determinewhowillperformtheseongoingconcurrentaudits• Establishfrequencyforperformingtheaudit• Establishtimeperiodcoveredbytheaudit• Identifyhowthesamplesizeifdetermined• Identifyadescriptionoftheoutcomeindicators• Determinehowcopyfunctionalitieswithintherecordareidentified• Designacorrectiveactionplanbasedonfindings• Maintainandprovideadetailedlistofcopyfunctionalitiesastheyexistwithin
theelectronicsystem• Providestestingofcopyfunctionalitiespriortoimplementationandpriorto
versionupdates• Identifiescopyfunctionalitiesandcategorizesbywhethertheyareretainedas
auditableeventsorotherwiseidentifiableascopied
32
EXAMPLE OF COPY AND PASTE CHALLENGES FOUND
• Outdatedhistories• Outdatedlabs• Entirechartnote• Patientisstablebutisaninpatient• Takingcreditforinterpretations• Spellingerrors,formattingissues• Attributionsnotdocumented• Ordersauthentication(verbalandphone)• Useofabbreviations(textingintheEMR)
6/8/2012
17
33
EXAMPLE OF DUPLICATIVE DOCUMENTATION CHALLENGES FOUND
• Copyerror– 2chartsopenatonetime• Physician– copiedandpastedtheofficevisitintothenext10visits
• 60pagechartnote• Chartnotedocumentationnotuniquetovisit• Billmultipletimesforoneprocedure• Consistencyof“place”intheEMRfordocumentation(providerordersinnursesnotes)
34
• JointCommissionrequirements• Useofaudittrails/auditlogs
AND….
6/8/2012
18
35
RECOMMENDATIONS
• Trainandeducateproviderstoreviewthenoteforaccuracybeforeauthentication
• Documentattributions
• Draftandimplementeducationpolicyandchecklist
• DraftandimplementanauditpolicyrelatedtotheEHR
• Performchartaudits
• LearnandknowyourEHRsystem
• Partnerandcollaboratewitheducationdepartment,codingdepartments,QualityManagement,andComplianceinthetrainingofproviders
36
RESOURCE/REFERENCE LIST
• AHIMACopyFunctionalityToolkit– APracticalGuide:InformationManagementandGovernanceofCopyFunctionsinElectronicHealthRecordSystems,AHIMAUpdated2011
• CMSDocumentationRequirements• LocalMedicareandMedicaidCarriers