Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 170

RIN 0991-AB58

Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology

AGENCY:

Office of the National Coordinator for Health Information Technology (ONC), Department of Health and Human Services.

ACTION:

Final rule.

SUMMARY:

The Department of Health and Human Services (HHS) is issuing this final rule to complete the adoption of an initial set of standards, implementation specifications, and certification criteria, and to more closely align such standards, implementation specifications, and certification criteria with final meaningful use Stage 1 objectives and measures. Adopted certification criteria establish the required capabilities and specify the related standards and implementation specifications that certified electronic health record (EHR) technology will need to include to, at a minimum, support the achievement of meaningful use Stage 1 by eligible professionals, eligible hospitals, and/or critical access hospitals (hereafter, references to “eligible hospitals” in this final rule shall mean “eligible hospitals and/or critical access hospitals”) under the Medicare and Medicaid EHR Incentive Programs. Complete EHRs and EHR Modules will be tested and certified according to adopted certification criteria to ensure that they have properly implemented adopted standards and implementation specifications and otherwise comply with the adopted certification criteria.

DATES:

Effective Date:

This final rule is effective August 27, 2010. The incorporation by reference of certain publications listed in the rule is approved by the Director of the Federal Register as of August 27, 2010.

FOR FURTHER INFORMATION CONTACT:

Steven Posnack, Director, Federal Policy Division, Office of Policy and Planning, Office of the National Coordinator for Health Information Technology, 202-690-7151.

SUPPLEMENTARY INFORMATION:

Acronyms

ANSI American National Standards Institute

CAH Critical Access Hospital

CCD Continuity of Care Document

CCHIT Certification Commission for Health Information Technology

CCR Continuity of Care Record

CDA Clinical Document Architecture

CDC Centers for Disease Control and Prevention

CFR Code of Federal Regulations

CGD Certification Guidance Document

CMS Centers for Medicare & Medicaid Services

CPOE Computerized Provider Order Entry

EHR Electronic Health Record

FIPS Federal Information Processing Standards

HHS Department of Health and Human Services

HIPAA Health Insurance Portability and Accountability Act of 1996

HIT Health Information Technology

HITECH Health Information Technology for Economic and Clinical Health

HITSP Healthcare Information Technology Standards Panel

HL7 Health Level Seven

ICD International Classification of Diseases

ICD-9-CM International Classification of Diseases, 9th Revision, Clinical Modification

ICD-10-PCS International Classification of Diseases, 10th Revision, Procedure Coding System

ICD-10-CM International Classification of Diseases, 10th Revision, Clinical Modification

IHS Indian Health Service

LOINC Logical Observation Identifiers Names and Codes

NCPDP National Council for Prescription Drug Programs

NLM National Library of Medicine

OCR Office for Civil Rights

OMB Office of Management and Budget

ONC Office of the National Coordinator for Health Information Technology

PHSA Public Health Service Act

PQRI Physician Quality Reporting Initiative

REST Representational state transfer

RFA Regulatory Flexibility Act

SNOMED-CT Systematized Nomenclature of Medicine Clinical Terms

SOAP Simple Object Access Protocol

UCUM Unified Code for Units of Measure

UMLS Unified Medical Language System

XML eXtensible Markup Language

Table of Contents

I. Background

A. Legislative History

B. Regulatory History

1. Initial Set of Standards, Implementation Specifications, and Certification Criteria for EHR Technology Interim Final Rule

2. Interdependencies With Other HITECH Provisions and Relationship to Other Regulatory Requirements

II. Overview of the Final Rule

III. Section-by-Section Discussion of the Final Rule and Response to Comments

A. Introduction

B. General Comments

C. Definitions—§ 170.102

1. Definition of Disclosure

2. Definition of Standard

3. Definition of Implementation Specification

4. Definition of Certification Criteria

5. Definition of Qualified EHR

6. Definition of Complete EHR

7. Definition of EHR Module

8. Definition of Certified EHR Technology

9. Definition of Human Readable Format

10. Definition of User

D. Final Rule Amendments to Adopted Standards, Implementation Specifications, and Certification Criteria §§ 170.202, 170.205, 170.207, 170.210, 170.302, 170.304, 170.306

1. Flexibility and Innovation

2. Transport Standards

3. Certification Criteria and Associated Standards and Implementation Specifications

a. General Certification for Complete EHRs or EHR Modules—§ 170.302

b. Specific Certification for Complete EHRs or EHR Modules Designed for an Ambulatory Setting—§ 170.304

c. Specific Certification for Complete EHRs or EHR Modules Designed for an Inpatient Setting—§ 170.306

d. Adoption and Realignment of Certification Criteria to Support the Final Requirements for Meaningful Use Stage 1.

E. Additional Comments

F. Comments Beyond the Scope of This Final Rule

IV. Collection of Information Requirements

V. Regulatory Impact Analysis

A. Introduction

B. Why is this rule needed?

C. Executive Order 12866—Regulatory Planning and Review Analysis

1. Comment and Response

2. Executive Order 12866 Final Analysis

a. Costs

b. Benefits

D. Regulatory Flexibility Act Analysis

1. Comment and Response

2. Final RFA Analysis

E. Executive Order 13132—Federalism Regulation Text

I. Background

A. Legislative History

The Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5), was enacted on February 17, 2009. The HITECH Act amended the Public Health Service Act (PHSA) and established “Title XXX—Health Information Technology and Quality” to improve health care quality, safety, and efficiency through the promotion of health information technology (HIT) and the electronic exchange of health information. Section 3004(b)(1) of the PHSA requires the Secretary of Health and Human Services (the Secretary) to adopt an initial set of standards, implementation specifications, and certification criteria by December 31, 2009 to enhance the interoperability, functionality, utility, and security of

health information technology. Section 3004(b)(1) of the PHSA also permits the Secretary to adopt the initial set of standards, implementation specifications, and certification criteria on an interim, final basis.

B. Regulatory History

1. Initial Set of Standards, Implementation Specifications, and Certification Criteria for EHR Technology Interim Final Rule

On December 30, 2009, the

Federal Register

made available for public inspection, an interim final rule (the Interim Final Rule) with a request for comments, which adopted an initial set of standards, implementation specifications, and certification criteria. As noted in this rulemaking (75 FR 2014), we described how Congress fundamentally tied the adopted standards, implementation specifications, and certification criteria to the incentives available under the Medicare and Medicaid EHR Incentive Programs by requiring the meaningful use of Certified EHR Technology. Congress outlined several goals for meaningful use, one of which included the “use of certified EHR technology in a meaningful manner.” This means that to qualify for incentives, an eligible professional or eligible hospital must both adopt Certified EHR Technology and demonstrate meaningful use of this technology.

The initial set of standards, implementation specifications, and certification criteria adopted in the Interim Final Rule established the capabilities that Certified EHR Technology would need to include to, at a minimum, support eligible professionals' and eligible hospitals' efforts to achieve what had been proposed for meaningful use Stage 1 under the Medicare and Medicaid EHR Incentive Programs proposed rule.

2. Interdependencies With Other HITECH Provisions and Relationship to Other Regulatory Requirements

In addition to our discussion of how the standards, implementation specifications, and certification criteria adopted in the Interim Final Rule correlated with the Medicare and Medicaid EHR Incentive Programs proposed rule, we also discussed our approach to align adopted standards, implementation specifications, and certification criteria with new and pending HITECH Act regulatory actions and with other already established regulatory requirements. We also explained our approach for aligning these standards, implementation specifications, and certification criteria with: the adopted standard and certification criterion related to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule Accounting of Disclosures Regulation under the HITECH Act; alignment with the HIPAA Privacy and Security Regulations; the Medicare Part D Electronic Prescribing Regulations; and the HIPAA Transactions and Code Sets Standards Regulations.

II. Overview of the Final Rule

We are amending part 170 of title 45 of the Code of Federal Regulations (CFR) to complete the adoption of the initial set of standards, implementation specifications, and certification criteria as required by section 3004(b)(1) of the PHSA and realign them with the final objectives and measures established for meaningful use Stage 1. After reviewing and considering public comments on our adopted standards, implementation specifications, and certification criteria, we have made several revisions to support the final meaningful use objectives and measures, clarify certain certification criteria to resolve identified technical challenges related to some of the standards and implementation specifications we adopted, and to provide for additional flexibility.

III. Section-by-Section Discussion of the Final Rule and Response to Comments

A. Introduction

This section summarizes the nearly 400 timely comments received by ONC related to the Interim Final Rule. In some cases, due to the simultaneous publication and topical similarity of the notice of proposed rulemaking for meaningful use Stage 1, commenters inadvertently submitted comments to our regulation docket on

regulations.gov

instead of the Centers for Medicare & Medicaid Services (CMS) regulation docket, and vice versa. Recognizing this oversight, CMS and ONC shared misplaced comments between the offices and we included within our review all comments that could be reasonably identified as comments on the Interim Final Rule.

We have organized the preamble of this final rule along the following lines. First, we respond to general comments, including those related to the scope and applicability of the final rule that we believe are necessary to clarify upfront. Next, we respond to comments regarding the definitions of certain defined terms. We then respond to public comments on each certification criterion, and where an adopted certification criterion also references standards and implementation specifications, we include our response to public comments on the related standards and implementation specifications. These concepts were separately discussed in the Interim Final Rule and we believe that discussing the certification criteria together with associated standards and implementation specifications will improve the clarity of the final rule and will allow us to more fully address public comments in a broader context. We include the following table at the beginning of the discussion of each certification criterion section to illustrate the final meaningful use Stage 1 objectives for eligible professionals and eligible hospitals and to show how we have revised adopted certification criteria in response to the revised meaningful use objectives and measures and public comments.

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Eligible Professional and/or Eligible Hospital & Critical Access Hospital Objective

Eligible Professional and/or Eligible Hospital & Critical Access Hospital Measure

Interim Final Rule Text: Certification Criterion.

Final Rule Text: Certification Criterion.

Finally, in considering public comments on the Interim Final Rule, we analyzed whether we had structured the regulation text in an optimal and understandable manner. For several provisions, we received comments requesting additional clarification and we felt that the original regulatory structure contributed to the commenters' confusion. Because of those comments and in an effort to better structure the regulation text for future revisions, we have revised the structure conceptually to group content exchange standards and associated

implementation specifications and vocabulary standards, and separated them into different sections. In line with this “conceptual” restructuring, we have determined that specifying how a Complete EHR or EHR Module must comply with an adopted standard should be solely reflected in the certification criteria. As a result, several certification criteria have been revised to more clearly reflect how a Complete EHR or EHR Module must comply with adopted standards and, where applicable, the relevant adopted implementation specifications.

B. General Comments

Some commenters appear to have misinterpreted or misunderstood the scope of the Interim Final Rule and the applicability of the adopted standards, implementation specifications, and certification criteria. We would therefore like to clarify these concepts at the beginning of this final rule and are providing the following responses to the relevant comments.

Comments.

Some commenters seem to have construed the adoption of standards, implementation specifications, and certification criteria as including requirements that apply to the health care providers that will use the Certified EHR Technology, rather than as required capabilities of the Certified EHR Technology itself. These commenters, for instance, questioned whether entities using Certified EHR Technology must comply with adopted standards and implementation specifications when electronically using or transmitting health information within or among components of the legal entity or alternatively whether the standards apply solely to transmissions between legal entities. Other commenters specifically requested clarification regarding the adopted standards that are required to be used internally within each provider's office, institution, or closed system and which standards are required for purposes of electronically exchanging health information among such entities. Some comments implied that the Interim Final Rule should have specified when an eligible professional or eligible hospital would be required to use adopted standards. One commenter specifically requested that the adopted standards apply only to the electronic exchange of health information between legal entities.

Response.

As stated in § 170.101, we specify that “[t]he standards, implementation specifications, and certification criteria adopted in this part apply to Complete EHRs and EHR Modules and the testing and certification of such Complete EHRs and EHR Modules.” In §§ 170.200 and 170.300, we further specify that “[t]he standards and implementation specifications adopted in this part apply with respect to Complete EHRs and EHR Modules” and that “[t]he certification criteria adopted in this subpart apply to the testing and certification of Complete EHRs and EHR Modules.”

The purpose of this final rule, therefore, is to adopt standards, implementation specifications, and certification criteria to test and certify that a Complete EHR or EHR Module provides certain capabilities, and where applicable, to require that those capabilities be implemented in accordance with adopted standards and implementation specifications. The adopted standards, implementation specifications, and certification criteria were not intended to impose independent requirements on the entities using Certified EHR Technology. Unlike certain other regulatory requirements to which eligible professionals or eligible hospitals may be subject, it is not within the intended scope of this final rule to specify the requirements for entities using Certified EHR Technology.

We understand the commenters' point though that an adopted standard and implementation specification could apply equally to electronic transactions between legal entities as well as to transmissions within an entity. This final rule, however, is not intended to specify the conditions under which adopted standards and implementation specifications must be used, only that a Complete EHR or EHR Module, in order to be certified, must include specified capabilities that are implemented in accordance with those standards, implementation specifications, and certification criteria. We anticipate that other regulations, as well as the clinical and business needs of HIT users, anticipated efficiencies and desired quality improvements, and technical, architectural, and enterprise limitations will determine when entities will utilize the capabilities required of Certified EHR Technology. Additionally, we would note that Complete EHRs and EHR Modules will, in many cases, be tested and certified independent of the environment within which they will be implemented. Consequently, specifying when an entity that implements Certified EHR Technology must utilize a particular capability in its operating environment exceeds the scope of this rule.

