On March 1st, 2024, according to the Pennsylvania Broadband Development Authority, more than 276,000 households, businesses, schools, and libraries do not have access to broadband internet (PBDA, 2024a). For practices with patients who struggle with access to the internet due to living in a rural area or being unable to afford the internet, progress and hope have been made to help resolve these issues.

Click here to learn more.

The Change Healthcare cybersecurity attack continues to rock the healthcare community. PAMED will continue to share resources as they are available.

Click here to learn more.

For the first time, the USPSTF is recommending young and middle-age adults, especially pregnant and postpartum women, should be regularly assessed for anxiety and depression, even if they don’t have symptoms.  The recommendation was published Tuesday in JAMA, the American Medical Association’s journal.  The new guidelines affect asymptomatic adults ages 19 through 64.

The Preventive Services Task Force is an independent panel of doctors and other experts appointed by the Department of Health and Human Services to evaluate care aimed at prevention or early detection.    

You can find the USPSTF Bulletin here:  https://www.uspreventiveservicestaskforce.org/uspstf/sites/
default/files/file/supporting_documents/sads-adults-final-rec-bulletin.pdf

CMS has released a Proposed Rule to amend regulations to the Medicare Advantage (Part C) and Medicare Prescription Drug Benefit (Part D) plans. The rule changes would increase beneficiary protections, promote healthy competition, improve access to care, and promote equity in coverage and care.

The Proposed Rule aims to help people with Medicare to select and enroll in coverage options that “best meet their health care needs by preventing plans from engaging in anti-competitive steering of prospective enrollees based on excessive compensation to agents and brokers, rather than the enrollee’s best interests”.

Additionally, the Rule would strengthen network adequacy requirements and improve access to behavioral health care services by adding a new facility category called “Outpatient Behavioral Health” to CMS’ Medicare Advantage network adequacy requirements.  Specialists under this category include marriage and family therapists, mental health counselors, addiction medicine physicians, among others who provide addiction medicine and behavioral health counseling or therapy services.

CMS is also proposing to provide more flexibility to substitute biosimilar biological products other than interchangeable biological products for their reference products to give people with Medicare more timely access to lower-cost biosimilar drugs.  Treating such substitutions as maintenance changes would mean that any substitutions would apply to all enrollees (not only those who begin the therapy after the effective date of the change) following a 30-day notice, and enrollees would have earlier access to equally effective and potentially more affordable options.

To review the complete publication, see CMS Proposed Rule.  

UnitedHealthcare will not be implementing a gastroenterology endoscopy prior authorization policy set to take effect June 1^st, 2023, and instead, will set up an advance notification process for non-screening GI procedures.  

Effective immediately, UHC will implement an advance notification process, rather than prior authorization, for non-screening and non-emergent GI procedures.  UnitedHealthcare said screening colonoscopy procedures are not subject to the advance notification process.  Find the full UHC announcement here: 

United Healthcare Gastroenterology Endoscopy Advance Notification

Novitas Solutions, the local Medicare Administrative Contractor for CMS, has fully implemented Smart Edits for their electronic billing system, originally introduced in July 2023. Additional Smart Edits will be incorporated routinely. This enhancement will alert providers of any claims that can be repaired prior to a denial. The messages will display on the 277CA electronic claims acknowledgement response report and may require the claim to be resubmitted.

The Novitas Smart Edit Lists (Smart Edit List Part B)  include the effective dates and are updated as they are introduced.  Notification of new edits will also be sent to Novitas’ email lists as notification. If you are not currently receiving those emails, join here.  

The HHS Office for Civil Rights (OCR) published two resource documents to help providers communicate telehealth privacy and security risks to their patients.  The documents are entitled “Educating Patients about Privacy and Security Risks to Protected Health Information when Using Remote Communication Technologies for Telehealth” and “Telehealth Privacy and Security Tips for Patients”. 

Patients may not want to participate in telehealth services due to privacy and/or security risks.  These documents highlight the importance of continuing the use of telehealth and, at the same time, help communicate the risks.  The two documents can be found at these links: 

The Guidance on Educating Patients about Privacy and Security Risks to Protected Health Information when Using Remote Communication Technologies for Telehealth may be found at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/resource-health-care-providers-educating-patients/index.html.

The Guidance on Telehealth Privacy and Security Tips for Patients may be found at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/telehealth-privacy-security/index.html.

For further details and background on the resources, please visit the following page from HHS: HHS OCR Resources for Health Care Providers and Patients/Telehealth Privacy and Security

Since the COVID-19 pandemic, the healthcare industry has continued to adopt different functionalities of Artificial Intelligence. As telemedicine and virtual care have been at the forefront of technology during the pandemic, Artificial Intelligence’s utilization in healthcare has exploded as well.

Click Here to Learn More

On March 1st, 2024, according to the Pennsylvania Broadband Development Authority, more than 276,000 households, businesses, schools, and libraries do not have access to broadband internet (PBDA, 2024a). For practices with patients who struggle with access to the internet due to living in a rural area or being unable to afford the internet, progress and hope have been made to help resolve these issues.

