5 Meaningful Use Facts and Tips

Updated 5/20/25, Originally published 6/8/2015

Meaningful Use refers to a set of standards under the U.S. EHR Incentive Programs that encouraged healthcare providers to adopt and effectively use certified electronic health record (EHR) technology. Launched in 2011 as part of the HITECH Act initiatives, Meaningful Use aimed to improve quality, safety, and efficiency in healthcare through better data management. Over time, the program evolved - by 2018 it was rebranded as Promoting Interoperability to emphasize data exchange and patient access to information. Today, the legacy of Meaningful Use lives on in the Merit-Based Incentive Payment System (MIPS) for Medicare providers, making it crucial for healthcare organizations to stay informed about both the historical requirements and current regulations. Below are five essential Meaningful Use facts and tips, updated to reflect the current regulatory landscape (including MIPS and Promoting Interoperability) that will help your organization maintain compliance and optimize EHR use.

1. The Stages of Meaningful Use (and Transition to MIPS)

Meaningful Use was implemented in three progressive stages. Each stage built upon the previous one to advance EHR capabilities:

Stage 1 - Data Capture and Sharing: Focused on basic electronic data capture and providing patients electronic copies of health information. Providers had to start using Certified EHR Technology (CEHRT) meaningfully, such as recording key patient data and initiating electronic prescribing.
Stage 2 - Advanced Clinical Processes: Emphasized health information exchange, more rigorous clinical decision support, and increased requirements like sending electronic summaries of care. Providers needed to begin exchanging data (e.g., lab results, care summaries) across systems to improve coordination.
Stage 3 - Improved Outcomes: Aimed at truly improving clinical outcomes. Stage 3 (final stage) required robust interoperability, patient access to their records (patient portals), and advanced use of EHR analytics for quality improvement. By 2018, Stage 3 became mandatory for all participants, marking the culmination of the Meaningful Use program.

Transition to MIPS: In 2015, Congress passed MACRA, which led to the creation of MIPS and the phase-out of the standalone Medicare Meaningful Use program. Under MIPS, Meaningful Use was transitioned into the "Promoting Interoperability" category, one of four components of the MIPS score. This means that eligible clinicians now fulfill Meaningful Use objectives as part of MIPS, rather than a separate program. Notably, the focus under MIPS Promoting Interoperability is on interoperability, data exchange, and patient engagement, moving beyond the original Meaningful Use requirements. For example, providers must now attest to not blocking information and to using 2015 Edition CEHRT, aligning with 21st Century Cures Act mandates (e.g., information blocking provisions). Tip: Even though the terminology has changed, the core goals remain - ensure your practice meets the EHR use objectives (e.g. e-prescribing, health information exchange, patient access) each year to avoid penalties under MIPS. Promoting Interoperability typically accounts for 25% of a clinician's MIPS final score, so successful attestation is critical. Staying current with CMS updates (such as new measures or required attestation statements each year) will help your organization adapt as the program continues to evolve.

2. Security Risk Analysis Requirements

Conducting a regular Security Risk Analysis (SRA) is not only a HIPAA Security Rule requirement - it's also a foundational element of Meaningful Use and continues under MIPS. HIPAA regulations explicitly mandate that organizations "conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information". In practical terms, this means your practice must review where electronic patient health information is stored or transmitted, identify potential threats (e.g. data breaches, improper access), and implement measures to mitigate those risks.

Under Meaningful Use Stage 1-3, providers had to attest each year that an SRA was performed or reviewed and any necessary updates were addressed. This requirement is reinforced in MIPS: as part of the Promoting Interoperability category, clinicians must attest to having conducted or reviewed a security risk analysis (or security risk review) during the calendar year. While MIPS no longer scores the SRA measure for points, failure to complete an SRA attestation can disqualify your Promoting Interoperability score, effectively risking your Medicare reimbursement adjustments. Tip: Treat the SRA as an annual must-do task - and document it thoroughly. Ensure you:

Assess all systems and devices that handle ePHI (electronic protected health information).
Identify vulnerabilities (e.g., outdated software, inadequate access controls) and remediate them.
Update your risk management plan with any new security measures or training implemented.
Maintain evidence of the analysis (reports, meeting notes, action plans) in case of audit.

Performing the SRA early in your MIPS reporting year gives you time to address any findings. Remember that protecting patient data isn't just about compliance; it also safeguards your patients' trust and your organization's reputation.

3. Medical Assistant Credentialing for EHR Entry

If your practice relies on medical assistants (MAs) to enter orders into the EHR, pay attention to credentialing requirements. Meaningful Use rules specify that only licensed or properly credentialed personnel can perform order entry for the purposes of meeting the objectives. In Stage 2 (and continued in Stage 3), CMS clarified that any orders counted toward the Computerized Provider Order Entry (CPOE) measure must be entered by a licensed healthcare professional or a "credentialed medical assistant." Crucially, the MA's credential must come from an independent credentialing body - not simply training provided by the employer. In other words, medical staff need to have a certification or credential (e.g. CMA, RMA, or equivalent) from a recognized program or authority for their order entries to count.