To further demonstrate this point, Certified EHR Technology implemented by an eligible professional will need to possess the capability to generate an electronic prescription according to one of the standards we have adopted. To specify the contexts in which an electronic prescription (generated according to the adopted standard) must be transmitted would go beyond the scope of certification. Moreover, it would raise a more serious and practical consideration. Attempting to specify when entities must utilize the capabilities of Certified EHR Technology would add an unnecessary level of complexity to this rule and create the potential for conflicts with other regulations promulgated by the HHS. For instance, HHS has already promulgated at least two sets of regulations identifying when health care providers need to use specific standards and the contexts in which those standards must be used. Under the HIPAA Transactions and Code Sets Standards regulations, HHS specifies at 45 CFR 162.923(a) that “[e]xcept as otherwise provided in this part, if a covered entity conducts with another covered entity (

or within the same covered entity

), using electronic media, a transaction for which the Secretary has adopted a standard under this part, the covered entity must conduct the transaction as a standard transaction.” (Emphasis added.) Consequently, in the HIPAA context, covered entities must use adopted transaction standards for covered transactions both within the covered entities and with outside entities. The Medicare Part D electronic-prescribing (e-prescribing) regulations implement a different approach for certain e-prescribing transactions. Health care providers that electronically prescribe Part D drugs for Part D eligible individuals under 42 CFR 423.160(a)(3)(iii), “may use either HL7 messages or the NCPDP SCRIPT Standard to transmit prescriptions or prescription-related information internally when the sender and the recipient are part of the same legal entity. If an entity sends prescriptions outside the entity (for example, from an HMO to a non-HMO pharmacy), it must use the adopted NCPDP SCRIPT Standard or other applicable adopted standards.” Therefore, we believe that it is unnecessary and outside of the intended scope of this rule to specify the contexts or circumstances under which adopted standards and implementation specifications must be utilized.

Moreover, we anticipate that future meaningful use objectives and measures will specify, as necessary and appropriate, the conditions under which certain health care providers will need

to use adopted standards and implementation specifications. The context, for instance, governing when a standard must be used will, in some cases, be directly related to whether and how an eligible professional or eligible hospital must meaningfully use Certified EHR Technology. For example, a final meaningful use Stage 1 objective requires that eligible professionals and eligible hospitals use Certified EHR Technology to record demographics including, among other fields, race and ethnicity. While we have adopted the race and ethnicity codes published by the Office of Management and Budget (OMB), in the context Medicare and Medicaid EHR incentive programs, the

meaningful use of Certified EHR Technology

will dictate whether such codes must be used “inside” an organization. Another example of when a meaningful use objective establishes the context in which a standard must be used is the objective that requires eligible professionals and eligible hospitals to use Certified EHR Technology to maintain an up-to-date problem list of current and active diagnoses. The measure associated with this objective requires that entries be recorded in “structured data” and in this context we adopted ICD-9 or SNOMED-CT® to provide that structure. As a result, Certified EHR Technology must be capable of using ICD-9 or SNOMED-CT® when an eligible professional or eligible hospital seeks to maintain an up-to-date problem list.

In other instances, the Department does not specify explicitly in regulation the context for certain meaningful use objectives and whether meaningful use of Certified EHR Technology would require the use of a standard for electronic transactions solely between two different legal entities, or for all transactions, or for most transactions with certain exemptions.

Comments.

Several commenters requested that we provide more information about the standards we expect the Secretary to adopt in order to support future stages of meaningful use. These commenters noted, along with referencing the timelines for making changes to HIT, that it would benefit the HIT industry if we could provide a roadmap, framework, or more descriptive “glide path” for future standards adoption activities.

Response.

We anticipate that future stages of meaningful use will require us to adopt additional standards, implementation specifications, and certification criteria. We also expect that standards we have adopted will continue to be revised and updated over time, to reflect current technology, changing medical practice and regulatory requirements. We will therefore need to continue to harmonize those adopted standards with other standards to support interoperability. We anticipate that the standards required to support future stages of meaningful use will need a framework that supports harmonization across different meaningful use scenarios and that supports early real world testing. We plan to work closely with the HIT Standards Committee to develop a forward looking agenda and to make known in advance the types of standards, implementation specifications, and certification criteria on which we will seek recommendations from the HIT Standards Committee. We believe this will benefit the HIT industry by providing greater transparency of the standards adoption activities and will serve as an early indication for the public of candidate standards that are being identified for possible adoption.

C. Definitions—§ 170.102

In this section, we respond to public comment on the definitions adopted in the Interim Final Rule. We address the definition of Certified EHR Technology last after we provide clarifications related to the definitions of Complete EHR and EHR Module.

1. Definition of Disclosure

Comments.

A few commenters noted that the definition of

disclosure

was too broad or asked that we refine the adopted definition to be more limited and to only apply in certain circumstances. One commenter noted that this was a new definition.

Response.

As we explained in the preamble of the Interim Final Rule, this definition repeated the text specified at 45 CFR 160.103 (the General Provisions section for the HIPAA regulations). Because the Interim Final Rule created a new part in Title 45 of the CFR, the definition of disclosure as it is used in the HIPAA regulations would not necessarily have applied to our use of the term in this rule. Therefore, to prevent unnecessary ambiguity for the regulated community, we adopted the definition of the term as it is defined at 45 CFR 160.103.

In light of public comment and to prevent any future regulatory inconsistency that would require rulemaking to correct, we have revisited our approach of repeating the text of the definition of disclosure from 45 CFR 160.103 and have decided to cross reference 45 CFR 160.103 in the definition of disclosure. The final definition will read: disclosure is defined as it is in 45 CFR 160.103.

2. Definition of Standard

Comment.

A commenter stated that our definition of standard was comprehensive from a technical perspective, but believed the definition was incomplete from a policy perspective. The commenter argued that for interoperability to be successful, it was essential that standards be created through collaborative, consensus-based processes that take into consideration the needs and concerns of all interested stakeholders. For that reason, the commenter suggested, in order for the definition to be whole from both a technical and policy perspective, we should add to the definition the phrase “developed through the use of open, collaborative, consensus-based processes.”

Response.

While we appreciate the commenter's point, we believe that the proposed language is unnecessary and potentially problematic. Federal agencies are already required under the National Technology Transfer and Advancement Act of 1995 (NTTAA) (15 U.S.C. 3701

et seq.

) and OMB Circular A-119

1

to use, wherever practical, technical standards that are developed or adopted by voluntary consensus standards bodies to carry out policy objectives or activities, with certain exceptions. In drafting the Interim Final Rule, we briefly discussed relevant provisions of the NTTAA and OMB Circular A-119, our compliance with the statute and the Circular, and we requested comments on our approach to the selection of standards. We also explained that both the NTTAA and OMB Circular A-119 provide for certain exceptions to selecting only standards developed or adopted by voluntary consensus standards bodies, namely when doing so would be “inconsistent with applicable law or otherwise impractical.” In the Interim Final Rule, we identified those instances in which we had and had not adopted voluntary consensus standards. In the instances in which we had not adopted voluntary consensus standards, we provided two principal reasons: first, that in most cases a voluntary consensus standard that could meet the requisite technical goals was simply unavailable; and second, that to the extent a potentially equivalent voluntary consensus standard was available, the standard was too limiting and did not meet our policy goals, including allowing for greater innovation by the industry. In

this final rule, we have adopted only voluntary consensus standards, except for two government-unique standards (CMS Physician Quality Reporting Initiative (PQRI) 2009 Registry XML Specification and the Office of Management and Budget Standards for Maintaining, Collecting, and Presenting Federal Data on Race and Ethnicity), a functional standard relating to vocabularies included in RxNorm, and the specified standards to protect electronic health information. We are aware of no voluntary consensus standards that would serve as alternatives to these standards for the purposes that we have identified. We encourage the HIT Standards Committee to obtain public input, hold hearings on, and recommend to the National Coordinator standards that have been developed or adopted by voluntary consensus standards bodies.

1

http://www.whitehouse.gov/omb/circulars_a119.

3. Definition of Implementation Specification

We did not receive any comments applicable to the definition of implementation specification and consequently did not make any changes to the definition.

4. Definition of Certification Criteria

Comments.

One commenter expressly stated its support for our definition of certification criteria.

Response.

We appreciate the commenter's support for our definition of certification criteria and have not made any changes to the definition in this final rule.

5. Definition of Qualified EHR

Comments.

A couple of commenters asserted that there is uncertainty in the industry with respect to what constitutes an EHR due both to the seemingly inconsistent definitions of terms in the HITECH Act and to the alternative definitions published by different organizations and associations. The commenters made specific reference to the definition of “Qualified Electronic Health Record” (“Qualified EHR”) at section 3000 of the PHSA and to the term “EHR” found in the HITECH Act at section 13400 of Subtitle D. The latter defines EHR as “an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized clinicians and staff.” The former defines Qualified EHR as “an electronic record of health-related information on an individual that: (1) Includes patient demographic and clinical health information, such as medical history and problem lists; and (2) has the capacity: (i) to provide clinical decision support; (ii) to support physician order entry; (iii) to capture and query information relevant to health care quality; and (iv) to exchange electronic health information with, and integrate such information from other sources.” Both commenters recommended that the definition of Qualified EHR be clarified with one commenter suggesting that the definition should follow the definition of EHR as it relates to health care providers.

Response.

We appreciate these comments and recognize that the existence of multiple terms that include the word “EHR” can be confusing. However, we believe that Congress intended for HHS to apply the definition of a Qualified EHR found in section 3000 of the PHSA to this regulation for specific reasons that cannot be overlooked. As a result, we have decided not to adopt the recommendation to follow the definition of the term EHR that is found in Subtitle D of the HITECH Act. We discuss additional responses to comments on the definition of Qualified EHR below.

Comments.

A few commenters requested that we expand the definition of Qualified EHR to include a variety of additional functionality and that a Qualified EHR be able to comply with business or legal requirements. These comments requested that we add required elements for an EHR to constitute a Qualified EHR, including that the EHR: Have a record-keeping capability for legal purposes; include certain requirements for usability; enable health care providers to perform several other actions not specified in the definition; and that certain elements of patient demographic information be specified.

Response.

We understand the rationale behind these commenters' suggestions, but we do not believe that it is necessary to add more prerequisite capabilities to the definition of Qualified EHR. We believe Congress defined Qualified EHR to include a minimum level of capabilities. Furthermore, to meet the definition of Certified EHR Technology, a Qualified EHR must be certified in accordance with a certification program established by the National Coordinator. As a result, we believe that any additional capabilities a Qualified EHR would need to possess to allow an eligible professional or eligible hospital to be in a position to qualify for incentive payments under the Medicare and Medicaid EHR incentive programs will be more appropriately addressed through the Secretary's adoption of additional standards, implementation specifications, and certification criteria.

Comments.

Some commenters requested that we clarify some of the terms in the definition of Qualified EHR such as “capture,” “query,” “other sources,” and “relevant to health care quality” with respect to how they related to Certified EHR Technology. Another commenter expressly stated that if we only intended to repeat the statutory definition of Qualified EHR without modification, we should at least clarify the meaning of demographic information.

Response.

We do not believe that additional clarity is needed or desirable for such terms because the meanings are context specific. The intended meanings of these terms will depend significantly on the contexts in which the terms are used and the associated capabilities of the Certified EHR Technology. The terms' meanings may also be affected by any standards and implementation specifications that are associated with those capabilities and adopted. In certain circumstances, for instance, the meaning of the phrase “other sources” as used in the definition of Qualified EHR will depend on the specific context in which electronic health information is being integrated or exchanged, and perhaps on whether the source is external to or internal within the Complete EHR or the EHR Module. Similarly, the meanings of the terms or phrases “capture,” “query,” “relevant to health care quality” and “demographic” information may vary according the context of the required capabilities of the EHR technology. In each of these instances, we believe that the adopted certification criteria and meaningful use objectives and measures will provide these contexts, identify the associated required capabilities, and consequently clarify the intended meanings of these terms.

6. Definition of Complete EHR

Comments.

Some commenters supported our definition of Complete EHR and believed that it was understandable, sufficient, and reasonable. Other commenters, however, suggested that the definition of Complete EHR was too narrow, because the term is tied to only those certification criteria adopted by the Secretary. These commenters argued that the Complete EHR and the adopted certification criteria should be more comprehensive and should include functionality that is not presently required for a Complete EHR to achieve certification. Many of these commenters referenced the Health Level Seven (HL7) EHR System Functional Model (EHR-S

FM) and contended that what we had defined as a Complete EHR did not align with or include all of the functionality specified in the EHR-S FM. One commenter requested that we clarify what we meant by “we fully expect some EHRs to have capabilities beyond those addressed by certification criteria” when we made this point during our discussion of the definition of Complete EHR in the preamble of the Interim Final Rule. Other commenters recommended specific wording changes to the definition.

Response.

In the Interim Final Rule we defined Complete EHR to mean “EHR technology that has been developed to meet all applicable certification criteria adopted by the Secretary.” We clarified that the term Complete EHR is “meant to encompass EHR technology that can perform all of the applicable capabilities required by certification criteria adopted by the Secretary and distinguish it from EHR technology that cannot perform those capabilities.” We believe that commenters misunderstood the scope and purpose of the regulatory definition and believe that the definition effectively fulfills its regulatory purpose. We intend for the definition of Complete EHR to be used to clearly identify EHR technology as being able to perform, at a minimum, all of the applicable capabilities required by certification criteria adopted by the Secretary, and thereby, as providing eligible professionals or eligible hospitals with the technical capabilities they need to support their achievement of meaningful use of Certified EHR Technology. It is in this context that we view such EHR technology as “complete.”

We recognize that many commenters recommended a definition of “Complete EHR” that would be more comprehensive than the definition we provided. Many commenters contended that HIT exists and is available for eligible professionals and eligible hospitals to implement, and much of it includes a myriad of capabilities far surpassing the capabilities required to meet the definition of Complete EHR. We do not dispute that point. We also understand that the capabilities included in a Complete EHR, as defined for the purposes of this regulation, may not encompass all of the capabilities a specific eligible professional or eligible hospital or for that matter any health care provider, may deem essential to meet their unique business needs and use cases.

This definition, however,

does not

in any way preclude any additional capabilities from being included in a Complete EHR or implemented in a complementary fashion. The definition sets forth a floor, not a ceiling, and serves to signify that once tested and certified to all applicable certification criteria, a Complete EHR meets the definition of Certified EHR Technology. For this reason, we did not seek to craft this definition in a way that signified that a Complete EHR would be able to provide all of the capabilities a health care provider desired or deemed necessary, or that the entity's EHR could only include the capabilities for which the Secretary has adopted certification criteria. Nor did we define Complete EHR according to a particular functional model, because doing so would have been inconsistent with the regulatory purpose of the definition.

In light of public comment and to further clarify the regulatory purpose of the definition of Complete EHR as well as make clear that a Complete EHR should not be misinterpreted to mean EHR technology that is any more comprehensive than the certification criteria to which it was tested and certified, we have added the phrase “at a minimum” to the definition. The final definition of Complete EHR will therefore read “EHR technology that has been developed to meet, at a minimum, all applicable certification criteria adopted by the Secretary.”