Click here to learn more.

The public health emergency expired on May 11^th, 2023, at 11:59 pm. We have entered the post-PHE world for the time being. Telehealth will have similarities to how it was during the PHE but with some changes from a regulatory standpoint. We will be covering those regulatory changes to help ensure that your practice is complying with the Department of Health and Human Services Office of Civil Rights.

During the Public Health Emergency, the requirement for Business Associate Agreements was waived. A HIPAA business associate agreement was to be required in order to comply with HIPAA regulations once the PHE ended. The reason behind the business associate agreements was to create a binding contract that would make the vendor liable for any HIPAA breach if it were to occur. During the PHE, the Department of HHS provided a list of vendors who advertised that they were HIPAA compliant and would enter into a Business Associate Agreement.¹ The following vendors listed were:

• Skype for Business / Microsoft Teams²
• Updox³
• VSee⁴
• Zoom for Healthcare⁵
• Doxy.me⁶
• Google Workspace⁷
• Cisco Webex Meetings / Webex Teams⁸
• Amazon Chime⁹
• GoToMeeting¹⁰
• Spruce Health Care Messenger¹¹

The Department of HHS did imply that the Office of Civil Rights has not reviewed the BAAs offered by these vendors and that there may be others that offer HIPAA Compliant technology and are willing to enter a BAA. To ensure that a vendor’s BAA meets HHS requirements, it would be recommended to review their definition and sample BAA provided on their site which can be found here.¹²

For guidance from HHS regarding HIPAA compliance and telehealth, here¹⁴ is a guide to compliance from the National Consortium of Telehealth Resource Centers shared by HHS. For additional information and guidance, the Department of HHS also shared a document regarding Telehealth and the HIPAA rules¹⁵.

References

1. (OCR), O. for C. R. (2021, June 28). Notification of enforcement discretion for telehealth. HHS.gov. https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html 
2. Virtual health with a HIPAA BAA in place automatically. TECHCOMMUNITY.MICROSOFT.COM. (2021, August 9). https://techcommunity.microsoft.com/t5/healthcare-and-life-sciences/virtual-health-with-a-hipaa-baa-in-place-automatically/ba-p/2621101 
3. Telehealth. Updox. (2022, August 12). https://www.updox.com/solutions/telehealth/
4. Most trusted HIPAA compliant telemedicine solution. VSee. (n.d.). https://vsee.com/ 
5. Comprehensive telehealth platform for Providers. Zoom. (2023, April 26). https://explore.zoom.us/en/industry/healthcare/ 
6. The easiest telemedicine solution. Doxy.me. (n.d.). https://doxy.me/en/providers/ 
7. Google. (n.d.). HIPAA compliance with Google Workspace and Cloud Identity. Google Workspace Admin Help. https://support.google.com/a/answer/3407054 
8. Webex. (2023, February 8). Exceptional telehealth experiences: Webex for Healthcare. Webex. https://www.webex.com/industries/healthcare.html 
9. Aggleton, P. (2015). Health. Amazon. https://aws.amazon.com/health/solutions/telehealth/ 
10. Unified Communications for Healthcare: HIPAA Compliant Video Conferencing: Goto. Healthcare | GoTo Suite. (n.d.). https://www.goto.com/healthcare 
11. Spruce Health. (n.d.). Spruce: Medical Communication. Spruce Health. https://www.sprucehealth.com/ 
12. (OCR), O. for C. R. (2023, January 17). Business associate contracts. HHS.gov. https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html 
13. (OCR), O. for C. R. (2023b, April 25). HHS Office for Civil Rights announces the expiration of COVID-19 public health emergency HIPAA notifications of enforcement discretion. HHS.gov. https://www.hhs.gov/about/news/2023/04/11/hhs-office-for-civil-rights-announces-expiration-covid-19-public-health-emergency-hipaa-notifications-enforcement-discretion.html 
14. TRC National Consortium of Telehealth Resource Centers. (2017, February 6). HIPAA & Telehealth: A stepwise guide to compliance. https://southwesttrc.org/sites/default/files/ resources/factsheets/HIPAA-Final.pdf 
15. (OCR), O. for C. R. (2022, June 10). Guidance: How the HIPAA rules permit covered health care providers and health plans to use remote communication technologies for audio-only telehealth. HHS.gov. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-audio-telehealth/index.html   

In 2022, President Biden signed off on the Consolidated Appropriations Act (H.R. 2471). A part of this act provided an extension of telehealth flexibilities for 151 days once the Public Health Emergency is declared over by the Secretary of Health and Human Services (HHS, 2023). Secretary Xavier Becerra will provide a 60-day notice of when the Department of HHS decides to end the Public Health Emergency for COVID-19. Since the recognition of a Public Health Emergency due to the Pandemic of COVID-19, the PHE has been extended up until this point. A PHE can only last for a maximum of 90 days but can continue to be extended by the Secretary of HHS.

