# ONC Health IT Certification Program: Enhanced Oversight and Accountability

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A2016-24908

## Record

- **Collection:** Federal Register
- **Document type:** Rule
- **Published:** October 19, 2016
- **Citation:** 81 FR 72404

## Text

DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Secretary
45 CFR Part 170
RIN 0955-AA00
ONC Health IT Certification Program: Enhanced Oversight and Accountability

AGENCY:

Office of the National Coordinator for Health Information Technology, Department of Health and Human Services.

ACTION:

Final rule.

SUMMARY:

This final rule finalizes modifications and new requirements under the ONC Health IT Certification Program (“Program”), including provisions related to the Office of the National Coordinator for Health Information Technology (ONC)'s role in the Program. The final rule creates a regulatory framework for ONC's direct review of health information technology (health IT) certified under the Program, including, when necessary, requiring the correction of non-conformities found in health IT certified under the Program and suspending and terminating certifications issued to Complete EHRs and Health IT Modules. The final rule also sets forth processes for ONC to authorize and oversee accredited testing laboratories under the Program. In addition, it includes provisions for expanded public availability of certified health IT surveillance results.

DATES:

These regulations are effective December 19, 2016.

The incorporation by reference of the publication listed in the rule is approved by the Director of the Federal Register as of December 19, 2016.

FOR FURTHER INFORMATION CONTACT:

Michael Lipinski, Office of Policy, Office of the National Coordinator for Health Information Technology, 202-690-7151.

SUPPLEMENTARY INFORMATION:

Commonly Used Acronyms

CAP Corrective Action Plan

CEHRT Certified Electronic Health Record Technology

CFR Code of Federal Regulations

CHPL Certified Health IT Product List

EHR Electronic Health Record

HHS Department of Health and Human Services

HIT Health Information Technology

ISO/IEC International Organization for Standardization/International Electrotechnical Commission

NVLAP National Voluntary Laboratory Accreditation Program

OMB Office of Management and Budget

ONC Office of the National Coordinator for Health Information Technology

ONC-ACB ONC-Authorized Certification Body

ONC-ATCB ONC-Authorized Testing and Certification Body

ONC-ATL ONC-Authorized Testing Laboratory

PoPC Principles of Proper Conduct

Table of Contents

I. Executive Summary

A. Purpose of Regulatory Action

B. Summary of Major Provisions

1. ONC Direct Review of Certified Health IT

2. ONC-Authorized Testing Laboratories

3. Transparency and Availability of Identifiable Surveillance Results

C. Costs and Benefits

1. Costs

2. Benefits

II. Provisions of the Final Rule

A. ONC's Role Under the ONC Health IT Certification Program

1. Review of Certified Health IT

a. Authority and Scope

(1) Requirements of the Program

(2) Review of Uncertified Capabilities

(3) Scope of Review

b. ONC-ACB's Role

c. Review Processes

(1) Notice of Potential Non-Conformity or Non-Conformity

(2) Corrective Action

(3) Suspension

(4) Termination

(5) Appeal

d. Consequences of Certification Termination

(1) Certification Ban, Recertification, and Heightened Scrutiny

(2) ONC-ACB Response to a Non-Conformity

2. Establishing ONC Authorization for Testing Labs Under the Program; Requirements for ONC-ATL Conduct; ONC Oversight and Processes for ONC-ATLs

a. General Comments on the ONC-ATL Approach

b. Regulatory Provisions for Inclusion of ONC-ATLs in the Program

(1) § 170.501 Applicability

(2) § 170.502 Definitions

(3) § 170.505 Correspondence

(4) § 170.510 Type of Certification

(5) § 170.511 Authorization Scope for ONC-ATL Status

(6) § 170.520 Application

(7) § 170.523 Principles of Proper Conduct for ONC-ACBs

(8) § 170.524 Principles of Proper Conduct for ONC-ATLs

(9) § 170.525 Application Submission

(10) § 170.530 Review of Application

(11) § 170.535 ONC-ACB Application Reconsideration

(12) § 170.540 ONC-ACB Status

(13) § 170.557 Authorized Certification Methods

(14) § 170.560 Good Standing as an ONC-ACB

(15) § 170.565 Revocation of ONC-ACB Status

(16) § 170.570 Effect of Revocation on the Certifications Issued To Complete EHRs and Health IT Module(s)

B. Public Availability of Identifiable Surveillance Results

III. National Technology Transfer and Advancement Act and the Office of Management and Budget Circular A-119

IV. Incorporation by Reference

V. Collection of Information Requirements

A. ONC-AA and ONC-ACBs

B. ONC-ATLs

C. Health IT Developers

VI. Regulatory Impact Statement

A. Statement of Need

B. Alternatives Considered

C. Overall Impact

1. Executive Orders 12866 and 13563—Regulatory Planning and Review Analysis

a. Costs

(1) Costs for Health IT Developers To Correct a Non-Conformity Identified by ONC

(2) Costs for ONC and Health IT Developers Related to an ONC Inquiry Into Certified Health IT Non-Conformities and ONC Direct Review

(3) Costs for Health IT Developers and ONC Associated With the Appeal Process Following a Suspension/Termination of a Complete EHR's or Health IT Module's Certification

(4) Costs for Health Care Providers to Transition to Another Certified Health IT Product When the Certification of a Complete EHR or Health IT Module That They Currently Use Is Terminated

(5) Costs for ONC-ATLs and ONC Associated With ONC-ATL Accreditation, Application, Renewal, and Reporting Requirements

(6) Costs for ONC-ATLs and ONC Related to Revoking ONC-ATL Status

(7) Costs for ONC-ACBs To Submit Identifiable Surveillance Results to the CHPL

(8) Total Annual Cost Estimate

b. Benefits

c. Accounting Statement and Table

2. Regulatory Flexibility Act

3. Executive Order 13132—Federalism

4. Unfunded Mandates Reform Act of 1995

Regulation Text

I. Executive Summary

A. Purpose of Regulatory Action

The ONC Health IT Certification Program (“Program”) was first established as the Temporary Certification Program in a final rule published on June 24, 2010 (“Temporary Certification Program final rule” (75 FR 36158)). It was later transitioned to the Permanent Certification Program in a final rule published on January 7, 2011 (“Permanent Certification Program final rule” (76 FR 1262)). Since that time, we have updated the Program and made modifications to the Program through subsequent rules as discussed below.

In November 2011, a final rule established a process for ONC to address

instances where the ONC-Approved Accreditor (ONC-AA) has engaged in improper conduct or has failed to perform its responsibilities under the Program (76 FR 72636). In September 2012, a final rule (“2014 Edition final rule” (77 FR 54163)) established an edition of certification criteria and modified the Program to, among other things, provide clear implementation direction to ONC-Authorized Certification Bodies (ONC-ACBs) for certifying Health IT Modules to new certification criteria. On September 11, 2014, a final rule provided certification flexibility through the adoption of new certification criteria and further improvements to the Program (“2014 Edition Release 2 final rule” (79 FR 54430)). On October 16, 2015, the Department of Health and Human Services (HHS) published a final rule that identified how health IT certification can support the establishment of an interoperable nationwide health information infrastructure through the certification and adoption of new and updated vocabulary and content standards for the structured recording and exchange of health information (“2015 Edition final rule” (80 FR 62602)). The 2015 Edition final rule modified the Program to make it open and accessible to more types of health IT, and health IT that supports various care and practice settings. It also included enhanced surveillance, disclosure, and other requirements. These requirements were designed to support the reliability of health IT certified under the Program and increase the transparency of information about such health IT (referred to as “certified health IT” throughout this final rule).

With each Program modification and rule, we continue to address stakeholder concerns, provide additional guidance, and improve oversight. In keeping with this approach, in the “ONC Health IT Certification Program: Enhanced Oversight and Accountability” proposed rule (81 FR 11056) (“Proposed Rule”) we put forth several new proposals for comment, based on feedback from stakeholders and our own experience administering the Program. Importantly, we explained that the adoption and use of certified health IT has increased significantly since the Program was established, and that this trend will continue, including for settings and use cases beyond the Medicare and Medicaid EHR Incentive Programs (“EHR Incentive Programs”). As certified health IT becomes more integral to the delivery of care, and as certified capabilities increasingly interact with other capabilities in certified health IT and with other products, we seek to strengthen oversight of the performance of certified health IT capabilities and ensure that concerns within the scope of the Program continue to be appropriately addressed.

We explained in the Proposed Rule that we had delegated authority to ONC-ACBs to issue certifications for health IT on our behalf through the Permanent Certification Program final rule (81 FR 11057). In addition to issuing and administering certifications, ONC-ACBs are responsible for conducting ongoing surveillance to assess whether certified health IT continues to conform to the requirements of the Program. An ONC-ACB's surveillance encompasses conformity assessments based on adopted certification criteria as well as certain other regulatory requirements (
e.g.,
§§ 170.523(k) and (l)). However, under this approach, which is consistent with customary certification programs and International Organization for Standardization/International Electrotechnical Commission 17065:2012 (ISO/IEC 17065),
1

ONC-ACBs do not have the responsibility to address the full range of requirements applicable to health IT certified under the Program. For example, an ONC-ACB's conformity assessment may not encompass certain interactions among certified capabilities and other capabilities or products that are not certified under the Program. Similarly, an ONC-ACB's assessment of certified capabilities may be limited to certain functional outcomes and may not encompass the combined or overall performance of certified health IT in accordance with Program requirements. Separately, in some instances an ONC-ACB may be responsible for administering Program requirements but may be unable to do so effectively due to practical challenges. In contrast, ONC is well-positioned to review certified health IT against the full range of requirements under the Program. Therefore, to enhance Program oversight and the reliability and safety of certified health IT, we have finalized provisions of the Proposed Rule that set forth a regulatory framework for ONC to directly review certified health IT and take appropriate responsive actions to address potential non-conformities and non-conformities.

1
The international standard to which ONC-ACBs are accredited (
see also
45 CFR 170.599(b)(3)).

The direct review processes included in this final rule will enhance the National Coordinator's ability to discharge his or her responsibilities under the Health Information Technology for Economic and Clinical Health (HITECH) Act. The HITECH Act amended the Public Health Service Act (PHSA) and created “Title XXX—Health Information Technology and Quality” (Title XXX) to improve health care quality, safety, and efficiency through the promotion of health IT and electronic health information exchange. Section 3001(b) of the PHSA requires that the National Coordinator for Health Information Technology (National Coordinator) perform specified statutory duties, including keeping or recognizing a program or programs for the voluntary certification of health information technology (section 3001(c)(5) of the PHSA), in a manner consistent with the development of a nationwide health information technology infrastructure that allows for the electronic use and exchange of information and that: (1) Ensures that each patient's health information is secure and protected, in accordance with applicable law; (2) improves health care quality, reduces medical errors, reduces health disparities, and advances the delivery of patient-centered medical care; (3) reduces health care costs resulting from inefficiency, medical errors, inappropriate care, duplicative care, and incomplete information; (4) provides appropriate information to help guide medical decisions at the time and place of care; (5) ensures the inclusion of meaningful public input in such development of such infrastructure; (6) improves the coordination of care and information among hospitals, laboratories, physician offices, and other entities through an effective infrastructure for the secure and authorized exchange of health care information; (7) improves public health activities and facilitates the early identification and rapid response to public health threats and emergencies, including bioterror events and infectious disease outbreaks; (8) facilitates health and clinical research and health care quality; (9) promotes early detection, prevention, and management of chronic diseases; (10) promotes a more effective marketplace, greater competition, greater systems analysis, increased consumer choice, and improved outcomes in health care services; and (11) improves efforts to reduce health disparities. Consistent with these statutory requirements, this final rule establishes a regulatory framework for ONC's direct review of health IT certified under the Program.

