Post-Payment Audit Guidance

Post-Payment Frequently Asked Questions (FAQs)

  • FAQs are also available in Portable Document Format (PDF)

Updated May 2020

Disclaimer

This document serves as an informational reference for Eligible Providers participating in the NY Medicaid or Medicare EHR Incentive Programs. Although reasonable effort has been made to assure the accuracy of the information within these pages at the time of posting, it is the responsibility of each provider to comply with the current policies and requirements of the program.

Post-Payment Audit Assistance
hitech@omig.ny.gov

Contents

  1. AIU
  2. MU
  3. OMIG Auditor
  4. Documentation
  5. Hospital-Based
  6. Child Health Plus
  7. Appeal
  8. Self-Report
  9. Patient Volume
  10. Audit Failure
  11. Exclusion(s)

1. AIU

Contents

1.1 Are the auditors particular about the options for attesting to adopt, implement, and upgrade (AIU)? For example, if a provider clicked on implement, but actually adopted the EHR, will that be an issue in any way?

Published: 05/14/2014

Updated: 11/20/2014

Providers are required to submit documentation to support their attestation. If during the audit process it is uncovered that an incorrect selection was made for adopt, implement or upgrade (AIU), the auditor will communicate this with the provider. Any errors in attestations made by the providers will be reviewed on a case-by-case basis at the discretion of OMIG management.

1.2 Does OMIG offer support for large organizations that are attesting for AIU?

Published: 06/04/2015

Updated: 06/04/2015

Providers with questions while attesting should contact the NY Medicaid EHR Incentive Program Support team at:

Email: hit@health.ny.gov

Phone Number: 877-646-5410 Option #2
Providers with questions specific to Medicaid EHR Incentive Program Audits should contact the OMIG auditing team at:

Email: hitech@omig.ny.gov

Mailing Address:

NYS Office of the Medicaid Inspector
General Division of Medicaid Audits
Attn: EHR Incentive Program Audits 800 North Pearl Street Albany, New York 12204
|top of section 1.| |top of page|

2. MU

Contents

2.1 What will happen in a Meaningful Use audit if a provider working at multiple locations did not realize he/she had to combine the data?

Published: 06/04/2015

Updated: 02/28/2020

During an audit, providers must submit documentation to support their Meaningful Use measures from all locations equipped with certified EHR technology, even if the additional locations were erroneously not included in the providers´ attestation.

Please refer to the CMS Guide for Eligible Professional Practicing in Multiple Locations.

2.2 Are Clinical Quality Measures being audited, or are only Core & Menu Measures being audited?

Published: 02/06/2015

Updated: 02/06/2015

Audits of a provider´s first Meaningful Use payment will focus on Core and Menu Measures. OMIG reserves the right to request supporting documentation for all measures and CQMs attested to.

2.3 How are Core measures such as Drug-Drug/Drug-Allergy Interaction Checks (Core 2) and Clinical Decision Support Rule (CDS) (Core 11) audited? How can "yes/no" measures be satisfied during an audit? Is a statement from the EHR vendor sufficient? What are examples of "proof" that are acceptable?

Published: 02/06/2015

Updated: 02/06/2015

Proof that the functionality was available, enabled, and active in the certified EHR system for the duration of the EHR reporting period will be requested. Providers are advised to retain electronic date-stamped screen shots displaying that the functions were enabled during the EHR reporting period. Additionally, providers should be prepared to produce any source reference documentation used at the time of their attestation for the attested-to measure(s).

2.4 What do auditors expect to see for public health measure documentation?

Published: 06/04/2015

Updated: 06/04/2015

The provider should retain all correspondence with the public health registries. Submission letters stating that the provider was in active engagement during the EHR reporting period will be required. Providers must provide documentation of meeting two public health measures for 2015-2017 MU attestations. Specific exclusions may apply. Please visit the below for further details about meeting these measures:

https://www.health.ny.gov/health_care/medicaid/redesign/ehr/audit/aiu_mu.htm

|top of section 2.| |top of page|

3. OMIG AUDITOR

Contents

3.1 Does a practice have a contact person at OMIG?

Published: 05/14/2014

Updated: 05/14/2014

Each audit is assigned a specific auditor who will serve as the main point of contact throughout the course of the audit. The auditor´s contact information (name, phone number, email, address, and drop box link) is listed in the Audit Notification Letter. The provider, or an appointed contact person, should reach out to the assigned auditor with any questions.

