Hi Don, I can help answer your questions:
1) the security component of the core measures. there is specific language that the office of CMS is using to determine what constitutes a secure system. Some people erroneously believe it is simply having passwords on your computer but it was painful for me to learn it is much much more than this. Some feel they can just click the "attest" button and be done with it. But the process is actually written by statute which is (not surprisingly) very complex. I have a toolkit that my Regional Extension Center in Maine gave me. I'm happy to email it to you. If you don't want this, I would encourage you to contact the REC in your state. There are numerous files in the toolkit and can't be posted here. Please either PM or email me if you would like these tools. It will take a great deal of effort to truly comply. I did it myself. It would be money well spent to employ someone else to do it, if you don't have time. It is definitely not overkill to keep record of this process for this core measure documented. In fact if you are audited, you will be required to prove that you conducted an internal audit of your security. You are also required to demonstrate which policy you enacted to address any deficiency in your security. This is no doubt the toughest measure to meet correctly with the proper documentation. However it's definitely doable. If you are to poll other physicians, I'm quite certain you will find a majority who did not attest to this correctly. It's ultimately up to you if you wish to do this measure correctly, or trust that simply having a firewall and passwords will protect you in an audit.
2) HTN CQM. You are correct in assuming this means two visits within the chosen report period, in your case attesting for the 1st time is 90 day minimum. However you are allowed to collect data for a longer than 90 day term if you wish. are you attesting to 2011 or 2012? If 2012, you are all set. Simply report for the whole year or most of the year. If you only report on 90 days, surprisingly you will probably have at least one or two visit you. You only need one to make this denominator greater than zero and therefore have passable numbers. Don't worry it will most likely happen. Make sure however that you use ICD9 code 401.1 when selecting diagnosis for HTN patients in order to tell AC that this patient has HTN. Otherwise it won't track them properly.
again let me know if you want the security toolkit, I'm happy to send it. The files are huge, over 10MB. And most email systems won't accept files >10MB. I would split it up into two zip files for email, or mail you a CD ROM. Just let me know.