This final rule also sets forth processes for ONC to timely and directly

address testing issues. These processes do not currently exist under the Program structure and would serve to align the testing structure with ONC's authorization and oversight of ONC-ACBs. In addition, this final rule would increase the transparency and availability of information about certified health IT through the publication of identifiable surveillance results. The publication of identifiable surveillance results will support further accountability of health IT developers to their customers and users of certified health IT.

B. Summary of Major Provisions

1. ONC Direct Review of Certified Health IT

This final rule provides a regulatory framework for ONC to directly review certified health IT to determine whether it conforms to the requirements of the Program. Under this framework, ONC's review of certified health IT will be independent of, and may be in addition to, ONC-ACBs' surveillance and other functions under the Program. ONC's review will focus on capabilities and aspects of health IT that are certified under the Program (referred to throughout this final rule as “certified capabilities”), taking into consideration other relevant functionalities or products to the extent necessary to determine whether certified health IT is functioning in a manner consistent with Program requirements.

While the PHSA provides authority for ONC to directly review certified health IT in a broad range of circumstances, at this time we have finalized a regulatory framework for the exercise of such review in a more limited set of circumstances. This scope of review reflects the need to focus ONC's resources in areas that, at this time, are most vital to ensuring the integrity and effectiveness of the Program. It also complements the existing oversight and enforcement responsibilities of other government departments, agencies, and offices (referred to throughout this final rule as “agencies” or “agency,” as the context requires) that encourage compliance with Program requirements and promote accountability for the reliability and performance of health IT.

Specifically, this final rule establishes regulatory processes for ONC to exercise direct review of certified health IT, and take appropriate responsive actions, in two distinct sets of circumstances.

First, ONC may elect to directly review certified health IT when it has reason to believe that the certified health IT may not conform to the requirements of the Program because the certified health IT is causing or contributing to serious risks to public health or safety. Addressing the full range of these suspected non-conformities is beyond the scope of an ONC-ACB's expertise and responsibilities under the Program. In contrast, ONC has the authority to address the full range of requirements under the Program and, as we explained in the Proposed Rule, can effectively respond to these issues, quickly bringing to bear needed expertise and resources and coordinating activities with federal counterparts and other relevant entities to ensure a coordinated review and response (81 FR 11061).

Second, in addition to serious risks to public health or safety, ONC may elect to directly review certified health IT on the basis of other suspected non-conformities that, while within the scope of an ONC-ACB's responsibilities, present practical challenges that may prevent the ONC-ACB from effectively investigating the suspected non-conformity or providing an appropriate response. In particular, ONC may directly review certified health IT if a suspected non-conformity presents issues that may require access to certain confidential or other information that is unavailable to an ONC-ACB; may require concurrent or overlapping reviews by multiple ONC-ACBs; or may exceed the scope of an ONC-ACB's resources or expertise. We believe that ONC's review of certified health IT in these situations will help ensure the continued effective oversight and administration of the Program.

In response to comments received on the Proposed Rule, we have not at this time finalized regulatory processes by which ONC would directly review certified health IT solely on the basis of circumstances distinct from public health or safety concerns or in cases where practical challenges prevent an ONC-ACB from effectively investigating the suspected non-conformity or providing an appropriate response, as discussed above (
compare
81 FR 11061). For example, at this time, the processes set forth in this rule do not establish that ONC will directly review certified health IT solely on the basis of a threat to the security or protection of patients' health information in violation of applicable law (
see
section 3001(b)(1) of the PHSA) or the risk of increasing health care costs resulting from, for example, inefficiency or incomplete information (
see
section 3001(b)(3) of the PHSA). We believe that other agencies are currently in the best position to provide effective oversight and enforcement with respect to such potential exigencies. We will continue to assess the need to exercise direct review in these additional circumstances, as necessary.

As mentioned above, in this final rule, we seek to align ONC's direct review of certified health IT with oversight and enforcement responsibilities of other agencies. We therefore clarify that ONC may decline to exercise review of certified health IT for any reason, including if it believes that other agencies may be better situated to respond to a suspected non-conformity. Additionally, to the extent permitted by law, ONC may coordinate and share information with other agencies, including agencies with applicable oversight or enforcement responsibilities, and may engage other persons and entities, as appropriate, to effectively respond to suspected problems or issues with certified health IT. We note that to the extent ONC engages in any efforts to identify or address non-conformities, such efforts and any resulting remediation (or the absence of such efforts or remediation) are not intended to impact the materiality of any non-conformity in a matter addressed by another agency; and nothing in this final rule is intended to supplant, delay, or in any way limit oversight or enforcement by other agencies, including any investigation, decision, legal action, or proceeding.

The final rule addresses actions ONC will take and procedures it will follow in the event that ONC's direct review of certified health IT substantiates a non-conformity. ONC will require corrective action for non-conformities and, when necessary, suspend, or terminate a certification issued to a Complete EHR or Health IT Module. Health IT developers will have the opportunity to appeal determinations by ONC to suspend or terminate certifications issued to health IT under the Program. Further, to protect the integrity of the Program and users of certified health IT, we have finalized a Certification Ban on the future certification of any of a health IT developer's health IT when the certification of one or more of the health IT developer's current Complete EHRs or Health IT Modules is: (1) Terminated by ONC; (2) withdrawn by an ONC-ACB because the health IT developer requested it to be withdrawn when the health IT developer's health IT was the subject of a potential non-conformity or non-conformity as determined by ONC; (3) withdrawn by an ONC-ACB because of a non-conformity with any of the certification criteria adopted by the Secretary at subpart C of this part; or (4) withdrawn by an ONC-ACB because the

health IT developer requested it to be withdrawn when the health IT developer's health IT was the subject of surveillance for a certification criterion or criteria adopted by the Secretary at subpart C of this part, including pending surveillance (
e.g.,
the health IT developer received notice of pending randomized surveillance).

We emphasize that ONC's role in reviewing certified health IT will support greater accountability for health IT developers under the Program and provide greater confidence that health IT conforms to Program requirements when it is implemented, maintained, and used. We further emphasize that our first and foremost goal is to work with health IT developers to remedy any identified non-conformities of certified health IT in a timely manner.

2. ONC-Authorized Testing Laboratories

ONC will conduct direct oversight of testing labs under the Program in order to ensure that ONC oversight can be similarly applied at all stages of the Program. Unlike the processes already established for ONC-ACBs, we had not established a similar process for testing labs. Instead, we required in the Principles of Proper Conduct (PoPC) for ONC-ACBs that ONC-ACBs only accept test results from National Voluntary Laboratory Accreditation Program (NVLAP)-accredited testing labs. This requirement for ONC-ACBs has had the effect of requiring testing labs to be accredited by NVLAP to International Organization for Standardization/International Electrotechnical Commission 17025:2005 (General requirements for the competence of testing and calibration laboratories) (ISO/IEC 17025). As a result, there has effectively been no direct ONC oversight of NVLAP-accredited testing labs like there is for ONC-ACBs.

This final rule establishes means for ONC to have direct oversight of NVLAP-accredited testing labs by having them apply to become ONC-Authorized Testing Labs (ONC-ATLs). Specifically, the final rule establishes processes for authorizing, retaining, suspending, and revoking ONC-Authorized Testing Lab (ONC-ATL) status under the Program. These processes are similar to current ONC-ACB processes. The finalized changes will enable ONC to oversee and address testing and certification performance issues throughout the entire continuum of the Program in a precise and direct manner.

3. Transparency and Availability of Identifiable Surveillance Results

In furtherance of our efforts to increase the transparency and availability of information related to certified health IT, we have finalized an approach that will now require ONC-ACBs to make identifiable surveillance results publicly available on the Certified Health IT Product List (CHPL) on a quarterly basis. Posting identifiable surveillance results on the CHPL provides stakeholders with a more readily available means for accessing the results. The information required to be reported for identifiable surveillance results includes information specified in the Proposed Rule and the relevant information already required to be posted on the CHPL, when appropriate, as part of a corrective action plan (CAP).

The publication of identifiable surveillance results will enhance transparency and the accountability of health IT developers to their customers. The public availability of identifiable surveillance results will provide customers and users with valuable information about the continued conformity of certified health IT. While we expect that the prospect of publicly available identifiable surveillance results will motivate some health IT developers to improve their maintenance efforts, we believe that most published results will reassure customers and users of certified health IT. This is because, based on ONC-ACB surveillance results to date, certified health IT and health IT developers are maintaining conformity with certification criteria and Program requirements. The publishing of identifiable surveillance results will also provide more complete information by illuminating good performance and continued conformity; rather than only sharing non-conforming results, and when applicable, CAPs.

C. Costs and Benefits

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any one year). It has been determined that this final rule is an economically significant rule as the potential costs associated with this final rule could be greater than $100 million per year. Accordingly, we have prepared an RIA that to the best of our ability presents the costs and benefits of the final rule.

1. Costs

We have identified and estimated the potential monetary costs of this final rule for health IT developers, ONC-ATLs, the federal government (
i.e.,
ONC), and health care providers. We have categorized and addressed costs as follows: (1) Costs for health IT developers to correct non-conformities identified by ONC; (2) costs for ONC and health IT developers related to an ONC inquiry into certified health IT non-conformities and ONC direct review, including costs for the new “proposed termination” step; (3) costs for health IT developers and ONC associated with the appeal process following a suspension/termination of a Complete EHR's or Health IT Module's certification; (4) costs for health care providers to transition to another certified health IT product when the certification of a Complete EHR or Health IT Module that they currently use is terminated; (5) costs for ONC-ATLs and ONC associated with ONC-ATL accreditation, application, renewal, and reporting requirements; (6) costs for ONC-ATLs and ONC related to revoking ONC-ATL status; and (7) costs for ONC-ACBs to publicly report (submit) identifiable surveillance results to the CHPL. We also provide an overall annual monetary cost estimate for this final rule. We note that we have rounded all estimates to the nearest dollar and all estimates are expressed in 2016 dollars.