On December 23^rd of 2022, President Biden signed HR 2617 which is recognized as the Consolidated Appropriations Act of 2023, and the Performance Enhancement Reform Act for the Fiscal Year 2023 budget. This Act provides an extension of the same telehealth flexibilities mentioned in the Consolidated Appropriations Act of 2022 till the end of the Calendar Year 2024.

Without these flexibilities, providers will not be reimbursed for these specific services beyond the end of the Public Health Emergency. The PHE created the opportunity for providers to use telehealth during a time of crisis and have extended the need for telehealth services to afford those who are effectively using these services to be able to continue without disruption or lack of reimbursement. These flexibilities are crucial to the importance of telehealth and the safety of our providers and patients. Below is a summary of the flexibilities.

The first flexibility is a temporary suspension of the geographic site requirement (HHS, 2023).  This suspension allows patients to receive telehealth services regardless of where in the United States they are located at the time of service. This allows patients to be in their homes when receiving telehealth care as well.

There was a requirement for mental health providers in which they were required to have an in-person visit with a patient within 6 months prior to seeing the patient by way of telehealth (HHS, 2023). During the PHE, this requirement was waived and is also a part of these flexibilities. Also, without the PHE being active, Federally Qualified Health Centers and Rural Health Centers would no longer be able to be reimbursed as distant site telehealth providers for non-mental health services. These flexibilities provide FQHCs and RHCs the opportunity to still provide telehealth as a distant site provider for other services outside of mental health care (HHS, 2023).

Under these flexibilities, audio-only telehealth services will continue to be reimbursed as well (HHS, 2023). Once the extension of these flexibilities is over, one will see reimbursement pulled for audio-only telehealth services for physical health, FQHC and RHC telehealth services that were rendered, and Distant-Site Telehealth services. Another change will be the in-person requirement for Mental Health services being rendered. Keep in mind that these flexibility extensions only affect those who are rendering services to Medicare patients. Most private payors have their own separate policies and make their decisions on whether to follow Medicare’s Golden standard or not.

References:

1. HHS (2023, December 19). Telehealth policy changes after the COVID-19 public health emergency. telehealth.hhs.gov. https://telehealth.hhs.gov/providers/telehealth-policy/policy-changes-after-the-covid-19-public-health-emergency 
   

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) created an opportunity for organizations to check the vulnerability of their electronic systems (CISA, 2024a). This act was signed into federal legislation to assist in the development of protecting organizations from Ransomware and cyberhackers. This service allows organizations to improve their cybersecurity around their business, which is even more important for healthcare organizations responsible for protecting Protected Health Information. The Cybersecurity & Infrastructure Security Agency (CISA) created and implemented this service.

This service is referred to as the Cyber Hygiene Vulnerability Scanning Service. The program will allow CISA to determine weak points or vulnerabilities that could expose an organization’s system to ransomware or cyberhackers. By performing this analysis, CISA is currently using a piloted program referred to as Ransomware Vulnerability Warning Pilot (RVWP), which will be able to notify those critical infrastructure entities that are at risk for possible ransomware exploitation (CISA 2023).  

CISA’s RVWP utilizes the Cyber Hygiene Vulnerability Scanning Service along with other existing data sources, technologies, and authorities to assist in determining vulnerabilities within organizations before a ransomware event occurs (CISA, 2024b). Beyond utilizing the Cyber Hygiene Vulnerability Scanning Service, CISA has another resource to help in the adoption of strong security measures on their website: https://www.stopransomware.gov

In order for an organization to use the free Cyber Hygiene Vulnerability Scanning Service to check for possible cybersecurity vulnerabilities and to prevent cybersecurity or ransomware actors from damaging your organization, you can reach out to vulnerability@cis.dhs.gov with the subject line “Requesting Cyber Hygiene Services” to get started in strengthening your cybersecurity measures within your practice(s) (CISA, 2024c).

References:

1. CISA. (2024a, January 1). Cyber incident reporting for critical infrastructure act of 2022 (CIRCIA): CISA. Cybersecurity and Infrastructure Security Agency CISA. https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia 
2. CISA. (2023, March 13). Ransomware vulnerability warning pilot (RVWP) - CISA. RVWP Fact Sheet. https://www.cisa.gov/sites/default/files/2023-03/rvwp-fact-sheet-508c.pdf 
3. CISA. (2024b, January 1). Ransomware vulnerability warning pilot (RVWP): CISA. Cybersecurity and Infrastructure Security Agency CISA. https://www.cisa.gov/stopransomware/Ransomware-Vulnerability-Warning-Pilot 
4. CISA. (2024c, January 1). Cyber Resource Hub: CISA. Cybersecurity and Infrastructure Security Agency CISA. https://www.cisa.gov/cyber-resource-hub 

On September 12^th and 13^th, the DEA hosted listening sessions revolving around the type of safeguards needed for providers to prescribe controlled substances by way of telemedicine without the in-person requirements. These sessions involved the virtual and in-person testimony of fifty-five individuals who ranged from physicians, health administrators, experts, advocates, patients, and government representatives (DEA, 2023a).

