On June 12, 2017, OIG released a report on Medicare and Medicaid electronic health record (EHR) incentive payments, claiming that between May 2011 and June 2014, CMS paid an estimated $729 million to eligible professionals (EPs) who OIG claims did not fully meet Federal requirements for EHR incentive payments.  This amount represents about 12 percent of the total amount of Medicare EHR incentives payments made during that time period.  The amount is based on extrapolation of alleged overpayments to a sample of EPs that were part of the OIG audit.

Medicare makes payments to EPs and hospitals for demonstrating “meaningful use” of a certified EHR to incentivize widespread adoption of EHR technology as established by the HITECH Act.  The Government Accountability Office (GAO) previously identified improper incentive payments as the main risk to the EHR incentive program, noting that the program’s attestation-based payment system is vulnerable to making payments to EPs and hospitals that are not fully meeting requirements.  As of June 2014, CMS has paid about $6 billion in incentive payments.

OIG reviewed a random sample of 100 EPs from the total 250,470 EPs who received EHR incentive payments from May 2011 to June 2014 to determine whether their attestations to meaningful use were properly supported.  From its sample, OIG identified 14 EPs who did not maintain support for their attestations and therefore, in OIG’s view, received government payments they were not entitled to.  This conclusion does not state, however, that the EPs failed to successfully attest to any of the measures but simply did not have the necessary paper documentation to demonstrate that they achieved the measures to which they attested.

Generally, to meet stage one meaningful use requirements, EPs must meet all 15 core measures and select an additional five of ten menu measures to satisfy.  For example, one of the core measures requires EPs to conduct or review a security risk analysis.  In its review, OIG found that six EPs could not provide documentation of a security risk assessment, and other EPs could not provide support for menu measures.  Again, OIG did not show that the EPs did not actually conduct the analysis or satisfy the menu measures.

OIG recommended that CMS implement stronger program integrity safeguards to promote more consistency in verifying that EPs self-attestations are properly meeting Meaningful Use requirements.

The full report is available here.