This requirement was designed to ensure that individuals entering medication, laboratory, or radiology orders have proven competencies. Tip: Verify the status of your medical assistants - if they are documenting orders in the EHR for Meaningful Use/MIPS measures, they should either be licensed (if applicable) or certified through a national or state-recognized program. For example, an MA with a certification from AAMA (American Association of Medical Assistants) or AMT (American Medical Technologists) would meet the "credentialed" criteria. If you have uncredentialed staff performing order entry, consider investing in a credentialing course or certification program for them. Not only will this keep you compliant with the EHR incentive criteria, it can also enhance the overall quality of data entry and patient safety. Many organizations (and some state programs) offer affordable MA certification training to help meet this need. Ensuring your MAs are properly credentialed will safeguard your EHR incentive compliance and prepare your practice for future program changes (since having qualified staff is always a good long-term strategy).

4. Documentation is Critical for Compliance

One of the most important (and sometimes overlooked) tips is to maintain meticulous documentation for every Meaningful Use measure you attest to. Whether you're attesting under the old Meaningful Use program or the current MIPS Promoting Interoperability category, having a paper trail (or digital trail) of evidence is essential. In the event of an audit, you will need to produce proof for the data and measures you reported.

Key documentation to have on file includes:

Security Risk Analysis reports - Save copies of your SRA report or executive summary for each year, along with evidence of remediation steps taken.
Medical Assistant credentials - Keep copies of certificates or licenses for any staff whose credentials were required for meeting measures (e.g. proof of MA certification as noted in Tip #3).
EHR system documentation - This includes your EHR vendor agreements and contracts, and proof that your EHR system is certified (ONC certification details). Auditors may request a copy of your EHR's certification page or number to verify you used CEHRT in the correct edition.
Measure-specific evidence - For each objective, retain supporting documents. For instance, if you attested to a public health reporting measure, take screenshots from your EHR showing a test submission to an immunization or syndromic surveillance registry, or keep confirmation emails/letters from public health agencies acknowledging your data submission. If you attested to patient portal usage, you might keep a report from the EHR showing the percentage of patients who accessed their health information. Essentially, for every percentage or yes/no measure reported, have something tangible to back it up.

Remember that auditors can ask for additional documentation beyond what you initially used to attest. A CMS contractor (for example, Figliozzi & Co. for Meaningful Use audits, or Guidehouse for recent MIPS audits) might request detailed records. Being organized from the start will make this process far smoother. Tip: Create a "Meaningful Use/MIPS Documentation Binder" (physical or electronic). For each year's attestation, compile all relevant screenshots, reports, and notes. Also, be aware of record retention rules CMS requires MIPS participants to retain documentation for 6 years from the end of the performance year. This is longer than many standard medical record retention policies, so make sure your Meaningful Use/MIPS files are stored in a secure but accessible archive. Good documentation not only helps in case of an audit, but it also enables your team to learn and improve on any objectives where you might have fallen short.

5. Meaningful Use Audits (and MIPS Audits) Happen

Audits are a reality of Meaningful Use and its successor programs, so organizations must be prepared. Under the original EHR Incentive Programs, CMS and the Office of Inspector General (OIG) established audit processes to verify that providers truly met the Meaningful Use requirements they attested to. In fact, roughly "5% to 10% of all Meaningful Use participants" were subject to audits - this included both pre-payment audits (before incentive money was paid out) and post-payment audits. In a Meaningful Use audit, a provider typically first receives an official letter (for example, from Figliozzi & Co., the CMS contractor that conducted many of the MU audits) requesting specific information. This letter might be titled "HITECH EHR Meaningful Use Audit Engagement" and can understandably trigger anxiety. Auditors will commonly ask for the kinds of documentation outlined in Tip #4, such as proof of your EHR reports and submissions.

In the current MIPS era, audits have continued in a similar vein. Starting in 2023, CMS began auditing clinicians for their past MIPS performance years (2019, 2020, 2021), including the Promoting Interoperability (former MU) category. CMS has contracted with audit firms (e.g., Guidehouse) to perform these checks, and selections are often random. If you are selected for a MIPS audit, you will likely receive an email or letter requesting information. You typically have 45 days to respond with all the requested data. The audit may cover not just Promoting Interoperability, but also your reported Quality measures and Improvement Activities. Failing to respond or to provide adequate evidence can lead to payment adjustments or forfeiture of incentives.