This final rule may: (1) Lead health IT developers to reassess whether their certified health IT is in conformity with Program requirements; and (2) require health IT developers to correct non-conformities found by ONC in their certified health IT. If ONC were to find a non-conformity with a certified capability under the direct review processes outlined in this final rule, then the costs to correct the non-conformity are a result of this final rule. However, due to the difficulty of projecting such instances given the underlying need to correct non-conformities, we have not been able to include these costs in our quantitative cost estimates, as discussed in greater detail in section VI.C.1.a.(1) of this final rule.

We have estimated the costs for ONC and health IT developers related to an ONC inquiry into certified health IT non-conformities and ONC direct review. We estimate the cost for a health IT developer to cooperate with an ONC review and inquiry into certified health IT would, on average, range from $9,819 to $98,192. We estimate the cost for ONC to review and conduct an inquiry

into certified health IT would, on average, range from $2,455 to $147,288.

We have estimated the costs for health IT developers and ONC associated with the appeal process following a suspension/termination of a Complete EHR's or Health IT Module's certification. We estimate the cost for a health IT developer to appeal a suspension or termination would, on average, range from $9,819 to $29,458. We estimate the cost for ONC to conduct an appeal would, on average, range from $24,548 to $98,192.

We have estimated the costs for health care providers to transition to another certified health IT product if the certification of a Complete EHR or Health IT Module that they currently use is terminated. Specifically, we estimate the cost impact of certification termination on health care providers would range from $33,000 to $649,836,000 with a median cost of $792,000 and a mean cost of $6,270,000. We note, however, that it is very unlikely that the high end of our estimated costs would ever be realized. To date, there have been only a few terminations of certified health IT under the Program, which have only affected a small number of providers. Further, we have stated in this final rule our intent to work with health IT developers to correct non-conformities ONC finds in a developer's certified health IT under the provisions in this final rule. We provide a more detailed discussion of past certification terminations and the potential impacts of certification termination on providers in section VI.C.1.a.(4) of this final rule.

We have estimated the costs for ONC-ATLs and ONC associated with ONC-ATL accreditation, application, renewal, and reporting requirements. We estimate the annualized cost for ONC-ATL accreditation, application, and the first proposed three-year authorization period to be approximately $48,832. We estimate the annualized cost for an ONC-ATL to renew its accreditation, application, and authorization during the first three-year ONC-ATL authorization period to be approximately $73,053. In addition, we estimate the total annual cost for ONC-ATLs to meet the reporting requirements of proposed § 170.524(d) to be approximately $3,276.

We estimate ONC's annualized cost for administering the entire application process to be approximately $992. This cost will be the same for a new applicant or ONC-ATL renewal. We would also post the names of applicants granted ONC-ATL status on our Web site. We estimate the potential cost for posting and maintaining the information on our Web site to be approximately $446 annually. We estimate an annual cost to the federal government of $743 to record and maintain updates and changes reported by ONC-ATLs.

We have estimated the costs for ONC-ATLs and ONC related to revoking ONC-ATL status. We estimate the costs for an ONC-ATL to comply with ONC requests per § 170.565 would, on average, range from $2,455 to $19,638. We estimate the cost for ONC would, on average, range from $4,910 to $39,277.

We have estimated the costs for ONC-ACBs to submit identifiable surveillance results to the CHPL on a quarterly basis. We estimate the annual cost for each ONC-ACB to report surveillance results to the CHPL to be $1,024 and the total cost for all three ONC-ACBs to be $3,072.

We estimate the overall annual cost for this final rule, based on the cost estimates outlined above, will range from $171,011 to $650,352,050 with an average annual cost of $6,597,033. For a more detailed explanation of our methodology and estimated costs, please see section VI.C.1.a of this final rule.

2. Benefits

While we do not have available means to quantify the benefits of this final rule, we believe there are many qualitative benefits. This final rule's provisions for ONC direct review of certified health IT promote health IT developers' accountability for the performance, reliability, and safety of certified health IT; and facilitate the use of safer and reliable health IT by health care providers and patients. Specifically, ONC's direct review of certified health IT will facilitate ONC's assessment of non-conformities and ability to require comprehensive corrective actions for health IT developers to address non-conformities determined by ONC, including notifying affected customers. As previously stated, our first and foremost goal is to work with health IT developers to remedy any non-conformities with certified health IT in a timely manner and across all customers. If ONC ultimately suspends and/or terminates a certification issued to a Complete EHR or Health IT Module under the processes established in this final rule, such action will serve to protect the integrity of the Program, patients, and users of health IT. In sum, ONC's direct review of certified health IT supports the National Coordinator in fulfilling his or her responsibilities under the HITECH Act, instills public confidence in the Program, and protects public health and safety.

This final rule's provisions will also provide other benefits. ONC's authorization and oversight of testing labs (ONC-ATLs) will promote further public confidence in testing and certification by facilitating ONC's ability to timely and directly address testing issues for health IT. The public availability of identifiable surveillance results will enhance transparency and the accountability of health IT developers to their customers. It will provide customers and users of certified health IT with valuable information about the continued conformity of certified health IT. Further, the public availability of identifiable surveillance results will likely benefit health IT developers by providing a more complete context of surveillance in the certified health IT industry by illuminating good performance and the continued conformity of certified health IT with Program requirements. Overall, we believe this final rule will improve Program conformity as well as further public confidence in certified health IT.

II. Provisions of the Final Rule

A. ONC's Role Under the ONC Health IT Certification Program

In initially developing the Program, ONC consulted with the National Institute of Standards and Technology (NIST) and created the Program structure based on industry best practice. This structure includes the use of two separate accreditation bodies: (1) An accreditor that evaluates the competency of a health IT testing laboratory to operate a testing program in accordance with international standards; and (2) an accreditor that evaluates the competency of a health IT certification body to operate a certification program in accordance with international standards (
see
the Permanent Certification Program final rule).

This final rule updates the structure of the Program to provide enhanced Program oversight, accountability, and transparency. The rule establishes a regulatory framework that will help facilitate ONC's direct review of certified health IT in current priority areas, including by setting forth processes for such review and describing certain actions ONC may take to enforce Program requirements in appropriate circumstances. The rule also provides for direct ONC oversight of testing laboratories. These and other related provisions of the final rule are described in detail below.

1. Review of Certified Health IT

a. Authority and Scope

We proposed to adopt a regulatory framework that would help facilitate ONC's direct review of certified health IT in certain circumstances and enhance oversight and accountability in the Program (81 FR 11058). This review would be independent of, and could be in addition to, an ONC-ACB's surveillance and other functions under the Program and would complement the role of ONC-ACBs.

In the Proposed Rule, we explained that under the current structure of the Program, ONC-ACBs are responsible for issuing and administering certifications for health IT on behalf of ONC (81 FR 11057). In addition, ONC-ACBs are responsible for conducting ongoing surveillance to assess whether certified health IT continues to conform to the requirements of the Program. An ONC-ACB's surveillance encompasses conformity assessments based on adopted certification criteria as well as certain other regulatory requirements (
e.g.,
§ 170.523(k) and (l)). However, under this approach, which is consistent with other certification programs and ISO/IEC 17065,
2

ONC-ACBs do not have the responsibility to address the full range of requirements applicable to health IT certified under the Program. For example, an ONC-ACB's conformity assessments may not encompass certain interactions among certified capabilities and other capabilities or products that are not certified under the Program. Similarly, an ONC-ACB's assessment of certified capabilities may address certain functional outcomes and may not encompass the combined or overall performance of certified health IT in accordance with Program requirements. Separately, in some instances an ONC-ACB may be responsible for administering Program requirements but ONC may be better suited to do so due to practical challenges.
3

2
The international standard to which ONC-ACBs are accredited (
see also
45 CFR 170.599(b)(3)).

3
In certain circumstances, an ONC-ACB may encounter practical challenges that could prevent it from effectively investigating a suspected non-conformity or providing an appropriate response. This may occur where, for example, a suspected non-conformity presents issues that may require access to certain confidential or other information that is unavailable to an ONC-ACB; may require concurrent or overlapping reviews by multiple ONC-ACBs; or may exceed the scope of an ONC-ACB's resources or expertise. For a more detailed discussion of these circumstances, we refer readers to section II.A.1.a.(3) of this final rule and to the section II.B (“Summary of Major Provisions”).

In the Proposed Rule, we outlined several situations in which, for these reasons, an ONC-ACB may be unable to provide oversight necessary to ensure that certified health IT meets Program requirements. We stated, for example, that ONC may be better situated to respond to certain types of non-conformities arising from interactions of certified and uncertified capabilities or from systemic, widespread, or complex issues that could quickly consume or exceed an ONC-ACB's resources or capacity (81 FR 11061). We also observed that in some instances ONC may have access to information about a putative non-conformity that is confidential and cannot be shared with an ONC-ACB (81 FR 11061). We explained that in some cases non-conformities with certified health IT may arise that pose risks to public health or safety or present other exigencies that may warrant ONC's direct review and action (81 FR 11061). Additionally, we noted that a suspected non-conformity may involve health IT or capabilities that have been certified by more than one ONC-ACB. In such a situation, we stated that ONC would be better suited to handle the review of the certified health IT as ONC-ACBs only have oversight of the health IT they certify, while ONC could ensure a more coordinated review and consistent determination. We explained that ONC is well-placed to effectively respond to these potential issues because of its broad authority to administer the full range of requirements under the Program, its ability to quickly marshal and deploy resources and specialized expertise, and its ability to provide a coordinated review and response that may involve other agencies. Therefore, to support ONC's oversight in these areas, we proposed to establish a framework and processes in rulemaking under which ONC may exercise its discretion to directly review certified health IT and take appropriate responsive action.

In the Proposed Rule, we stated that ONC's review of certified health IT could be based on any applicable Program requirements and as such would not be limited to requirements that ONC-ACBs are responsible for enforcing. We proposed that, while ONC would have broad discretion, it would consider the following factors in determining whether to initiate direct review of certified health IT:

• The potential nature, severity, and extent of the suspected non-conformity or non-conformities, including the likelihood of systemic or widespread issues and impact.

• The potential risk to public health or safety or other exigent circumstances.

• The need for an immediate and coordinated governmental response.

• Whether investigating, evaluating, or addressing the suspected non-conformity would require access to confidential or other information that is unavailable to an ONC-ACB; would present issues outside the scope of an ONC-ACB's accreditation; would exceed the resources or capacity of an ONC-ACB; or would involve novel or complex interpretations or application of certification criteria or other requirements.

• The potential for inconsistent application of certification requirements in the absence of direct review.

(
see
81 FR 11061). We anticipated that ONC's direct review of certified health IT would be relatively infrequent and would focus on situations that pose a risk to public health or safety as well as other situations that present unique challenges or issues that ONC-ACBs may be unable to effectively address without ONC's assistance or intervention (based on consideration of the factors listed above). We stressed that our first and foremost desire would be to work with developers to address any non-conformities identified as a result of ONC's review.

