Hospital Certified Electronic Health Record (EHR)
Technology Questionnaire
Thank you for taking time to complete this questionnaire. The
Office of Inspector General (OIG) is conducting this survey as part
of a study on fraud and abuse safeguards in EHRs. Participating
will help us learn about the certified EHR technology hospitals are
using. Our questions concern the presence of features and
capabilities of certified EHR technology, as well as barriers to
implementing certain safeguards for increased fraud protection and
data integrity.
If you have any questions, please contact Kim Yates at
617-565-2911 or Kim.Yates@oig.hhs.gov.
Your responses will be saved every time you click the NEXT
button.
You can return to the questionnaire at any time, using the
same link, until you click the red SUBMIT button.
Click the PRINT button to print a copy of this questionnaire
with your responses.
Once you click the red SUBMIT button you will not be able
to edit or print your responses.
1.
Please provide the following information for the individual(s) completing this questionnaire:Respondent name(s) and title(s):
Phone number:
The following questions ask about the certified EHR technology this hospital
has implemented and attested to meaningful use.
2.
What type of EHR technology does this hospital use?One or more commercial vendor product(s) One or more internally developed product(s)
A combination of vendor and internally developed products Other
Please specify:
3.
How many years has the hospital used any EHR technology?4.
Is this hospital part of a network of hospitals that use the same EHR technology?The following questions ask about the certified EHR technology's capabilities
regarding coding.
5.
How are diagnoses and procedures coded at this hospital?Manually by professional coders
Yes No
Automatically with coding software
Other
Please specify:
6.
Does this hospital have plans to adopt computer-assisted coding?The following questions ask about user authentication and access to the
certified EHR technology.
7.
Does access to the hospital EHR technology require the following user authorizations? Unique user ID Yes No Password Token-based (e.g., identification card)Biometrics (e.g., fingerprints) Public-key (e.g., PKI, digital certificates)
8.
Has the hospital implemented the following policies and procedures regarding access to the EHR technology?Automatic user log-off/ Session time-out
Yes No
Minimum password configuration rules
Regular changing of password User agreements or contracts to prevent sharing of
passwords Other
The following questions ask about access to the certified EHR technology by
outside entities.
9.
Does this hospital allow any outside entity (such as a payer) access to the EHR technology?Yes No
10
.
How does the hospital allow outside entities access to the EHR technology?
Remotely Yes No On-site Other Please specify:
11
.
Does the hospital establish unique user IDs to track outside entities' activity?
The following questions ask about access to the certified EHR technology by
outside entities.
12
.
How does the hospital limit outside entities' access?
To specific patients
Yes No
To specific claims
To view-only (i.e., the outside entity cannot print, export, transmit, or email data)
To limited information within a specific patient or encounter Other
Please specify:
13
.
Are outside entities allowed access to audit logs and metadata?
The following questions ask about access to the certified EHR technology by
outside entities.
14
.
To what extent does the hospital consider the following to be barriers to allowing outside entities access to EHR technology?
EHR technology does not support the capability
To A Large
Extent To Some Extent To Little Extent Not At All
Hardware does not support the capability
Insufficient human resources Funding restrictions/additional costs to implement
Insufficient training on EHR technology
Inability to integrate with existing systems
Inability to limit access to specific patients, encounters, or information
Concerns with EHR system performance
Concerns with patient privacy Concerns with provider rights Concerns with inappropriate use by outside entities
Hospital policy prevents such access
Other
The following questions ask about the certified EHR technology's audit log
and metadata features.
Audit logs and metadata track access and changes within an EHR
chronologically by capturing data elements such as date and time when
users access or change the record.
15
.
Does the audit log record data for the following events?
Each entry or access to the EHR
Yes No
Signature event (the proactive or auto default completion of a patient encounter)
Export of EHR document (printed, electronically exported, emailed)
Amendments, corrections, or modifications of data
Import of data
Disabling of audit log
Release of encounter for billing Access by an authorized
outside entity Other
16
.
Does the audit log record the following data?
National Provider Identifier (NPI)
Yes No
Date/Time/User stamps
Access type (creating, editing, viewing, printing, etc.)
Internet Protocol (IP)/ Media Access Control (MAC) address Network Time Protocol (NTP)/ Simple Network Time Protocol (SNTP) synchronized time Method of data entry (direct entry, speech recognition, automated, copy/import, copy forward, dictation)
Date/Time/User stamp of original author when data are copied
Date/Time/User stamp of original author if data are entered on behalf of another (e.g., an assistant enters clinical information for a physician)
Other
The following questions ask about the certified EHR technology's audit log
and metadata features.
17
.
Is the audit log operational whenever the EHR technology is available for updates or viewing?
Yes No
18
.
To what extent does the hospital consider the following to be barriers to having the audit log operational at all times?
Insufficient storage space for data
To A Large
Extent To Some Extent To Little Extent Not At All
Impedes system performance Inability to use audit log data (i.e., cannot identify and interpret audit log data) Insufficient human resources Inadequate training on audit log functionality
A lack of user guides for audit log functionality
Other
The following questions ask about the certified EHR technology's audit log
and metadata features.
19
.
Can the audit log be disabled?
Yes No
20
.
Who can disable the audit log?
Any EHR user
EHR users who are authorized to access the audit log EHR system administrators
Other
Please specify:
21
.