These testimonies are to assist in the development of a final rule that could determine the fate of the Ryan Haight Act. The hope is for legislation to be developed by Fall 2024. The Ryan Haight Act requires physicians to have one in-person evaluation prior to prescribing controlled substances by way of telemedicine. Originally, this act was waived until November 11^th, 2023. The DEA in conjunction with SAMHSA created a temporary rule that would extend the Telemedicine Flexibilities regarding the prescribing of controlled substances as they were in place during the COVID-19 Public Health Emergency (DEA, 2023b). This would have allowed a provider-patient relationship that was established prior to November 11^th, 2023, to be given a one-year grace period where the telehealth flexibilities would then be governed until November 11^th, 2024 (DEA, 2023c). As an update to the first temporary rule, the DEA because of the listening sessions created another temporary rule that would extend the telehealth flexibility and waive the Ryan Haight Act through December 31^st, 2024, regardless of when the relationship was established (DEA, 2023d).  

The purpose of the listening sessions was to receive public comment on the three proposed rules from March 2023 along with what safeguards should be in place to remove any possible drug diversion occurring in the event the telehealth flexibilities were made permanent. These sessions provided testimony both for and against modifying the Ryan Haight Act. Examples of representatives from organizations that testified were:

• Alliance for Connected Care
• The American Academy of Family Physicians
• The American Psychiatric Association
• The American Society of Addiction Medicine
• The American Society of Consultant Pharmacists
• The American Telemedicine Association
• Investigations Medicare Drug Integrity Contractor
• Johns Hopkins
• National Association of Community Health Centers
• PharmD
• Yale School of Medicine

Some of the testimony suggested the creation of another DEA license that was only committed to telehealth-only prescribing as a way for pharmacies to identify the type of licensure. Other testimony was against the use of creating another licensure for telehealth. Another suggestion was the method being used for drug screening patients by way of telehealth and limiting the type of controlled substances that are being prescribed under the use of telehealth without the in-person requirement.  

There were some who testified and spoke on data from research studies their organization performed or was in the middle of performing. The deputy administrator and assistant deputy administrator both asked for the study to be sent to them if/once completed. Those who testified were required to provide and spell out their first and last name as the testimony was being transcribed so that it may be involved in the determination of a final rule on this matter (DEA, 2023a). It was made clear at the beginning of both sessions that given the transcribing, presentations or visual aids would not be accepted during the testimony itself. The visual aids could be submitted just not presented. The deputy administrator and assistant deputy administrator did perform follow-up questions during some of the testimonies but made it clear that there would not be a long discussion on each testimony. The purpose of the follow-up questions was to increase clarity and understanding of the testimony that was provided. The listening sessions were recorded and can be found here.

The next steps will involve the DEA and SAMHSA coming together and determining how to proceed with their next legislation to address this situation (DEA, 2023a). They plan to open a written comment period for this rule. The hope is to release a final rule regarding the prescribing of controlled substances by way of telehealth without the in-person medical evaluation by Fall 2024. The current temporary rule has been extended through December 31^st, 2024, because of these sessions (DEA, 2023d).  

References:

1. The Drug Enforcement Agency. (2023a). Telemedicine listening session. Telemedicine Listening Session. https://deadiversion.usdoj.gov/Telemedicine_listening_session.html  
2. The Drug Enforcement Administration (DEA). (2023b). Practice of Telemedicine: Listening Sessions; Notice of Meeting. DEA. 88 Fed Reg. No. 150, 16889 (August 7, 2023). https://www.govinfo.gov/content/pkg/FR-2023-08-07/pdf/2023-16889.pdf 
3. The Drug Enforcement Administration (DEA). (2023c). Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications. DEA. 88 Fed Reg. No. 90, 09936 (May 10, 2023). https://www.govinfo.gov/content/pkg/FR-2023-05-10/pdf/2023-09936.pdf
4. The Drug Enforcement Administration (DEA). (2023d). Second Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications. DEA. 88 Fed Reg. No. 194, 22406 (October 10, 2023). https://www.govinfo.gov/content/pkg/FR-2023-05-10/pdf/2023-09936.pdf
   

On February 9^th, Doximity announced a beta (testing) application of a new program called DocsGPT (Diaz, 2023). This program is currently free and allows providers who are registered with Doximity to utilize the current Doximity e-faxing applications with assistance from ChatGPT, which is an AI (Artificial Intelligence) program (Doximity, 2024a). ChatGPT is owned by Open AI and has received increased recognition in different industries throughout the United States such as Academia, Business, and Legal industries (OpenAI, 2024). In fact, Microsoft has partnered with Open AI since 2019, with an announcement in January 2023 regarding further investment into Open AI to accelerate the current AI breakthroughs (Capoot, 2023).

In case you are not familiar with Doximity, this is a program that allows providers to perform many tasks both on phone and on the computer. Some examples are telehealth, electronic faxing, and internal and external communication among physicians (Doximity, 2024b). Doximity received the most attention during the height of the COVID-19 pandemic as an application to perform HIPAA-compliant telehealth.

