Stage 3 of meaningful use is shaping up to be the most challenging and detailed level yet for healthcare providers. Among the elements that warrant attention are quality reporting, clinical decision support and security risk analysis.

But first things first: Stage 3 may not be as near final as some would hope, and there are likely to be modifications before a final rule is issued, says Pamela Chapman, director of clinical product and regulatory affairs at Austin, Texas-based e-MDs.

"We have a long way to go until Stage 3 is finalized and it is my understanding that CMS is not even looking at the public comments yet, so we don't know what we'll be looking at," she said this past month.

One of the new developments of Stage 3 is the decoupling of certification and meaningful use, which have been synonymous in the process to date, Chapman said. With the decoupling, certification becomes modular and not centered around MU, which is "scary," she says.

"We need to know the criteria and what measures will meet our customers' needs best," she said. "We need to know which quality programs will require additional criteria for their programs and there is no way to anticipate that. That is the biggest frustration with the decoupling – which programs will require additional criteria and the timeline to turn it around."

CMS and ONC are encouraging providers to share their stories in the Stage 3 feedback to the agencies, and relating how regulations impact patients can carry a persuasive influence with policymakers. But Chapman says providers have been reluctant to do so because "they are really jaded and don't believe anyone will listen to them," she said.

Clinical decision support
The Stage 3 proposed rule lists clinical decision support as one of the eight key objectives. Unlike the Stage 1 measure which required one CDS rule, Stages 2 and 3 specifically require the use of five CDS interventions.

"It's an area that is sometimes misunderstood, and people have more flexibility to meet the requirement than they think," said Victor Lee, MD, vice president of clinical informatics at Los Angeles-based Zynx Health. "Stage 1 only required one CDS rule, but Stages 2 and 3 recognize different forms beyond just rules, like order sets, interdisciplinary sets of care, templates and other things to help make decisions."

Contrary to what some people believe, Lee says CDS interventions can consist of more than just alerts, as discussed in the proposed rule.

"I'm a huge fan of HHS and CMS and think they are doing great things, but the Stage 3 proposed rule falls short of the overall goal to achieve better outcomes because it is more process based," Lee said. "Every objective doesn't need to state outcomes, but rather than looking for five interventions, it should try to measure outcomes."

Lee sees two major issues with CDS – one is that not enough clinicians are demanding CDS be updated with changing evidence; and clinician access to CDS needs to be made easier and more efficient.

"CDS needs to be updated and modified with time just like a car needs care and maintenance," Lee said. "As it turns out, CMS has official guidance on how often CDS should be updated and maintained. They have gotten prescriptive in saying if you're a certification body, look for these processes to exist within hospitals. It's not good enough to have CDS, but is consistent with evidence-based medicine and the vetting process for decision-makers to weigh in on it."

Security risk analysis
A common thread in all three stages is security risk analysis as core criteria and Phoenix-based ClearData has conducted these tests for providers ranging from solo practitioners to integrated delivery systems, says Carl Kunkleman, senior vice president and co-founder.

SRA requires a specific code of federal regulation and within that code are three safeguards – administrative, technical and physical. Within those "buckets" are 54 safeguards that must be completed, he said.

The top challenge from MU so far is the migration from paper to electronic records and it is the key reason why SRA is required in meaningful use, Kunkleman said.

"The migration happened so quickly that the government wants to make sure personal health information is protected," he said. "The good news is that because there have been so many security breaches, CIOs have become really interested in this topic."

In an era where hacks and breaches have become commonplace, Kunkleman maintains that high risk areas continue to exist within organizations.

"We are not encrypting data and don't have a handle on PHI," he said. "You've got to know where PHI lives. If you don't know where it lives, how do you know what the safeguards are? So you need to do a thorough PHI inventory."

'Structural weakness'
Meaningful use has served a valuable purpose in ensuring that more than tens of billions in ARRA dollars are "spent meaningfully" for creating an electronic health record infrastructure across the country, says Frank Ingari, CEO of Boston-based NaviNet.

"At the end of the day, MU will be successful," he said. "It provides a set of tools to move the industry in a positive direction on the back of $20 billion in funding. The MU criteria is a significant set of metrics and a much higher degree of electronic information exchange. It is a success. But it doesn't compare to Medicare Advantage in terms of being a long-term model for healthcare overall."

The chief problem with MU, Ingari says, is a "structural weakness" in the model.

"MU has been set up as a series of one-time tests to certify for certain requirements – those tests by definition are static, you pass one time and you've passed," Kunkleman said.

"The problem is that the nature of the metrics tends to be not directly related to outcomes," he added. "The structural weakness is that it is badly matched to the wide variety of the medical providers – from Kaiser to small hospitals, the multispecialty clinic to the solo doc in a strip mall. The metrics in Stage 1 were very low level and still generated a ton of complaints from the marketplace, so there were a lot of waivers and exceptions. Metrics that are subject to interpretation are a poor fit and too hard for small providers."

Conceding that MU and MA are "apples and oranges" in that MA aims at a different constituency, Ingari contends that "MA motivates everyone – consumers, contractors, providers and payers. It's hard to do that with MU because it is aimed squarely at providers."

Making MU 'digestible'
Boston-based Amazing Charts is charged with "making meaningful use digestible" for small practices, says Chris Tremblay, product manager. One of the challenges of Stage 3, she says, is distinguishing MU from the multitude of quality programs in existence.

"Where Stage 3 attempts to back away from the clinical side of quality reporting, having one view – a single set of standards for reporting – should be a priority," she said. "Stage 3 should be about sharing data and opening the ecosystem."