Promoting Interoperability

CMS Adds Cyberattack Hardship Option to MIPS EUC

Due to the ongoing impact the Change Healthcare Cyberattack has had on physician practices, CMS has added an option to cite the cyberattack when requesting the 2024 Merit-based Incentive Payment System (MIPS) Extreme and Uncontrollable Circumstances (EUC) hardship exception.

To account for the increased number of physicians that have been impacted by a cyberattack this year, CMS has specifically added a drop-down tab in the application to indicate the EUC is due to the Change cyberattack. When in the EUC portal, physicians should select the event type as “ransom/malware”. Once a physician clicks on the event type “ransom/malware” a drop-down box will appear asking whether the event pertains to the Change Healthcare Cyberattack. Reference page 8 in the 2024 MIPS EUC Application User Guide for more details. The 2024 MIPS EUC portal is now open, and physicians have until December 31, 2024, to file a hardship application and avoid a 2026 MIPS negative payment adjustment.

When applying for a hardship, physicians have the option to request reweighting of up to four MIPS categories. Reweighting of all performance categories will result in avoiding a MIPS penalty of up to -9 percent in 2026. As a reminder, if a physician or group submits data, it will override the hardship exception and the physician or group may be scored.

How Do I Meet the PI Requirements?

To meet the requirements of the PI category, an EHR is required.

• If you do not currently use an EHR, you will have to select, purchase, and implement an EHR. Be sure the product you select is certified. TMA has numerous resources to help practices with selection.
• If you currently use a certified EHR, check with your EHR vendor to ensure the product you use meets the ONC health IT certification criteria. View the list of certified products here.

2024 PI Objectives and Measures

For 2024, eligible clinicians must use technology that meets the ONC health IT certification criteria.

Participants must submit collected data for certain measures from each of the measures (unless an exclusion is claimed) for 180 continuous days or more during 2024. It was previously 90 days with 2024 being the first year that the data collection requirement is increased to 180 days.

In addition to submitting data on the measures, clinicians must positively attest to:

• The Actions to Limit or Restrict Compatibility or Interoperability of CEHRT Attestation,
• The ONC Direct Review Attestation,
• Completing or updating the security risk analysis, and
• Submit a "yes" to Safety Factors for EHR Resilience (SAFER) Guides, High Priority Practices.
  
  

• View the 2024 measures at-a-glance.

• Additional information and measure specifications may be found on the Quality Payment Program’s Promoting Interoperability page.

Resources for Objectives and Measures

Use the following resources to meet the PI objectives and measures. 

E-prescribing

• TMA E-prescribing Resource Center
• Texas Prescription Monitoring Program (Online Registration) - Texas State Board of Pharmacy

• Texas PMP Requirements: Who, What, When, and How (TMA Webinar)

• Sample Opioid Treatment Agreement (Texas Pain Society)
  An informed consent and opioid treatment agreement is a contract between a doctor and a patient. The goal of the agreement is to ensure that patients who are taking opioid drugs do so exactly as their doctor has prescribed. This sample agreement can be used as a template for your practice. Once it is signed, be sure to incorporate it into the patient’s record in the EHR. Thank you to the Texas Pain Society for allowing TMA to link to the sample agreement.
  
  

Health Information Exchange

• TMA Health Information Exchange Resource Center
  
  

Provider to Patient Exchange

• Patients, Portals, and PHRs
  
  

Public Health and Clinical Data Exchange

• Immunization Registry Reporting (Immtrac)
• Public Health Registry Reporting (Texas Cancer Registry)
• Clinical Data Registry Reporting
  Check with your specialty society for clinical data registries applicable to your specialty.
• Syndromic Surveillance Reporting
  DSHS is only accepting syndromic surveillance reporting registrations from hospitals, and professionals in urgent care centers or free-standing emergency centers at this time.
  
  

Security Risk Analysis

• Security Risk Analysis Is Not a Do-It-Yourself Project (Texas Medicine, Aug. 2019)
• Free Security Risk Assessment Tool (HealthIT.gov)

Reporting Options

Notes: 

• Be sure to ask your EHR vendor about MIPS reporting options.
• You don’t have to use the same reporting mechanism for all MIPS categories. For example, you can report PI via attestation, but submit quality measures via a qualified registry. 
• When using the Group Reporting option, you must use the same identifier for all reporting methods. For example, you cannot individually report PI and then group report quality measures.

Don't Forget About Audits

CMS could tap you for a MIPS audit in the future. Here are some things to know to prepare your practice.

• Document everything (take screen shots)
• Maintain documentation for 6 years
• Maintain practice email addresses for notification
  
  

Yes, You Do Have to Comply With a MIPS Audit Request Texas Medicine Today, Aug. 14, 2019

Audit Readiness – What You Need to Know (TMF Quality Innovation Network)

Learn More About Audit Documentation