Comments.
We received mixed comments on our proposal to establish regulatory processes that would help facilitate ONC's direct review of certified health IT. Some commenters supported the proposal, emphasizing that direct review would address potential gaps in the Program, improve the safety and performance of health IT, and improve the effectiveness of the Program. Other commenters supported ONC's direct review of certified health IT, but within a narrower or more defined scope.

A significant number of commenters were opposed to the proposal or voiced strong concerns. Many of these commenters were opposed to ONC's reviewing the interaction of certified capabilities and uncertified capabilities. Commenters also stated that our proposal would create uncertainty by providing ONC with discretion to review certified health IT in a broad range of circumstances, without clear and predictable rules for assessing conformity to Program requirements. Commenters expressed fear that this broad discretion could lead to inconsistent or arbitrary application of requirements, create uncertainty for developers and other stakeholders, and impede progress and innovation in health IT. Some commenters also contested the authority for ONC to directly review certified health IT in the manner proposed.

Response.
We thank commenters for their detailed feedback on this proposal.

We have finalized the proposal subject to the changes and clarifications summarized here for the convenience of the reader and described in more detail in our responses to the specific comments that follow.

The policy and approach we have finalized respond to emerging challenges identified by stakeholders, through consultation with NIST, and as a result of our experience administering the Program. In the more than six years since the Program was established, certified health IT has become widely adopted and is now integral to the delivery of patient care. At the same time, in response to growing market and regulatory demands for the exchange and use of electronic health information, the capabilities of certified health IT have become more varied, more advanced, and more interdependent with other health IT products and capabilities. These developments are encouraging and signal progress towards a more connected health system that can help transform health and care; yet for that to occur, the public must trust and have confidence in the nation's health IT infrastructure.

To effectively respond to these challenges, and for the National Coordinator to continue to meet his or her responsibilities under section 3001 of the PHSA, we are adopting a regulatory framework in this final rule to enhance the Program. As noted in the Proposed Rule, there are several areas in which ONC-ACBs may lack the responsibility, expertise, or resources to provide effective oversight of certified health IT. Importantly, certain kinds of non-conformities may be difficult to substantiate through technical conformity assessments of the kind ONC-ACBs are currently responsible for administering under the Program. In addition, practical challenges may arise for ONC-ACBs when non-conformities span multiple health IT products whose certifications are administered by more than one ONC-ACB; or where a failure of certified capabilities to perform in an acceptable manner occurs only in the context of the capabilities' interaction with other capabilities or products that are not certified under the Program. For example, some non-conformities may be so systemic, complex, or widespread that to isolate or effectively address them would quickly exceed an ONC-ACB's resources or expertise. In some cases, an ONC-ACB may be unaware of a non-conformity or may be unable to obtain the information necessary to effectively investigate and respond to a suspected non-conformity, such as when doing so would require access to certain confidential information that may be known to ONC but cannot be disclosed to the ONC-ACB.

These reasons support the need for ONC to directly administer Program requirements in appropriate circumstances. Further, the need is all the more compelling when one considers that certified capabilities may be impaired by failures or deficiencies that are not only beyond the reach of ONC-ACBs, but could cause or contribute to serious risks to public health or safety or lead to other outcomes that could significantly undermine public confidence in the health IT infrastructure, the successful development of which is the overriding purpose of the Program itself and of the duties of the National Coordinator under section 3001(c) of the PHSA.

For all of these reasons, we have finalized a regulatory framework that will facilitate ONC's direct review of certified health IT to determine whether it conforms to the requirements of the Program. In doing so, however, we have carefully considered and, where appropriate, accommodated concerns raised by commenters. In particular, while the PHSA provides authority for ONC to directly review certified health IT in a broad range of circumstances, the direct review processes finalized in this rule apply to a more limited set of circumstances in which ONC intends to focus its oversight at this time. This approach will concentrate ONC's resources in areas that at this time are most vital to ensuring the integrity and effectiveness of the Program. In addition, it will complement the existing oversight and enforcement responsibilities of other agencies, provide guidelines that will encourage compliance with Program requirements, and provide accountability for the performance and reliability of health IT. Specifically, this final rule establishes regulatory processes for ONC to exercise direct review of certified health IT, and take appropriate responsive actions, in two distinct sets of circumstances.

First, ONC may elect to directly review certified health IT when it has reason to believe that the certified health IT may not conform to the requirements of the Program because the certified health IT is causing or contributing to conditions that pose a serious risk to public health or safety. Addressing the full range of these suspected non-conformities is beyond the scope of an ONC-ACB's expertise and responsibilities under the Program. In contrast, ONC has the authority to address the full range of requirements under the Program and, as we explained in the Proposed Rule, can effectively respond to these issues, quickly bringing to bear needed expertise and resources and coordinating activities with federal counterparts and other relevant entities to ensure a coordinated review and response (81 FR 11061).

Second, in addition to serious risks to public health or safety, ONC may elect to directly review certified health IT on the basis of other suspected non-conformities that, while they are within the scope of an ONC-ACB's responsibilities, present practical challenges that may prevent the ONC-ACB from effectively investigating the suspected non-conformity or providing an appropriate response. In particular, ONC may directly review certified health IT if a suspected non-conformity presents issues that may require access to certain confidential or other information that is unavailable to an ONC-ACB; may require concurrent or overlapping reviews by multiple ONC-ACBs; or may exceed the scope of an ONC-ACB's resources or expertise. We believe that ONC's review of certified health IT in these circumstances is integral to ensuring the effective oversight and administration of the Program.

In response to comments received on the Proposed Rule, we have not at this time finalized a regulatory framework under which ONC would directly review certified health IT in circumstances other than those that raise public health or safety concerns, or those in which practical challenges prevent an ONC-ACB from effectively investigating a suspected non-conformity or providing an appropriate response, as discussed above (
compare
81 FR 11061). For example, at this time, the regulatory framework set forth in this rule does not provide that ONC will directly review certified health IT solely on the basis of a threat to the security or protection of patients' health information in violation of applicable law (
see
section 3001(b)(1) of the PHSA) or the risk of increasing health care costs resulting from, for example, inefficiency or incomplete information (
see
section 3001(b)(3) of the PHSA). We believe that other agencies are currently in the best position to provide effective oversight and enforcement with respect to such potential exigencies. We will continue to assess the need to exercise direct review in these additional circumstances, as necessary.

Finally, in response to commenters' requests for additional clarity on certain provisions of the Proposed Rule, this final rule explains three key principles ONC will apply when deciding whether to initiate direct review of certified health IT and in determining whether

certified health IT conforms to the requirements of the Program.

First, ONC's direct review of certified health IT—and any subsequent determination of non-conformity by ONC—would be based on a reasonable belief that health IT may be or is in violation of Program requirements. Contrary to the assertions of some commenters, these requirements have been clearly and consistently communicated to developers and do not impose new obligations under the Program. Indeed, in the 2015 Edition final rule, we explained that to comply with applicable certification criteria, developers must not only demonstrate required capabilities in a controlled testing environment but must also make those capabilities available in ways that enable them to be implemented and used in production environments for their intended purposes (80 FR 62711). That includes making certified capabilities available in a manner that does not cause or contribute to serious risks to public health or safety or to other outcomes that are inconsistent with the National Coordinator's responsibilities under section 3001(b) of the PHSA.

Second, while several commenters objected to our proposal to review uncertified capabilities, we believe that many of these commenters misunderstood the scope of what was proposed. We proposed and have finalized regulatory processes for ONC to review capabilities and aspects of health IT that are certified under the Program. Our consideration of uncertified capabilities would be ancillary to our review of certified capabilities and would be limited to the extent necessary to determine whether certified capabilities are functioning in a manner consistent with Program requirements.

Last, as we have previously explained in the context of an ONC-ACB's surveillance of certified health IT, a developer of certified health IT cannot be held responsible under the Program for putative non-conformities that are not reasonably within its ability to influence or control. This limiting principle applies with equal force to ONC's direct review of certified health IT under the Program.

The foregoing principles are consistent with those that have previously been established under the Program and ensure that ONC's review of certified health IT is consistent, follows clear and predictable guidelines, and is limited to issues that are within the scope of the Program. These principles and other aspects of ONC's direct review under this final rule are explained in greater detail in the responses to specific comments below. We also have included numerous examples to assist readers in understanding these concepts and the manner in which ONC would apply them in various circumstances.

(1) Requirements of the Program

Comments.
Some commenters, primarily health IT developers, posited that ONC may lack the requisite authority to directly review or enforce Program requirements, or to do so in the manner proposed. Several of these commenters criticized our invocation of section 3001(b) of the PHSA, which expressly enumerates the core principles and requirements inherent to the purpose of ONC. Some commenters suggested that the provisions of section 3001(b) are general and aspirational and that Congress did not intend for them to have any operative effect. Alternatively, some commenters supposed that these provisions operate “in the aggregate” or on the performance of ONC's functions on the whole but are not relevant to the National Coordinator's responsibility to oversee the Program or to perform other specific duties enumerated in section 3001(c). In support of this view, commenters asserted that other sections of the PHSA speak directly to the scope of the Program and the rules by which it should operate. In particular, section 3001(c)(5)(A) directs the National Coordinator to keep or recognize a program or programs for the voluntary certification of health IT as being in compliance with applicable certification criteria; and sections 3002 through 3004 establish the HIT Policy Committee (HITPC) and HIT Standards Committee (HITSC) and a consultative process for developing, endorsing, and adopting standards, implementation specifications, and certification criteria for inclusion in the Program. According to some of these commenters, this statutory design precludes ONC from enforcing requirements under the Program unless those requirements are expressed in certification criteria adopted through the processes noted above.

In contrast to these comments, several commenters recognized ONC's authority to directly review certified health IT in the manner proposed. Multiple commenters explicitly recognized ONC's broad authority to establish certification programs and to directly review certified health IT against a wide range of requirements. One commenter stated that our proposal was an appropriate exercise of this authority because it did not take a broad brush approach and limited oversight to areas where there is a potential risk to health or safety or a gap in oversight that could result in harm.

Response.
We agree that ONC's role under the Program must comport with the National Coordinator's statutory authority under the HITECH Act. As we stated in the Proposed Rule, direct review helps enable the National Coordinator to fulfill the statutory duties specified in section 3001(b) and (c)(5) of the PHSA as they relate to keeping a certification program for the voluntary certification of health IT that allows for the electronic use and exchange of information consistent with ONC's purposes. This includes ensuring that each patient's health information is secure and protected, in accordance with applicable law; improving health care quality; reducing medical errors; reducing health care costs resulting from inefficiency, medical errors, inappropriate care, duplicative care, and incomplete information; and promoting a more effective marketplace, greater competition, greater systems analysis, increased consumer choice, and improved outcomes in health care services (
see
section 3001(b) of the PHSA).

We respectfully disagree with the interpretation advanced by some commenters that the National Coordinator is not bound to observe these statutory dictates in the administration and oversight of the Program. By its plain language, section 3001(b) is an express mandate to the National Coordinator to perform the duties delegated to him or her in a manner consistent with the core principles and requirements enumerated in that section.

