Post-Payment Audit Guidance


Providers selected for a post–payment audit will be required to provide documentation that verifies the Adoption/Implementation/Upgrade (AIU) or Meaningful Use (MU) of their complete certified Electronic Health Record (EHR) system. Below are explanations and documentation requirements for AIU and MU audits. Please note that for both types of audits, additional documentation will be requested in the Audit Notification Letter to support eligibility for the incentive program (e.g., documentation to support a qualifying Medicaid patient volume).

The payment year, as well as the reporting periods for MU and patient volume, is selected by the provider or authorized person during the online attestation process. All providers should be prepared to supply documentation to support that their activities during the payment year and selected reporting periods met the definition of the activities to which they attested. For example, an attestation for AIU for payment year 2016 may be submitted in 2017, but the supporting documentation must show that the AIU activity attested to was performed by the provider during payment year 2016.

Adoption/Implementation/Upgrade (AIU)

In their first payment year, providers may attest that they have adopted, implemented, or upgraded to certified EHR technology. According to the Final Rule, "Section 1903(a)(3)(F)(i) of the Act, as amended by section 4201 of the HITECH Act, establishes 100 percent FFP to States for providing incentive payments to eligible Medicaid providers (described in section 1903(t)(2) of the Act) to adopt, implement, upgrade, and meaningfully use certified EHR technology. The incentive payments are not direct reimbursement for the purchase and acquisition of such technology, but rather are intended to serve as incentives for EPs and eligible hospitals to adopt and meaningfully use certified EHR technology".
        Source: Federal Register / Vol. 75, No.144/ Rules and Regulations Page 44482

Adopt means to acquire, purchase, or secure access to certified EHR technology. It is not necessary that the certified EHR technology be installed or in active use in the clinical setting, so long as the provider can demonstrate a financial commitment to purchasing or using the certified EHR technology during the payment year. Documentation to support this could include payment receipts, signed vendor contract, leases, or proof of the acquiring of the system. In cases where the EHR system is free or a financial exchange cannot be demonstrated, the provider will be required to submit documentation that shows installation or access to the system.

Implement means to commence usage of a certified EHR technology capable of meeting Meaningful Use requirements. It is not necessary to demonstrate that implementation is complete or that the EHR system is in active use in the clinical setting; however, plans to implement the certified EHR technology are not sufficient. The provider also needs to show examples of adopting the technology. Examples of activities that may be sufficient to demonstrate implementation include:

  • Progress in integrating the certified EHR system with existing systems
  • Execution of staff training on the certified EHR technology
  • Progress in transition to the certified EHR technology, such as entry of existing patient data into the EHR system

Upgrade means to expand the available functionality of certified EHR technology capable of meeting Meaningful Use requirements at the practice site, including staffing, maintenance, and training, or upgrade from existing EHR technology to certified EHR technology. If the provider is upgrading from a previous version of the EHR technology to a certified version, or adding modules to achieve a complete certified system, the same documentation criteria applies as for adoption of a new EHR system. If the provider is upgrading custom EHR technology to achieve certification, the following are examples of documentation that would be sufficient to demonstrate upgrade:

  • Signed contract with vendor, developer, or systems integrator for services to upgrade the EHR technology
  • Copy of paid invoice that clearly identifies the EHR technology and indicates the services rendered


In the second payment year and beyond, Eligible Professionals will be required to demonstrate Meaningful Use (MU) of certified EHR technology (CEHRT). All documentation submitted for an MU audit needs to clearly show the provider´s name, MU EHR reporting period and system name in order to pass the audit. A majority of the information requested for MU audits can be captured electronically by the CEHRT. If a provider cannot obtain all requested information, it is suggested to contact the vendor for assistance. However, the responsibility to retain all accurate documentation ultimately lies with the provider. Additionally, not all vendors will retain information needed for audits.

In a post–payment audit, providers will be required to submit documentation to adequately demonstrate they have met the requirements of the Core Objectives and Menu Objectives attested to during the EHR reporting period selected.

A "dashboard" generated by the CEHRT is requested from the provider to show the numerator/denominator measures and exclusions. If a provider claims an exclusion(s) on his/her attestation, this will be validated through the dashboard for numerator/denominator measures and along with an e-mailed exclusion statement from the provider explaining why he/she is eligible for the exclusion. Providers will be expected to complete this statement once the Audit Notification e-mail is received. In addition to the dashboard, providers must also submit screen shots or other supporting documentation for the non–numerator/denominator measures/exclusions attested to.

The Audit Notification e-mail sent by the auditor will also request a list of all location addresses where the provider saw patients during the MU EHR reporting period. This list must identify each location equipped with CEHRT, the number of patients seen at each location, and the number of patients with records maintained within the CEHRT at each location. This will indicate the percentage of patient encounters that occurred at locations equipped with CEHRT and also the percentage of patients with records maintained within the CEHRT for those locations equipped with CEHRT.

The below MU Guidance hyperlinks detail the documentation required to meet auditing criteria. Please reference the below links for additional guidance on Meaningful Use objectives and measures for the different stages/years.

  1. MU Guidance–Modified Stage 2 for 2015–2017
  2. MU Guidance–Stage 1–2013
  3. MU Guidance–Stage 1–2014
  4. MU Guidance–Stage 2–2014

It is strongly encouraged that all providers, at the time of attestation, consolidate ancillary reports, screenshots and other types of supporting documentation for all MU measures and retain for potential audits. Ensure EHR-related records are retained for at least six years, kept centrally, and can be easily accessed by staff in the event of future audit requests. Below are some best practices as they relate to retaining EHR documentation.

  • Document patient volume at the time of attestation.
  • Document all MU measures. Do not rely solely on summary dashboard reports.
  • Keep supporting documentation in a central location.
  • Retain ALL relevant supporting documentation used in the completion of your EHR attestation for six years post-attestation. This includes documentation to support data for MU objectives and Clinical Quality Measures (CQMs), as well as data to support any exclusions that were taken. Retain documentation that is in either paper or electronic format, including relevant screenshots.
  • Download and save and/or print a copy of your MU report at the time of attestation, and retain for your records. The reporting dates on your MU report should match the dates in your attestation.