Chat GPT has only been around since November 2022. This AI is referred to as an AI Chatbot and has so far passed the bar, and medical licensing examinations (Landi, 2023). There are other Chatbots that have been tested and used by healthcare organizations with success. One example is AllianceChicago, a health services organization, using an AI chatbot known as Quincy from QliqSOFT to increase child immunizations and well-child checks (AllianceChicago, 2023a)(AllianceChicago, 2023b). The hope behind DocsGPT is that it will reduce the administrative burden that providers face daily. The concern and recommendations by Doximity are that the ChatGPT is not always accurate in regard to medical citations that are involved in creating prior authorization letters to send to insurance companies. They have listed when using DocsGPT, prior to sending, “PLEASE EDIT FOR ACCURACY BEFORE SENDING”, and “Since the letter content is AI-generated, please make sure to review and ensure accuracy before you submit.” in the fax box itself (Fox, 2023).

References:

1. Diaz, N. (2023, February 14). Doximity rolls out CHATGPT integration for physicians. Becker’s Hospital Review. https://www.beckershospitalreview.com/innovation/doximity-rolls-out-chatgpt-integration-for-physicians.html
2. Doximity. (2024a, January 1). Doximity GPT. https://www.doximity.com/doximity-gpt-info 
3. OpenAI. (2024, January 1). Introducing chatgpt. Introducing ChatGPT. https://openai.com/blog/chatgpt/
4. Capoot, A. (2023, February 7). Microsoft announces new multibillion-dollar investment in CHATGPT-maker openai. CNBC. https://www.cnbc.com/2023/01/23/microsoft-announces-multibillion-dollar-investment-in-chatgpt-maker-openai.html  
5. Doximity. (2024b, January 1). The Professional Medical Network for physicians. About Doximity. https://www.doximity.com/about/company 
6. Landi, H. (2023, February 11). Doximity rolls out beta version of chatgpt tool for docs aiming to streamline administrative paperwork. Fierce Healthcare. https://www.fiercehealthcare.com/health-tech/doximity-rolls-out-beta-version-chatgpt-tool-docs-aiming-streamline-administrative
7. AllianceChicago. (2023a, November 13). Innovating for better health. https://alliancechicago.org/ 
8. AllianceChicago. (2023b, January 17). AllianceChicago publishes digital intervention study using Chatbots to increase well-child visits and immunizations. https://alliancechicago.org/alliancechicago-publishes-digital-intervention-study-using-chatbots-to-increase-well-child-visits-and-immunizations/     
9. Fox, A. (2023, February 21). DocsGPT in beta targets physician burnout. Healthcare IT News. https://www.healthcareitnews.com/news/docsgpt-beta-targets-physician-burnout 

On April 17^th, 2023, the Department of Health and Human Services (HHS) created a Cybersecurity Task Force that provides new resources to help healthcare organizations address the threat of cyberattacks and ransomware (OCIO, 2023). There are three resources that they created. The first resource is an educational platform referred to as “Knowledge on Demand”. This platform offers free cybersecurity training for health organizations so that they may improve cybersecurity awareness within their organizations. The next resource is a publication that guides standards for mitigating threats, and the awareness of cybersecurity risks, and the publication also provides best practices. This publication is referred to as “Health Industry Cybersecurity Practices (HICP) 2023 Edition”. The final resource is a report referred to as “Hospital Cyber Resiliency Initiative Landscape Analysis”. This report provides information on the hospital’s current state of cybersecurity preparedness. I’ll provide more comprehensive information on each of these below.

            The Knowledge on Demand educational platform on Cybersecurity has 5 pieces of training with subsections and knowledge checks throughout the pieces of training (OIS, 2023a). The 5 pieces of training are Social Engineering, Ransomware, Loss or Theft of Equipment or Data, Accidental, Intentional, or Malicious Date loss, and Attacks against Network Connected Medical Devices. Each training piece provides a job aid, interactive video, PowerPoint with presenter notes, and a learning management system. Although some of the titles may not feel relatable, the details inside them will be more familiar. This is a free program by the Department of Health and Human Services.

            The HICP 2023 Edition publication is the next free resource on cybersecurity. This publication has three documents, the HICP Main Document, the HICP Tech Volume 1, and the HICP Tech Volume 2 (OIS, 2023b). The HICP Tech Volume 1 is meant for small healthcare organizations and provides best practices for these organizations, whereas the HICP Tech Volume 2 provides best practices for medium-sized and large healthcare organizations. The Main HICP Document provides an understanding of cyber threats and having strong cybersecurity standards in place (OIS, 2023b). The document also reviews the types of threats that are discussed in the Knowledge on Demand training. Most importantly, this document helps connect healthcare organizations to the importance of cybersecurity. Another aspect of these publications is at the top of the page. An individual can state whether they are a healthcare practitioner or IT professional, and the size of their organization. Once those are established, the page will provide all the resources that could benefit the individual. There are implementation guides and a visual aid with statistics that will help strengthen your practice’s knowledge of cybersecurity and awareness of cyber threats in healthcare (OIS, 2023b). The Department of HHS is currently building a Quick Start guide which will be attached to the visual aid once completed.

