Phishing

phish·ing

noun: phishing

the fraudulent practice of sending emails (and phone messages) purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.

And here I thought Phishing meant being an ardent fan of an iconic 1980's progressive rock band from Vermont! (Phish is a totally awesome band that tragically disbanded in 2004. Fortunately, they reunited and are still making music today.) Nope, as the above definition states,"phishing" refers to that odious practice of scamming e-mail recipients with the intent of separating recipients from their hard-earned money.

Phishing has been around pretty much since there's been Internet and scammers but especially for people within healthcare organizations, these e-mails are getting far more sophisticated and predatory.  TNW has an excellent article on how this area is evolving - well worth spending five minutes to read.

The worst type of malware is ransomware, which deploys nasty little programs that encrypt all the data on your computer system (or even network) and for a large fee, will let you have your data back...sometimes.  The ransoms demanded can be in the millions of dollars.

Open me please!

Messages with attachments can be a clear tell that you are being phished. Attachments can deploy all manner of nasty things like viruses, malware, and keystroke recorders. If a suspicious message has an attachment, do not click on the link to open it.

For a small fee...
The problem, though, is that the quality of phishing e-mails is improving. One trick is to send a resumé as an attachment to a reply to a legitimate job position for which the organization is advertising. The e-mail is addressed by name to the recipient and contains no obvious spelling errors or visual oddities. However, the act of opening the attachment will deploy malware, thereby holding your data hostage until an exorbitant ransom is paid.

The criminals understand, though, that most users are very skeptical of attachments at this point, so they are switching their efforts over to links (URLs) which appear to be legitimate, but point to a site which will download an infection. Ironically, they will take an e-mail from the Centers for Disease Control, copy it exactly, but just change the links to (say) updated immunization tables to point to something completely different.

There is an easy way to ascertain the Web address to which a link points: Simply hover your cursor over the link and the address will display in a pop-up window. For instance, if you hover over this seemingly innocent link, the web address should give you pause. Do this every single time you click on a link in an e-mail address.  Every single time!  You do not want to be the person responsible for bringing your organization down or costing it large sums of money!

Urgent Action Required!!!

"Your account will be suspended" "You will be arrested" "Your Social Security Number will be inactivated" All of these messages are designed to create an "Oh no!" response and get you to supply an account number, user ID, and password. Generally, legitimate companies will not require you to log into a website or otherwise divulge your password and account information.

Greetings Mr. (or Mrs.) um...um...er...What did you say your name was?

Your bank knows your name and will send e-mails that address you by your name. A scammer however, has your email address but seldom has your name. Accordingly, phishing emails will generally contain a more generic salutation like "Greetings Valued Customer" or "Dear Member".

Looks can be deceiving

Remember, phishers need you to think you are dealing with a legitimate problem and company. Therefore, any website you are directed to will probably resemble the real website of the real company. However, there is an easy way to ascertain the Web address a link points to. Simply hover your cursor over the link and the address will display in a pop-up window. For instance, if you hover over this seemingly innocent link, the web address should give you pause.

Legit and not legit

Often, to make the phishing message seem authentic, there will be genuine links sprinkled throughout the message like salt and pepper on mashed potatoes. Generally the authentic links will point to generic things like privacy policies and terms of service pages. Meanwhile, the malicious link to the spoof website is lurking within the e-mail, just a phrase or two and one mouse-click away.

I spel reel gud

Watch for grammatical, linguistic, and spelling errors as these are an indicator that the email or web page might have been put together by a phisher. Be wary of communiques with poor graphics, too.

The password is...

Readers of a certain (old!) age will recognize the above line from Password, a 1960's game show, and your blog writer probably just dated himself. However, your bank, credit union, credit card company etc will never ask you to verify or provide confidential information like passwords, Social Security number, date of birth, bank account number, and so and so forth, via an unsolicited email. 

Sadly, the basic message here is don't trust anything. But unfortunately, such is the electronic world we live in. While scammers will continue phishing (among other fraud schemes) some common sense mixed with a healthy dose of skepticism will go a long way towards fending off fraud victimhood.

MIPS 2019, 4 of 4

Today, we are going to talk about the Quality Performance Category of MIPS which represents 45% of your total MIPS score. Points-wise, Quality Performance represents the largest flapjack in the MIPS stack.