3.2 How are providers contacted when they are chosen for a Meaningful Use audit?

Published: 03/16/2015

Updated: 03/16/2015

Each provider selected for audit is sent an Audit Notification Letter via certified mail. An auditor will follow up with providers via email to confirm receipt.

3.3 How are providers chosen for an audit?

Published: 02/06/2015

Updated: 02/06/2015

Any provider who received an EHR incentive payment for either the Medicare or Medicaid EHR Incentive Program may be subject to an audit. Audit candidates will be identified using a variety of analytical tools, data mining techniques, and random selection.

3.4 How will Meaningful Use audits be conducted? Who will conduct the audits?

Published: 02/06/2015

Updated: 02/06/2015

Audits will be conducted by the New York State Office of the Medicaid Inspector General. Auditors will review provider-submitted documents to support all attested to Meaningful Use measures and eligibility requirements. In some cases, the audit will include an on-site review at the provider´s location, for a demonstration of the EHR system and to verify Meaningful Use.

3.5 What is the typical duration of an audit for small practices/large practices? How long does it take for a practice to be notified of a "pass/fail" audit?

Published: 05/14/2014

Updated: 05/14/2014

Once an initial Audit Notification Letter has been mailed to the point of contact listed on the signed attestation, no fewer than 30 calendar days are provided to supply the requested documentation. If additional time is needed to compile the information pertinent to the audit, a deadline extension may be requested by the provider. The approval of the extension will be at the discretion of the audit staff assigned to the particular audit and OMIG management. After the auditor has received all necessary information, he or she will spend time analyzing it to ensure that it is compliant with all program requirements. The practice will be notified of the audit´s pass/fail status as soon as the auditor has reached a decision and forwarded the audit through the standard approval process. Many factors affect the duration of an audit, so a "customary audit duration" does not exist.

|top of section 3.| |top of page|

4. DOCUMENTATION

Contents

4.1 If a provider passes a Pre-Payment Validation, can he/she get the file from that and submit it to OMIG?

Published: 06/04/2015

Updated: 06/04/2015

All source documentation used by providers in the completion of their attestations to the Medicaid EHR Incentive Program must be retained for a period of six years. Documentation submitted for a pre-payment validation may also be sent to OMIG during an audit; however, the provider would send this documentation with the understanding that additional documentation may be requested by the auditor.

4.2 How should providers prepare for an audit? What documentation is needed?

Published: 02/06/2015

Updated: 02/06/2015

The documentation providers may submit for AIU includes, but is not limited to: NYS professional license and registration, documentation demonstrating AIU of the certified EHR system identified by the EHR Certification Number on the attestation, signed contract with vendors, vendor invoices, payment receipts, and screenshots showing the product name and version number. A system generated report or other documentation is required to support the total Medicaid encounters and total encounters that were attested to for the 90-day reporting period.

Examples of documentation to demonstrate the MU portion of an audit include any EHR or ancillary system reports that support the conclusion that you have met one of the exclusions or objectives for attested Core or Menu measures, and/or a record to support the numerator and denominator values for the attested Menu and Core measures. Additional information may be requested as needed during the review process. The level of the audit may depend on a number of factors; therefore, it is not possible to provide an all-inclusive list of supporting documents. In preparation for a possible post-payment audit, providers should retain documentation to support all attestations for no less than six years after each payment year.
Please visit the below for more information:

https://www.health.ny.gov/health_care/medicaid/redesign/ehr/audit/aiu_mu.htm

4.3 How does a provider who left a larger group get the documentation to show the financial commitment to the EHR system?

Published: 05/11/2015

Updated: 05/11/2015

The provider would need to work with the vendor or previous group to obtain the required supporting documentation.

4.4 How should HIPAA-sensitive documentation be sent to OMIG?

Published: 05/14/2014

Updated: 05/14/2014

HIPAA-sensitive information can be sent in any secure method of the provider´s choosing, such as encrypted email or certified mail. We highly recommend using OMIG´s secure HIPAA compliant drop box known as Hightail. This drop box will allow supporting documentation to be uploaded securely to the auditor.

4.5 Will all of my documents be saved from previous audits if I am audited for MU?

Published: 05/14/2014

Updated: 05/14/2014

Documentation from previous audits will be retained. The documentation that was used for an AIU audit can be used again for an MU audit if relevant. All supporting documentation should be retained for each attestation for six years after each payment.

