According to CMS Officials, about one in 20 participants in the meaningful use program can expect to face an audit for compliance with the program’s requirements.

Since October 2012, CMS has conducted audits of meaningful use program participants who have received incentive payments. In January, CMS started conducting prepayment audits of health care providers who attested to the meaningful use of EHR systems.

Robert Anthony — deputy director of CMS’ Health IT Initiatives Group — said that CMS aims to audit about 5% of all meaningful use program participants by conducting approximately the same amount of prepayment and post-payment audits. He added that Figliozzi & Company, CMS’ audit contractor, will conduct the majority of reviews through “desk audits” but that a few on-site audits could occur.

Anthony said CMS so far has sent few letters notifying health care providers about adverse audit findings. However, he noted that the agency still is in the early stages of its auditing efforts. He added that a few health care providers with adverse audit notices are starting the appeals process and that some providers are facing investigation for possible fraud.

According to Anthony, the most common problems identified in the audits so far are:

Noncompliance with the requirement that health care providers conduct a data security risk assessment, which also is a requirement under HIPAA; and

A lack of adequate documentation to support responses to some of the “yes or no” meaningful use requirements, such as whether an EHR system has been tested for the ability to exchange clinical data.

Providers should retain all relevant supporting documentation-in either paper or electronic format—used to complete the Attestation Module as follows:

• Documentation to support attestation data for MU objectives and clinical quality measures should be retained for six years post-attestation
• Documentation to support payment calculations (such as cost report data) should follow the current documentation retention processes

Are you prepared? Please contact your Kentucky REC implementation specialist to ensure that you have all of the proper documentation in place in the case of an audit.