How to prepare? The best defense is a good offense: anticipate an audit before it happens. As mentioned, maintain your documentation diligently. Conduct internal mock audits - periodically review your own attestation package to ensure it's complete and that you could readily furnish it if asked. Double-check that EHR-generated summary reports correspond to the attestation numbers. It's also wise to stay informed on current audit targets; for example, OIG occasionally audits specific aspects (like verifying Medicaid Meaningful Use payments or checking if providers improperly claimed exclusions). By keeping an eye on OIG reports and CMS announcements, you can gauge where there might be extra scrutiny.

Finally, do not ignore an audit notice. If an audit letter arrives, respond promptly and thoroughly. If you're unsure how to respond, consult compliance experts or legal counsel experienced in CMS audits. Many professional organizations provide guidance on handling Meaningful Use/MIPS audits. Being proactive and organized will make the audit process less daunting. Remember, an audit is essentially about validating your good work - if you've truly met the requirements and saved the evidence, you should be able to demonstrate compliance and retain your incentive payments without issue.

Frequently Asked Questions (FAQs) about Meaningful Use

Q1. What is Meaningful Use in healthcare?
A: Meaningful Use is a term used to describe the effective utilization of certified electronic health record (EHR) technology to improve patient care. The concept was introduced under the 2009 HITECH Act, establishing objectives that eligible healthcare providers had to meet to qualify for federal EHR incentive payments. In practice, Meaningful Use criteria included core objectives like electronic prescribing, maintaining up-to-date problem lists, sharing electronic health information, and reporting clinical quality measures. The goal was to ensure EHRs were used in a "meaningful" way - not just for digital record-keeping, but to enhance care coordination, safety, and efficiency in the healthcare system. While the formal Meaningful Use programs (Medicare and Medicaid EHR Incentive Programs) have since ended or transitioned, the principles of Meaningful Use live on in current initiatives (such as MIPS's Promoting Interoperability), continuing to shape how providers use health IT to improve outcomes.

Q2. What are the 3 stages of Meaningful Use?
A: Meaningful Use was implemented in three stages, each with a specific focus:

Stage 1 (2011-2012): Data capture and sharing. Providers had to capture electronic health data (e.g., patient demographics, vital signs) and share information with patients and other providers. This stage established the basic EHR capabilities and reporting of certain clinical quality measures.
Stage 2 (2014-2015): Advanced clinical processes. The requirements became more stringent, emphasizing health information exchange between providers, e-prescribing, incorporating lab results, and giving patients secure online access to their health data. Stage 2 also introduced new objectives like electronic medication administration records and sending care summaries during transitions of care.
Stage 3 (2016-2018): Improved outcomes. The final stage focused on improving clinical outcomes. It required enhanced interoperability (greater exchange of data with registries and other clinicians), patient engagement (e.g., a percentage of patients actively accessing or receiving their health information electronically), and more robust public health reporting. Stage 3 also aligned with broader quality programs and set the foundation for the transition to the MIPS framework.

Each stage built upon the previous one, so providers needed to continue meeting the prior stage's requirements while adding new capabilities. By Stage 3, the aim was for EHR technology to be deeply integrated into care delivery, leading to measurable improvements in health care quality and efficiency.

Q3. Is Meaningful Use still required in 2025?
A: The original Meaningful Use incentive programs per se are no longer standalone programs in 2025 - but their requirements still exist under new names. For Medicare providers, Meaningful Use was effectively replaced by the Promoting Interoperability (PI) category of the MIPS program in 2017. Eligible clinicians (such as physicians) now fulfill what used to be Meaningful Use objectives by participating in MIPS and meeting the PI measures (e.g., e-prescribing, health information exchange, providing patient access, etc.). For Medicaid, the EHR Incentive Program (Medicaid Meaningful Use) concluded in 2021 when federal funding for that program ended. After 2021, Medicaid agencies no longer offer incentive payments for Meaningful Use.

However, the essence of Meaningful Use - using EHR technology to improve care - is very much alive in 2025. Hospitals and Critical Access Hospitals have a Medicare Promoting Interoperability Program (for hospital EHR use), and clinicians have MIPS. So, while you may not hear the term "Meaningful Use" in recent rules, providers are still required to use certified EHRs and report on objectives that originated from Meaningful Use. Failure to do so (for example, not meeting Promoting Interoperability requirements under MIPS) can result in financial penalties (Medicare payment reductions). In summary, Meaningful Use as a program name has evolved, but the requirements persist under Promoting Interoperability/MIPS, and providers must continue to comply with them in 2025.

