Over the past few years, electronic health records (EHR) have increasingly gained attention in the United States. In 2007, the government and the private sector took several steps to encourage healthcare providers to switch to EHR. First, an anti-kickback safe harbor and a Stark law exception both related to health information technology came into full force and effect. Second, the Bush administration announced a five-year demonstration project that will encourage physician practices to adopt EHR systems through providing financial rewards. Third, the Centers for Medicare and Medicaid Services (CMS) proposed uniform standards for an electronic prescription drug program. Finally, many third-party payers began providing incentives to providers who use EHR. Since this push for EHR is expected to grow during 2008, now is a good time to consider if making the switch to EHR is right for your practice. While most physician practices are not currently using EHR for all basic functions (e.g., ordering prescriptions and tests, reporting test results, maintaining physician notes, etc.), the number of physicians using EHR, at least partially, is increasing. However, implementing an EHR system is not beneficial for every provider and is a decision that should be given careful consideration. Below are several key issues everyone must consider before making the decision to implement an EHR system: • Cost vs. benefit. Before your practice decides to go paperless, first run a cost-benefit analysis weighing the benefits of the system against the costs. The benefits associated with an EHR system generally include a reduction in overhead expenses (e.g., paper and supplies, rental space, transcription expenses, administrative staff, etc.), a reduction in treatment errors due to better communication among physicians and an increase in overall profits. However, there are also several disadvantages of implementing an EHR system, the biggest of which is cost. EHR systems require a high initial investment in addition to other, often overlooked, associated expenses, such as printers and supplies, annual software updates, training costs, etc. For many providers, including smaller physician practices, this high cost outweighs the benefits received. Therefore, every provider must carefully weigh the costs of the system against the benefits received before deciding to implement an EHR system. • Implementation time. Making the switch to EHR will not occur overnight. It will take at least a couple of months to fully research the systems available, install the software, learn the new system and train employees on how to use the system. Additional manpower and time will be needed to transfer existing written records to electronic form. Therefore, if after conducting the cost-benefit analysis you decide to switch to electronic records, you should begin the process well before your estimated implementation date. • Unexpected difficulties. With EHR systems, downtime, technical difficulties and power outages will limit access to patient records and other information necessary for providing patient services. When such problems occur, technical support and additional expenses may be required to get the system up and running again. • HIPAA compliance. As with paper records, under the HIPAA Privacy Rule, protected health information contained in an EHR must be safeguarded and may not be improperly used or disclosed. Additionally, health information contained in electronic form must comply with the HIPAA Security Rule, addressing, among other things, administrative, physical and technical safeguards to ensure the confidentiality of electronic protected health information. Consequently, the HIPAA policies and procedures you currently have in place under the Privacy Rule to prevent the improper use and disclosure of information contained in paper records will need to be revised, updated and expanded under both the Privacy Rule and the Security Rule for electronic records. Issues addressed in revising your policies and procedures may include username and password protection, safeguards for information contained in the EHR system (e.g., logging off the system before leaving the computer unattended), off-site use of EHR systems from a home computer or a smart phone, designating a security official and training employees on protecting the health information contained in an EHR. • Retention and destruction of paper records. When switching from paper to electronic records, you must follow all applicable record retention and destruction guidelines. For example, even after implementing an EHR system, certain paper records may need to be retained under state law, federal law and/or third-party payer guidelines. Be sure to review and follow these guidelines before destroying any paper records. Furthermore, when you do decide to destroy paper records, to ensure compliance with applicable guidelines and to prevent the improper destruction of paper records, it is recommended that each provider have a medical record retention and destruction policy. This policy may address, among other things, how long the records should be retained (e.g., five years, ten years, indefinitely), how they should be retained (e.g., on-site vs. off-site, electronically on a secured network) and the process for destroying the records. Finally, from a practical standpoint, it is a good idea to have one designated person in charge of the destruction process. This will avoid confusion (and prevent mistakes) about which records are to be destroyed and when the destruction is to take place. The decision to implement an EHR system is an important business decision and is unique to each provider. Reviewing and carefully considering the issues discussed above will help ensure that you are making the correct decision for your practice from both a legal and a business perspective. February 2008