The minimum reporting requirements are 6 measures or a complete specialty set. At least one measure must be an outcome measure or a high priority measure if no outcome measure is applicable to your practice. Reporting must be over the full calendar year.

There are 250 Quality Measures to choose from, which can be daunting. However, they are sorted into 7 types of measures:

• Efficiency
• Intermediate Outcome
• Outcome
• Patient Engagement Experience
• Patient Reported Outcome
• Process
• Structure

The measures can be a mix of QMs, eCQMs, QCDRs (Registry), and Medicare Part B claims. Additionally, there are specialty sets containing measures centered around an area of specialized medicine,  i.e. Infectious Disease and Geriatrics, just to namedrop a pair. 


One bonus point can be earned per each additional high priority measure. Two bonus points can be earned per each additional outcome and patient experience measure. There are up to 10 bonus points available based on the rate of improvement compared to the previous year. The total score is determined by dividing the points earned by the maximum points you could achieve.

Quality Performance is a complex category and this blog is not intended to be an all-encompassing definitive authority on the subject. For details, we strongly suggest you utilize the following CMS resources:

• https://qpp.cms.gov/mips/quality-measures
• https://qpp.cms.gov/mips/explore-measures/quality-measures?py=2019#measures (for details, including all specifications, quality benchmarks, etc.)
• https://qpp.cms.gov/about/resource-library (for even more resources)

Looking ahead to next year, now is the time to look at measures desired for next year, to be sure programming support is available and the Quality Measure screen is set up for your practice. As always, contact Client Services for assistance.

Blog posts in this series:

Part 1 (Overview of 2019 MIPS)
Part 2 (Promoting Interoperability)
Part 3 (Health Information Objective )
Part 4 (Quality Performance Category)

MIPS 2019, 3 of 4

In our last post we did an overview of Promoting Interoperability (PI) and its objectives. However, there are some major changes in the Health Information Objective measures, particularly in how they are scored. Since this particular objective can generate up to 50 points of your PI score (if you claim an e-Prescribing exclusion) a little more detail and explanation is warranted.

The biggest change for 2019 is that the scoring is percentage based, meaning that you'll need to send as many CCDs via Direct Message as possible, as well as incorporating all that you receive electronically. Detailed instructions are below.

There are two measures in the objective:

• Support Electronic Referral Loops by Receiving and Incorporating Health Information
• Support Electronic Referral Loops by Sending Health Information

We will discuss what to do about each measure in turn.  But first, if you have any questions about the meaning of terms like CCD or Direct Message or you're wondering how to get a Direct Messaging address, or how to get the addresses of other providers, please ask the question in the comments section - if you are wondering, so are others.


Support Electronic Referral Loops by Receiving and Incorporating Health Information

Scoring: 20 points

Scoring Formula:

(Number of CCDs incorporated into AuroraEHR)

---

(Number of CCDs you receive electronically)

You need to be sure that you receive at least one referral or transfer of care in a structured format (CCD) via Direct message.  This might involve reaching out to your referrers, but remember they are probably also working to reach their MIPS goals. They should be happy to cooperate with you, since this will help them on the Sending measure within this objective.

You can find out if you have any incoming Direct messages in two ways.  We suggest that you either use the first option or make a staff member responsible for doing a check using the second method every day.

•  AuroraEHR -> Task View:  The second option on the screen is External Alerts - my Direct (secure) Messages.  You could check this toggle box, save the default with the red heart button, and make the Task View run automatically every time you log in.  This way you'll never miss an incoming message.
• AuroraEHR -> Secure MD Toolbox Messages:  As soon as you enter this screen, the system will check for any new Direct Messages and display them to your screen.

When you do receive a message with an attached CCD (structured clinical data) follow these steps.

• One way or another, you'll be in the Secure MD Toolbox Messages screen.
  

• In the grid, select the the new message. Look under the Added to Chart column on the far right to see if it's been processed yet.

• Select the Add to Patient's Chart tab and press the Add to Chart - Pick Account button. You'll need to match the incoming message to a patient already in your system.  Part of the incoming message should be identifying information about the patient, and AuroraEHR can often make the match for you.