Q4. What is MIPS and how does it relate to Meaningful Use?
A: MIPS stands for Merit-Based Incentive Payment System, a performance-based payment program for Medicare Part B clinicians established by MACRA in 2015. MIPS consolidates several prior programs (Meaningful Use, PQRS, and the Value-Based Modifier) into one framework. Under MIPS, clinicians are scored on four categories: Quality, Cost, Improvement Activities, and Promoting Interoperability (PI). The Promoting Interoperability category is directly derived from the Meaningful Use program - in essence, it is "Meaningful Use 2.0" for Medicare clinicians. It carries forward the requirement to use CEHRT and meet various EHR-based objectives. For example, reporting immunization data to a public health registry or conducting a security risk analysis are part of the PI requirements (these were also Meaningful Use objectives).

MIPS uses a composite performance score (0-100) to determine payment adjustments on Medicare claims - positive, negative, or neutral. The PI (formerly Meaningful Use) category typically comprises 25% of that MIPS score. Thus, good performance in what used to be called Meaningful Use is necessary to avoid penalties and potentially earn bonuses. In summary, Meaningful Use for Medicare didn't disappear; it became one piece of the MIPS puzzle. Clinicians now report their EHR usage measures through MIPS. If you were familiar with Meaningful Use, you'll find MIPS PI very similar - though MIPS offers more flexibility overall by balancing multiple performance areas. It's important for providers to understand this relationship so that they continue meeting those EHR objectives under the MIPS program. Notably, Promoting Interoperability in MIPS places a strong emphasis on interoperability (data exchange) and reducing provider burden, reflecting lessons learned from the Meaningful Use era.

Q5. How can I prepare for a Meaningful Use or MIPS audit?
A: Preparation for a Meaningful Use or MIPS audit starts with robust record-keeping and internal compliance checks. Here are some key steps and best practices:

Maintain Organized Documentation: Keep a dedicated file (digital or physical) for each attestation year. Include screenshots, reports, and correspondence that substantiate each measure you attested "yes" to or each percentage reported. Make sure you have proof for core objectives like patient access, health information exchange, clinical decision support, etc., as well as your Security Risk Analysis report and any policies or sign-offs required.
Retain Records for 6 Years: CMS requires participants to retain documentation for six years post-attestation. Have a secure archive for older records (e.g., if you attested in 2019, keep everything at least until 2025 or beyond). This includes any emails or letters from public health registries, EHR vendor certificates, and even your attestation confirmation from CMS or state systems.
Audit Simulation: Periodically perform a self-audit. Pretend you've been selected for an audit and attempt to compile all requested materials. Identify any gaps in documentation before an official auditor does. This exercise can be enlightening - for instance, you might realize you need a better screenshot of a particular data submission, or that a report you assumed was saved cannot be easily reproduced later.
Responding to Audit Notices: If you are contacted for an audit, respond promptly and professionally. The notification will list what the auditor wants (e.g., specific reports, screenshots, security policies). Provide everything requested, in an organized manner. It can help to include a cover letter or index explaining how you have fulfilled each request, referencing the attached documents. Always send data securely (follow instructions on how to upload or transmit files, as they may contain PHI).
Seek Expert Help if Needed: If an audit uncovers potential non-compliance (for example, you discover that a measure was mistakenly attested to), consider consulting a healthcare compliance expert or legal counsel. There may be steps you can take to mitigate penalties. Also, if you're unsure how to compile certain evidence, your EHR vendor or a compliance consultant may assist in retrieving log files or database extracts to satisfy the auditor's request.

In summary, the best way to handle an audit is to be ready for it at all times. By treating your Meaningful Use/Promoting Interoperability compliance as an ongoing process (with good documentation habits and periodic reviews), an audit becomes less a scramble and more an opportunity to demonstrate your diligence. Most providers who genuinely meet the requirements and prepare well come through audits without loss of incentive payments. Being organized, honest, and responsive are your best tools in passing an audit with flying colors.

Sources:

Office of the National Coordinator for Health IT - EHR Incentive Programs (Meaningful Use) Historycms.gov cms.gov
Centers for Medicare & Medicaid Services - Promoting Interoperability Programs Overviewcms.gov cms.gov
HealthIT.gov - MACRA / MIPS Transition Detailssharearkansas.com
Massachusetts eHealth Institute - Meaningful Use Overview and Stagesmehi.masstech.org mehi.masstech.org
Healthcare Compliance Pros - 5 Meaningful Use Facts and Tips (Original Article)healthcarecompliancepros.com healthcarecompliancepros.com
Healthcare Compliance Pros - Advancing Care Information (MIPS) Factshealthcarecompliancepros.com healthcarecompliancepros.com
American College of Allergy, Asthma & Immunology - MIPS Audit Announcement 2023college.acaai.org college.acaai.org
HIPAA Security Rule - 45 CFR 164.308(a)(1) Risk Analysis Requirementlaw.cornell.edu
HHS Office for Civil Rights - Guidance on Risk Analysishhs.gov