4.6 If a provider uses an incorrect CMS EHR Certification ID for his/her attestation but he/she is using a certified EHR, and can prove it, will he/she pass an audit? For example, if a provider accidentally used a 2011/2014 combination or 2014 certification ID instead of the simple 2011 certification, or if he/she used the correct vendor/product, but incorrect version number.

Published: 03/16/2015

Updated: 03/16/2015

During an audit, providers will be required to submit documentation to support their attestation. If, during the audit process, it is uncovered that an incorrect selection was made for the Certification ID, the auditor will communicate this to the provider and request an explanation of the circumstances surrounding the error. Any errors in attestation values will be reviewed on a case-by-case basis at the discretion of OMIG management.

4.7 What documentation do Eligible Professionals and Eligible Hospitals need to submit to demonstrate that they qualify for the CMS 2014 CEHRT Flexibility Rule?

Published: 06/04/2015

Updated: 06/04/2015

Eligible Professionals and Eligible Hospitals are required to retain documentation that clearly demonstrates that due to delays in 2014 Edition CEHRT availability, they were unable to fully implement 2014 Edition CEHRT.

Examples that do not count as delays in availability include:

  • Financial Issues - The inability to meet the costs associated with implementing, upgrading, installing, testing, or other similar issues of a financial nature, do not qualify the provider to use the options outlined in the CMS 2014 CEHRT Flexibility Rule.
  • Difficulty Meeting Measures - Issues related to meeting meaningful use objectives and measures do not constitute an inability to implement 2014 Edition CEHRT fully. Providers who simply cannot meet one or more measures cannot use the options and must attest to their stage of meaningful use using 2014 Edition CEHRT as originally intended.
  • Staffing Issues - Staff turnover and changes, as well as any other similar situations, are considered normal situations during the course of business and are, therefore, insufficient grounds for a provider to use the options.
  • Provider Delays - Situations stemming from providers´ inactions or delays in implementing 2014 Edition CEHRT are not sufficient cause to use one of the options. Other disqualifying situations include providers waiting too long to engage a vendor or a provider´s inability or refusal to purchase the requisite software update.

For reference, please see 42 CFR §495.8 (a)(2)(i)(D)

|top of section 4.| |top of page|

5. HOSPITAL-BASED

Contents

5.1 Do auditors ask for documentation regarding inpatient and outpatient encounters?

Published: 05/11/2015

Updated: 05/11/2015

Yes. If Medicaid claims data shows a provider as hospital-based, the EP must provide documentation to support all Medicaid encounters for the entire year preceding the payment year, to determine if a provider is considered hospital-based. Encounters must be clearly marked Medicaid inpatient encounters, Medicaid emergency department encounters, and Medicaid outpatient encounters. Your auditor will provide you with a spreadsheet that must be completed. Failure to provide this information will result in an audit determination made solely on Medicaid claims data.

5.2 What is the look-back period for hospital-based documentation?

Published: 06/04/2015

Updated: 06/04/2015

All eligible professionals (EPs) participating in the Medicaid EHR Incentive Program must render less than 90 percent of his/her covered Medicaid services in the inpatient (IP) and emergency department (ED) settings. Hospital-based refers to Medicaid services only. For example, a provider attested to payment year (PY) 2014 would make his/her determination based on the total covered Medicaid IP and ER services against the total covered Medicaid services for the 2013 calendar year (1/1/13-12/31/13). Non-Medicaid encounters are not included in the hospital-based determination.

|top of section 5.| |top of page|

6. CHILD HEALTH PLUS

Contents

6.1 Why is Child Health Plus not included as a Medicaid patient encounter for the Medicaid EHR Incentive Program?

Published: 05/14/2014

Updated: 05/14/2014

The reason Child Health Plus is not included as a Medicaid patient encounter is that funding for the Child Health Plus program does not come from Title 19, which funds the Medicaid program. Child Health Plus is funded by the Children´s Health Insurance Program (CHIP), which is funded by Title 21, making it not funded by Medicaid. Since the Child Health Plus program is not funded by Title 19 (Medicaid Funding) it cannot be considered a Medicaid patient encounter.