It is true that some of the core principles and requirements in section 3001(b) are more relevant to the performance of some of the National Coordinator's duties than others, and that not every one of them is relevant to the performance of all of the National Coordinator's duties at all times or in the same way. It is also true that many of the core principles are stated broadly and permit substantial latitude in determining how corresponding requirements are to be met. But neither of these observations indicates that section 3001(b) was intended to be inoperative, as some commenters have suggested. To the contrary, section 3001(b) is a logical and expedient way to give effect to the purpose of ONC, by enumerating the core principles and requirements that in turn provide the basic parameters by which the National Coordinator must perform his or her duties and functions.

Even were that premise open to question, there is another reason to doubt that Congress would have intended the National Coordinator to administer and oversee the Program in a manner divorced from section 3001(b) of the PHSA. The purpose of ONC and the core principles and requirements expressed in section 3001(b), and the language and structure of the HITECH Act as a whole, leave no doubt that Congress intended a critical role for health IT and the use and exchange of electronic health information in improving health, transforming care, and enabling new frontiers in research and scientific discovery. To achieve these ends, Congress, through the HITECH Act, established the EHR Incentive Programs to encourage the meaningful use of EHR technology certified by ONC. As commenters point out, Congress also specified formal processes and an advisory committee apparatus to assist the National Coordinator in endorsing and adopting certification criteria for use in the Program. Having placed the Program and the certification of health IT at the center of this plan for developing and advancing the goals of a nationwide health IT infrastructure, Congress would have expected the National Coordinator to ensure that the Program furthers those goals and does not permit certified health IT to perform in ways that subvert them.

Finally, we reject the assertion that ONC is precluded from enforcing requirements of the Program other than those expressed in certification criteria adopted under section 3004 of the PHSA. As we explained most recently in the 2015 Edition final rule, the established requirements of the Program are not limited to compliance with certification criteria (80 FR 62710). For example, developers must disclose known material information about limitations and additional types of costs associated with their certified health IT (§ 170.523(k)(1)); comply with rules governing the use of the ONC Certification and Design Mark (§ 170.523(l)); submit user complaints to ONC-ACBs (§ 170.523(n)); make certified capabilities available in ways that enable them to be implemented and used in production environments for their intended purposes (80 FR 62710); cooperate with an ONC-ACB's surveillance of their certified health IT (80 FR 62716); and cooperate with and not seek to prevent or discourage an ONC-ACB from reporting the results of its surveillance activities (80 FR 62718). We have also explained that certification under the Program is conditioned on a health IT developer's compliance with certain Program requirements—independent of any particular certification criteria—that are necessary to the basic integrity and effectiveness of the Program (80 FR 62710, n.170). We discuss these requirements and their regulatory history immediately below in response to requests from commenters for additional clarification of the Program's requirements.

The foregoing considerations and our experience implementing the statutory provisions at issue leave no question that the National Coordinator has a duty to ensure that the certification of health IT under the Program furthers and does not subvert the core principles and requirements directly applicable to the National Coordinator's duties as enumerated in section 3001(b) of the PHSA. At a minimum, that includes updating the Program as necessary to provide effective oversight over problems or deficiencies with certified health IT that could lead to risks to public health or safety or to other outcomes that are inconsistent with the National Coordinator's responsibilities. We believe that the regulatory approach to direct review set forth in this rule is integral to fulfilling that duty.

Comments.
Many commenters stated that there is a need for greater clarity and consistency concerning the requirements to which developers will be held under the Program. Several commenters asked us to define the requirements of the Program more explicitly, including by providing a clear definition of non-conformity. Commenters noted that unpublished or generalized Program requirements could be a source of confusion for developers or of capricious application by ONC. This could have unintended consequences such as discouraging investment and innovation in health IT because developers and investors may be reluctant to pursue innovative technologies if regulatory requirements are unclear.

Response.
We agree that it is important to clearly communicate the requirements of the Program so that developers can design and make their certified health IT available in a manner that consistently meets Program requirements and the expectations of purchasers and users of certified health IT. In response to the comments, we explain in greater detail the sources of those requirements and the principles that ONC and ONC-ACBs apply when assessing whether they have been met.

In the 2015 Edition Final Rule, we explained that a non-conformity arises when certified health IT fails to conform to the requirements of its certification under the Program (80 FR 62710). Those requirements take various forms and may apply to aspects of the design and performance of the health IT, the ability of the health IT to support required capabilities and uses, and the responsibility of developers to make certified capabilities available in ways that enable them to be implemented and used in production environments for their intended purposes (80 FR 62710).

The certification criteria adopted under section 3004 of the PHSA form the core of the Program. In the 2010 interim final rule entitled Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology (75 FR 2013) (“Interim Final Rule”), we defined certification criteria as criteria to establish that health IT meets applicable standards and implementation specifications adopted by the Secretary or that are used to test and certify that health IT includes required capabilities (75 FR 2021-22;
see also
§ 170.102). To meet these certification criteria, health IT must be able to perform required specifications and capabilities and, more generally, to do so in an accurate and reliable manner. For example, health IT certified to § 170.315(a)(1) (Computerized provider order entry—medications) must “[e]nable a user to record, change, and access medication orders.” Satisfying this criterion also plainly requires that the health IT perform this function accurately and reliably. For example, when a user enters a medication order for a patient, the health IT must accurately record the medication ordered and associate it with the patient selected by the user. Similarly, when a user accesses a list of medication orders for a particular patient, the health IT must not display medication orders for a different patient.

While certification criteria define the required capabilities of certified health IT, ensuring that health IT can perform certified capabilities is not the only requirement of the Program. In the 2015 Edition final rule, we adopted Program requirements under which developers must disclose on an ongoing basis any known material information about limitations and additional types of costs associated with any certified capabilities of their health IT (80 FR 62720). We have also adopted other Program requirements such as those related to the use of the ONC Certification and Design Mark and the submission of complaints to ONC-ACBs (§ 170.523(l) and (n), respectively). Developers must also submit

information that is required to be included on the CHPL (80 FR 62725).

Finally, in previous rulemakings we have highlighted that there are certain overarching requirements of the Program, in addition to those described above, that are necessary to ensuring its basic integrity and effectiveness (
see, e.g.,
80 FR 62710 n.170), thereby ensuring that the National Coordinator can meet his or her responsibilities under section 3001(b) of the PHSA. These requirements are part of the bases on which other requirements of the Program are understood and assessed.

A prime example is the duty of developers who participate in the Program to cooperate with the surveillance of their certified health IT. The Permanent Certification Program final rule incorporated requirements for ONC-ACBs to conduct surveillance to ensure that certified health IT continues to conform to the requirements of certification when it is implemented “in the field” (76 FR 1282). More recently, in the 2015 Edition final rule, we expanded these surveillance requirements and also stated our expectations for the performance of certified health IT in production environments. We explained that health IT developers have a responsibility to make their certified capabilities available to purchasers and users in a manner that allows them to be used for their intended purposes, including any uses reasonably within the scope of the health IT's certification (80 FR 62710). We stated that health IT would no longer conform to the requirements of its certification if customers or users were restricted from successfully implementing and using the technology for any purpose contemplated by the certification criteria to which the technology was certified (80 FR 62711). As an illustration, we said that a developer's failure to supply training materials and instructions necessary to access and successfully use data export capabilities described by § 170.315(b)(6) would constitute a non-conformity (80 FR 62711). Similarly, technical or other limitations that substantially interfere with the ability to access or use certified capabilities (or any aspect or intended uses of such capabilities) would give rise to a non-conformity (80 FR 62711). Further, even in the absence of any actual impairment, if a developer's actions would be likely to substantially impair the ability of one or more users (or prospective users) to implement or use certified capabilities for any purpose within the scope of applicable certification criteria, the technology would no longer conform to the requirements of its certification (80 FR 62711). Thus, we explained that the failure to disclose known material information about limitations or types of costs associated with certified health IT not only violates the express disclosure requirements at § 170.523(k)(1), but also constitutes a non-conformity to the certification criteria associated with the potentially affected capabilities (80 FR 62711).

Consistent with these established principles under the Program, certified health IT must be designed and made available to users in ways that allow certified capabilities to be used in an accurate and reliable manner, including in a manner that does not cause or contribute to serious risks to public health or safety or to other outcomes that are inconsistent with the National Coordinator's responsibilities under section 3001(b) of the PHSA. This requirement applies to the use of certified capabilities individually and in combination with other certified and uncertified capabilities of health IT. Just as the failure to disclose known material limitations or types of costs may impair the use of certified capabilities, the failure to design and make certified capabilities available so that they perform in an accurate and reliable manner impairs the safe and effective use of certified capabilities and is a non-conformity under the Program.

It is important to note that the foregoing examples and analysis assume that the putative non-conformity is a result of the actions of the developer or factors that are reasonably within the developer's ability to influence or control. As we have explained on prior occasions, a non-conformity does not arise when certified health IT fails to perform in an acceptable manner but where the failure is the result of factors that are far removed from the control or responsibility of the developer (80 FR 62710).

These principles are further elaborated and applied in the responses to specific comments throughout the remainder of this section (II.A.1.a) of the final rule. We have also included numerous examples to assist readers in understanding these principles and how ONC would apply them in particular circumstances.

Comments.
Many commenters believed that ONC should review certified health IT against specific standards, implementation specifications, certification criteria, or other express requirements, preferably developed through formal rulemaking; otherwise, developers would have insufficient guidance to design and implement their products in a manner that complies with Program requirements, and any determinations made by ONC could be ad hoc and have the potential to be unfairly applied. For these reasons, several commenters urged us to initiate separate rulemaking to identify and adopt new certification criteria that would prescribe specific requirements that ONC would apply when reviewing certified health IT and determining whether it conforms to Program requirements.

Response.
These comments raise many of the same concerns expressed in comments on the 2015 Edition proposed rule regarding then-proposed requirements for ONC-ACBs to conduct in-the-field surveillance of certified health IT. As we explained in finalizing those requirements, we understand the desire for bright-line rules; yet experience suggests that the fast-paced nature of technological change in the health IT landscape makes it impracticable to anticipate and prescribe detailed rules for every conceivable situation in which health IT may not conform to Program requirements (
see
80 FR 62709). In practice, certified health IT may be integrated with a wide range of other systems, processes, and workflows and may be customized and used in many different ways. These circumstances, which are inherent to the production environment, are too numerous and varied to anticipate or to reduce to simple rules of universal application.

For the same reasons, we do not believe that adopting certification criteria would provide the clarity or certainty sought by advocates of that approach. We believe that clarity and predictability are best achieved by articulating and explaining the basic principles that govern our review of certified health IT, as we have done in our previous response above and in the examples and discussion of potential non-conformities throughout this section of the preamble. These principles are consistent with those that govern an ONC-ACB's surveillance of certified health IT in the field (80 FR 62709). As such, they will ensure that ONC's review of certified health IT is consistent and based on clear and predictable principles.