As a related point, we would also note that an eligible professional or eligible hospital would need to use a capability that is included among the adopted certification criteria to meet the associated meaningful use objective or measure. The eligible professional or eligible hospital therefore could not attempt to use a capability that is superfluous to certification to demonstrate the meaningful use of “Certified EHR Technology.” We understand that the Medicare and Medicaid EHR Incentive Programs final rule discusses this issue more fully in several places, and we defer to those discussions concerning the requirements for achieving meaningful use of Certified EHR Technology.

Comment.

In the context of the definition of Complete EHR, one commenter asked for clarification regarding how many certification criteria a Complete EHR must be developed to meet.

Response.

For the purposes of meeting the definition of Complete EHR, EHR technology designed for an ambulatory setting (to be used by eligible professionals) must be certified to all of the certification criteria adopted at 45 CFR 170.302 and 45 CFR 170.304, and EHR technology designed for an inpatient setting (to be used by eligible hospitals) must be certified to all of the certification criteria adopted at 45 CFR 170.302 and 45 CFR 170.306.

7. Definition of EHR Module

Comments.

Numerous commenters strongly supported our inclusion of a modular approach to meet the definition of Certified EHR Technology. Many of these commenters saw this approach as a way to spur greater innovation in the HIT marketplace, provide more choices for health care providers, and generally broaden the appeal of HIT and expedite its adoption. Some commenters noted, however, that they believed the definition needed further clarification with respect to what would constitute an EHR Module. In most cases, these commenters provided examples of technologies that they believed should meet the definition of EHR Module and they sought confirmation that these technologies would meet the definition. Included among these technologies were radiology information systems (RIS), picture archiving and communication systems (PACS), PHRs, speech recognition software, electrocardiogram systems, remote patient monitoring (RPM) devices, and other electronic devices including non-health care devices.

Response.

In the Interim Final Rule, we defined an EHR Module to mean “any service, component, or combination thereof that can meet the requirements of at least one certification criterion adopted by the Secretary.” Consequently, EHR Modules, by definition, must provide a capability that can be tested and certified in accordance with at least one certification criterion adopted by the Secretary. Therefore, if an EHR Module does not provide a capability that can be tested and certified at the present time, it is

not

HIT that would meet the definition of EHR Module. We stress “at the present time,” because as new certification criteria are adopted by the Secretary, other HIT could be developed and then tested and certified in accordance with the new certification criteria as EHR Modules.

We encourage eligible professionals and eligible hospitals to use any and all HIT they believe will help make the health care they deliver more effective and efficient. However, unless the HIT is tested and certified to at least one certification criterion for use as part of Certified EHR Technology, it does not constitute an EHR Module for the purposes of this regulation. Eligible professionals and eligible hospitals are not prohibited from using or implementing this HIT, but again, at the present time, such HIT cannot

constitute an EHR Module and serve as a necessary component of Certified EHR Technology for eligible professionals or eligible hospitals to use when seeking to achieve meaningful use as defined in the Medicare and Medicaid EHR Incentive Programs final rule.

In response to these comments, we would also like to clarify our conceptualization of an EHR Module. An EHR Module could provide a single capability required by one certification criterion or it could provide all capabilities but one, required by the certification criteria for a Complete EHR. In other words, we would call HIT tested and certified to one certification criterion an “EHR Module” and HIT tested and certified to nine certification criteria an “EHR Module,” where ten certification criteria are required for a Complete EHR. We have not made any changes to the definition of EHR Module as a result of these comments or the comments addressed below.

Comment.

One commenter asked whether we meant to include in the definition of EHR Module “interfaces” that perform data mapping or transformation. The commenter raised this question while noting that some organizations use multiple interfaces to interconnect their HIT systems and that it would be an arduous task for these organizations to ensure that all individual interfaces are certified. Another commenter sought clarification regarding what we meant when we stated as an example in the Interim Final Rule that EHR Modules could be “an interface or other software program that provides the capability to exchange electronic health information.”

Response.

As discussed above, to meet the definition of EHR Module, HIT would need to provide a capability that could be tested and certified to at least one certification criterion. If a certification criterion has therefore been adopted that requires a particular capability for exchanging electronic health information, an interface or other software program that provides that capability could be tested and certified as an EHR Module. In many circumstances, an interface or program may provide valuable functionality, but not a capability for which a certification criterion has been adopted. For example, software implemented by an eligible professional that performs data translation or mapping between two databases or data sets may provide critical functionality, yet that software would not constitute an EHR Module. Similarly, interfaces between “HIT systems” may be critical to the functionality of the separate systems, but they themselves would not be EHR Modules.

In those circumstances in which an interface or other software program is an integral component of an EHR Module without which it would not be able to be tested and certified, then such interface or other software program, though not itself an EHR Module, would function as a critical piece of the overall EHR Module presented for testing and certification. For example, a software program that would permit an eligible professional or eligible hospital to electronically exchange health information with other eligible professionals or eligible hospitals could be tested and certified as an EHR Module, if it provides the capability to electronically exchange health information according to standards adopted by the Secretary. In this example, whatever comprises the software program would be considered part of the EHR Module that is tested and certified.

Finally, in situations where an eligible professional or eligible hospital believes that it has multiple HIT systems that would each meet the definition of EHR Module, we suggest that the eligible professional or eligible hospital evaluate whether these systems could be combined with other systems to constitute a Complete EHR. If they are capable of being combined to form a Complete EHR, it may be more expeditious and beneficial for an eligible professional or eligible hospital to simply seek Complete EHR testing and certification.

Comments.

A few commenters requested that we clarify how EHR Modules would be tested and certified to adopted privacy and security certification criteria. Other commenters asked whether we meant to allow for there to be EHR Modules that provided only privacy and security capabilities.

Response.

These comments pertain to the certification programs rule, and are outside of the scope of this rule. We therefore respond to these comments in the Temporary Certification Program final rule (75 FR 36158).

8. Definition of Certified EHR Technology

Comments.

Multiple commenters commended ONC for recognizing the need to certify EHR Modules and enabling certified EHR Modules to be used in combination to meet the definition of Certified EHR Technology. These commenters noted that this approach makes it clear that eligible professionals and eligible hospitals will have the flexibility to select certified EHR modules that are the most useful to them, and can achieve meaningful use either with combinations of certified HIT or a single EHR system. However, some commenters mentioned that the definition is unnecessarily ambiguous, and subject to possible alternative interpretations. Some commenters also commented on certain statements in the preamble regarding EHR Modules and queried how a proper combination of EHR Modules could be used to meet the definition of Certified EHR Technology. Other commenters, while acknowledging that adopted certification criteria will determine in part what constitutes Certified EHR Technology, urged ONC to revise the definition to include only patient care functionality. Finally, a few commenters offered specific word changes for the definition to improve its clarity.

Response.

In the Interim Final Rule, we defined Certified EHR Technology to mean “a Complete EHR or a combination of EHR Modules, each of which: (1) Meets the requirements included in the definition of a Qualified EHR; and (2) Has been tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary.” With respect to a combination of EHR Modules, we clarified in the preamble of the Interim Final Rule that:

As long as each EHR Module has been separately tested and certified in accordance with the certification program established by the National Coordinator * * * to all of the applicable certification criteria adopted by the Secretary, a proper combination of certified EHR Modules could meet the definition of Certified EHR Technology. To clarify, we are not requiring the certification of combinations of certified EHR Modules, just that the individual EHR Modules combined have each been certified to all applicable certification criteria in order for such a “combination” to meet the definition of Certified EHR Technology.

Many commenters appeared to be confused by the inclusion of “each of which” in the definition of Certified EHR Technology. Other commenters also stated that “each of which” was awkwardly placed, making it difficult to interpret how the combination of EHR Modules must satisfy the subsequent requirements of the definition. This confusion also made it difficult to understand the clarifying remarks reiterated above regarding our intention to avoid implying that a combination of certified EHR Modules had to be certified a second time when a proper combination had been created. We generally agree with these comments and are revising the definition slightly

to avoid this ambiguity and to clarify that the definition of Certified EHR Technology can be met in either of two ways.

The first way that the definition of Certified EHR Technology can be met is for a Complete EHR to: (1) Meet the requirements included in the definition of a Qualified EHR, and (2) be tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary. The second way that the definition of Certified EHR Technology can be met is if each constituent EHR Module of a combination of EHR Modules has been tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary and the resultant combination also meets the requirements included in the definition of a Qualified EHR.

As previously written, it was unclear to many commenters that the comma preceding “each of which” was meant to separately apply a Complete EHR and “combination of EHR Modules” to the subsequent requirements. Our intention was that a combination of EHR Modules would have to provide the capabilities necessary to meet the definition of a Qualified EHR and that the EHR Modules combined would have

each

been tested and certified in accordance with the certification criteria applicable to each EHR Module.

In response to commenters, we have decided to revise the definition of Certified EHR Technology to state explicitly the two distinct ways the definition can be met. The revised definition will read as follows.

Certified EHR Technology

means:

(1) A Complete EHR that meets the requirements included in the definition of a Qualified EHR and has been tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary; or

(2) A combination of EHR Modules in which each constituent EHR Module of the combination has been tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary, and the resultant combination also meets the requirements included in the definition of a Qualified EHR.

As discussed in the Temporary Certification Program final rule, a pre-coordinated integrated bundle of EHR Modules would fall under the second definition of Certified EHR Technology, although each EHR Module of the bundle would be tested and certified at the same time rather than separately. Therefore, provided that a proper combination of EHR Modules has been created, combinations of EHR Modules could be tested and certified either at the same time or at separate times, to meet the definition of Certified EHR Technology.

Finally, we believe that commenter suggestions to revise the definition of Certified EHR Technology to reference specific certification criteria are misguided. The definition, regardless of the certification criteria that must be included in a Complete EHR or combination of EHR Modules, must be able to accommodate changes in certification criteria over time. Accordingly we believe that the final definition meets this intended goal and conveys a clear meaning.

Comments.

Some commenters appeared to interpret our definition as providing that EHR Modules must be used to meet the definition of Certified EHR Technology. Of these commenters, some requested that we clarify whether health care providers would be required to obtain certification of EHR Modules that no vendors support. Other commenters asked whether non-certified “EHR modules” could be used in combination with a Complete EHR or in combination with EHR Modules that are used to meet the definition of Certified EHR Technology.

Response.

We would like to make clear that eligible professionals and eligible hospitals are

not

required to use EHR Modules in order to meet the definition of Certified EHR Technology. The use of EHR Modules is completely voluntary and provides an alternate avenue for eligible professionals and eligible hospitals who seek to implement more customized HIT solutions while still meeting the definition of Certified EHR Technology. Commenters who expressed concerns about their responsibility for seeking certification for EHR Modules for which no vendor supports did not provide specific examples, and we are uncertain as to the basis for their concerns. Regardless, we reiterate that the use of EHR Modules is voluntary and we believe that most eligible professionals and eligible hospitals that are adopting HIT for the first time will have a variety of Complete EHRs available from which to choose.

We also clarify that only those EHR Modules that provide capabilities necessary to meet the definition of Certified EHR Technology will need to be tested and certified. That being said, eligible professionals and eligible hospitals are free to utilize any other type of HIT to complement or in combination with Certified EHR Technology, including HIT that provides capabilities for other purposes not related to meaningful use.

Comments.

Some commenters suggested that our definition was too broad. Most of these commenters argued that we should permit eligible professionals to adopt only Complete EHRs and EHR Modules that were certified as including only those capabilities applicable to their specialty or practice. In other words, these commenters sought for the definition of Certified EHR Technology to be interpreted in such a way as to permit different specialty-oriented variations of Certified EHR Technology to exist.

Response.

At the present time, we believe that the definition of Certified EHR Technology already includes some of the flexibility these commenters request. We permit, for example, a Complete EHR designed for an ambulatory setting and a Complete EHR designed for an inpatient setting both to meet the definition of Certified EHR Technology, even though each is compliant with a slightly different set of applicable certification criteria. In that regard, we believe we have integrated a balanced and appropriate amount of flexibility into the definition of Certified EHR Technology, which will also allow us to make additional refinements over time. We believe that it is possible based on industry need for us to specify in a future rulemaking sets of applicable certification criteria for Complete EHRs and EHR Modules designed for particular clinical settings.

9. Definition of Human Readable Format

Comments.

A number of commenters across several certification criteria requested that we clarify the meaning of “human readable format.” These commenters questioned what human readable format meant when it was used in the certification criteria and offered examples of what they thought would constitute human readable format such as, style sheets and PDFs. A couple of commenters suggested that human readable format should consider patients' linguistic needs. A commenter requested we discuss the compliance requirements associated with the Americans with Disabilities Act and the relevant sections of the Rehabilitation Act of 1973 to ensure human readable format was meant to include an obligation to provide people with disabilities alternative formats such as large print or Braille.

Response.

In the Interim Final Rule, we discussed the meaning of human readable format and provided examples of what we believe would constitute human readable format. We reiterate that discussion below.

We believe that in order to recognize the enormous potential of HIT, greater standardization in future years is necessary. In that regard, we recognize that more advanced interoperability requires health information to be represented by specific vocabularies and code sets that can be interpreted by EHR technology as well as converted and presented in a readable format to the users of such technology. At the present time we recognize that implementing certain vocabularies and code sets in EHR technology is a difficult, technical undertaking. For that reason, we have not adopted specific vocabularies and code sets for a number of the exchange purposes * * * We have, however, as a transitional step, adopted certification criteria that require Certified EHR Technology to be capable of presenting health information received in human readable format. By human readable format, we mean a format that enables a human to read and easily comprehend the information presented to them regardless of the method of presentation (

e.g.,

computer screen, handheld device, electronic document). This would likely require information in coded or machine readable format to be converted to, for example, its narrative English language description. In an effort to further the transition to, and prevalence of, more specific vocabularies and code sets, we are interested in public comment regarding industry readiness if we were to adopt certification criteria requiring the use of additional vocabularies and code sets in parallel with meaningful use Stage 2. Such certification criteria could include not only that Certified EHR Technology be capable of presenting information in human readable format but also that it be capable of automatically incorporating certain vocabulary or code sets (

i.e.,

machine readable information).

