6/8/2012

1

1

LoriLaubach,Partner,MossAdamsLLPCatherineWakefield,VicePresident,CorporateComplianceandInternalAudit,MultiCare

Cloning and Other ComplianceRisks in Electronic MedicalRecords

2

• Basicdefinitionsandstories• Identifywhereriskisassociatedwithspecificfunctionsinanelectronicmedicalrecord

• Presentmethodstoauditandmonitorthecontrolsoftheelectronicrecord

AGENDA

6/8/2012

2

3

“Forexample,electronichealthrecords(EHR)maynotonlyfacilitatemoreaccuratebillingandincreasedqualityofcare,butalsofraudulentbilling.TheveryaspectsofEHRsthatmakeaphysician’sjobeasier—cut‐and‐pastefeaturesandtemplates—canalsobeusedtofabricateinformationthatresultsinimproperpaymentsandleavesinaccurate,andthereforepotentiallydangerous,informationinthepatientrecord.Andbecausetheevidenceofsuchimproperbehaviormaybeinentirelyelectronicform,lawenforcementwillhavetodevelopnewinvestigationtechniquestosupplementthetraditionalmethodsusedtoexaminetheauthenticityandaccuracyofpaperrecords.“

FROM TESTIMONY OF LEWIS MORRIS, OIG

http://oig.hhs.gov/testimony/docs/2011/morris_testimony_07122011.pdf

4

CLONING

• Cloning• Cut & Paste = Blocks of text or even complete

notes from another MD

• Copy & Paste = Carry forward of prior notes

• Other terms used = • Copy forward,

• Re-use, and

• Carry forward

6/8/2012

3

5

FirstCoastServicesOptions,Inc.• Cloneddocumentationdoesnotmeetmedicalnecessityrequirementsforcoverage

ofservicesrenderedduetothelackofspecific,individualinformation.Alldocumentationinthemedicalrecordmustbespecifictothepatientandher/hissituationatthetimeoftheencounter.Cloningofdocumentationisconsideredamisrepresentationofthemedicalnecessityrequirementforcoverageofservices.Identificationofthistypeofdocumentationwillleadtodenialofservicesforlackofmedicalnecessityandrecoupmentofalloverpaymentsmade.

CahabaGovernmentBenefitAdministratorsLLC• Themedicalnecessityofservicesperformedmustbedocumentedinthemedical

recordandCahabawouldexpecttoseedocumentationthatsupportsthemedicalnecessity oftheserviceandanychangesandordifferencesinthedocumentationofthehistoryofpresentillness,reviewofsystemandphysicalexamination

TWO MACS’ POLICIES ON CLONING

6

• NoridianAdministrativeServices,LLCDocumentationtosupportservicesrenderedneedstobepatientspecificanddateofservicespecific.Theseauto‐populatedparagraphsprovideusefulinformationsuchastheetiology,standardsofpractice,andgeneralgoalsofaparticulardiagnosis.However,theyaregeneralizationsanddonotsupportmedicallynecessaryinformationthatcorrelatestothemanagementoftheparticularpatient.PartBMRisseeingthesameauto‐populatedparagraphsintheHPIsofdifferentpatients.Creditcannotbegrantedforinformationthatisnotpatientspecificanddateofservicespecific.

Source:https://www.noridianmedicare.com/shared/partb/bulletins/2011/271_jul/Evaluation_and_Management_Services_‐_Documentation_and_Level_of_Service_.htm

LCD GUIDANCE ON TEMPLATES

6/8/2012

4

7

http://library.ahima.org/xpedio/groups/public/documents/ahima/bok1_033097.hcsp

Guidelines for EHR Documentation to Prevent Fraud

• Authorshipintegrityrisk:Borrowingrecordentriesfromanothersourceorauthorandrepresentingordisplayingpastascurrentdocumentation,andsometimesmisrepresentingorinflatingthenatureandintensityofservicesprovided

• Auditingintegrityrisk:Inadequateauditingfunctionsthatmakeitimpossibletodetectwhenanentrywasmodifiedorborrowedfromanothersourceandmisrepresentedasanoriginalentrybyanauthorizeduser

DOCUMENTATION RISKSAHIMA AREAS OF CONCERN

8

• Documentationintegrityrisk:Automatedinsertionofclinicaldataandvisitdocumentation,usingtemplatesorsimilartoolswithpredetermineddocumentationcomponentswithuncontrolledanduncertainclinicalrelevance

• Patientidentificationanddemographicdatarisks:Automateddemographicorregistrationentriesgeneratingincorrectpatientidentification,leadingtopatientsafetyandqualityofcareissues,aswellasenablingfraudulentactivityinvolvingpatientidentitytheftorprovidingunjustifiedcareforprofit