Comments.
Multiple commenters stated that a non-conformity should be defined as occurring only when certified health IT can no longer complete or repeat the certification test procedures against which it was previously tested and on the basis of which the health IT was certified.

Response.
We expressly rejected these arguments in the preamble to the 2015 Edition final rule (80 FR 62709). There, we explained that an ONC-ACB's

assessment of certified health IT in the field is not limited to aspects of the technology that were tested in a controlled environment. Rather, an ONC-ACB must consider the unique circumstances and context in which the certified health IT is implemented and used in order to properly assess whether it continues to perform in a manner that complies with its certification.

Testing is an important part of an ONC-ACB's overall analysis of health IT under the Program. For practical reasons, however, testing focuses on particular use cases and necessarily reflects assumptions about how capabilities will be implemented and used in practice. Thus, while test results provide a preliminary indication that health IT meets the requirements of its certification and can support the capabilities required by the certification criteria to which the technology was certified, that determination is always subject to an ONC-ACB's ongoing surveillance, including the ONC-ACB's evaluation of certified capabilities in the field. Indeed, a fundamental purpose of in-the-field surveillance is to identify deficiencies that may be difficult to anticipate or that may not become apparent until after certified health IT is implemented and used in a production environment. That purpose would be entirely frustrated if an ONC-ACB's assessment of technology in the field were confined to those aspects of the technology's performance specifically delineated in test procedures.

For these same reasons, we again reject the position that Program requirements should be rigidly defined by test procedures instead of more meaningful performance outcomes. In assessing putative non-conformities in the course of ONC direct review, we consider the unique circumstances and context in which the certified health IT is implemented and used in order to properly assess whether it continues to perform in a manner that complies with the Program (
see,
80 FR 62709).

Comments.
Several commenters observed that the performance of health IT may be impacted by providers' implementation choices or other factors that the developer of the health IT may be unable to reasonably anticipate or control. One commenter explained that health IT developers do not necessarily control which third-party products their customers may deploy in conjunction with the developer's certified health IT and that it is not unusual for interface issues to arise because of updates to these unsupported products or uses. Commenters noted that developers may find it particularly difficult to anticipate and address interactions of their certified health IT with third-party products that are not certified under the Program or with capabilities or aspects of certified health IT that are not directly governed by certification criteria.

Response.
In the 2015 Edition final rule, we recognized there may be instances in which the failure of certified health IT to perform required capabilities in the field may be due to factors that are beyond the ability of the health IT's developer to reasonably influence or control (80 FR 62710). Because the requirements of the Program focus on the responsibilities of health IT developers and those aspects of their technology that they can reasonably influence or control, we explained that the failure of health IT to perform in an acceptable manner would not constitute a non-conformity if the failure was caused exclusively by factors far removed from the control or responsibility of the developer.
4

We also explained that, in evaluating non-conformities in the field, ONC-ACBs are required to determine the reasons for the failure of health IT to function in an acceptable manner, taking into account the roles of the technology as well as the health IT developer, users, and other parties. If an ONC-ACB finds that the developer or its technology were a substantial cause of the failure, the ONC-ACB would conclude that the health IT does not meet the requirements of its certification. By contrast, if the ONC-ACB finds that the failure was caused exclusively by factors far removed from the control or responsibility of the developer, the ONC-ACB would regard those factors as beyond the scope of the health IT's certification and would not find a non-conformity.

4
For example, in the 2015 Edition final rule we provided a hypothetical scenario in which a health IT developer's certified health IT could not demonstrate required capabilities in the field due to factors that were far removed from the developer's control or responsibility (80 FR 62710). In the scenario, a customer had instructed the developer to configure the certified health IT to use clinical decision support content from a third-party vendor with whom the developer had no sublicensing agreement. The customer agreed that it would be responsible for maintaining the necessary licenses for access to the third-party vendor's content. Despite the developer's warning, the customer failed to maintain the necessary licenses and access to the content was suspended, which prevented the certified health IT from functioning as expected.

These same principles apply equally to ONC's review of certified health IT. If in the course of reviewing certified health IT, ONC determines that the failure of the health IT to perform in an acceptable manner is the result of factors that, because they are far removed from the control or responsibility of the developer, were not within its ability to reasonably influence or control, ONC would not conclude that the certified health IT is non-conforming.

(2) Review of Uncertified Capabilities

In the Proposed Rule, we proposed that ONC could review the interaction of certified capabilities of health IT with uncertified capabilities. As defined earlier in section II.A.1.a of this final rule, we use the term “certified capabilities” to refer to any capabilities or other aspects of health IT that are certified under the Program. In contrast, other aspects of health IT are referred to as “uncertified capabilities” throughout this final rule. Uncertified capabilities may be integrated with certified capabilities within a single certified health IT product (
i.e.,
a certified Complete EHR or certified Health IT Module) or may be part of other health IT products or services that are not certified under the Program.

Comments.
Several commenters supported our proposal to review certified health IT in a manner that recognizes that, in practice, certified capabilities frequently interact with uncertified capabilities, whether because a developer of certified health IT includes additional capabilities in its certified health IT product or because the developer's certified health IT product is deployed with or configured to work with other health IT products that are not certified under the Program. One commenter stated that a significant limitation of the Program to date has been the lack of an effective means to evaluate how certified capabilities of health IT are performing once they are deployed in the field and interact with other capabilities or products that are not certified under the Program.

In contrast, some commenters, including one health IT developer, suggested that it would be appropriate for ONC to review uncertified capabilities, but only in certain limited circumstances. One commenter recommended that such review be limited to situations in which a developer integrates uncertified “components” with its certified health IT in a manner that directly causes a material adverse impact on the ability of the certified health IT to function in accordance with certification requirements.

Other commenters categorically opposed this aspect of our proposal. Some of these commenters assumed, however, that ONC would review and make determinations about the performance of capabilities or products

that the commenters regarded as clearly beyond the scope of the Program. Some commenters even assumed that ONC would review health IT products that are not certified under the Program at all. According to these commenters, ONC's review of uncertified capabilities or other products would be inconsistent with the voluntary nature of the Program and would be a significant overstep of ONC's authority. One commenter, for example, stated that ONC had no authority to investigate uncertified “components” of certified health IT or to dictate how a developer builds and modifies a product in response to market mandates.

Response.
It appears that many commenters interpreted this aspect of our proposal in a manner that was more far-reaching than we had either contemplated or proposed. The confusion appears to have resulted from our summary of the major provisions of the Proposed Rule, which stated that ONC's direct review “may include certified capabilities and non-certified capabilities of the certified health IT” and “would extend to the interaction of certified and uncertified capabilities within the certified health IT and to the interaction of a certified health IT's capabilities with other products” (81 FR 11058).

In explaining the purpose of the Proposed Rule, we stated that as certified capabilities of health IT interact with other capabilities in certified health IT and with other products, ONC's direct review would ensure that concerns
within the scope of the Program
can be appropriately addressed (81 FR 11057). As this statement suggests, the purpose of direct review is to evaluate and determine whether capabilities and other aspects of health IT that are certified under the Program conform to the Program's requirements. Nevertheless, because certified capabilities are frequently integrated or deployed with uncertified capabilities, evaluating whether a certified capability under review (the “target capability”) conforms to the requirements of the Program may require understanding how the target capability is interacting with other capabilities of health IT. Those other capabilities may be certified under the Program or they may be uncertified capabilities. In the case of an uncertified capability, the capability may be part of the same “product” as the target capability or it may be part of a different product, which may or may not be certified under the Program. Whatever the case, to ensure that ONC can properly evaluate whether the target capability is functioning in an acceptable manner, we proposed that ONC may have to consider the interaction of the target capability with other capabilities that affect its performance, which could include uncertified capabilities, as discussed above. We did
not
propose, however, that uncertified capabilities would themselves become a target of ONC's review. In this sense, our statement that ONC's “review” would extend to the uncertified capabilities was somewhat inexact because ONC would be concerned with only the effects of the uncertified capabilities on the target capability, not with the performance of the uncertified capabilities in isolation. In other words, ONC's consideration of uncertified capabilities would be ancillary to its review of certified capabilities and limited to the extent necessary to determine whether those certified capabilities are functioning in a manner consistent with Program requirements.

As an illustration, consider a Health IT Module designed for ambulatory settings and that is certified to, among other criteria, § 170.314(b)(5) (Incorporate laboratory tests and values/results). Under the process established by this final rule, ONC could initiate direct review if, for example, it had reliable information that the Health IT Module were receiving and incorporating lab results incorrectly in a manner that was causing or contributing to missed diagnoses or improper management of serious medical conditions. ONC's review of the Health IT Module would be based on the Health IT Module's certified capabilities, which include the capability to incorporate lab results according to the standard specified in § 170.205(j) and, at a minimum, the version of the standard specified in § 170.207(c)(2). However, it may be that the lab results are being corrupted before they are received by the certified capability. To determine whether that is the case, it may be necessary for ONC to examine the capabilities of upstream health IT systems from which the Health IT Module receives lab results. This may include examining certified capabilities or uncertified capabilities of the upstream systems to the extent that those capabilities could be causing or contributing to incorrect data being transmitted to the receiving Health IT Module.

We reiterate that ONC does not intend to review the functioning of uncertified capabilities except to the extent that an uncertified capability interacts with and affects the performance of a certified capability that is under review. If ONC commenced review of certified health IT based on a reasonable belief that the certified health IT may not conform to the requirements of the Program, but subsequently determined that the problem or deficiency was related solely to the functioning of uncertified capabilities in isolation, ONC would cease its review of the certified health IT. We note that, as discussed subsequently in section II.A.1.a.(3) of this preamble, ONC may share any information obtained in connection with its review with other relevant agencies, to the extent permitted by law, including agencies with applicable federal oversight or enforcement authority.

With these clarifications, we believe the concerns raised in connection with this aspect of our proposal are misplaced. Contrary to those concerns, this final rule does not establish a process for ONC to make determinations about uncertified capabilities, nor to dictate how developers design uncertified capabilities within certified health IT or other technologies. ONC's consideration of uncertified capabilities will be ancillary to ONC's review of certified capabilities and limited to aspects of uncertified capabilities that interact with certified capabilities and are relevant to evaluating the performance of those certified capabilities. Further, we reiterate our expectation that direct review will occur relatively infrequently and will focus on situations that pose a risk to public health or safety or where ONC-ACBs may be unable to respond effectively.

Comments.
A number of commenters raised concerns that the application of direct review to uncertified capabilities would be contrary to ONC's policy of encouraging flexibility in the way that health IT systems are configured and used. Commenters also expressed concern that direct review of uncertified capabilities could create regulatory uncertainty and would diminish innovation. Noting that developers regard the uncertified aspects of their health IT as a key area of differentiation from their competitors, commenters expressed fear that direct review of uncertified capabilities would crowd out innovation in this important area and diminish overall incentives to innovate and improve health IT capabilities.