The term human readable format is used in two contexts, when coded health information should be displayed to an eligible professional or (to a health care professional within) an eligible hospital using Certified EHR Technology and in the circumstances where Certified EHR Technology must be capable of generating an electronic copy of health information for individuals. Each context may dictate a different human readable format. For example, the use of a style sheet may be appropriate for both health care professionals that are interacting with Certified EHR Technology as well as individuals who receive an electronic copy of their health information to access at a later time. In other circumstances it may be more appropriate for a health care professional to view health information in human readable format on their handheld device while an individual may seek an electronic document, such as a PDF. Given the requests for additional clarity regarding the meaning of human readable format, we have decided to define the term in this final rule as follows: Human readable format means a format that enables a human to read and easily comprehend the information presented to him or her regardless of the method of presentation (

e.g.,

computer screen, handheld device, electronic document).

We noted in the Interim Final Rule that the standards, implementation specifications, and certification criteria adopted by the Secretary applied to Complete EHRs and EHR Modules, not to persons or entities. We also stated that nothing required by the Interim Final Rule should be construed as affecting existing legal requirements under other Federal laws. Accordingly, this final rule does not affect an eligible professional or eligible hospital's requirements to comply with other Federal laws in the event health information is provided in human readable format and persons with disabilities require reasonable accommodations.

10. Definition of User

Comments.

A number of commenters commenting on several certification criteria requested that we clarify the meaning of the term “user.”

Response.

We recognize that the term user is referenced in the certification criteria and at times could be interpreted differently. We believe this flexibility is necessary because a user may be different depending on the certification criterion and the context within which the capability it specifies is used. Accordingly, we believe a user could be a health care professional or office staff, someone who might interact directly with Certified EHR Technology or that it could also be software program or service.

D. Final Rule Amendments to Adopted Standards, Implementation Specifications, and Certification Criteria §§ 170.202, 170.205, 170.207, 170.210, 170.302, 170.304, 170.306

1. Flexibility and Innovation

Comments.

Many commenters requested that we provide more flexibility in the final rule to accommodate new developments in HIT. These commenters agreed with our approach to identify minimum standards for certain code sets and they recommended a similar approach for other standards. Some commenters suggested alternative approaches to adopting standards, such as adopting standards at a higher level of abstraction (

e.g.,

HL7 2.x, where “x” could be any version within the version 2 family) and accompanying the adopted standards with detailed implementation specifications or guidance outside of the rulemaking process.

Response.

We appreciate commenters' support for the “minimum standard” approach that we established in the Interim Final Rule. We believe that code sets are an appropriate type of standard to set as a “minimum.” In the Temporary Certification Program final rule, we discuss the approaches available to the Secretary to identify and accept newer versions of adopted minimum code set standards. Below, we discuss how we have added flexibility into this final rule and how we can add flexibility in future rulemakings.

In many cases, however, our flexibility may be limited due to legal requirements to adopt substantive requirements through following the procedures of the Administrative Procedure Act (APA). Depending upon the circumstances and subject matter, we may not be able to alter the substantive standards that apply to Certified EHR Technology solely through guidance. In addition, a real and practical need to ensure consistency among various standards regulations constrains the amount of flexibility we can incorporate into the standards we adopt.

In addition, in accordance with Office of the Federal Register regulations related to “incorporation by reference,” which we follow for this final rule, the publications we reference are “limited to the edition of the publication that is approved” and do not include “[f]uture amendments or revisions of the publication.” Consequently, we do not include regulatory language that refers, for instance, to “Version 1.X” when “X” remains a variable.

We do believe, however, that additional flexibility can be added into this and future rulemakings through at least one of four currently identified means:

•

Alternative Standards.

In the Interim Final Rule and in this final rule, we have adopted “alternative” standards (and applicable implementation specifications) for several certification criteria. As a general rule, when an adopted certification criterion refers to two or more standards as alternatives, use of at least one of the alternative standards will be considered compliant with the certification criterion. For the certification criterion at § 170.302(k)(1), for instance, we have adopted HL7 2.3.1

and HL7 2.5.1 as alternatives, and the use of either standard (and the applicable implementation specifications) would be sufficient to comply with the certification criterion. In each of these instances, we have tried to balance the need for flexibility with the goal of advancing interoperability, while also taking into account that the HIT industry has not yet migrated to a single specific standard for certain purposes. In some cases, this balancing has required the adoption of certification criteria that requires certain EHR technology to be capable of receiving electronic health information formatted according to a standard that it is not natively capable of generating. For example, with respect to patient summary records, we have adopted the Continuity of Care Document and Continuity of Care Record standards as alternatives. As a condition of certification, section 170.304(i)(1) provides as an additional requirement that upon receipt of a patient summary record formatted in the alternative standard, the EHR technology must be capable of displaying the patient summary record in human readable format. We believe this final rule correctly balances at this stage of EHR adoption our goal of promoting interoperability with the HIT industry's ability to comply with the certification criteria and its need for flexibility. Consistent with our long-term goals for interoperability, we anticipate that this balance will need to change as the HIT industry migrates to single specific standards for particular purposes.

•

Minimum Code Set Standards.

As previously discussed in the Interim Final Rule, we adopted several minimum code set standards. It is important to note that these code set standards set the floor, not the ceiling, for testing and certification. If, and when, the Secretary accepts a newer version of an adopted minimum standard code set, the Secretary will, in effect, raise the ceiling for what is permitted for testing and certification as well as whether Certified EHR Technology can be upgraded to that newer version without adversely affecting the Certified EHR Technology's certified status. For context purposes we repeat a portion of the Interim Final Rule's preamble that discussed our approach to minimum code set standards.

We have implemented this approach by preceding references to specific adopted standards with the phrase, `at a minimum.' In those instances, the certification criterion requires compliance with the version of the code set that has been adopted through incorporation by reference, or any subsequently released version of the code set. This approach will permit Complete EHRs and EHR Modules to be tested and certified, to, `at a minimum,' the version of the standard that has been adopted or a more current or subsequently released version.

We would note that consistent with this approach the Secretary has proactively identified and deemed acceptable newer versions of the following adopted “minimum standard” code sets:

(1) LOINC version 2.3, released on February 26, 2010; and

(2) CVX—Vaccines Administered, March 17, 2010.

We are consequently using this opportunity to inform Complete EHR and EHR Module developers, prospective ONC-Authorized Testing and Certification Bodies, and the rest of the public of the Secretary's recognition of these newer versions of certain adopted “minimum standard” code sets. We reiterate that use of these newer versions is voluntary. We also note in accordance with 45 CFR 170.455(b)(2) that Certified EHR Technology may be upgraded to comply with these newer versions at any time without adversely affecting the certification status of the Certified EHR Technology.

•

Optional Standards, Implementation Specifications, and Certification Criteria.

We believe that additional flexibility and specificity can be introduced into this and future cycles of rulemaking through the adoption and designation of “optional” standards, implementation specifications, and certification criteria. Optional standards, implementation specifications, and certification criteria would be

voluntary

and would

not be required

for testing and certifying a Complete EHR or EHR Module. We believe that optional standards, implementation specifications, and certification criteria will also help better prepare the HIT industry for future mandatory certification requirements.

•

Standards and Backwards Compatibility.

In previous rulemakings, specifically the Secretary's adoption of electronic prescribing (e-prescribing) standards (70 FR 67579) related to the Medicare Part D prescription drug program, HHS discussed a process to improve flexibility in regulatory requirements which involves “backwards compatibility.” HHS described backwards compatibility as meaning that a newer version of a standard retains at a minimum the full functionality of the version previously adopted in regulation, and that the newer version would permit the successful completion of the applicable transaction(s) with entities that continue to use the older version(s). HHS discussed that if a newer version of a standard were backward compatible with an adopted standard, it would be possible to pursue a more expedited approach to permit the utilization of the newer version while still remaining in compliance with the law. We believe that the approach established in the e-prescribing rulemaking could be leveraged in many situations for the standards and implementation specifications adopted for HIT certification. However, we note that this approach can only be implemented when a newer version of a standard is technically capable of fully functioning with the adopted version of the standard to conduct the specified transaction.

Much like minimum code set standards, we could foresee possibly adopting a backward compatible version of a previously adopted standard and allowing entities to voluntarily use the newer version for a period of time. In such cases, much like a minimum code set standard, Complete EHR and EHR Module developers would be permitted to have their Complete EHR or EHR Module certified according to the adopted backward compatible version, and eligible professionals and eligible hospitals in possession of Certified EHR Technology would be permitted to upgrade voluntarily their Certified EHR Technology to include the adopted backwards compatible version. Given that we anticipate adopting new or modified standards, implementation specifications, and certification criteria every two years in sync with the initiation of a new meaningful use stage, we believe that the Secretary's adoption of backward compatible versions of standards would generally be limited to intermediate years (

i.e.,

2012 and 2014). To accomplish the adoption of a backwards compatible version, we would take an approach very similar to the approach described in the final e-prescribing regulation.

We would first review whether the new version of an adopted standard retains at a minimum the full functionality of the adopted version of the standard as well as whether it enables the successful completion of the applicable transaction(s) with entities that continue to use the older version(s). We would then review whether a standard should be updated with a new version and whether use of either the new version or the older version would be considered compliant as well as whether use of the new version would conflict with any already existing regulatory requirements. If we believe that the Secretary's adoption of a newer version of a standard on a voluntary

basis would be appropriate, we would then seek the advice of the HIT Standards Committee to evaluate the newer version of the standard and to solicit relevant public input. The Secretary would then recognize or adopt for voluntary use the new version of the standard in a

Federal Register

publication. At that point, use of either the new or old version would be considered compliant. Entities that would voluntarily adopt the later backward compatible version of the standard would remain obligated to accommodate the earlier adopted version without modification. Prior to the Department formally retiring the older version of the standard and mandating the use of the later version, the Department would engage in notice and comment rulemaking.

2. Transport Standards

Comments.

Generally, commenters echoed one of two responses: Some urged for the complete removal of SOAP and REST and others requested that we provide detailed implementation specifications for SOAP and REST along with the identification of the transactions to which SOAP and REST were applicable. Some commenters also stated that neither standard was sufficiently specified in order to ensure interoperability, while others pointed out that it appeared that we had globally applied the usage of SOAP or REST to all adopted standards, which, if true, would cause conflicts with several adopted standards (

e.g.,

it was noted that the HL7 standards we adopted utilize Minimum Lower Layer Protocol (MLLP) as the transport standard and not SOAP or REST).

Response.

We have considered the public comments received on this matter and we are convinced that it is prudent to remove the adopted standards, SOAP and REST. We did not intend for the significant potential conflicts identified by commenters to occur as a result of our adoption of SOAP and REST. We have determined that it would be more appropriate and reasonable for us not to require at the present time specific transport standards as a condition of certification. We hope that this will reduce some of the burden on Complete EHR and EHR Module developers and provide greater opportunities for innovation. With that said, we plan to carefully watch the impact of this decision and its affect on interoperability. We encourage Complete EHR and EHR Module developers to utilize transport standards that will help the industry coalesce around common methods for electronic health information exchange, and we plan to examine this decision in future rulemakings.

3. Certification Criteria and Associated Standards and Implementation Specifications

We have organized our discussion of the final certification criteria according to the order in which they are currently specified at 45 CFR 170 subpart C. We note that the final regulatory citations will have changed for many certification criteria and encourage the public to review, in full, the final regulatory text specified in subpart C of part 170 in the regulation text of this final rule. We begin with the certification criteria at 45 CFR 170.302 (general certification criteria for Complete EHRs and EHR Modules), move on to 45 CFR 170.304 (specific certification criteria for Complete EHRs and EHR Modules designed for an ambulatory setting) and end with 45 CFR 170.306 (specific certification criteria for Complete EHRs or EHR Modules designed for an inpatient setting). We also include, where appropriate, a discussion of the adopted standard(s) and implementation specifications associated with each certification criterion. For each final certification criterion, we start with an overview of the final version and then discuss and respond to public comments.

a. General Certification for Complete EHRs or EHR Modules—§ 170.302

Section 170.302(a)—Drug-Drug, Drug-Allergy, Drug-Formulary Checks

Meaningful use Stage 1 objective

Meaningful use

Stage 1 measure

Certification criterion

Implement drug-drug and drug-allergy interaction checks

The EP/eligible hospital/CAH has enabled this functionality for the entire EHR reporting period

Interim Final Rule Text:

(1)

Alerts.

Automatically and electronically generate and indicate in real-time, alerts at the point of care for drug-drug and drug-allergy contraindications based on medication list, medication allergy list, age, and computerized provider order entry (CPOE).

(3)

Customization.

Provide certain users with administrator rights to deactivate, modify, and add rules for drug-drug and drug-allergy checking.

(4)

Alert statistics.

Automatically and electronically track, record, and generate reports on the number of alerts responded to by a user.

Final Rule Text: § 170.302(a).

(1)

Notifications.

Automatically and electronically generate and indicate in real-time, notifications at the point of care for drug-drug and drug-allergy contraindications based on medication list, medication allergy list, and computerized provider order entry (CPOE).

(2)

Adjustments.

Provide certain users with the ability to adjust notifications provided for drug-drug and drug-allergy interaction checks.

Meaningful use Stage 1 objective

Meaningful use

Stage 1 measure

Certification criterion

Implement drug-formulary checks

The EP/eligible hospital/CAH has enabled this functionality and has access to at least one internal or external drug formulary for the entire EHR reporting period

Interim Final Rule Text:

(2)

Formulary checks.

Enable a user to electronically check if drugs are in a formulary or preferred drug list in accordance with the standard specified in § 170.205(b).

Final Rule Text: § 170.302(b).

Drug-formulary checks.

Enable a user to electronically check if drugs are in a formulary or preferred drug list.

Comments.

Based on the example given in the preamble of the Interim Final Rule, several commenters believed that we required real-time alerts to utilize a pop-up message or sound. Commenters stated that the method of delivering real-time alerts should not be included in the regulation as it would restrain innovation. One commenter expressed concern that the requirements of this certification criterion were overly specific with respect to how the Certified EHR Technology needed to perform the tasks rather than focusing on the desired result. The commenter recommended the certification criterion be modified to ensure that such alerts are clearly visible to the physicians at the point-of-care. Some commenters recommended that the term “notification” should replace the term “alert” for this and other certification criterion because the term alert implied a particular implementation whereas notification was more neutral.