6.2 In what situation can Child Health Plus be included as a Medicaid patient encounter for the EHR Incentive Program?

Published: 05/14/2014

Updated: 11/20/2014

In order to count Child Health Plus encounters, an EP must practice predominantly as part of a Federally Qualified Health Center (FQHC) or Rural Health Center (RHC). The Social Security Act at section 1905(l)(2) defines an FQHC as an entity which:

"(i) is receiving a grant under section 330 of the Public Health Service Act, or (ii)(I) is receiving funding from such a grant under a contract with the recipient of such a grant, and (II) meets the requirements to receive a grant under section 330 of the Public Health Service Act, (iii) based on the recommendation of the Health Resources and Services Administration within the Public Health Service, and is determined by the Secretary to meet the requirements for receiving such a grant, including requirements of the Secretary that an entity may not be owned, controlled, or operated by another entity; or(iv) was treated by the Secretary, for purposes of Part B of title XVIII, as a comprehensive Federally-funded health center as of January 1, 1990, and includes an outpatient health program or facility operated by a tribe or tribal organization under the Indian Self-Determination Act or by an urban Indian organization receiving funds under Title V of the Indian Health Care Improvement Act for the provision of primary health services."
|top of section 6.| |top of page|

7. APPEAL

7.1 What are the details of the appeals process for providers who disagree with the outcome of their audit? Can providers appeal a failed audit?

Published: 05/14/2014

Updated: 05/14/2014

If a provider chooses not to settle through repayment, they have the right to challenge findings by requesting an administrative hearing. Issues raised shall be limited to those relating to determinations contained in the Final Audit Report. Providers may only request a hearing to challenge findings that they challenged in a response to the Draft Audit Report. A hearing request may not address issues regarding the methodology used to determine any rate of payment or fee. Providers must make a request for a hearing, in writing, within 60 days of the date on the Final Audit Report..

|top of section 7.| |top of page|

8. SELF-REPORT

Contents

8.1 What should a provider do if he/she realizes that they´ve falsely attested?

Published: 05/14/2014

Updated: 03/16/2015

If a provider wishes to self-report that they have falsely attested, prior to receiving an Audit Notification Letter, they should contact the NY Medicaid EHR Incentive Program Support Team at 1-877-646-5410 (option #2), or email HIT@health.ny.gov for assistance. If, based on an audit, a provider is found not to be eligible for an EHR incentive payment, the payment will be recouped, and the providers will be ineligible to re-attest for that payment year.

8.2 If a provider cannot provide documentation, can they return the funds and re-attest?

Published: 05/11/2015

Updated: 05/11/2015

No. The provider cannot self-report once an Audit Notification Letter has been issued. However, if a provider is found to be ineligible for payment due to audit finding(s) for a specific payment year, he/she may still participate in subsequent program participation years.

|top of section 8.| |top of page|

9. PATIENT VOLUME

9.1 How do you verify the total patient volume?

Published: 03/16/2015

Updated: 03/16/2015

Providers will be required to supply documentation containing the Medicaid and non-Medicaid encounters to which they attested. Auditors will then review and analyze this information. If, during the audit process, discrepancies in the patient volume are uncovered, the auditor will communicate this with the provider and work with him/her to determine if other forms of documentation can be provided.

|top of section 9.| |top of page|

10. AUDIT FAILURE

10.1 If a provider has to repay his/her incentive money due to a failed audit, does he/she repay the full amount of the incentive or just the amount after taxes? Assuming he/she paid taxes on the incentive in the payment year.

Published: 03/16/2015

Updated: 03/16/2015

If, during the course of an audit, a provider is found to be ineligible for payment, he/she would be required to re-pay the full amount of the EHR incentive payment for the appropriate payment year, and the provider will be ineligible to re-attest for that payment year.

|top of section 10.| |top of page|

11. EXCLUSION(S)

Contents

11.1 Why do providers have to provide a reason for the exclusion they attested to?

Published: 05/11/2015

Updated: 05/11/2015

If a provider decides to take an exclusion from any of the MU objectives, he/she should maintain documentation that supports his/her eligibility for that exclusion. Example documentation to support exclusions includes, but is not limited to, a report from the provider´s certified EHR system showing a zero denominator for the measure. If a report from the certified EHR is not available, then providers should retain any applicable documentation to confirm that they qualified for the exclusion.

11.2 If a provider says he/she is eligible for an exclusion, but in fact is not, what would happen during the audit?

Published: 05/11/2015

Updated: 05/11/2015

The provider would be allowed to provide documentation for the full measure for which the exclusion was taken.

|top of section 11.| |top of page|