• The CCD itself will be saved in the patient's Outside Reports, but in order to make it truly useful, you'll need to reconcile problems, allergies, and medications between the incoming record and the information (if any) already in your system. 

Support Electronic Referral Loops by Sending Health Information

Scoring: 20 points.

Scoring Formula:

(Number of  referrals/transitions of care you send via Direct Message)

---

(Number of referrals/transitions of care you perform)

Here are some notes and steps to follow:

• The Continuity of Care you send must include all the patient's clinical data, including your assessment and plan. This means that your progress note (or other free text notes) should be complete before sending.
• It must include information about medications, allergies, and problems.  It's OK to use the Allergies screen to indicate "no known allergies", but not to skip the allergy task altogether, etc.
• Therefore, a Direct Message should be sent right before or right after completing the encounter. We suggest that you add (or ask Client Services to add) a Send Direct Message task to your AuroraEHR task list and that Mark as done automatically after running this task is NOT checked.  This is the biggest change you'll need to make in your work flow.
• This new task will take you to the Direct Message screen, where you can send either a referral or a Continuity of Care message.  You can also add any other files you wish, such as an image file or a PDF with lab results:

• Important: Do not add private information to the Subject. This line is not encrypted and any sensitive information will display there for any hacker to see. You can add sensitive and private material to the Message box which is safely encrypted.  The patient's name and date of birth is entered for you as a default.
• When you press the Send button, AuroraEHR will display a pop-up message letting you know if the Direct Message was sent successfully or not.
• Note: The message is not sent until you press the Send button. If you forget to to do so, you will not get credit for this measure.

Make sure to complete the Providers Orders/Notes (or similarly named) task for every referred patient to get the full 20 point credit for this measure.

Blog posts in this series:

Part 1 (Overview of 2019 MIPS)
Part 2 (Promoting Interoperability)
Part 3 (Health Information Objective)
Part 4 (Quality Performance Category)

MIPS 2019, 2 of 4

Promoting Interoperability (PI) is not the biggest piece of the 2019 MIPS pie, but it still represents 25% of the total MIPS score which, in turn, determines the amount of your Medicare payment adjustment in 2021. PI is the category with the largest requirement changes from last year. There's a great deal to cover, so without further preamble, here goes:

Category: Promoting Interoperability (PI)
Weight: 25% of total MIPS score

Web Resources: 

• Overview with links to detailed information 
• The overview has a link at the bottom to a PDF with more detail, titled 2019 Promoting Interoperability Information Blocking Fact Sheet. (This is misleading, the "Blocking Fact" part of the title appears to be a mistake on the web page - just click on it to get the 2019 Promoting Interoperability Fact Sheet.  Interestingly, this is not the only confusing thing we'll cover in this post!)
  
• To explore measure specifications, click on Explore Measures in the box labeled View Promoting Interoperability Measures, found about halfway down the page.

Reporting Period: 90 or more continuous days during 2019, which means that the last possible day to begin is October 3, 2019.

Scoring: 110 points possible, capped at 100, scored as a % of 25 total MIPS points.  Example: if your score in this category is 80%, you'll get 20 points for the Promoting Interoperability category (80% of 25 points) to add to your MIPS score.  Confused yet?  If so, just ask us for help, or simply try to maximize your PI score.

MANDATORY ATTESTATIONS

Mandatory Attestations are the first part of your reporting. We're giving only a very rough summary here; please look into them further using the Web Resources above.

• Prevention of Information Blocking: All AuroraEHR users should be able to submit a "yes", basically agreeing that there was no disabling of the EHR to prevent information sharing, that a patient portal and Direct messaging were used, and that you responded in good faith to retrieve/exchange EHR data, including patients and other providers.
• ONC Direct Review Attestation: A "yes" essentially means that you agree to cooperating with ONC in evaluating CEHRT or use of CEHRT.
• Security Risk Analysis in 2019:  You must submit a "yes", which means that you must perform a security risk analysis.
• This is unscored, but it is mandatory.  If you can't submit "yes" then you will score zero points for Promoting Interoperability as a whole, regardless of how well you have done in its other measures.
• You can download the Security Risk Assessment Tool which should be of help.