Response.

Unfortunately, many of the commenters who reacted to our example also believed that it was a requirement. We simply added the example of a pop-up message or sound in the preamble of the Interim Final Rule to make the requirement clear. The use of a pop-up message or sound was not a specified requirement in the regulation text. We agree with the commenters who explained that there may be better ways to provide alerts. For the purposes of testing and certification, we leave it entirely up to Complete EHR and EHR Module developers to innovate in this area and provide capabilities that are both easy to use and prevent medical errors. Additionally, we agree with the commenters who suggested that we replace “alert” with “notification,” and we have made that change globally across all certification criteria that used the term alert.

Comments.

A few commenters requested clarification of the requirement to track and report on the number of alerts responded to by a user. A commenter requested clarification on why the number of alerts is captured but not what the user did with the alert and if this data is going to be used to rate providers based upon the number of alerts they received. Two commenters requested that “responded to by a user” be clarified and asked whether it meant that a user had taken a different action as a result of the alert. One commenter recommended removing the alert requirement unless it is more clearly specified. One commenter recommended deleting the requirement on alert statistics because it could lead to alert fatigue. A few commenters expressed concern about the ability to deactivate, modify, and add rules for drug-drug and drug-allergy checking. These commenters recommended that this capability be removed because of the risk to patient safety. A commenter noted that treating physicians should have the ability to ignore alerts in light of other clinical facts about the patient and felt that providing the ability to delete or modify alerts in a way that would be inconsistent with current medical standards would be irresponsible and contrary to the meaningful use goal of preserving the health and safety of patients. Other commenters requested clarification as to whether the ability to “deactivate” rules implied the ability to remove specific rules or drug pairs as they exist in commercially‐available clinical decision support (CDS) databases; the ability to “modify” rules implied that an administrator would be able to change the rules as they exist in these commercially‐available CDS databases; and the ability to “add” new rules implied that the administrator could create new rules in commercially‐available CDS databases. The commenters interpreted “modify” to mean, for example, the ability to override or change severity setting; and “add” to mean activating a category of CDS, such as drug‐drug interactions, but not individual rules; and “deactivate” as the ability to “turn off” specific types of rules. Another commenter requested clarification as to whether the requirement for customization would be met if a system administrator were to set the selected severity level to reflect the collective decision of a practice or if alerts must be tailored on an EP-by-EP basis. A commenter requested clarification on what qualifies as a “response” to an alert. One commenter recommended that the rule clarify that “responded to by a user” means in a way which meaningfully addresses the alerts. A couple of commenters stated that centrally hosted services would have problems complying with the customization requirements because the hosting vendor takes responsibility for the administration, maintenance and updating of the clinical decision support rules including alerts for drug interactions alerts, including drug-drug, drug-allergy and drug-problem. These commenters were concerned that allowing each of their clients to create local drug-interaction rules would slow their ability to provide important updates to their client base, since this would require navigation of a complex hierarchy of preferred local rules. These local rules would also introduce clinical risk if old local rules could create a conflict with a clinically appropriate global, updated rule.

Response.

Based on the significant number of comments presenting diverse interpretations of these provisions, we determined that this certification criterion needed further clarification and have revised it accordingly. Our intention related to the alert statistics capability had been to mirror the clinical decision support capability. With respect to customization, we sought to provide users of Certified EHR Technology with a way to adjust the severity level for which alerts are presented. In response to public comment, and to clarify what we believe Certified EHR Technology must include as a condition of certification, we have removed the “alert statistics” part of the certification criterion altogether and revised the “customization” part of the certification criterion to more clearly specify this capability. Our revisions focus on Certified EHR Technology's capability to allow certain users (

e.g.,

those with administrator rights) with the ability to adjust notifications provided for drug-drug and drug-allergy checks (

e.g.,

set the level of severity for which notifications are presented).

Comment.

A commenter stated that use of age as a required data element in this certification criterion is a problem

because drug databases handle age in non-standard ways. It was also stated that for geriatric patients weight is also considered along with age.

Response.

We agree with this commenter. After considering this comment, particularly in light of the potentially divergent interpretations of this certification criterion we noted above, we have removed “age” from the certification criterion. It was never our intention, as could have been anticipated, to require that Certified EHR Technology be capable of performing checks that relate type or dosage of drugs to the patient's age, or “drug-age checks.”

Comment.

A commenter encouraged ONC to add adverse drug events to the certification criterion and to identify candidate standards for its inclusion to support meaningful use Stage 2.

Response.

We appreciate the suggestion and believe that identifying adverse drug events is important. Because the final meaningful use Stage 1 requirements under the Medicare and Medicaid EHR incentive programs do not include such a requirement, though, we do not believe that it would be appropriate at the present time to add such a requirement as a condition of certification. This does not preclude Complete EHR or EHR Module developers from including such functionality.

Comment.

A couple of commenters requested clarification on what CPOE means in the certification criterion. A commenter requested that ONC clarify that this certification criterion applies only to the order-entry workflow and is not applicable to other office processes or workflows which might involve the same clinical data but which would not necessarily generate these alerts.

Response.

We clarify for commenters that our inclusion of CPOE in the certification criterion is meant to indicate that notifications should occur based on new medication orders, in addition to a patient's current medications and medication allergies, as they are being entered. In response to the other commenter's request for clarification, we believe that notifications will occur during the order-entry workflow.

Comment.

A commenter requested that the rule be clarified to explicitly require that drug-drug, drug-allergy, and drug formulary checks occur based on information and medication lists in an individual's complete medical record derived from all relevant providers, not only the drug list of the specific provider.

Response.

We clarify that we expect Certified EHR Technology to perform drug-drug and drug-allergy checks based on medication list and medication allergy list information included within Certified EHR Technology as structured data. We recognize that Certified EHR Technology may also store health information in scanned documents, images, and other non-interoperable non-computable formats and, consequently, do not expect Certified EHR Technology to be capable of reading or accessing the information in these other formats for the purposes of performing drug-drug and drug-allergy checks.

Comment.

A commenter requested that ONC clarify that EHR vendors will not be required to remove the option to disable drug-drug and drug-allergy checks.

Response.

While we do not require that the option to disable drug-drug and drug-allergy checks be removed as a condition of certification, we note that in order for an eligible professional or eligible hospital to become a meaningful user of Certified EHR Technology this capability must be enabled.

Comments.

Several commenters noted that the NCPDP Formulary and Benefits standard is not used in an inpatient setting. The commenters consequently requested clarification as to how the standard can be used in an inpatient setting. Some of the commenters noted that for inpatient settings, hospitals typically relied on their own formularies for performing the types of checks specified. Another commenter requested clarification whether the correct content exchange standard was National Council for Prescription Drug Programs (NCPDP) Formulary and Benefits Standard version 1.0 and that if it was, the commenter recommended its adoption. Another commenter noted that some State Medicaid formularies are not yet available via nationwide e-prescribing networks and recommended that ONC encourage the implementation of State Medicaid formularies within the NCPDP Formulary and Benefits Standard via a nationwide e-prescribing network.

Response.

We agree with those commenters who identified the inconsistency of applying the Formulary and Benefits standard to the inpatient setting. Because the CMS proposed meaningful use objectives applied to both eligible professionals and eligible hospitals, we did not make the distinction as to when a Complete EHR or EHR Module would need to include the Formulary and Benefits standard. However, in light of these comments and to support the final meaningful use measure, we have determined that it would be appropriate to adopt a more general certification criterion that would be applicable to both Complete EHRs and EHR Modules designed for ambulatory and inpatient settings. Accordingly, we have removed any reference to a particular standard because an eligible professional or eligible hospital that does not have external access to a drug formulary would be able to satisfy this meaningful use measure by checking an internally managed drug formulary. Although the Formulary and Benefits standard is no longer required as a condition of certification, we note that eligible professionals who seek to comply with the electronic prescribing requirements associated with Medicare Part D eligible individuals will need to use this standard as they do today. Additionally, we do not agree that it is within the scope of this rulemaking to address State Medicaid Agencies' participation in nationwide e-prescribing networks.

Comments.

Many commenters noted that the drug-formulary requirement should not apply to Complete EHRs and EHR Modules designed for an inpatient setting because there was no proposed requirement for meaningful use Stage 1 for eligible hospitals to electronically prescribe. Many of the commenters recommended removing this as a requirement for eligible hospitals while retaining it with the criteria for eligible professionals. A few commenters specifically recommended adding it to the criterion for electronic prescribing. Several commenters recommended that if the requirement were kept for hospitals it should be written as a separate criterion to address the query of a hospital's drug formulary during the order entry process and not the NCPDP Formulary and Benefits standard. A commenter stated that current industry practice among vendors of EHR technology is to provide a “generic” national formulary rather than the formulary for a particular plan. The commenter recommended that the functionality require that a user actually perform an eligibility check before access is provided and, in response to that check, the functionality show the correct formulary and benefits information, rather than just generic data.

Response.

We believe that our discussion above regarding the removal of the standard associated with this certification criterion addresses many of the concerns raised by commenters. However, we disagree with the suggestion that Complete EHRs and EHR Modules designed for an inpatient setting should not be required to include this capability. This capability is required to be enabled for the

purposes of meeting the meaningful use Stage 1 measure. Consistent with the final meaningful use Stage 1 objectives which separated drug-drug and drug-allergy checks from drug-formulary checks, we have separated out these capabilities into two different certification criteria.

Comments.

A commenter stated a concern that this criterion, combined with future meaningful use requirements, will shift providers' focus from prescribing the best drug for the patient to prescribing what is covered by the patient's insurance plan or generic brands. Another commenter stated that adding formulary checks to the workload of physicians will decrease physicians' efficiency and increase their costs.

Response.

In this rule, the Secretary is completing the adoption of the initial set of standards, implementation specifications, and certification criteria for the certification of Complete EHRs and EHR modules. The certification criteria ensure that Certified EHR Technology includes certain capabilities. The extent to which health care providers must use those capabilities and how they integrate EHR technology into their practice falls outside the scope of this rule. We therefore do not believe that these concerns are within the scope of this rulemaking.

Comment.

A commenter recommended that “drug-test checks” should be added. The commenter stated that many drugs require some form of laboratory testing to ensure that drugs are prescribed appropriately. The commenter stated, for example, that an anticoagulant medication should not be prescribed unless there is a test result on record that shows that giving this drug would not cause harm.

Response.

Presently, drug-test checking is not a required capability for eligible professionals and eligible hospitals to use in order to successfully meet the requirements of meaningful use Stage 1. Accordingly, we do not believe that it would be appropriate to require Certified EHR Technology to be capable of performing drug-test checks as a condition of certification at the present time.

Section 170.302(b)—Maintain Up-To-Date Problem List

Meaningful use stage 1 objective

Meaningful use stage 1 measure

Certification criterion

Maintain an up-to-date problem list of current and active diagnoses

More than 80% of all unique patients seen by the EP or admitted to the eligible hospital's or CAH's inpatient or emergency department (POS 21 or 23) have at least one entry or an indication that no problems are known for the patient recorded as structured data

Interim Final Rule Text:

Maintain up-to-date problem list.

Enable a user to electronically record, modify, and retrieve a patient's problem list for longitudinal care in accordance with:

(1) The standard specified in § 170.205(a)(2)(i)(A); or

(2) At a minimum, the version of the standard specified in § 170.205(a)(2)(i)(B).

Final Rule Text: § 170.302(c).

Final rule text remains the same as Interim Final Rule text, except for references to adopted standards, which have been changed.

Comments.

Several commenters expressed concerns about the use of ICD-9-CM because it is primarily used for billing and administrative purposes and may not accurately represent the true clinical meaning of a problem or condition when it is documented at the point of care. One commenter stated a concern that the problem list standards do not allow for capturing of free text that health care providers use when an appropriate code is in neither SNOMED-CT® nor ICD-9-CM.

Response.

The comments are correct in that ICD-9-CM is primarily used for billing and administrative purposes. SNOMED-CT® is offered as an alternative standard that will support more clinical descriptions of patient problems or conditions. We believe that with the adoption of both SNOMED-CT® and ICD-9-CM, healthcare providers should have adequate coverage for patient diagnoses and conditions. We are discouraging the use of free text for documenting problem lists since this will limit the usefulness of problem lists for clinical reminders, decision support and other patient safety and quality reporting.

Comments.

Several commenters recommended that only SNOMED-CT® be adopted, or alternatively, that we expressly indicate an intention to move away from ICD-9CM and ICD-10 in the future. Another commenter recommended against the adoption of SNOMED-CT® because the commenter felt that our adoption of SNOMED-CT® would require eligible professionals and eligible hospitals to use both ICD-9-CM and SNOMED-CT®. One commenter recommended that a publicly vetted and HHS approved standard mapping between ICD-9-CM and SNOMED CT® should be made available at the public's expense.

Response.

We agree conceptually that a single standard for clinical information would be desirable in the long term. However, presently both ICD-9-CM and SNOMED-CT® are used by EHR technology to code clinical information, and adopting both would provide users with additional flexibility. Moreover, we anticipate that as meaningful use objectives and measures evolve over time, we will receive additional public input and experience related to these standards and may eventually be able to adopt only one standard.

Comments.

A few commenters asked for clarification as to whether SNOMED-CT® or ICD-9CM codes needed to be included within Certified EHR Technology or if these standards were only necessary when electronic health information is exchanged. Some of these commenters also requested that we permit any coding system to be used as long as it can be mapped to the appropriate format when electronic health information is to be exchanged.

Response.

As previously discussed, meaningful use requirements will typically specify whether an adopted standard will have to be used among components of a business organization or solely for the electronic exchange of health information with other legal entities. The measure for this final meaningful use objective provides that entries be recorded as structured data. The certification criterion specifies that ICD-9CM or SNOMED-CT® are the code sets which must be included in Certified EHR Technology, and are therefore the code sets that would be used to record entries as structured data.

Comments.

A few commenters recommended the removal of “longitudinal care” in the certification criterion. These commenters cited our clarification in the preamble that by longitudinal care we meant “over multiple office visits.” These commenters questioned how this language would be applicable to an inpatient setting since patients are typically treated for acute episodes and not over multiple office visits.

Response.

