I have been getting a lot of questions about the American Recovery and Reinvestment Act of 2009 (ARRA) and how it will affect IT spending in health care. A WTN News article has an excellent executive summary:

The largest allocation of funding — approximately $17 billion — is for incentive payments through the Medicare and Medicaid reimbursement systems to encourage providers and hospitals to implement EHR technology systems. As described more fully below, the incentive payments are triggered when a provider or hospital demonstrates it has become a “meaningful EHR user.” Payments are paid over time, with larger payments in the early years and lower payments over time, totaling as much as $48,400 for eligible professionals and up to $11 million for hospitals. On the other hand, hospitals and eligible professionals suffer penalties through reduced Medicare reimbursement payments if they do not become meaningful users of EHR by 2015.

This says to me an entity has to purchase and install the technology before it can be reimbursed. Proof that electronic health records (EHR) are deployed securely will net payments and incentives out of the stimulus package. Here are the top five objectives, which should help prioritize projects related to the above reimbursements:

• The electronic exchange of health information
• Utilization of electronic health records for each person in the United States by 2014
• Use of privacy and security protections (including encryption standards) for electronic exchange of identifiable health information
• Improving quality of health care
• Specifying plans for individuals with unique needs such as children

Security protections of IT can be reimbursed. A regulated entity thus should see the stimulus as an opportunity to invest in the security of their health information technology (HIT) and EHR systems. This should be taken as great news by the health care industry, especially with recent state laws that strengthen HIPAA security requirements, such as California AB211 and SB541, and Massachusetts 201 CMR 17.