OIG to beef up EHR, MU scrutiny

The Department of Health and Human Services Office of Inspector General (OIG) plans to significantly beef up its scrutiny of EHRs, according to its 2015 work plan.

EHRs is a new focus area in the plan which also continues most of OIG's EHR-related reviews from last year but, for the first time, will review hospitals' EHR contingency plans.

"We will determine the extent to which hospitals comply with contingency planning requirements of the Health Insurance Portability and Accountability Act [HIPAA]," according to the plan. "We will also compare hospitals' contingency plans with government- and industry-recommended practices. The HIPAA Security Rule requires covered entities to have a contingency plan that establishes policies and procedures for responding to an emergency or other occurrence that damages systems that contain protected health information." 

OIG already has been working on reviews that determine whether providers that received Meaningful Use (MU) incentive payments were entitled to the money; the success of Centers for Medicare & Medicaid Services (CMS) oversight of MU payments; CMS oversight of hospitals' security controls over networked medical devices integrated with EHR systems; and whether covered entities and business associates are adequately securing electronic patient protected helath information created or maintained by certified EHR technology.

Access the 2015 work plan.