The reference to longitudinal care is intended to convey that the problem list must be comprehensive in the sense that it must be capable of including entries provided over an extended period of time. Consequently, for Complete EHRs and EHR Modules to be certified for an ambulatory setting, they will need to be designed to enable the user to electronically record, modify, and retrieve a patient's problem list over multiple encounters. For an inpatient setting, they will need to enable the user to electronically record, modify, and retrieve a patient's problem list for the duration of an entire hospitalization. This clarification was also requested in relation to the medication list and medication allergy list certification criteria and we have not repeated our response. As a result, we have retained “longitudinal care” in each certification criterion where the term is referenced and only make this clarification once.

Comment.

A commenter suggested that we include a reasonable expectation of what constitutes “up-to-date” in the reference to “up-to-date” problem list.

Response.

We referred this comment to CMS, and it is addressed in the final rule on the Medicare and Medicaid EHR Incentive Programs.

Section 170.302(c)—Maintain Active Medication List

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Maintain active medication list

More than 80% of all unique patients seen by the EP or admitted to the eligible hospital's or CAH's inpatient or emergency department (POS 21 or 23) have at least one entry (or an indication that the patient is not currently prescribed any medication) recorded as structured data

Interim Final Rule Text:

Maintain active medication list.

Enable a user to electronically record, modify, and retrieve a patient's active medication list as well as medication history for longitudinal care in accordance with the standard specified in § 170.205(a)(2)(iv).

Final Rule Text: § 170.302(d).

Maintain active medication list.

Enable a user to electronically record, modify, and retrieve a patient's active medication list as well as medication history for longitudinal care.

Comments.

A few commenters agreed with the certification criterion. One commenter requested that we provide more clarity on the use of term “retrieve.” The commenter questioned whether we intended to use the word “retrieve” in the certification criterion to mean solely the retrieval of information available to Certified EHR Technology or if we intended for it to also include the interactive retrieval of medication list information from external sources. The commenter suggested we clarify that “retrieve” meant retrieval of only information internally available to Certified EHR Technology. Other commenters, similar to their comments on the problem list certification criterion, stated that there needed to be more clarity with respect to how the reference to “longitudinal care” applied to a Complete EHR or EHR Module used by an eligible hospital.

Response.

We clarify that for this certification criterion, and all other certification criteria, the term “retrieve” means the retrieval of information directly stored and managed by Certified EHR Technology and that it does not mean the retrieval of information from external sources, unless explicitly stated otherwise. We also take this opportunity, in the context of our response regarding “longitudinal care” above, to clarify that “medication history” is intended to include a record of prior modifications to a patient's medications.

Comment.

A commenter stated that there needs to be more clarity with respect to whether an EHR Module must maintain a list of all active medications or if a specialty system, such as a cardiology system, could maintain a list of medications specific to its specialty use and provide the list to the enterprise EHR.

Response.

If an EHR Module developer seeks to have its “medication list EHR Module” certified, the EHR Module must provide the capabilities specified by the certification criterion. We do not intend to limit how the EHR Module could appropriately provide these capabilities (

i.e.,

whether the EHR Module must itself enable the user to electronically record, modify, and retrieve a patient's active medication list for longitudinal care, or whether the EHR Module could be designed to provide those capabilities through its interaction with a device or devices at the enterprise level).

Comment.

One comment stated that this criterion should include a provision to include the ability to transmit this information to public health entities as required by law.

Response.

Nothing we adopt in this final rule precludes such a capability from being included in a Complete EHR or EHR Module. That is not, however, currently a necessary requirement for certification.

Comments.

One commenter stated that it would need to perform extensive reprogramming to accommodate the standard we adopted if it meant modifying underlying medication databases. This commenter suggested that this standard as it applied to the maintenance of medication lists be deferred. Along those lines, a couple of commenters stated that more clarification was needed with respect to whether RxNorm identifiers needed to be stored internally within Certified EHR Technology or only needed to be used upon the electronic exchange of health information. Other commenters expressly stated that the mapping of the vocabulary be limited to instances where the electronic exchange of health information would take place.

Response.

We understand these commenters' concerns and agree that it would be premature to require the use of the adopted standard in this context. In that regard, we seek to clarify for commenters our intention, which was solely to associate this adopted standard (as some commenters suggested) with the certification criteria that require the capability to electronically exchange health information. We recognize that continuing to associate this standard with the adopted certification criterion could potentially impose a significant burden on the industry, which we did not intend. Accordingly, we have removed from this certification criterion the requirement to use this standard. We discuss our response to comments on the standard itself in the context of the patient summary record certification criterion.

Section 170.302(d)—Maintain Active Medication Allergy List

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Maintain active medication allergy list

More than 80% of all unique patients seen by the EP or admitted to the eligible hospital's or CAH's inpatient or emergency department (POS 21 or 23) have at least one entry (or an indication that the patient has no known medication allergies) recorded as structured data

Interim Final Rule Text:

Maintain active medication allergy list.

Enable a user to electronically record, modify, and retrieve a patient's active medication allergy list as well as medication allergy history for longitudinal care.

Final Rule Text: Unchanged

Now § 170.302(e).

Comments.

Much like the prior certification criterion, many commenters signaled their support for this certification criterion. Other commenters raised the same points related to this certification criterion as they did for the medication list certification criterion.

Response.

We believe our responses to the problem list and medication list certification criteria are applicable to these repeated comments.

Comments.

Many commenters suggested that non-medication allergies be added to this certification criterion. A few commenters stated that it could jeopardize patient safety if not all allergens were included in Certified EHR Technology.

Response.

Patient safety is one of HHS's top priorities. At the present time, the final meaningful use objective and measure focus on medication allergies. Accordingly, we have adopted a certification criterion to support this objective and measure. We would like to reiterate, however, that a certification criterion sets the floor not the ceiling for the capabilities Certified EHR Technology must include. We encourage Complete EHR and EHR Module developers to provide more comprehensive capabilities than those currently required for achieving certification.

Section 170.302(e)—Record and Chart Vital Signs

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Record and chart changes in vital signs:

• Height

• Weight

• Blood pressure

• Calculate and display BMI

• Plot and display growth charts for children 2-20 years, including BMI.

For more than 50% of all unique patients age 2 and over seen by the EP or admitted to eligible hospital's or CAH's inpatient or emergency department (POS 21 or 23), height, weight and blood pressure are recorded as structured data

Interim Final Rule Text:

(1)

Vital signs.

Enable a user to electronically record, modify, and retrieve a patient's vital signs including, at a minimum, the height, weight, blood pressure, temperature, and pulse.

(2)

Calculate body mass index.

Automatically calculate and display body mass index (BMI) based on a patient's height and weight.

(3)

Plot and display growth charts.

Plot and electronically display, upon request, growth charts for patients 2-20 years old.

Final Rule Text: § 170.302(f).

(1)

Vital signs.

Enable a user to electronically record, modify, and retrieve a patient's vital signs including, at a minimum, height, weight, and blood pressure.

(2) Unchanged

(3) Unchanged

Comment.

One commenter noted that the units of measurement should be specified in the EHR with regards to vital signs. For example that height should be specified in inches or centimeters.

Response.

We do not believe that this level of specificity is necessary. We expect that Complete EHR and EHR Module developers will include the units of measure that their customers believe are necessary to meet their needs, which in many cases will include those that patients routinely request. We also expect that many Complete EHR and EHR Module developers will offer both metric units and U.S. units of measurement, as a standard business practice.

Comments.

In what appeared to be a reaction to the proposed meaningful use objective and measure, some commenters requested that we remove BMI as part of the certification criterion for Complete EHR or EHR Modules designed for an inpatient setting. The rationale provided was that acute care providers would not be required to track BMI.

Response.

While we can understand these commenters' concern, we believe that BMI is a simple mathematical calculation that Certified EHR Technology should be capable of performing regardless of the setting for which it is designed.

Comment.

One commenter recommended that BMI and age components should be used to create an alert when an unhealthy BMI is indicated for a patient and that Certified EHR Technology should record whether the patient was informed of the unhealthy BMI status.

Response.

We believe that this recommendation is overly specific, is more germane to meaningful use, and exceeds the type of capability we believe should be specified as a condition of certification.

Comments.

A few commenters noted this certification criterion applies more directly to specialties that predominantly treat children. For other specialties, this criterion would add unnecessary cost and complexity to many HIT products that they would use. Many commenters suggested that a growth chart component should not be required for EHR technology designed for an inpatient setting, as it is not feasible to track this data in a meaningful way over a long enough period of time in an inpatient setting (which is typically of a short and

infrequent duration). A couple of commenters suggested that non-traditional forms of growth charts should be accepted. One commenter suggested that the certification criterion establish a baseline, but should not limit the expansion of this capability to other ages. Other commenters made specific suggestions for different age ranges, such as including children under the age of two and lowering the upper age to ages less than 20 years old (

e.g.,

18).

Response.

As we stated above with respect to the calculation of BMI, we believe that Certified EHR Technology should be capable of performing this capability regardless of the setting for which it is designed. Moreover, with respect to whether growth charts should be applicable to Complete EHRs and EHR Modules designed for an inpatient setting, we remind commenters that children's hospitals qualify as eligible hospitals under the Medicaid EHR incentive program and will also need to demonstrate meaningful use of Certified EHR Technology. We do not preclude Complete EHR and EHR Module developers from designing novel approaches to displaying growth charts. Finally, we concur with the commenter that suggested this certification criterion should be a baseline. We reiterate that this certification criterion establishes a floor, not a ceiling, and we encourage Complete EHR and EHR Module developers to include additional functionality where it will enhance the quality of care that eligible professionals and eligible hospitals can provide.

Comments.

Similar to the comments above, many commenters suggested the growth chart requirement should include children under age 2. The charting would then include: weight, length, pulse oximetry, head circumference, and blood pressure (with percentiles based on age and weight).

Response.

For Stage 1, the related meaningful use objective addresses ages 2-20. In order to remain consistent with and support this objective, we do not believe that it is necessary at this time to require a capability for charting any additional ages as a condition of certification.

Comment.

One commenter requested that we clarify whether “plot and electronically display” means to plot height, weight, and BMI over time or against national norms.

Response.

We clarify that we expect a growth chart to plot the height, weight, and BMI over time, as compared to national norms. While the regulation text does not specifically require comparison to national norms, we understand that this type of information is typically provided along with the growth chart itself to provide greater relevance and meaning for the growth charts. We encourage Complete EHR and EHR Module developers to include this feature.

Comment.

A commenter suggested that SNOMED-CT® be used for designation of BMI.

Response.

Although we agree that SNOMED-CT® could be used to code BMI, we only require that Certified EHR Technology be capable of calculating BMI. We do not believe that it is necessary, as a condition of certification, to specify how BMI should be coded. That being said, we do not preclude the use of SNOMED-CT® to code BMI.

Comment.

One commenter suggested that the certification criterion should be better aligned with the final meaningful use objective and measure. The commenter noted that the criterion includes temperature and pulse, which is not included in the meaningful use objective and measure.

Response.

We agree with the comment and have removed temperature and pulse from the certification criterion.

Section 170.302(f)—Smoking Status

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Record smoking status for patients 13 years old or older

More than 50% of all unique patients 13 years old or older seen by the EP or admitted to the eligible hospital's or CAH's inpatient or emergency department (POS 21 or 23) have smoking status recorded as structured data

Interim Final Rule Text:

Smoking status.

Enable a user to electronically record, modify, and retrieve the smoking status of a patient. Smoking status types must include: current smoker, former smoker, or never smoked.

Final Rule Text: § 170.302(g).

Smoking status.

Enable a user to electronically record, modify, and retrieve the smoking status of a patient. Smoking status types must include: current every day smoker; current some day smoker; former smoker; never smoker; smoker, current status unknown; and unknown if ever smoked.

Comments.

Several commenters stated that the smoking status certification criterion was overly prescriptive because it specified certain status variables. These commenters agreed that recording smoking status is crucial to health improvement efforts, but contended that mandating certain fields was the wrong approach. Many of these commenters stated that they were unaware of defined industry standard value set for smoking terminology and other suggested that our reference to specific types of smokers be removed. Others asked whether these variables were examples or the only responses allowed. A few commenters agreed with this certification criterion as reasonable and appropriate because it would provide value for both clinical care and public health. Commenters recommended that besides what we had specified, the certification criterion should also reference packs per day history information, secondhand smoke exposure, and alcohol consumption information. Other commenters recommended that the certification criterion be changed to reflect tobacco use rather than smoking.

Response.

We have adopted this certification criterion to fully support the final meaningful use objective and measure, which in response to comments has been revised to further clarify the purpose of the objective and measure. We therefore disagree with those commenters who stated that this certification criterion is too prescriptive. Concurring with CMS, we believe that the fields associated with this measure should mirror those expressed in the Centers for Disease Control and Prevention, National Center for Health Statistics, National Health Interview Survey related to smoking status recodes.

2

Accordingly, the final certification criterion further specifies and slightly broadens the smoking statuses we expect Certified EHR Technology to be capable of recording. Generally speaking, we understand that a “current every day smoker” or “current some day smoker” is an individual who has smoked at least 100 cigarettes during his/her lifetime and still

regularly smokes everyday or periodically, yet consistently; a “former smoker” would be an individual who has smoked at least 100 cigarettes during his/her lifetime but does not currently smoke; and a “never smoker” would be an individual who has not smoked 100 or more cigarettes during his/her lifetime.

3

The other two statuses (smoker, current status unknown; and unknown if ever smoked) would be available if an individual's smoking status is ambiguous. The status “smoker, current status unknown” would apply to individuals who were known to have smoked at least 100 cigarettes in the past, but their whether they currently still smoke is unknown. The last status of “unknown if ever smoked” is self-explanatory.

2

Smoking status recodes:

http://www.cdc.gov/nchs/nhis/tobacco/tobacco_recodes.htm.

3

ftp://ftp.cdc.gov/pub/Health_Statistics/NCHS/datasets/DATA2010/Focusarea27/O2701a.pdf.

Section 170.302(g)—Incorporate Laboratory Test Results

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Incorporate clinical lab-test results into certified EHR technology as structured data

More than 40% of all clinical lab tests results ordered by the EP or by an authorized provider of the eligible hospital or CAH for patients admitted to its inpatient or emergency department (POS 21 or 23) during the EHR reporting period whose results are either in a positive/negative or numerical format are incorporated in certified EHR technology as structured data

Interim Final Rule Text:

(1)

Receive results.

