NC-MIPS is Open for Program Year 2020
NC-MIPS is now accepting Program Year 2020 Stage 3 Meaningful Use (MU) attestations.
In Program Year 2020, EPs may use a 90-day MU and clinical quality measure (CQM) reporting period.
EPs who attested with another state should email NCMedicaid.HIT@dhhs.nc.gov prior to attesting with North Carolina for Program Year 2020.
To participate in Program Year 2020, all EPs must meet the following eligibility criteria:
- Have a 2015 Edition of certified EHR technology (CEHRT).
- Meet the required Medicaid patient volume (PV) threshold of 30%, pediatricians may qualify for a reduced payment with 20% Medicaid PV. Note: EPs who were paid for Program Year 2019 using a 90-day patient volume reporting period from calendar year 2019 have the option to use the same patient volume reporting period to attest for Program Year 2020.
- Meet MU and CQMs requirements. In Program Year 2020, EPs will be attesting to Stage 3 MU and 2020 CQMs.
Program Year 2020 Webinar Series
The NC Medicaid EHR Incentive Program’s webinar series has been updated to reflect the rules and regulations for Program Year 2020.
The webinars are designed with the busy provider in mind, so most of them are about five minutes long. Each short webinar explains a different piece of the attestation process such as updating a CEHRT number, updating a username in NC-MIPS, and submitting an attestation.
Other webinar topics include patient volume, audits, MU and CQMs in Program Year 2020 and more. These webinars can be found on the ‘Resources and Webinars’ tab of the program website.
The Security Risk Analysis (SRA)
States must comply with federal requirements to ensure EPs who attest for EHR incentive payments do so in accordance with the Centers for Medicare and Medicaid Services’ (CMS) rules and regulations. The NC Medicaid EHR Incentive Program Investigation Team serves the purpose of detecting improper payments and takes corrective action in the case improper payments were issued. All EPs who receive an EHR incentive payment are subject to audit and must keep all documentation supporting their attestation for six years post-payment.
NC Medicaid EHR Incentive Program Investigators are sharing tips from CMS to prepare for Objective 1: Protect Patient Health Information. Per CMS, to meet this objective, “EPs must attest YES to conducting or reviewing a security risk analysis (SRA) and implementing security updates as necessary and correcting identified security deficiencies to meet this measure.”
Every EP must include, at minimum, the following five items in her/his SRA. These items must be completed during the calendar year of her/his MU reporting period:
- Define the scope of the risk analysis.
- Identify potential threats and vulnerabilities to patient privacy.
- Describe how to protect against potential threats (physical, administrative and technical safeguards).
- Review and update the risk analysis on a periodic basis.
- Develop a corrective action plan.
EPs selected for audit who cannot provide documentation that their SRA included the above five items will fail the audit and will be required to return the incentive payment received for that program year.
Please note, SRAs are not synonymous to a practice’s operating procedures or policies. The SRA is an independent security review and analysis of an individual or practice’s EHR.
The U.S. Department of Health and Human Services (HHS) has developed an SRA Toolkit which provides suggestions for implementing an effective means for safeguarding electronic protected health information and further guidance to be in compliance with the risk analysis requirements.
HHS’ Office for Civil Rights (OCR) and the Office of the National Coordinator (ONC) created and SRA tool, which when completed satisfies the objective’s requirements. Program Investigators recommend EPs review HHS’ guidance and/or complete the SRA tool prior to attesting to ensure compliance.
Contact
NCTracks Contact Center: 800-688-6696