Response.
We are sensitive to the competition and innovation concerns raised by commenters. We believe that those concerns can be effectively addressed by clearly communicating the scope of ONC's direct review under this final rule and the limited extent to which it will impact developers of uncertified capabilities. We have

explained the potential scope of ONC's review under the processes established by this final rule, including the extent to which ONC would consider the impact of uncertified capabilities on the performance of certified capabilities. In addition, section II.A.1.a.(3) of this preamble describes the types of circumstances in which ONC may invoke the processes for direct review set forth in this final rule.

To further communicate our intent and address the concerns raised by commenters, we reiterate that the purpose of direct review is to ensure that certified health IT functions in a manner that is consistent with the requirements of the Program. In the event that ONC determines that an uncertified capability is causing a certified capability to function in a manner inconsistent with Program requirements, ONC's determination would relate to the functioning of the certified capability at issue. Even in the event that an uncertified capability is identified as the cause of, or a contributing factor toward, certified health IT functioning in a manner inconsistent with Program requirements, direct review would not dictate whether or in what manner the uncertified capability should be modified. Any corrective action to be taken by the developer in response to a determination of non-conformity by ONC would relate to bringing the certified capability or capabilities into conformity. For example, appropriate corrective action might involve the developer taking steps to ensure that the certified capability does not interact with the uncertified capability that is causing it to function in an unsafe manner.

Comments.
A number of commenters expressed concern that extending ONC's review to uncertified capabilities or to uncertified products would conflict with or duplicate oversight of health IT by other federal agencies.

Response.
We acknowledge that the investigatory and enforcement authorities of other federal agencies might apply, in certain circumstances, to the performance and functioning of certified health IT. For several reasons, however, we disagree that ONC's review will conflict with or duplicate other oversight of health IT.

First, as discussed above, while ONC's review may encompass uncertified capabilities, ONC would only be concerned with aspects of the uncertified capabilities that interact with the certified capabilities that are the subject of ONC's review, and only to the extent necessary to assess whether the certified capabilities are functioning in accordance with Program requirements. This limited and ancillary consideration of uncertified capabilities would be unlikely to create any significant conflict with or duplication of any other agency's authority. Moreover, to the extent that ONC's review does uncover issues that fall within the purview of other agencies with relevant oversight or enforcement responsibilities, ONC could coordinate with and share any information or evidence it has obtained with such agencies, to the extent permitted by federal law, and, if appropriate, could pause or end its review.

Second, as discussed below in section II.A.1.a.(3) of this preamble, we have narrowed the scope of direct review under this final rule based in part on the ability of other agencies to provide appropriate oversight of certain types of non-conformities that would otherwise warrant ONC's review. For example, at this time, we have not finalized in this rule processes for ONC direct review of a suspected non-conformity solely on the basis that certified health IT may be compromising the security or protection of patients' health information (
see
section 3001(b)(1) of the PHSA) or increasing health care costs as a result of, for example, inefficiency or incomplete information (
see
section 3001(b)(3) of the PHSA). Our decision not to establish regulatory processes for such oversight at this time is based in part on the recognition that other agencies have the ability to investigate and respond to these types of issues and our desire to make the most efficient use of limited federal resources.

Third, far from conflicting with or duplicating the efforts of other agencies, we expect direct review to promote greater alignment in the oversight of health IT. Direct review allows ONC to coordinate with and provide expertise to other agencies, and to share any information or evidence ONC has obtained, as permitted by federal law. For example, ONC could quickly marshal and deploy resources and specialized expertise while working with federal counterparts to ensure a coordinated review and response to potential non-conformities. This approach is consistent with our inter-agency efforts to avoid regulatory duplication and promote appropriate, risk-based oversight of health IT, including efforts described in the Draft Food and Drug Administration Safety and Innovation Act (FDASIA) Health IT Report,
5

published jointly with the Food and Drug Administration (FDA) and the Federal Communications Commission (FCC). Indeed, the need for effective coordination could be especially important in responding to serious risks to public health or safety that arise from the complex interaction of health IT products that may include certified capabilities regulated by ONC as well as uncertified capabilities that may be subject to FDA, FCC, or another agency's oversight.

5
Draft FDASIA Health IT Report: Proposed Strategy and Recommendations for a Risk-Based Framework (April 2014), available at
https://www.healthit.gov/sites/default/files/fdasia_healthitreport_final.pdf.

Finally, we note that ONC may elect to not initiate direct review (or, if it has initiated direct review, to cease such review) at any time and for any reason, including if ONC believes that another agency is better situated to investigate or address a suspected non-conformity, or if ONC believes that direct review could duplicate or interfere with the oversight or enforcement activities of other agencies. ONC may also coordinate with and share any information or evidence it has obtained, through its direct review or otherwise, with other agencies, to the extent permitted by federal law. We also anticipate that ONC may coordinate with ONC-ACBs, ONC-ATLs, the ONC-AA, and other entities in appropriate circumstances and consistent with applicable federal law.

(3) Scope of Review

We proposed that ONC may exercise direct review of certified health IT when there is reason to believe that the certified health IT may not conform to the requirements of the Program. We explained that ONC's review could be in response to concerns that certified health IT may be leading to medical errors or other outcomes that are inconsistent with the National Coordinator's responsibilities under section 3001 of the PHSA. We also stated there could also be other exigencies, distinct from public health or safety concerns, that for similar reasons would warrant ONC's direct review and action. In addition, we proposed that ONC may directly review certified health IT in situations that present unique challenges or issues that ONC-ACBs may be unable to effectively address without ONC's assistance or intervention. We listed a variety of factors in this regard that could help inform ONC's decision whether to initiate direct review in individual cases, specifically:

• The potential nature, severity, and extent of the suspected non-conformity or non-conformities, including the likelihood of systemic or widespread issues and impact.

• The potential risk to public health or safety or other exigent circumstances.

• The need for an immediate and coordinated governmental response.

• Whether investigating, evaluating, or addressing the suspected non-conformity would require access to confidential or other information that is unavailable to an ONC-ACB; would present issues outside the scope of an ONC-ACB's accreditation; would exceed the resources or capacity of an ONC-ACB; or would involve novel or complex interpretations or application of certification criteria or other requirements.

• The potential for inconsistent application of certification requirements in the absence of direct review.

(
see
81 FR 11061). We anticipated that ONC's direct review of certified health IT would be relatively infrequent and would focus on situations that pose a risk to public health or safety as well as other situations that present unique challenges or issues that ONC-ACBs may be unable to effectively address without ONC's assistance or intervention (based on consideration of the factors listed above). We stressed that our first and foremost desire would be to work with developers to address any non-conformities identified as a result of ONC's review.

Comments.
A majority of commenters agreed that ONC should directly review certified health IT that could be leading to medical errors or other risks to public health or safety. One commenter representing health care professionals noted a strong need for ONC to adjust the Program to focus on the safety, usability, and interoperability of certified health IT, citing widespread concerns among the medical community about these issues. The commenter stated that ONC could play a valuable role in ensuring that the appropriate parties are identifying, analyzing, and correcting health IT safety concerns by quickly resolving non-conformity issues.

Several commenters who otherwise opposed direct review, including health IT developers, stated that it may be reasonable for ONC to review non-conformities as a “true last resort” when risks to patient safety are sufficiently compelling or when there is a gap or overlap in the ability of ONC-ACBs to effectively address the risk.

A small number of commenters categorically opposed this aspect of our proposal and stated that whether certified health IT is leading to medical errors or other risks to public health or safety is either beyond the scope of current certification criteria, other Program requirements, or section 3001(c)(5) of the PHSA. A few commenters, including one ONC-ACB, stated that health IT-related safety risks should not be addressed through the Program because there might be other channels, such as the proposed Health IT Safety Collaborative,
6

through which these issues could be more effectively dealt with, including by identifying health IT safety-related issues, defining appropriate best practices and criteria, and making objective assessments. Commenters also urged ONC to continue to support existing private-public initiatives that are developing a framework for the identification of health IT safety incidents to expand knowledge for all stakeholders.

6

See
Department of Health and Human Services,
Justification of Estimates for Appropriations Committee (Office of the National Coordinator for Health Information Technology),
app. IV,
https://www.healthit.gov/sites/default/files/final_onc_cj_fy_2017_clean.pdf
(2016) (proposing that Congress provide ONC with authority to establish a Health IT Safety Collaborative and provide adequate confidentiality protections).
See also
ONC,
Health IT Safety Center Roadmap, http://www.healthitsafety.org/uploads/4/3/6/4/43647387/roadmap.pdf
(2015) (containing task force recommendations for the development of a national Health IT Safety Center); Food and Drug Administration,
Draft FDASIA Health IT Report, https://www.healthit.gov/sites/default/files/fdasia_healthitreport_final.pdf
(2014) (recommending establishment of a Health IT Safety Center as a key component of a risk-based approach to health IT safety oversight and efforts to create a sustainable, integrated health IT learning system that avoids regulatory duplication and leverages and complements existing public and private sector activities to improve the safety and safe use of health IT).

Response.
We thank commenters for their feedback and suggestions on this aspect of our proposal. Based on the comments, and consistent with the focus of the Proposed Rule, we continue to believe that direct review by ONC is necessary to address potential non-conformities and non-conformities in certified health IT that may be leading to medical errors or contributing to other risks to public health or safety. As we have explained, although ONC-ACBs play an important role in the Program, addressing the full range of these suspected non-conformities is beyond the scope of their responsibilities under the Program. In addition, ONC-ACBs may as a practical matter lack the expertise and resources to effectively respond to certain types of non-conformities, such as widespread or systemic problems with certified capabilities. Other agencies may similarly be unable to effectively respond to these issues, especially when the underlying causes are unclear or involve complex interactions among multiple health IT capabilities or products. As the capabilities of certified health IT evolve and become ubiquitous in the delivery of care, the National Coordinator has a responsibility to continually update and enhance oversight of the Program so that certified health IT continues to improve, and does not compromise, patient safety.

Addressing these types of issues will promote greater confidence in the safety of certified health IT and protect the integrity and effectiveness of the Program. Accordingly, § 170.580(a)(2) addresses the process for ONC to directly review certified health IT when the health IT may be causing or contributing to conditions that pose a serious risk to public health or safety. We note that the policy we have finalized is consistent with the general sentiment expressed by commenters, as we understand it, that ONC should exercise direct review judiciously, focusing on risks to public health or safety that are serious and on non-conformities that cannot be effectively addressed by ONC-ACBs. As we stated in the Proposed Rule, we expect that ONC's exercise of direct review will be relatively infrequent. We discuss these considerations in detail in our responses to the comments summarized immediately below.

We agree with commenters that advancing health IT safety is a shared responsibility and will require a concerted commitment by all relevant stakeholders, including through current public-private efforts and proposed initiatives such as the Health IT Safety Collaborative. We continue to strongly support these efforts and recognize the vital role they play in promoting the safety of health IT and the use of health IT to improve the safety and quality of care. We regard ONC's direct review as complementary to these efforts.