            The final resource, Hospital Cyber Resiliency Initiative Landscape Analysis, provides a 55-page report that highlights key observations, and the adoption of HICP practices (HHS & HSCC, 2023). This report provides data on the type of threats and how they are impacting healthcare organizations, along with the actors and how these cyber threats are attacking healthcare organizations. This is a very in-depth analysis of the HICP in comparison to the National Institute of Standards and Technology (HHS & HSCC, 2023). There are references and an acronym list on the last few pages of the document. This report also highlights the development of cybersecurity and cyber threats, along with cyber security survey results from hospitals in data pulled from CHIME which is the College of Healthcare Information Management Executive (HHS & HSCC, 2023). This report goes further in-depth than the other resources as this connects the dots given the real-life data and visual presentation of the results from the research performed.

These resources are all easily accessible and can be found at: https://www.hhs.gov/about/news/2023/04/17/hhs-cybersecurity-task-force-provides-new-resources-help-address-rising-threat-cyberattacks-health-public-health-sector.html

We invite your practices to review these programs further as cyber threats are continuing to surface in the healthcare industry which makes strengthening or creating cybersecurity processes even more important in this new technological age that we are in.

References:

1. OCIO. (2023, April 17). HHS Cybersecurity Task Force provides new resources to help address rising threat of cyberattacks in health and Public Health Sector. HHS.gov. https://www.hhs.gov/about/news/2023/04/17/hhs-cybersecurity-task-force-provides-new-resources-help-address-rising-threat-cyberattacks-health-public-health-sector.html 
2. OIS. (2023, April 17). Knowledge on Demand. HHS 405(d). https://405d.hhs.gov/knowledgeondemand 
3. OIS. (2023a, April 17). HICP 2023 Edition. HICP. https://405d.hhs.gov/information  
4. HHS, & HSCC. (2023, April 17). Hospital cyber resiliency initiative landscape analysis. Hospital Cyber Resiliency Initiative Landscape Analysis. https://405d.hhs.gov/Documents/405d-hospital-resiliency-analysis.pdf  
   

NextGen Healthcare, the Electronic Health Record vendor, has recently created an artificial intelligence referred to as Ambient Assist. This artificial intelligence will record Patient-Provider interaction with a speech-to-text tool that then generates a SOAP note (NextGen Healthcare, 2023a). As Artificial Intelligence continues to become more involved in the healthcare industry, this specific use has hopes of cutting down on some of the big waste areas for physicians as well as for their patients. According to NextGen Healthcare, this AI will generate a 90% accuracy rate and alleviate two hours of administrative burden daily for providers (NextGen Healthcare, 2023a). Finding an efficient way to document visits could assist in diminishing the waste of waiting for the next patient, waste of transportation for the physician, and waste of overproduction for the clinical notes themselves. Each of these aspects has an impact on decreasing Physician Burnout.

Depending on the processing speed by Ambient Assist, this could alleviate the work behind prior authorizations for organizations that utilize the NextGen Healthcare EHR when it comes to submitting clinical documentation. It was rumored that NextGen Healthcare would be a QHIN for the Trusted Exchange Framework and Common Agreement to assist in the Nationwide Health Information Exchange that is being coordinated by the Sequoia Project for the Office of the National Coordinator in Health IT. It seems that NextGen Healthcare redirected their focus as they are not listed as one of the initial waves of QHINs once TEFCA goes live which is expected in 2024.

According to an AMA article, physician burnout where physicians reported one manifestation of burnout was at 62.8% in 2022 during the Pandemic (Berg, 2022). This was an all-time high statistic for provider burnout. In 2014, this statistic was at 54.4 percent (Berg, 2022). Organizations are working to improve provider burnout and one of the ways to improve this is to decrease the number of administrative obligations they are required to complete.

In previous PAMED articles, there were other developments with the use of AI to help decrease administrative burden. Other forms of AI or Chat Bots in this specific scenario were used to increase compliance in underserved communities for pediatric vaccinations and well-child checks. Through each of these examples and innovations to incorporate AI into healthcare, the trend is that there is still skepticism on the accuracy regarding the work of AI. Some organizations have created controls to ensure the accuracy and legitimacy behind the work of the AI application before utilizing the work as a final product.

For those with a NextGen Healthcare EHR who have not utilized NextGen Healthcare Mobile or been informed about Ambient Assist, we suggest contacting your vendor representative. We’ve provided more information below about the AI tool along with a video that demonstrates the use of Ambient Assist.

