Milestone Attestation Documentation Requirements

Participating providers will complete an attestation process to finalize achievement of each program milestone. This process will entail a secure email communication with the MDAAP team in which the authorized provider will attest to the achievement of the program milestone and also submit the necessary supporting documentation. In some cases, the MDAAP team will request documentation from VITL or the business support vendor to substantiate milestone achievement. While completion of all program milestones is voluntary, associated incentive payments will only be distributed upon documented completion of milestones, which includes submission and approval of all required supporting documentation.

The table below describes the documentation necessary to support attestation of each program milestone and also contains guidance on documentation each provider should retain for a period of six (6) years in the event a provider is selected for post-payment audit.

Milestone Documentation Requirements

Program Track	Incentive Payment Milestone	Documentation for Attestation and Retention
All tracks	MDAAP Eligibility Requirements	Attestation: Medicaid patient volume data Retention: Providers should maintain complete documentation of Medicaid patient volume including all data elements contained in the Medicaid Volume Calculation spreadsheet.
All tracks	MDAAP Participation Agreement	Attestation: Copy of signed Participation Agreement
Tracks 1 & 2	Signed Scope of Services Agreement to implement CEHRT or EHR Lite system	Attestation: Copy of signed Scope of Services Agreement
Track 1	New CEHRT Technology Purchase	Attestation: Copy of the executed vendor agreement, dated on or after 10/1/22, that must contain the vendor’s 2015 Cures Edition certification ID and the number of licensed users for the system.
Track 2	New EHR Lite/Other Program-Eligible System Purchase and Completion of Go-Live Checklist	Attestation: Copy of the executed vendor agreement, dated on or after 10/1/22, that must contain vendor-supplied documentation of active HITRUST certification, as maintained by the HITRUST Alliance, and the number of licensed users for the system. Additionally, a Go-Live Checklist signed by the business support vendor is required.
Tracks 1 – 4	Security Risk Analysis (SRA)	Attestation: Copy of completed SRA template. Assessment must have been completed within the 12 months preceding milestone attestation. A complete SRA will include an asset inventory, evidence that the SRA addressed encryption/security of data, and a final report that identifies risks, deficiencies, and a corrective action plan (CAP). It is not necessary that all deficiencies be mitigated at the time of attestation, but there should be a plan in place.
Tracks 1	New CEHRT Solution or EHR Lite Solution Go-Live	Attestation: Business support vendor attestation in the form of a go-live checklist signed by the assigned business support resource.
All Tracks except Track 3	VITLAccess Credentialing, Training, Usage	Attestation: Executed Vermont Health Information Exchange (VHIE) Services Agreement with VITL as well as verification by VITL of active user account(s), user access privileges, and evidence showing the provider has used VITL access for at least one client on or after 10/1/22.
Tracks 1 & 3	Vendor Contract for ADT Interface	Attestation: Executed copy of the EHR vendor statement of work (SOW), dated on or after 10/1/22, which must spell out the specific interface(s) in scope; and executed Vermont Health Information Exchange (VHIE) Services Agreement with VITL
Tracks 1 & 3	Vendor Contract for CCD Interface	Attestation: Executed copy of the EHR vendor statement of work (SOW), dated on or after 10/1/22, which must spell out the specific interface(s) in scope; and executed Vermont Health Information Exchange (VHIE) Services Agreement with VITL
Tracks 1 & 3	Go-Live Achieved and Sending Production Encounter Data (ADT) to the VHIE	Attestation: Email from VITL containing Go-Live date or stating production data is being sent, or written verification by VITL project lead that interface(s) have been successfully moved from Test Environment to Production Environment and are sending production messages on or after 10/1/22.
Tracks 1 & 3	Go-Live Achieved and Sending Production Clinical Data (CCD) to the VHIE	Attestation: Email from VITL containing Go-Live date or stating production data is being sent, or written verification by VITL project lead that interface(s) have been successfully moved from Test Environment to Production Environment and are sending production messages on or after 10/1/22.
Track 4	Signed Scope of Services Agreement to explore connection to the VHIE	Attestation: Copy of the Scope of Services Agreement with VITL that outlines the specific type of integration method to be pursued.
Track 4	Vendor contract for EHR Lite or other system to connect to the VHIE	Attestation: Executed copy of the EHR Lite or other system vendor statement of work (SOW), which must spell out the specific interface(s) or integration methods in scope that aligns with the VITL Scope of Services Agreement
Track 4	Go-live achieved and sending production data to the VHIE	Attestation: Email from VITL containing Go-Live date or stating production data is being sent, or written verification by VITL project lead that interface(s) or other integration type files have been successfully moved from Test Environment to Production Environment and are sending production data.