DOCUMENTATION RISKSAHIMA AREAS OF CONCERN

http://library.ahima.org/xpedio/groups/public/documents/ahima/bok1_033097.hcspGuidelines for EHR Documentation to Prevent Fraud

6/8/2012

5

9

• Twovarieties:– Word(CtrlC)– Computergenerated

• Concern:– Copyingandpastingisnot noncompliant.Itishowthe

informationisusedor“counted.”– Forexample,perTrailblazer'sSeptember30,2002,

bulletin,Medicareisalsoconcernedthattheprovider'scomputerizeddocumentationprogramdefaultstoamoreextensivehistoryandphysicalexaminationthanistypicallymedicallynecessarytoperform,anddoesnotdifferentiatenewfindingsandchangesinapatient'scondition.”

COPY AND PASTE

10

• Realexamples:o Nursewasupdatingherresume(usingWord)andcopiedaportionofherresumeintoapatientchart

o EDnursehadtworecordsopen.ShecopiedpartofPatientA’srecordintoPatientB’srecord—druguseandbi‐polardiagnosesshowedonPatientB’smedicalrecordandbillinginformation

COPY AND PASTE

In an EMR, the error never truly goes away

6/8/2012

6

11

COPY AND PASTE EXAMPLES

• Anotewascopied"intotal"toincludethePREVIOUSperformingprovider'sname

• NOoriginaldocumentationbythe'today'provider;justanelectronicsignaturewith'today'sdateandtime'.

• Reviewed10visitsoverayearperiodforaprovider....everyexamfindingwasthesamedespitecurrentcomplaintstothecontrary.Foundtobecopyingandpastingexam......forgotto'edit'fortoday'sfindings.

12

• Remindersforimportant“redflag”questions• Forexample,strepthroattemplatewouldhave

thepromptsbelow:o Fever?HA?Rash?HeartValve?KidneyProblem?o Consistencyandmedical/legalliabilitycoverage

• Despitethewell‐intendedquestions,allthevisitslookexactlythesame

TEMPLATES: A NECESSARY EVIL

6/8/2012

7

13

• Generatecannedphrases,mayloseuniqueness.• Multipleconsecutivecannedstatementscausesapoorread

thatmaymisconstruetheintendedmeaning.• One‐size‐fits‐alltemplatesareincomplete,not

comprehensiveenough,andonlyworkforoneproblem.• Subjectiveobservationsgoundocumented.• Templatesdrivemoreunnecessarydocumentation.Many

timestheycannotbecloseduntilallboxesarechecked,whichthendriveshigherE&Mlevelsthanmedicallynecessary.

TEMPLATES: CHALLENGES

14

StructuredData• Advantages:Enablesstatedvaluestobesupportedforspecificvariablessoastoprovidestandardmeaningforreportingpurposes(allentriesarereportabledata).

• Disadvantages:Predetermineddisplaynamesandconsistentlystructuredphrasesappearthesameinallcharts;doesnotallowfordescriptionsinthecliniciansownthoughtsorstyle.

o Theclassiccompletely“cannedtext”note

OTHER RISK AREAS

6/8/2012

8

15

FreeText• Advantages:Preservesthenarrativecomponentofthemedicalrecord.Eachvisitappearsdifferentbecausethecliniciancreateditspecificallyfortheindividualpatient.

• Disadvantages:Typingand/ordictationmustbedoneforeachpatientbyaclinicianwhowouldratherbeseeingpatientsthantyping.Thistyping,dictatingorfillingouttemplatescanbeoneroustotheprovider.

OTHER RISK AREAS

16

• MonitoringofcodingbyEMRisnotdone• AssumeEMRcodingmatchesbillingsystem• Coding“assistance”viatheEMRproductitself(CPT&ICD)

• CodinginEMRisvalidalthoughbasedonpre‐determineddesign

• My“99214”template• Mystandardproceduretemplate

OTHER RISK AREAS

6/8/2012

9

17

• Trackingofuser’schanges,deletionsormodificationtoaspecificsubsystem

• LackofpoliciesandproceduresrelatedtocodinganddocumentationrelatedtoEHR

• LackofEHRretentionpolicies• Lackofcontinuousmonitoringwithfeedbacktoproviders• Whoownsthis—Coding?MedicalDirectors?Quality?