Demonstration: https://www.nextgen.com/all/all/video/solution/nextgen-ambient-assist (NextGen Healthcare, 2023b)

More information: https://www.nextgen.com/solutions/provider-experience/mobile (NextGen Healthcare, 2023a)

References:

1. NextGen Healthcare (2023a). Mobile EHR solutions: NextGen Healthcare. Mobile EHR Solutions | NextGen Healthcare. https://www.nextgen.com/solutions/provider-experience/mobile 
2. NextGen Healthcare (2023b). NextGen Ambient Assist. Award-winning EHR/EMR software. https://www.nextgen.com/all/all/video/solution/nextgen-ambient-assist 
3. Berg, S. (2022, September 15). Pandemic pushes U.S. doctor burnout to all-time high of 63%. American Medical Association. https://www.ama-assn.org/practice-management/physician-health/pandemic-pushes-us-doctor-burnout-all-time-high-63 

On Wednesday, November 15^th, 2023, the Centers for Medicare and Medicaid Services’ Office of Burden Reduction and Health Informatics (OBRHI) hosted a virtual conference titled “Optimizing Healthcare Delivery to Improve Patient Lives”. CMS's goal for this conference was to convene leadership from the federal government, health provider organizations, and patient advocacy communities to determine ways to reduce administrative burden, strengthen access to quality care, and make it easier for clinicians to render this care (CMS OBRHI, 2023).

The AAFP (American Academy of Family Physicians) recognized from a 2017 report that there is a significant percentage of time family physicians spend on administrative and EHR tasks (Arndt et al., 2017). These tasks are:

            Chart Review: 32.1%

            Billing and Coding: 3.9%

            Visit Documentation: 23.7%

Also, Deloitte published in their “Global Health Care Outlook 2023” document that administrative or clerical burdens are one of the primary contributors to burnout (Deloitte, 2023). According to the Surgeon General’s Advisory on Addressing Health Worker Burnout, 35 – 54% of nurses and physicians in the United States Health Workforce and 45 – 60% of medical students and residents all reported symptoms of burnout (HHS, 2022).  This data represents the need for addressing these concerns as this will help in improving the lives of physicians and reducing the harmful consequences of burnout and administrative burnout such as decreased time spent between provider and patient, increased medical errors, and hospital-acquired infections among patients and staffing shortages (HHS, 2022).

The other area of focus for this conference is to strengthen access to quality care. According to the CDC, in 2021 the United States had 84 million people who lived in Primary Care Health Professional Shortage Areas (CDC, 2023). Access to care is a continued concern in the United States, and addressing this issue connects to solving the other issues surrounding this conference.

The recordings for the meeting can be accessed online at:

https://cmsburdenreductionconference.com/session-recordings/

To stay connected with this event and other events under the CMS OBRHI you can sign up for their newsletter at:

https://public.govdelivery.com/accounts/USCMS/subscriber/new?topic_id=USCMS_12350

References:

1. CMS OBRHI. (2023, September 11). CMS burden reduction conference. CMS Burden Reduction Conference. https://cmsburdenreductionconference.com/  
   1. Arndt BG, Beasley JW, Watkinson MD, et al. Tethered to the EHR: primary care physician workload assessment using EHR event log data and time-motion observations. Ann Fam Med. 2017;15(5):419-426.
      1. Deloitte. (2023, February 22). Global Health Care Outlook 2023 - Deloitte. Global Health Care Outlook 2023. https://www.deloitte.com/content/dam/assets-shared/legacy/docs/gx-UPDATED-Health-care-Outlook-2023_Consolidated.pdf  
      2. HHS. (2022, May 20). Addressing health worker burnout - HHS.gov. The U.S. Surgeon General’s Advisory on Building a Thriving Health Workforce. https://www.hhs.gov/sites/default/files/health-worker-wellbeing-advisory.pdf  
      3. CDC. (2023, September 1). Health Care Access. Centers for Disease Control and Prevention. https://www.cdc.gov/dhdsp/health_equity/health-care-access.htm

Monday, February 13^th, 2023, was a significant movement for the goal of a nationwide health information exchange as the Department of HHS and ONC worked together to announce the first six participants in the Federal Nationwide Health Information Exchange. From start to finish, the announcement was full of great information and speeches. Dr. Mickey Tripathi began the announcement with remarks from Secretary Becerra, President Biden’s Director of the Office of Science and Technology Policy Dr. Arati Prabhakar, Dr. Rochelle Walensky, amongst others. The following organizations are among the first group to become Qualified Health Information Networks:

CommonWell Health Alliance, eHealth Exchange, EPIC, Health Gorilla, Kno2, and Konza HIE

These six will be working together to connect to one another’s Health Information Networks through the mapping directed by TEFCA so that those under their QHIN can query and retrieve PHI as the Nationwide Health Information Exchange begins. There are future processes that will be implemented in TEFCA, this announcement of approved consumers/QHINs is a monumental step toward creating this exchange.

The next steps are the pre-production testing process and project plan completion which involves conformance testing to verify the systems and technology used by the QHINs, then there will be onboarding for these QHINs, and then the launch of the TEFCA exchange pilot program. QHINs will then continue to be onboarded, then the next phase involves designation and post-production testing. This involves refining the Common Agreement among other aspects of TEFCA such as Standard Operating Procedures and the Qualified Technical Framework, etc. The QHIN then countersigns the Common Agreement and the QHIN is then designated by the Sequoia project so that they can configure its production system for connectivity. The QHIN will then have to initiate a connectivity validation test within 30 days of being designated. Once these steps are completed, these QHINs will enter the final phase for TEFCA which is the production QHIN Exchange phase for operationalization.

