HHS Says Certified EHR Available in Fall 2010

Well, it always seems to happen when I go out of town on vacation that HHS finally decides to go to work and make some announcements. The final rule for the Temporary EHR certification rule is out and will be published to the Federal Register on June 24th. It’s non-final format is available at the Federal Register’s Public Inspection Desk. Does anyone else kind of squirm when they read about this final rule for a temporary EHR certification. Final and temporary just don’t sound right together, but that’s what we have.

The Healthcare IT Guy attended an HHS ONC press conference and added a nice little summary of what was said:

*As of today if you’re interested in being a certification body you must request the HHS Certifying Body application in writing
*On July 1 ONC will start accepting applications
*By the “end of the summer” (HHS’s words) there will be one or more certifying bodies open for business (accepting products)
*By “this fall” (again, their words) there will be fully HHS certified products available

One important clarification was made by ONC — there is no grandfathering in CCHIT or previously certified products. Everybody is going to be re certified using the new NIST rules. This means that if you have even 2011 CCHIT certification now it won’t mean anything, you have to go through the process again. CCHIT is offering their “ARRA Interim Certification” but beware — the rules say that you have to follow the NIST plans, not what CCHIT developed. So, if you have the ARRA Interim Certification you may not have pay again but you still will be required to change your software to meet the HHS/NIST test plans and requirements.

Nothing that’s all that newsworthy, except it’s nice to finally have a little bit more solid timeline for when there will be some ARRA EHR certification bodies.

I think that Shahid’s analysis of the now meaningless 2011 CCHIT certification is spot on as well. Although, I’m sure we’ll still see quite a few EMR vendors using the marketing power of the CCHIT certification on unsuspecting clinics who don’t know the difference.

Yes, it does also mean that clinics will have to wait until Fall of 2010 (or later) before they’ll really know if an EHR will be a certified EHR or not. Of course, I’ll be very surprised if less than 98% of EMR vendors don’t become ARRA certified.

ARRA Q&A: Are imaging costs recoupable under the HITECH act?

I got the following question from Brandon about the need to have a domain controlled network in order to comply with HIPAA.

I am currently trying to implement an EMR system in a small practice. I am trying to convince the parties involved that it is necessary to transition to a domain controlled network for security reasons even though this type of network is not required for our EMR system or its server. My understanding of HIPAA is that simply having a firewall does not qualify as a “secured network”. Am I right on this?

Brandon,
You are correct that just having a firewall does not likely qualify as a “secured network.” However, that doesn’t necessarily mean that you need to have a domain controlled network to meet the HIPAA security standards. You could still manually apply the domain security policies on to individual computers and achieve the same level of security.

Of course, the key word in that statement is the word “manually.” If you have less than 10 computers, then this probably isn’t a huge deal and can be done manually. Once you pass 10 computers (or somewhere in that range) you probably want to consider using active directory to manage the security policies on your computers. It’s much easier to apply policies on a large number of computers using active directory. Plus, you can know that the policy was applied consistently across your network.

You also shouldn’t ignore the other benefits of a domain controlled network. I’ve written previously about the benefits of things like shared drives as a nice companion to an EMR. Active Directory makes adding these shared drives trivial. It’s also a nice benefit to have a universal login that’s managed by the domain and can work on every computer in the office.

Plus, if your EMR runs on SQL Server and you buy a nice but inexpensive server with Windows Small Business Server, then you already have the software for active directory. So, it’s really an easy decision to use it. I’ve implemented it at a site with 5 computers and it’s been a great thing to have even if it’s a bit of overkill.

EMR Stimulus Q&A: Government Incentives for EMR Adoption Outside of Medicare and Medicaid

Time again for everyone’s favorite topic (or so it seems), EHR stimulus questions and answers. Today’s EMR stimulus question comes from Jamie who asked the following question on a previous post:

Does anyone know whether or not the government is implementing some kind of incentive benefit for non-Medicare/Medicaid users? Or are these practices totally out of luck?

The short answer (at least for now) is not really. The ARRA EHR stimulus money is provided through Medicare and Medicaid programs as “bonuses” for those who show “meaningful use” of a “certified EHR.”

With that said, there are some grants available for special situations. For example, they have a beacon communities program which are given to organizations that will supposedly take EHR software to the next level and be examples for their communities of what can be done with IT and EMR software.

I’ve heard there’s other grants that people can apply for also, but I’m not sure all of the details. I also hear that there might be some EMR stimulus money available in the latest healthcare reform bill. For example, I read somewhere recently that the healthcare reform bill includes some stimulus money for long term care which has basically been left out of stimulus money as well.

Clinics interested in EMR software should also be able to get some help from the RECs and HITRCs. At least their stated mission is to assist doctors to adopt and meaningfully use EMR software. I think the jury’s still out on how helpful these RECs will actually be. It’s a nice idea, but could go horribly wrong if not done right.

I won’t go into all the details here, but not qualifying for the EMR stimulus money might just be the best thing that’s happened to your practice. That means you won’t be distracted and you don’t need to wait. You can hone in on the other EMR benefits and start reaping those benefits without all the bureaucracy.