Can the audit log be deleted?
Yes No
22
.
Who can delete the audit log?
Any EHR user
EHR users who are authorized to access the audit log EHR system administrators
Other
Please specify:
23
.
Can the audit log be edited?
24
.
Who can edit the audit log?
Any EHR user
EHR users who are authorized to access the audit log EHR system administrators
Other
The following questions ask about the certified EHR technology's audit log
and metadata features.
25
.
How long are audit log data stored?
26
.
Does the EHR technology allow for the destruction of EHR and audit log data according to the hospital's data retention policies?
Yes No
27
.
Can the EHR technology produce a user friendly version of the audit log (i.e., a summary of audit data in a readable format or embedded in an electronic form) for transmitting, printing, or exporting?
The following questions ask about the certified EHR technology's audit log
and metadata features.
28
.
Does anyone at the hospital analyze the audit log data?
Yes No
29
.
Which of the following individuals at the hospital analyzes the audit log data?
EHR system administrator
Yes No Compliance officer Privacy officer Other Please specify:
30
.
How often is the audit log data reviewed and analyzed?
Monthly Quarterly Annually Other
31
.
To what extent does the hospital consider the following to be barriers to analyzing audit log data?
Insufficient storage space for data
To A Large
Extent To Some Extent To Little Extent Not At All
Inability to interpret audit log data
Insufficient human resources Inadequate training on audit log data
A lack of user guides for audit functionality
Other
The following questions ask about how physician progress notes are entered
into the certified EHR technology.
32
.
To what extent are physician progress notes handwritten and/or dictated instead of directly entered into the EHR at this hospital?
All physician progress notes are handwritten/dictated
Some physician progress notes are handwritten/dictated and some are directly entered into the EHR
No physician progress notes are handwritten/dictated
33
.
How are these physician progress notes maintained?
Maintained as a hardcopy
Yes No
Scanned into the EHR Transcribed into the EHR
34
.
Why are physician progress notes not directly entered into the EHR?
35
.
How are physician progress notes entered into the EHR?
Typed directly into the EHR as free text
Yes No
Entered into the EHR with templates
Other
The following questions ask about how nursing notes are entered into the
certified EHR technology.
36
.
To what extent are narrative nursing notes handwritten instead of directly entered into the EHR at this hospital?
All narrative nursing notes are handwritten
Some narrative nursing notes are handwritten and some are directly entered into the EHR
No narrative nursing notes are handwritten
37
.
How are these narrative nursing notes maintained?
Maintained as a hardcopy
Yes No
Scanned into the EHR
38
.
Why are narrative nursing progress notes not directly entered into the EHR?
39
.
How are narrative nursing notes entered into the EHR?
Typed directly into the EHR as free text
Yes No
Entered into the EHR with templates
Other
The following questions ask about the certified EHR technology's capabilities
regarding exporting and transmitting EHR documents.
40
.
Are there limits on which EHR users are authorized to electronically export, transfer, or print EHR documents?
Yes No
41
.
Does the EHR technology require the user to document why an EHR document was electronically exported, transferred, or printed?
Yes No
42
.
Does the EHR technology have the capability to disable the Print Screen function?
Yes No
43
.
Does the hospital disable the Print Screen function for the EHR technology?
The following questions ask about certified EHR technology features
regarding patient access.
44
.
Do patients have the following electronic access to their EHR data?
View their entire EHR
Yes No
View only components of their EHR
Ability to comment in their EHR View all entities to which their EHR was released
View all the entities who accessed their EHR
Other
The following questions ask about certified EHR technology features
regarding patient access.
45
.
To what extent does the hospital consider the following to be barriers to allowing patient access to their EHR data?
EHR technology does not support the capability
To A Large
Extent To Some Extent To Little Extent Not At All
Hardware does not support the capability
Resistance by physicians to have patients access the information
Concerns with patient security and privacy
Funding restrictions/ additional costs to implementation
Insufficient training on the EHR technology
Inability to integrate with existing systems
Concerns with EHR system performance
Hospital policy prevents such access
Other
The following questions ask about the certified EHR technology features
regarding patient identity management.
46
.
What procedures does the hospital require to identify patients upon check-in?
Photo identification
Yes No
Established relationship (i.e., visual recognition)
Verifying identity based on information an individual can verify (e.g., address, data of birth) Biometric identification Other Please specify:
47
.
For each patient check-in, does the EHR technology have the capability to record which identification procedure was used to confirm patient identity?
The following questions ask about additional features and safeguards that
the hospital's certified EHR technology may have in place.
48
.
Can an EHR document be modified after it has been finalized by a "signature event" (i.e., the proactive or auto default completion of a patient encounter)?
Yes No
49
.
Are the original unmodified EHR data retained?
Yes No
50
.
Can the following features be customized in the EHR technology?
Copy/Paste
Yes No Do Not Have That Feature
Templates
51
.
Does the hospital have a policy regarding the use of the copy/paste feature in EHR technology?
Yes No
52
.
The following questions ask about the additional features and safeguards the
the hospital's certified EHR technology may have in place.
53
.
Has the hospital implemented any of the following safeguards?
Policies and procedures for analysis of audit log data
Yes No
Written policies and
agreements for EHR users Employee training on privacy Employee training on fraud and abuse prevention
Employee training on EHR data integrity
Routine review of EHR user privileges