OTHER RISK AREAS

18

FOLLOWING YOUR ORGANIZATION’S COPY AND PASTE POLICY AND PROCEDURE

• Ifyouhaveapolicyandprocedureinplaceandyouarenotfollowingitwhataretheconsequences?o MHShasaPhysicianHandbookwiththeindustrybestpracticesforourmedicalstafftofollow

o Ourauditfoundthatwewerenotfollowingourownhandbookpolicyandprocedures

o Interviewswereconductedwithkeystakeholdersandendusers

o TheinformationgatheredwasmeasuredagainsttheMHSPhysicianHandbookandtheAHIMACopyFunctionalityToolkit

6/8/2012

10

19

MULTICARE IDENTIFIED EXCELLENT PROCESSES IN PLACE

• Collaborationbetweenphysiciansintheambulatorysettingisoccurring

• Thecodingteamisattendingthenewphysicianorientationandprovidingtraining

• Codingauditsthedocumentationofnewlyhiredphysicians

• Codinghelpsphysicianswithdevelopmentofsmartphrases

• Revenuecycleclinicalappealshasawelldefinedprocessforhandlingadditionaldocumentationrequestsformedicalnecessityrequirements

• Identifiedserviceswhohavestandardizedtheirtemplates

20

• Auditdifficulty:o Identifyingiffunctionwasused

• Documentationintegrityrisks:o Bringingforthinformationwhichisnotspecifictopatiento Failuretoeditinformationnotapplicabletosubsequentencounter

• Canusesoftwareoriginallydesignedtodetectplagiarismatuniversities

• Usingencounterdata,comparedthefollowingEHRo Sameprovider,sameprimarydiagnosiso AllvisitsforonedayforaproviderPlagiarismsoftwaredownload:http://plagiarism.phys.virginia.edu/AHIMAarticle:http://library.ahima.org/xpedio/groups/public/documents/ahima/bok3_005520.hcsp

CUT & PASTE / COPY & PASTE

6/8/2012

11

21

MAKE ME THE AUTHOR

• AuditDifficulty:Identifyingwhenthisfunctionwasused

• TestEMRsystemcontrolsbycreatingapatientencounterusinganotherprovideruserID(orRN)andcreatedocumentation

• ReviewEHRdocumentation&auditlogstoensurethattestdocumentationisattributabletothecorrectprovider

• Turnoff/removethisfunctionalityiftheEHRdoesnothavethecapabilitytoattributeanentry,modificationordeletiontoaspecificindividual

22

• Identifyasampleofpatientencounterswhereatemplatewasselectedfortheencounterdocumentation(frequenttemplateusers– GI,cardiology,urology,respiratory,andprimarycare)

• ReviewEMRdocumentationtoensurethatanydefaultinformationwasverifiedorupdated(patientname,symptoms,medication,etc.)

• ReviewtheEMRauditlogstoensurethatthedefaultedinformationwasedited(inquirehowthisshouldlookpriortoexamination)

TEMPLATES

6/8/2012

12

23

EHR TOOLKIT – TESTING POLICY

• Testingforcopyfunctionalityinyourexistingelectronichealthrecord

• Comprehensivetestingintestenvironmentorusing“dummy”patients

• WorkwithyourEHRvendorandtheinformationservicesdepartmenttodeterminecopyfunctionalityoptions,e.g.,copyforward,blockingordisabling,auditrecords,date/timeofentry,attributions,etc.

24

EHR TOOLKIT – CHECKLIST OF ORGANIZATIONAL QUESTIONS

• Dutytoensuretheintegrityofthehealthrecord• Questionsyouneedtoask…

o Isthereabettermeansthancopyfunctionalitytoaccomplishtheclinicalobjectives,suchasthroughtheuseofformsortemplatesthataremorereadilystandardizedandauditable?

o IfyourEHRusessmarttools,thenyourprovidershavetheoptiontocreatesmartphrasesandsmartlistsbasedontheirindividualpreferences.Whatisthescopeofthis?

6/8/2012

13

25

EHR TOOLKIT – QUESTIONS…

• Canyoubeassuredthattheongoingtrainingandeducationyouhaveprovidedtoyourmedicalstaffissufficienttoaddresscloningrisks?

• Howdoyoumonitortoensureprovidersarefollowingtheorganization’scopyandpastepoliciesandprocedures?

26

EHR TOOLKIT – QUESTIONS…

• DoestheorganizationknowhowitssystemscopyfunctionscanbeusedwithintheEHR?

• Doestheorganizationhaveaprocessforidentifyingandmitigatingunacceptablefunctionsoruses?

• HastheorganizationidentifiedhowcopywillbeutilizedwithintheEHR?

• Hasthemedicalstaffapprovedcopypolicyandprocedures?

6/8/2012

14

27

EHR TOOLKIT – QUESTIONS…

• Whoisresponsibleforensuringthatallcopypoliciesandproceduresareenforced?

• Whowillperformongoingauditsofproviderdocumentationforappropriateuseofcopy?

• Whataudittrailsareavailable?