Electronically receive clinical laboratory test results in a structured format and display such results in human readable format.

(2)

Display codes in readable format.

Electronically display in human readable format any clinical laboratory tests that have been received with LOINC® codes.

(3)

Display test report information.

Electronically display all the information for a test report specified at 42 CFR 493.1291(c)(1) through (7).

(4)

Update.

Enable a user to electronically update a patient's record based upon received laboratory test results.

Final Rule Text: § 170.302(h).

(1) Unchanged.

(2)

Display test report information.

Electronically display all the information for a test report specified at 42 CFR 493.1291(c)(1) through (7).

(3)

Incorporate results.

Electronically attribute, associate, or link a laboratory test result to a laboratory order or patient record.

Comments on 170.302(g)(1)

Comments.

A few commenters suggested that we specify in the regulation that the reference to receiving clinical laboratory test results in a “structured format” means in HL7 version 2.3.1 format. These commenters further recommended that we refer to HL7 version 2.3.1 within the certification criterion. These commenters stated that many Complete EHR and EHR Module developers already use HL7 2.3.1 and that adopting it as a standard would spur industry-wide adoption and also set the stage for driving adoption of future HL7 standards, like HL7 2.5.1, in the later stages of meaningful use. A commenter in support of including HL7 2.3.1 stated that it was concerned that if we did not specify a standard for this requirement that there could be confusion regarding which version of the standard should be used, and that laboratories would have to continue to support multiple standards. Another commenter also noted that we did not specify a standard format for the laboratory results that Certified EHR Technology must be capable of receiving. This commenter, however, stated that many EHRs are compliant with HL7 2.5.1 for the purposes of receiving laboratory results. The commenter also recommended that we apply this certification criterion differently for ambulatory and inpatient settings by requiring that Complete EHRs and EHR Modules designed for an ambulatory setting be required to receive HL7 2.5.1 formatted laboratory test results and those designed for an inpatient setting be required to receive HL7 2.3.1 formatted laboratory test results. One commenter suggested that our objectives could be better supported if we stated that in this certification criterion a requirement that laboratory results must be received electronically using HL7 transactions with implementation guidance.

Response.

While we understand the intent of these commenters' suggestions, we do not believe that it is within the scope of this rule to dictate the standard by which laboratories transmit test results. The scope of this rule is the adoption of certification criteria that specify required capabilities of Certified EHR Technology (in this case, receiving laboratory information in structured format) and not, in this instance, specifying the standard by which laboratories must transmit test results.

Comment.

A commenter requested that we clarify how this certification criterion is applicable to hospital settings. The commenter asked whether we intended for the capability of receiving laboratory test results to include results obtained during a patient's stay at the hospital or if we meant to also include the receipt of laboratory test results from other time periods. They suggested requiring only those laboratory test results obtained during the patient stay.

Response.

For the purposes of demonstrating compliance with this certification criterion, we do not specify the contexts (

e.g.,

a patient stay) under which laboratory test results are received. Rather, consistent with the meaningful use objective and measure and the capabilities required by this certification criterion, we specify that when laboratory test results are received in structured format by Certified EHR Technology, that the results can be incorporated.

Comment.

One commenter requested that we clarify whether the structured data requirement applies to all laboratories (including reference labs, hospital labs, physician office labs, and physicians performing their own lab tests).

Response.

This certification criterion requires Complete EHRs and EHR Modules to provide the capability to receive clinical laboratory test results in a structured format as a condition of certification. It does not speak to how laboratories must send the test results.

Comments on 170.302(g)(2)

Comments.

Some commenters requested clarification on this specific capability within the certification criterion regarding what needed to be displayed in the context of LOINC codes. These commenters suggested that we not require the display of the actual LOINC code, but the description associated with the LOINC code. A commenter suggested that we identify a subset of common LOINC codes instead of requiring that tens of thousands of LOINC codes be supported for the purposes of certification. Other commenters suggested that we offer guidance in the form of a “starter set” of LOINC codes to encourage the use of the standard. One commenter requested that we confirm its understanding of this specific part of the certification criterion, which is that Certified EHR Technology must demonstrate the capability to import LOINC coded results from an external source. Finally, one commenter noted that the heading for the standard at § 170.205(a)(2)(iii) should just refer to “laboratory test results” and not “laboratory orders and results.”

Response.

We clarify that we do not expect Certified EHR Technology to natively (or internally) support LOINC in its entirety, which is why we do not believe that it is necessary to specify a subset of common LOINC codes. Given the diverse comments and requests for clarification on this specific aspect of the certification criterion, we agree with commenters that we should not require a LOINC code that has been received, to then be displayed. Accordingly, we have decided to remove this requirement from the certification criterion. We do, however, wish to further clarify our current approach to Certified EHR Technology's use of LOINC codes. Presently, we expect Certified EHR Technology to be able to reuse a LOINC code once it has been received and is accessible to Certified EHR Technology. We do not expect, as we mention above, that Certified EHR Technology will have to crosswalk or map internal or local codes to LOINC codes. This clarification is applicable to the standard that we have adopted regarding LOINC codes now specified at § 170.207. This response is applicable to similar comments we received on other certification criteria that also referenced the use of LOINC codes. Finally, we agree with the commenter who suggested that we revise the heading of the standard at § 170.205(a)(2)(iii). We have done this as part of the overall restructuring of the regulation text.

Comments on 170.302(g)(3)

Comments.

Some commenters agreed with the capability specified in 170.302(g)(3). One noted a concern that modifications to either a certified Complete EHR or certified EHR Module could potentially result in the failure of Certified EHR Technology to display the test report information as required by the regulations and, thereby, put the laboratory in technical violation of the CLIA regulations. These commenters reasoned that because a Complete EHR or EHR Module must be tested and certified to be in compliance with 42 CFR 493.1291(c)(1) through (7) that certification should replace any requirement for the laboratory to confirm that the information has been properly transmitted and meets the CLIA requirements. These commenters also asserted that a laboratory should be relieved of any further regulatory responsibility under 42 CFR 493.1291(c)(1) through (7) for the display of the required report information to the physician or subsequent viewers of the information if the Certified EHR Technology has been implemented by an eligible professional or eligible hospital. One commenter reiterated the point by stating that because Certified EHR Technology would be required to display the required CLIA report elements, laboratories should not be unfairly held accountable for any elements that may be removed or altered by other parties from the test report before received by the physician.

Response.

While we can understand the concern expressed by these commenters, we reiterate that the scope of our authority under this final rule only applies to capabilities that Certified EHR Technology must include. As a result, we cannot provide the regulatory relief that these commenters seek.

Comments on 170.302(g)(4)

Comments.

A couple of commenters questioned whether we intended for the “updates” to be manual updates of electronic records. If that were true, some commenters were concerned that would create workflow problems and reduce the availability of results. Other commenters suggested that either the user be able to create an additional record, rather than be permitted to change the “official” record or that an adequate audit trail be preserved of the existing data and any updates, since an update may result in disparities with the official record of test results. These commenters wanted to ensure that the laboratory's record would be the same as the record maintained in the EHR. One commenter stated that paragraph (g)(4) could imply process and system behavior that we did not intend to require. The commenter stated that it is common practice in a hospital setting for lab results to be transmitted in high volume from a lab system to an EHR and made available for review to the clinician through the EHR, without a need for a user to review each transaction before updating the EHR to make the results available. Another commenter made a similar point and questioned whether an “update” meant manual intervention, which they stated would be impracticable in a hospital setting. One commenter stated that most EHR technology already links orders to lab results in an established way. The commenter also indicated that the certification criterion we adopted requires changes to a process that most EHR developers have already implemented and introduces inefficiencies for both EHR developers and health care providers.

Response.

We appreciate the issues raised by commenters on this specific capability and have revised this part of the certification criterion to more clearly express our expectation for Certified EHR Technology and to be responsive to and consistent with commenters' suggestions. We intended for an update to mean, as indicated by the meaningful use objective and measures, that a laboratory test result would be incorporated in Certified EHR Technology with the originating laboratory order or with a patient's record in any one of the methods specified. Accordingly we have revised this specific capability to more clearly reflect our intent. We believe this addresses commenters' concerns and requests for clarification and would permit batches of laboratory test results to be electronically linked to laboratory orders or patient records without manual intervention.

Comments.

Some commenters noted that small and medium size practices have had a difficult time working with commercial laboratory vendors to provide interfaces from which they can receive lab test results. These commenters noted that laboratory vendors typically charge too much for their services and do not prioritize establishing connections with small and medium size practices because they do not have the same volume of laboratory referrals as large practices.

Response.

This certification criterion requires as a condition of certification that Certified EHR Technology be capable of supporting electronic laboratory interfaces. We understand the

concerns raised by commenters pertaining to the difficulty of certain practices being able to obtain laboratory interfaces and note that the meaningful use Stage 1 measure associated with this certification criterion is included in the “menu set” specified by CMS which we believe should help assuage some commenters' concerns. We do not believe that the ability of a practice (regardless of size) to obtain an interface or other type of connection is an issue that is within the scope of this final rule to address.

Comment.

One commenter recommended that we revise this certification criterion to require that laboratory domain expertise be exhibited when laboratory information is displayed. The commenter further elaborated by stating that laboratory results are not homogeneous, and that specific laboratory domain expertise is necessary to design the ways in which the data associated with certain laboratory results (

e.g.,

microbiology, molecular pathology) are displayed in EHR systems to ensure appropriate presentation and interpretation.

Response.

With the exception of displaying the required elements specified at 42 CFR 493.1291(c)(1) through (7), we do not require as a condition of certification any additional display requirements. Accordingly, we do not preclude Complete EHR and EHR Module developers from designing more specific displays of laboratory results that may need to be displayed in a more complex fashion.

Comment.

One commenter requested that we clarify that Certified EHR Technology did not need to enable the EHR Technology user to receive voluminous raw or pre-final-report lab data, and further, that not providing this capability would not disqualify a Complete EHR or EHR Module from becoming certified.

Response.

Enabling a Complete EHR or EHR Module to receive “raw or pre-final-report lab data” is not required under this or any other adopted certification criterion.

Comment.

One commenter suggested that we modify this certification criterion to require transmission of cancer related lab tests and results to cancer registries as required by law.

Response.

Because this certification criterion is about incorporating lab test results in Complete EHRs and EHR Modules and does not require any electronic transmissions, we do not believe that this is an appropriate requirement to consider.

Section 170.302(h)—Generate Patient Lists

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Generate lists of patients by specific conditions to use for quality improvement, reduction of disparities, research or outreach

Generate at least one report listing patients of the EP, eligible hospital or CAH with a specific condition

Interim Final Rule Text:

Generate patient lists.

Enable a user to electronically select, sort, retrieve, and output a list of patients and patients' clinical information, based on user-defined demographic data, medication list, and specific conditions.

Final Rule Text: § 170.302(i).

Generate patient lists.

Enable a user to electronically select, sort, retrieve, and generate lists of patients according to, at a minimum, the data elements included in:

(1) Problem list;

(2) Medication list;

(3) Demographics; and

(4) Laboratory test results.

Comments.

Several commenters requested clarification regarding the set of variables that should be included in the demographic information for the patient lists. Some of these commenters suggested that the gender, race, ethnicity and preferred language of the patient should be included in this data set. One commenter suggested that the final rule should explicitly adopt and incorporate the recommendations of a report published by the Institute of Medicine in mid-2009 entitled, “Race, Ethnicity and Language Data: Standardization for Health Care Quality Improvement.”

Response.

We appreciate the commenters' suggestions, and we have used them to clarify this certification criterion. It was our intention that Certified EHR Technology would be able to leverage the information, specifically the structured data it has available to it, to assist eligible professionals and eligible hospitals to generate patient lists. We have clarified this certification criterion to express this intent. Accordingly, we expect that Certified EHR Technology will be able to generate patient lists according to certain data elements for which structured data will be available: Medical problems; medications; demographics; and laboratory test results. While we respect the work completed by the Institute of Medicine, we do not believe that the public has had an adequate opportunity to consider its recommendations related to demographics in the context of certification, and we are therefore not including them as a condition of certification at this time. We encourage the HIT Standards Committee to consider this report as it recommends standards to the National Coordinator.

Comments.

Several commenters requested further clarification regarding the meaning of “patient's clinical information.” Other commenters stated that this phrase was too vague and was not included as part of the proposed meaningful use objective or measure and should therefore be removed. Some commenters requested further definition of the term “specific conditions,” particularly to clarify whether this term refers to problems and diagnoses. Clarification was also requested regarding whether this information includes: a patient summary; the patient's entire medical history; and patient encounter notes. One commenter recommended that we clarify how the lists must be structured and suggested that we specify time periods for patient histories. One commenter requested clarification of the term “output,” and suggested that it should mean to produce a list for internal use and that it does not refer to exporting the patient list to a system or destination external to the office of an eligible professional.

Response.

We appreciate the concerns raised by these commenters and after further consideration agree that the terms referenced by commenters could be interpreted in multiple ways. Accordingly we have removed “patient's clinical information” and “specific conditions” from the certification criterion, and have reframed the certification criterion to more directly

align with the meaningful use measure by changing “output” to “generate.” We sought to clarify that we intended that Certified EHR technology would be capable of electronically producing or “generating” patient lists for an eligible professional or eligible hospital's subsequent use. We do not require as a condition of certification that time periods be associated with a patient list, but presumably time (

i.e.,

the age of the information) could be one factor an eligible professional or eligible hospital could also use to sort their lists (

e.g.,

patients with XYZ problem recorded in the past 3 months). We believe that these revisions make this certification criterion clearer while addressing these commenters' concerns.

Section 170.302(i)—Report Quality Measures

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Eligible Professionals: Report ambulatory clinical quality measures to CMS or the States

For 2011, provide aggregate numerator, denominator, and exclusions through attestation as discussed in section II(A)(3) of [the Medicare and Medicaid EHR Incentive Programs final rule]

Interim Final Rule Text:

(1)

Display.

Calculate and electronically display quality measures as specified by CMS or States.

(2)

Submission.

Enable a user to electronically submit calculated quality measures in accordance with the standard and implementation specifications specified in § 170.205(e).