 OBJECTIVES

Important:  It is a requirement that measures must be reported from each of the 4 objectives, even if what you report is an exclusion. Failure to to report for a single objective will result in a zero score for the entire Promoting Interoperability Category, no matter how well you have performed in the other three objectives.

e-Prescribing: 

• Scoring: 10 points, plus up to 10 bonus points. If exclusions are claimed, then the points get allocated to Health Information Exchange. 
• Exclusion: There is an exception for clinicians writing fewer than 100 prescriptions during the performance period.
• Measure 1: e-Prescribe. You're scored on the percentage of all prescriptions that you write which were done electronically.  For AuroraEHR clients, you would use Rcopia.
• Measure 2: PDMP Query. This is optional, but you get 5 bonus points for completing this.  Talk to us about making this available through Rcopia if it's possible to do for your state.  The sooner the better, since there are setup and registration steps involved.
• Measure 3: Verify Opioid Treatment Agreement. Also optional, worth 5 bonus points.

Provider to Patient Exchange:

• Scoring: 40 points, by performance rate
• You must provide patients electronic access to their health information via an available API or a patient portal, in a timely way.
• Patients must be able to view, download, or transmit their information.
• You'll meet this measure by completing encounters in a timely way, which will automatically upload the required information to Bridge. 

Health Information Exchange:

• Measure 1: Support Electronic Referral Loops by Receiving and Incorporating Health Information: 
  
• Scoring: 20 points, based on the percentage of electronic summary of care records received for which clinical information reconciliation was performed.
• An exclusion exists for clinicians/groups with less than100 transitions of care/referrals/new patients. If reporting as a group, this means the entire group received less than 100 transitions of care/referrals/new patients.
• You must receive at least one CCDA and do a clinical information reconciliation.
• You can do this through the menu option AuroraEHR ->  Secure MD Toolbox Messages.
•  Measure 2: Support Electronic Referral Loops by Sending Health Information
• Scoring: 20 points, based on the percentage of summary of care records you sent which were sent via Direct message.
• An exclusion exists for any MIPS-eligible clinician/group who transfers a patient to another setting or refers a patient fewer than 100 times during the performance period.
• Doing this is an important part of your success, but will involve some changes in the way you finish encounters.  Part 3 of this series will delve into this measure in more detail.

Public Health and Clinical Data Exchange: - Report on two measures from this objective. If you claim an exclusion, the points are reallocated to the Provider to Patient Exchange objective.

• Scoring: 10 points
  
• Immunization Registry Reporting
• Syndromic Surveillance Reporting
• Electronic Case Reporting
• Public Health Registry Reporting
• Clinical Data Registry Reporting  

Four 2018 measures were removed:

• Patient-Specific Education
• View, Download, or Transmit (VDT)
• Secure Messaging
• Patient-Generated Health Data

Blog posts in this series:

Part 1 (Overview of 2019 MIPS)
Part 2 (Promoting Interoperability)
Part 3 (Health Information Objective )
Part 4 (Quality Performance Category)

MIPS 2019, 1 of 4

Well, it is mid-September 2019 and in three months, the year will come to an end. That means we should talk about MIPS, since the current reporting period closes at year's end. It would behoove us all to review the requirements, since the 2019 scores will determine the 2021 MIPS Payment Adjustment for each clinician/group/provider.

Let's start with some basics. Your total MIPS score is determined by the four performance categories listed below (along with the weight of each category in the final score):

• Quality Measures (45% of total score) 
• Promoting Interoperability (25%)
• Improvement Activities (15%)
• Cost (15%)

For today, we are just presenting a summary of all of the performance categories and their respective highlights. Each performance category will (very soon!) be covered in other blog posts.