28

EHR TOOLKIT – SAMPLE PROCEDURE

• Providersareresponsiblefortheentirecontentoftheirdocumentation,whetherthecontentisoriginal,copied,pasted,importedorreused

• Theproviderisresponsiblefortheaccuracyandmedicalnecessityofthenotewhetheritiscopied,pasted,etc.

• ProvidersareresponsibleforcorrectinganyerrorsidentifiedandalertingtheHIMprofessional

• Providersmustreferenceorattributeanydocumentationbroughtforward

• Whenreferencingpriordocumentationtheprovidermustattributewhoandwherehe/shebroughtinformationforward

• Providersarerequiredtofollowallstate,federal,andlocallaws,includingthemedicalstaffbylaws,rulesandregulations

• Failuretocomplywillresultindisciplinaryactionbeingtaken

6/8/2012

15

29

EHR TOOLKIT – SAMPLE SANCTION POLICY

• Title:CopyFunctionSanctionPolicy

• Purpose:ToprovideguidanceforactionintheeventofinappropriateuseofcopyfunctionalityintheEHR

• Policy:ProviderdocumentingintheEHRmustavoidindiscriminatelycopyingandpastinganotherprovider’sdocumentation.Theprocessofcopyingforwardinformationfrompreviousnotes,withoutclearattributioninanefforttoincreasedocumentationinacurrentvisitisprohibited.

30

EHR TOOLKIT – SANCTION PROCEDURE

• Procedure:“Who”isresponsibleforreferringcasesofinappropriatecopyingandpastingto“whom”forcorrectiveaction,review,andfacilitywidetrending.

• “Who”isresponsibleforreviewingthecorrectiveactionandfacilitywidetrendingreport.“Who”shallmakerecommendationsondisciplinaryactioninwhichcontinuedinappropriateuseofcopytechnologyisidentified.

• Failuretocomplywiththeorganizationalpolicyregardingcopyfunctionalitymaybedeemedasviolatinghospitalpolicy.

• Disciplinaryactionmaybetaken.

6/8/2012

16

31

COPY FUNCTIONALITY AUDIT PROCEDURE EXAMPLE

• Identifyresponsibleparty• Determinehowandwhenauditswillbeconducted• Determinewhowillperformtheseongoingconcurrentaudits• Establishfrequencyforperformingtheaudit• Establishtimeperiodcoveredbytheaudit• Identifyhowthesamplesizeifdetermined• Identifyadescriptionoftheoutcomeindicators• Determinehowcopyfunctionalitieswithintherecordareidentified• Designacorrectiveactionplanbasedonfindings• Maintainandprovideadetailedlistofcopyfunctionalitiesastheyexistwithin

theelectronicsystem• Providestestingofcopyfunctionalitiespriortoimplementationandpriorto

versionupdates• Identifiescopyfunctionalitiesandcategorizesbywhethertheyareretainedas

auditableeventsorotherwiseidentifiableascopied

32

EXAMPLE OF COPY AND PASTE CHALLENGES FOUND

• Outdatedhistories• Outdatedlabs• Entirechartnote• Patientisstablebutisaninpatient• Takingcreditforinterpretations• Spellingerrors,formattingissues• Attributionsnotdocumented• Ordersauthentication(verbalandphone)• Useofabbreviations(textingintheEMR)

6/8/2012

17

33

EXAMPLE OF DUPLICATIVE DOCUMENTATION CHALLENGES FOUND

• Copyerror– 2chartsopenatonetime• Physician– copiedandpastedtheofficevisitintothenext10visits

• 60pagechartnote• Chartnotedocumentationnotuniquetovisit• Billmultipletimesforoneprocedure• Consistencyof“place”intheEMRfordocumentation(providerordersinnursesnotes)

34

• JointCommissionrequirements• Useofaudittrails/auditlogs

AND….

6/8/2012

18

35

RECOMMENDATIONS

• Trainandeducateproviderstoreviewthenoteforaccuracybeforeauthentication

• Documentattributions

• Draftandimplementeducationpolicyandchecklist

• DraftandimplementanauditpolicyrelatedtotheEHR

• Performchartaudits

• LearnandknowyourEHRsystem

• Partnerandcollaboratewitheducationdepartment,codingdepartments,QualityManagement,andComplianceinthetrainingofproviders

36

RESOURCE/REFERENCE LIST

• AHIMACopyFunctionalityToolkit– APracticalGuide:InformationManagementandGovernanceofCopyFunctionsinElectronicHealthRecordSystems,AHIMAUpdated2011

• CMSDocumentationRequirements• LocalMedicareandMedicaidCarriers

6/8/2012

19

37

QUESTIONS?

Lori.laubach@mossadams.comCatherine.wakefield@multicare.org