Eligible Hospitals and CAHs: Report hospital clinical quality measures to CMS or the States

For 2012, electronically submit the clinical quality measures as discussed in section II(A)(3) of [the Medicare and Medicaid EHR Incentive Programs final rule]

Final Rule Text: § 170.304(j).

(1)

Calculate.

(i) Electronically calculate all of the core clinical measures specified by CMS for eligible professionals.

(ii) Electronically calculate, at a minimum, three clinical quality measures specified by CMS for eligible professionals, in addition to those clinical quality measures specified in paragraph (1)(i).

(2)

Submission.

Enable a user to electronically submit calculated clinical quality measures in accordance with the standard and implementation specifications specified in § 170.205(f).

§ 170.306(i).

(1)

Calculate.

Electronically calculate all of the clinical quality measures specified by CMS for eligible hospitals and critical access hospitals.

(2)

Submission.

Enable a user to electronically submit calculated clinical quality measures in accordance with the standard and implementation specifications specified in § 170.205(f).

Comments.

Many commenters stated that the Physician Quality Reporting Initiative (PQRI) 2008 Registry XML specifications apply only in the context of eligible professionals. Some of these commenters went on to state that hospitals are not familiar with PQRI and have been submitting quality measurement data to CMS under a separate program. A few commenters recommended that this standard requirement be removed while several others stated we should adopt both Quality Reporting Document Architecture (QRDA) and the PQRI XML Registry specification in this rulemaking and move to a single standard in the next rulemaking. Other commenters recommended that QRDA not be adopted in this rulemaking. Several commenters suggested that an implementation specification for eligible hospitals be created if we intend to continue to require that quality measure be reported in the PQRI Registry XML format. One commenter expressed a concern that if the PQRI 2008 Registry XML standard is maintained as the adopted standard that there is a danger that the certification Complete EHR and EHR Module developers obtain may become obsolete before Stage 1 has run its course. Finally, a couple of commenters suggested that ONC consider deferring the naming of a standard for submission of clinical quality measures until Stage 2 and instead only require what is necessary to support clinical quality measure submission in Stage 1.

Response.

Many commenters misinterpreted our intent with respect to the adoption of the PQRI 2008 Registry XML specification as the standard for electronically submitting quality reporting data to CMS. Presently, CMS requires the submission of aggregate, summary level data for the purposes of meaningful use and not data at the patient-specific level. It is our understanding that the PQRI 2008 Registry XML specification is capable of serving as the “envelope” for aggregate, summary level data. Accordingly, we do not believe that, as some commenters suggested, an eligible hospital's familiarity with the PQRI program is relevant to the adoption of this standard for this specified purpose. Nor do we believe that a specific implementation of this standard is necessary for hospital settings as the standard's purpose and the type of data it will transmit to CMS will be the same—aggregate, summary level data. Through recent discussions with CMS since the publication of the Interim Final Rule we have determined that the PQRI 2009 Registry XML specification, a more recent version of the standards we adopted in the Interim Final Rule is a suitable replacement for 2008 version, and accordingly, we have adopted the 2009 version in its place. We believe this revision should assuage some commenters' concerns about the obsolescence of the adopted standard and reduce concerns that a wholly different standard would be adopted in the near future. If adopting a different standard for Certified EHR Technology becomes necessary, we would do so only after engaging in subsequent rulemaking.

Comments.

A few commenters stated that many of the clinical quality measures proposed by CMS do not have electronic specifications and contended that it would be difficult for any vendor to have embedded these measures in their EHR products in a timely manner. But, these same commenters stated that when the specifications become available, that HHS should ensure through the certification process that the products are capable of generating accurate data. Many commenters expressed concerns that the certification criterion was too vague or too broad (because it implicitly referenced all of

the quality measures CMS had proposed). Some of the commenters recommended that this certification criterion be removed, while others recommended that it focus on a subset of measures in order to constrain the amount of electronic measure specifications a Complete EHR or EHR Module developer would need to address in order to be certified. At least one of these latter commenters indicated that our adopted certification criteria created uncertainty for Complete EHR and EHR Module Developers. This commenter asked that we clarify what clinical quality measures would need to be tested in order to satisfy this certification criterion and if there would be a baseline for eligible hospital measures as well as some identified core set of measures for eligible professionals. Along these same lines, another commenter recommended that EHR technology should be tested and certified only to the clinical quality measures applicable to the medical specialties of the eligible professionals that the EHR technology is intended to support and to whom it is marketed. Other commenters expressed concerns about timing and that a significant amount of effort would be required to reprogram Complete EHRs and EHR Modules to capture, calculate, and report the final meaningful use Stage 1 measures. Many commenters also stated that the proposed quality measures are not yet ready for automated reporting, that a significant amount of work is still required by the measure developer community, and that the value sets for these quality measures have not been validated. Several commenters objected to the reference to “States” in the certification criterion and recommended that it be removed. These commenters contended that the certification criterion should be limited to the “federal requirements” and further that it was unrealistic to expect Complete EHR and EHR Module developers to also comply with 50 separate State requirements as a condition of certification.

Response.

We understand that CMS has worked to significantly increase the availability of a number of electronic measure specifications that are associated with specific clinical quality measures. In light of the final approach CMS has taken with respect to clinical quality measures for meaningful use Stage 1, we have revised this certification to better align it with the Medicare and Medicaid EHR Incentive Programs final rule requirements. We also agree with those commenters that requested we explicitly focus the report of clinical quality measures certification criterion, and the certification criteria in general, on Federal requirements and have removed the reference to “or States” in this certification criterion.

To better align this certification criterion with the final approach to clinical quality measures in the Medicare and Medicaid EHR Incentive Programs final rule, we have determined that it is no longer sufficient to specify one general certification criterion for both Complete EHRs and EHR Modules designed for either an ambulatory or inpatient setting. Accordingly, the final rule in §§ 170.304 and 170.306 will include a specific certification criterion for each setting. Complete EHRs and EHR Modules designed for an ambulatory setting will be required to be tested and certified as being compliant with all 6 of the core (3 core and 3 alternate core) clinical quality measures specified by CMS for eligible professionals (Section II(A)(3) of the Medicare and Medicaid EHR Incentive Programs final rule). Complete EHRs and EHR Modules designed for an ambulatory setting will also be required to be tested and certified as being compliant with, at a minimum, 3 of the additional clinical quality measures CMS has identified for eligible professionals (Section II(A)(3)of the Medicare and Medicaid EHR Incentive Programs final rule). We believe this revision provides clarity and flexibility and reduces the potential burden for Complete EHR and EHR Module developers (who may have been unfamiliar with certain clinical quality measures because of the type of eligible professional they serve) to become compliant with this certification criterion. As a result, Complete EHR and EHR Module developers for the ambulatory setting may provide Certified EHR Technology with a certain level of variability in terms of clinical quality measure capabilities. To provide further transparency for potential eligible professionals regarding the clinical quality measures to which a Complete EHR or EHR Module has been tested and certified, we specified that an ONC-Authorized Testing and Certification Body would need to report such information to the National Coordinator, and further, that the Complete EHR or EHR Module developer would need to make sure this information is available and communicated to prospective purchasers as part of the Complete EHR or EHR Module's certification.

Complete EHRs and EHR Modules designed for an inpatient setting will be required to be tested and certified as being compliant with all of the clinical quality measures specified by CMS (Section II(A)(3) of the Medicare and Medicaid EHR Incentive Programs final rule) for eligible hospitals. Again, we believe this revision provides greater clarity and reduces the potential burden for Complete EHR and EHR Module developers.

Comments.

One commenter suggested that we separate the calculation and the submission parts of this certification criterion into two separate certification criteria.

Response.

We disagree. We see no basis for separating these two parts of this certification criterion into two separate certification criteria. However, we believe that it is necessary to specify two different certification criteria to account for the different clinical quality measures that eligible professionals and eligible hospitals will need to report. Accordingly, we have adopted separate certification criteria for Complete EHRs and EHR Modules designed for ambulatory and inpatient settings and referenced the respective quality measures for each in the appropriate certification criterion.

Comments.

One commenter suggested that all approved PQRI registries be automatically certified as an EHR Module.

Response.

We do not believe that it is prudent or appropriate to automatically deem certain HIT as certified. That being said, if a PQRI registry can adequately perform the capability specified by the certification criterion, it could be certified as an EHR Module.

Comments.

Several commenters stated that Certified EHR Technology should be capable of collecting quality measurement data and calculating results for reporting to avoid having eligible professionals and eligible hospitals perform these processes manually. These commenters also stated that Certified EHR Technology should be capable of accurately and reliably reporting quality measurement data. Some commenters recommended that a Complete EHR or EHR Module only be required to be certified to existing e-measure specifications.

Response.

We agree that the collection of clinical quality measurement data and the calculation of results for submission to CMS should be performed by Certified EHR Technology. We also agree that Complete EHRs or EHR Modules should only be required to be tested and certified to developed electronic measure specifications. This is why CMS has only specified clinical quality measures for eligible professionals and eligible hospitals in the Medicare and Medicaid EHR Incentive Programs final rule for which electronic measure

specifications have been developed. Complete EHR and EHR Module developers should follow these electronic measure specifications in order to accurately calculate clinical quality measures.

Comments.

Several commenters recommended that the certification criterion should be revised to include the word “accurately.”

Response.

We expect that clinical quality measures would be accurately calculated and do not see a need to specifically include the word in the certification criterion.

Section 170.302(j)—Check Insurance Eligibility and § 170.302(k)—Submit Claims

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Removed from final rule

Removed from final rule

Interim Final Rule Text:

Enable a user to electronically record and display patients' insurance eligibility, and submit insurance eligibility queries to public or private payers and receive an eligibility response in accordance with the applicable standards and implementation specifications specified in § 170.205(d)(1) or (2).

Final Rule Text:

Removed.

Meaningful use Stage 1 objective

Meaningful use Stage 1 measure

Certification criterion

Removed from final rule

Removed from final rule

Interim Final Rule Text:

Enable a user to electronically submit claims to public or private payers in accordance with the standard and implementation specifications specified in § 170.205(d)(3).

Final Rule Text:

Removed.

Comments.

Many commenters recommended that the certification criteria for administrative transactions be removed because they considered the administrative capabilities that we required to be outside of the scope of an electronic health record and stated further that their inclusion did not align with the HIT industry's common view of what constituted EHR technology. A large number of commenters conveyed specific challenges including: These functions are usually handled by practice management systems which generally are separate from an EHR, although on occasion some vendors include these functionalities in their EHRs; practice management systems adoption is already very high and requiring certification for these products would be unnecessary and burdensome, given the wide variety and number of vendors and significant potential for increasing costs for providers; providers interested in achieving meaningful use would have to abandon a working practice management system if their practice management vendors were unwilling or unable to get certified; and many providers currently use clearinghouses to convert paper claims into electronic claims to submit to CMS and other payers. Several commenters recommended retaining the administrative transactions certification criteria because it would eventually reduce administrative costs across the health care system. Many commenters requested that we clarify several aspects of these certification criteria while some other commenters noted that significant progress has been made in using electronic eligibility inquires and claims transactions outside of an EHR context. Those commenters expressed concern that the inclusion of administrative transaction capability in this rule would create confusion, ambiguity, and potentially duplicate efforts. A couple of commenters noted that some payers do not accept electronic claims and eligibility checks. One commenter expressly noted that including the administrative functionalities would decrease innovation by creating a large barrier to entry for EHR innovators. Finally, a couple of commenters noted that health care providers would face significant challenges in the transition to ASC X12N 5010 and ICD-10 and lost productivity.

Response.

In concert with CMS, we have considered commenters' rationale for and against the inclusion of these certification criteria. We have tried to summarize above several technical and programmatic challenges commenters identified if administrative transaction capability were included within the certification requirements. Due to the removal of these objectives from the meaningful use Stage 1 requirements, we do not believe that it would be appropriate to continue to require, as a condition of certification, that Complete EHRs and EHR Modules include these capabilities. Accordingly, we have removed the adopted standards, implementation specifications, and certification criteria related to these administrative transactions from this final rule.

As CMS explains in more detail in the Medicare and Medicaid EHR Incentive Programs final rule, the subsequent inclusion of administrative simplification requirements as part of meaningful use Stage 2 is an important long-term policy goal. Administrative simplification can improve the efficiency and reduce unnecessary costs in the health care system as a whole; the small percentage of paper claims submitted represents a disproportionately high administrative cost for health plans; the reconciliation of billing charges for services not eligible for payment creates a significant burden for providers, health plans, and most significantly, for patients. Moreover, we believe that the integration of administrative and clinical information systems is necessary to support effective management and coordinated care in physician practices. For example, the ability to: leverage clinical documentation in support of appropriate charge capture (

e.g.,

for preventive counseling, or immunizations provided); link lists of patients needing clinical reminders with patient contact information; stratify quality measures by patient demographic factors (

e.g.,

race/ethnicity) and insurer status (

e.g.,

Medicare beneficiaries).

Additionally, we believe that important benefits can be recognized through the future adoption of administrative transactions standards and certification criteria for Complete EHRs and EHR Modules. Through the

use of EHR Modules, eligible professionals and eligible hospitals have the opportunity to use practice management systems or clearinghouses that provide the capability to conduct administrative transactions as components of Certified EHR Technology. In that regard, we recognize the concerns expressed by some commenters that the developers of some practice management systems may not be prepared to seek certification for these legacy systems in 2010 or 2011. We also acknowledge that the required compliance date of January 1, 2012 for ASC X12N version 5010 transactions would further complicate the certification process associated with meaningful use Stage 1. However, we believe that after the ASC X12N version 5010 transition has occurred, and we approach the October 1, 2013 compliance date for HIPAA covered entities to use ICD-10, our decision to delay the adoption of administrative transactions certification criteria will prove beneficial for the adoption of Certified EHR Technology.

In order to meet upcoming administrative simplification deadlines, most health care providers will have to upgrade their practice management systems or implement new ones. This will provide an important opportunity to align EHR technology capabilities and standards for administrative transactions with the administrative simplification provisions that the Affordable Care Act provides for health plans and clearinghouses. Therefore, we intend to include for adoption, administrative transactions standards and certification criteria to support meaningful use Stage 2 rulemaking, and expect health care providers and Complete EHR and EHR Module developers to take this into consideration leading up to 20

This text is long and has been trimmed here. Open the source document for the complete record.