Though it seems that this original wave of QHINs is not far from becoming operational, these steps could take a considerable amount of time. The hope, according to the National Coordinator of Health IT Micky Tripathi, Ph.D., M.P.P., is for this first wave to begin exchanging data by the end of 2023. The RCE or Recognized Coordinating Entity also has this as their goal for the operationalization of TEFCA in their timeline.

As discussed in the prior article in February, this will only affect practices that are involved in one of these organizations. As more organizations join, the hope is that more practices will become involved in the ability to Query and Retrieve PHI on their patients that they may currently be struggling to receive in a timely manner. Keep an eye out for communications regarding involvement in the exchange if you use any of these organizations for health information exchange or for your electronic medical record system (EPIC).

https://www.healthit.gov/buzz-blog/electronic-health-and-medical-records/interoperability-electronic-health-and-medical-records/building-tefca

https://rce.sequoiaproject.org/timeline-to-operationalize-tefca/

https://rce.sequoiaproject.org/tefca/how-it-works/

https://rce.sequoiaproject.org/qhin-process/

ONC hired a Recognized Coordinating Entity (RCE) to build, implement, and maintain what is known as the Trusted Exchange Framework and Common Agreement (TEFCA) (ONC, 2024). The release of the 21^st Century Cures Act required the Office of the National Coordinator for Health Information Technology to create TEFCA, which is ONC’s interoperability framework for a Nationwide Health Information Exchange. ONC hired the Sequoia Project as their RCE. To be a part of TEFCA, organizations must form a group, meet the standards of TEFCA, and apply to become a Qualified Health Information Network (QHIN) (ONC, 2024). These QHINs will then communicate with each other to share Personal Health Information nationwide. So, what does this mean for private practices? This could open the doors for private practices to have better access to their patients’ records.

How does a private practice become part of a QHIN?

There are Electronic Medical Record (EMR) vendors who have announced their commitment to being a part of the QHIN. The QHIN would need to follow a strict common agreement which in turn will trickle down and require its subsidiaries to also follow the agreement. I’ve provided a hyperlink below to the developed common agreement:

Common Agreement: https://rce.sequoiaproject.org/common-agreement/

The QHIN would have to also meet the technical requirements which is the Trusted Exchange Framework aspect of TEFCA. Once these are met, and the organization is approved to be a QHIN, it will go through an onboarding process that involves testing its product with other QHINs and making sure that they are meeting all the requirements needed to belong to TEFCA. The Sequoia Project has common Frequently Asked Questions to help organizations understand TEFCA and how they can participate (The Sequoia Project, 2024). I’ve provided the Sequoia Project’s detailed step-by-step process for an organization to become a QHIN and their FAQ page below:

Sequoia Project’s QHIN Process: https://rce.sequoiaproject.org/qhin-process/

Sequoia Project’s FAQ Page for TEFCA: https://rce.sequoiaproject.org/

Now, many practices are a part of the P3N which is a group of about 5 Health Information Organizations that share and exchange medical records through different query processes. These HIOs are KeyHIE, Lehigh Valley Health Network, Central PA Connect HIE, Clinical Connect HIE, and HealthShare Exchange.

P3N Landing Page: https://www.dhs.pa.gov/providers/Providers/Pages/
Health%20Information%20Technology/Health-Information-Exchange-Providers.aspx

Will the P3N become a QHIN?

At this time, the P3N is not planning to apply to be a QHIN at least during the first round of applications. Some notable organizations that were planning to apply to become or be a part of a QHIN are CommonWell, eHealth Exchange, EPIC, Health Gorilla, Kno2, and NextGen.

CommonWell: https://www.businesswire.com/news/home/20220831005757/en/
CommonWell-To-Apply-to-Become-One-of-TEFCA%E2%80%99s-First-Qualified-Health-Information-Networks

eHealth Exchange and CRISP: https://www.healthcareitnews.com/news/ehealth-exchange-crisp-plan-join-tefca-qhins

EPIC: https://ehrintelligence.com/features/ehr-vendor-epic-systems-applying-as-tefca-qhin-a-logical-next-step

Health Gorilla: https://ehrintelligence.com/news/large-health-it-networks-unveil-plans-to-become-qhin-under-tefca

Kno2: https://ehrintelligence.com/news/large-health-it-networks-unveil-plans-to-become-qhin-under-tefca

NextGen: https://www.healthcareitnews.com/news/nextgen-says-it-will-apply-qualified-health-information-network

References:

1. ONC. (2024, January 3). Trusted Exchange Framework and common agreement (TEFCA). HealthIT.gov. https://www.healthit.gov/topic/interoperability/policy/trusted-exchange-framework-and-common-agreement-tefca 
2. The Sequoia Project, . (2024, February 4). ONC TEFCA RCE. https://rce.sequoiaproject.org/