Quality Measures (45% of total score)

• Quality Measures must be reported over the entire year, not 90 days.
• Reporting should be done on 6+ measures or a complete specialty measure set.
• You can mix and match four different types of quality measures, but one of the selected measures should be an outcome or priority measure. 
• There are ways to get bonus points which will be covered in part 4 of this series.
• Resources:
• https://qpp.cms.gov/mips/quality-measures for an overview
• https://qpp.cms.gov/mips/explore-measures/quality-measures?py=2019#measures for details, including all specifications, quality benchmarks, etc.)
• https://qpp.cms.gov/about/resource-library for even more resources

Promoting Interoperability (Reporting on EHR usage - 25%)

• The reporting period is for at least 90 continuous days in 2019. 
• Reporting is required on all measures except for two bonus e-prescribe measures.
• There are some attestation questions and four main objectives:
• e-Prescribing (10 points + 10 bonus points)
• Provider to Patient Exchange - essentially your patient portal (40 points)
• Health Information Exchange (40 points)
• Most AuroraEHR users will claim exclusions for e-Prescribing and Data Exchange, moving some points to this objective.
• This area will include the biggest differences from 2018, and will mean some changes in the way you use AuroraEHR to exchange structured clinical data with referring providers.
• Part 3 of this series will go into detail about exactly what you need to do to maximize your points.
• Reporting to registries (10 points)
• Details about the objectives and measures will be covered in part 2 of this series.
• Important: If you skip reporting on a single one of the required measures (without claiming exclusions), the entire score for Promoting Interoperability is 0!
• Four measures have been removed:
• Patient-specific education
• View, download, or transmit (VDT)
• Secure messaging
• Patient-generated health data
• Resources:
•  https://qpp.cms.gov/mips/promoting-interoperability
• Go to https://qpp-cm-prod-content.s3.amazonaws.com for measure specifications.

Improvement Activities (15%)

• Activities must be performed for 90+ continuous days in 2019.
• High-weighted activities receive 20 points and medium-weighted activities receive 10 points.
• You must report with one of these combinations of weighted activities:
• 2 high-weighted
• 1 high-weighted and 2 medium
• 4 medium
• Resources:
• https://qpp.cms.gov/mips/improvement-activities

Cost (15%)

• There are no reporting obligations for this objective, because the cost data is automatically calculated by CMS based on submitted Medicare claims.
• Resources at https://qpp.cms.gov/mips/cost 

We've covered a lot here and we will take an in-depth look at the areas relating to AuroraEHR over the next three blog posts. If there is anything we can do to help or if you have any questions, feel free to reach out to Client Services.

Blog posts in this series:

Part 1 (Overview of 2019 MIPS)
Part 2 (Promoting Interoperability)
Part 3 (Health Information Objective )
Part 4 (Quality Performance Category)

Rcopia 4

Our e-Prescribe partner, DrFirst, recently certified us for Rcopia 4 and you can find us doing the happy dance in our programming cave! Of course, along with the certification comes a lot of behind-the-scenes work so we'll stop dancing and get back to our computers and start laboring away at getting all our AuroraEHR clients updated and brought into the Rcopia 4 fold.

Many of the new features are a bit on the wonky side, like complying with CMS Script 2017 mandates and deadlines. However, Script 2017 is kind of a big deal as there is a January 1, 2020 deadline attached to compliance with the new requirements. DrFirst has already been certified for Script 2017, well in advance of the January 2020 compliance date.There are several other more obvious features in Rcopia 4 and we'll mention a few of them here.

Rcopia 4 offers Electronic Prior Authorization (hereafter referred to as EPA, because we all like acronyms) which will streamline prescription and renewal processes,  and avoid that always unpleasant situation where a patient runs out of medication and has to wait (without medications) for an authorization.

Prescription drug abuse has become a thing over the last decade or so. Accordingly, many states have implemented prescription drug monitoring programs (PDMP) databases, each with different requirements, layouts, and technologies. Lately, the federal government has regulated electronic prescriptions for controlled substances (EPCS) in an attempt to combat the opioid epidemic. While compliance with EPCS is not mandatory, it nonetheless cuts down on prescription abuse by eliminating paper prescriptions. More and more pharmacies are using EPCS and it's the wave of the future. At any rate, DrFirst has implemented the EPCS and PDMP (for all states that have them) requirements and features thereof in Rcopia 4. (For DrFirst's interactive map of PDMP and EPCS status for each state, click on this link).

We will be contacting our Rcopia users one by one to implement the switch-over from Rcopia 3 to Rcopia 4. We will also work with DrFirst to provide training and support as we integrate the new version of Rcopia.

With the ever increasing complexity in prescribing medications, a program such as Rcopia 4 is a valuable asset. If you feel that e-prescribing might help your practice, contact Client Services about upgrading to AuroraEHR.