We disagree with the view expressed by some commenters that concerns related to the safety of certified health IT are beyond the scope of current certification criteria, other Program requirements, or section 3001(c)(5) of the PHSA. We refer commenters to our discussion of these issues in section II.A.1.a.(1) of this preamble.

Comments.
We received relatively broad support for our proposal to enhance oversight of non-conformities that pose a risk to public health or safety, including through the direct review of such issues by ONC. A significant number of commenters urged us to prioritize public health and safety over other concerns by narrowing the scope of ONC's review to focus exclusively or primarily on non-conformities that pose serious risks to public health or safety. Commenters stated that this narrower focus would

allow ONC to concentrate its resources and provide more effective oversight of safety issues.

Many commenters also recognized the need for and supported ONC's review of non-conformities that, for other reasons, would be difficult for ONC-ACBs to effectively address.

Commenters were less supportive of applying ONC oversight of the Program to the other areas we had proposed, such as widespread non-conformities that could compromise the security or protection of patients' health information in violation of applicable law, or that could lead to inappropriate claims for reimbursement under federal health care programs. A substantial majority of commenters urged us to significantly narrow and more clearly define the types of non-conformities that ONC could potentially review. Commenters were concerned that, as proposed, ONC could conceivably review non-conformities that implicate any of a wide and diverse range of potential subjects, from security breaches, to anti-competitive practices, to conditions giving rise to health disparities. This could lead to regulatory uncertainty or arbitrary enforcement, and could discourage innovation in health IT.

For many of the same reasons, commenters urged us to clarify the specific types of circumstances or situations in which ONC would be likely to initiate direct review of certified health IT. While we had proposed several factors that ONC would consider in determining whether to initiate direct review, a number of commenters stated that these factors were too numerous or open-ended to provide useful guidance to stakeholders. Several commenters urged us to provide guidelines or examples explaining when ONC would be likely to initiate direct review. One commenter explained that by clarifying our methodology we could make the direct review process fairer and more equitable and establish confidence both in the process and its outcomes.

Response.
We agree with commenters that the types of non-conformities ONC may review and, equally important, the types of circumstances in which ONC will take action to enforce Program requirements should be made as clear as possible and should be applied in a consistent and judicious manner. Such clarity and consistency help enable developers to design and make their certified health IT available in a manner that consistently meets Program requirements and the expectations of purchasers, licensees, and users of certified health IT. We also appreciate that uncertain or unnecessary regulation can have unintended consequences, including reducing incentives to invest in and to innovate the technologies that will make it possible to use health IT and health information to improve health and the delivery of care.

In light of these and other considerations described below, we have reconsidered and revised our proposal in several key respects. Importantly, while the PHSA provides the National Coordinator the authority to directly review certified health IT in the broad range of circumstances we proposed, at this time we have finalized a regulatory framework for the exercise of such review in a more limited set of circumstances. This scope of review is consistent with our expectation stated in the Proposed Rule that direct review will be relatively infrequent and will focus primarily on issues that pose a risk to public health or safety (81 FR 11058) or that ONC-ACBs may be unable to effectively address without ONC's assistance or intervention (81 FR 11061). While we stated that there could be other exigencies in addition to risks to public health and safety that could also warrant ONC's review, we agree with commenters that the need for additional ONC oversight in these areas is less pronounced at this time. In particular, we note the active oversight in these areas by other agencies, as discussed below. In light of this existing oversight and the limited resources at ONC's disposal, we agree with commenters that it is advisable to focus ONC's resources in areas in which, at this time, additional and direct oversight by ONC is most vital to ensuring the integrity and effectiveness of the Program. We believe that focusing ONC's review in these areas will help foster alignment and coordination with other agencies and promote confidence in the performance of certified health IT and the nation's health IT infrastructure, which will in turn support innovations and investments in health IT.

For all of these reasons, we have finalized processes in this rule for ONC to exercise direct review of certified health IT in two distinct sets of circumstances.

First, ONC may elect to directly review certified health IT when there is reason to believe that the certified health IT may be causing or contributing to serious risks to public health or safety. In these circumstances, ONC's direct review of certified health IT may be necessary to protect the public from certified health IT that is unsafe and to ensure the basic integrity and effectiveness of the Program. As explained in section II.A.1.a.(1) of this preamble, it is a requirement of the Program that certified health IT be made available in a manner that does not cause or contribute to serious risks to public health or safety. However, responding to the full range of these suspected non-conformities is beyond the scope of an ONC-ACB's expertise and responsibilities under the Program. In contrast, ONC is well-placed to respond to these issues, through the direct review processes established by this final rule, bringing to bear needed expertise and resources and coordinating activities with federal counterparts and other relevant entities to ensure a coordinated review and response to public health and safety concerns (81 FR 11061).

Second, in addition to serious risks to public health or safety, ONC may elect to directly review certified health IT on the basis of other suspected non-conformities that, while within the scope of an ONC-ACB's responsibilities, present practical challenges that may prevent the ONC-ACB from effectively investigating the suspected non-conformity or providing an appropriate response. In particular, ONC may directly review certified health IT if a suspected non-conformity presents issues that may require access to certain confidential or other information that is unavailable to an ONC-ACB; may require concurrent or overlapping reviews by multiple ONC-ACBs; or may exceed the scope of an ONC-ACB's resources or expertise. We believe that ONC's review of certified health IT in these situations will help ensure the continued effective oversight and administration of the Program.

The circumstances described above do not encompass all possible non-conformities of certified health IT. For example, certified health IT may not conform to the requirements of the Program if it is causing or contributing to other outcomes—distinct from risks to public health or safety—that are inconsistent with the National Coordinator's responsibilities, such as compromising the security or protection of patients' health information in violation of applicable law (
see
section 3001(b)(1) of the PHSA) or increasing health care costs resulting from, for example, inefficiency or incomplete documentation (
see
section 3001(b)(3) of the PHSA). At this time, however, we believe that other agencies are in the best position to provide effective federal oversight and enforcement in these areas. For example, within HHS, the Office for Civil Rights' (OCR) enforces the Privacy, Security, and Breach Notification Rules promulgated under the Health Insurance Portability and

Accountability Act of 1996 (HIPAA) and amended by the HITECH Act, and the Office of Inspector General (OIG) enforces a range of federal laws related to fraud, waste, and abuse. Therefore, we have not at this time finalized regulatory processes by which ONC would directly review certified health IT solely on the basis of circumstances distinct from public health or safety concerns or in cases where practical challenges prevent an ONC-ACB from effectively investigating the suspected non-conformity or providing an appropriate response, as discussed above (
compare
81 FR 11061). We will continue to assess the need to exercise direct review in these additional circumstances, as necessary

As mentioned above, in this final rule, we seek to align ONC's direct review of certified health IT with oversight and enforcement responsibilities of other agencies. We therefore clarify that ONC may decline to exercise review of certified health IT for any reason, including if it believes that other agencies may be better situated to respond to a suspected non-conformity. Additionally, to the extent permitted by law, ONC may coordinate and share information with other agencies, including agencies with applicable oversight or enforcement responsibilities, and may engage other persons and entities, as appropriate, to effectively respond to suspected problems or issues with certified health IT.
7

Such agencies could include, for example, the Centers for Medicare and Medicaid Services, the Food and Drug Administration, the HHS Office for Civil Rights, the HHS Office of Inspector General, the Department of Veterans Affairs, the Federal Communications Commission, or state Medicaid agencies. We note that to the extent ONC exercises its discretion to engage in any efforts to identify or address non-conformities, such efforts and any resulting remediation (or the absence of such efforts or remediation) are not intended to impact the materiality of any non-conformity in a matter addressed by another agency; and nothing in this final rule is intended to supplant, delay, or in any way limit oversight or enforcement by other agencies, including any investigation, decision, legal action, or proceeding.

7
Example E in section II.A.1.a.(3) of this preamble illustrates the complementary roles of ONC's direct review and the activities of other agencies.

Finally, our decision to focus ONC's review, at this time, on the types of non-conformities described above allows us to provide a more structured decision-making regulatory framework to support the exercise of ONC's discretion to initiate review of certified health IT in the circumstances we have described. In contrast to the framework set forth in the Proposed Rule, we have simplified and defined with greater specificity the factors ONC will consider in determining whether to initiate direct review of a suspected non-conformity. The updated regulatory framework, which we have finalized at § 170.580(a)(2), provides a more sequential and targeted set of factors that ONC will consider when determining whether to initiate direct review. We have also eliminated duplicative or redundant factors included in the Proposed Rule, as discussed in more detail in our responses to comments on those factors below. These revisions will provide clear and predictable guidelines that will promote compliance with Program requirements while preserving incentives to develop and adopt new and innovative technologies.

Comments.
Several commenters suggested that ONC should focus its oversight on risks to public health or safety that are “clear,” “severe,” “immediate,” “extreme,” or otherwise compelling. A few commenters stated that ONC should not exercise direct review unless the risk to patient safety or public health poses imminent risks to public health or safety. Commenters stated that focusing on these types of risks would ensure that ONC's limited resources are used to mitigate the problems or issues with certified health IT that pose the most serious risks of harm to patients and the public. Separately, some commenters stated that exercising direct review of all potential risks could be counter-productive in that it may discourage efforts to implement and use health IT to improve patient safety and care.

Relatedly, commenters requested additional specificity regarding the types of risks to public health or safety that could trigger ONC's review or give rise to a non-conformity. One commenter requested that ONC provide examples to illustrate how certified health IT might contribute to risks to patient safety and public health.

Response.
We agree that not every risk to public health or safety necessitates ONC's direct review. We are also cognizant of the need to prioritize ONC's limited resources by focusing on the kinds of problems and other issues that, if not addressed through ONC's direct review, are most likely to lead to harm to patients or the public and undermine confidence in health IT and the integrity of the Program.

As described in section II.A.1.a.(1) of this preamble, to conform to the requirements of the Program certified health IT must be designed and made available to users in a way that allows certified capabilities to be used in an accurate and reliable manner. This includes making capabilities available in a manner that does not cause or contribute to medical errors or other conditions that give rise to serious risks to public health or safety. Direct review would be appropriate if ONC had reason to believe that certified health IT were causing or contributing to conditions that present a serious risk to public health or safety, including conditions that could result in serious injury or death, whether to a patient or to any other person.

Our focus on risks to public health or safety that are “serious” is consistent with the Proposed Rule, in which we suggested that ONC's direct review would be appropriate in response to certified health IT causing or contributing to medical errors or other exigent circumstances that call for an immediate or coordinated governmental response (81 FR 11058;
compare
proposed § 170.580(a)(1)(ii) through (iii) at 81 FR 11082). This focus also aligns with the general sentiment expressed by commenters that ONC's review of matters involving public health or safety should focus on risks that are “clear,” “severe,” “immediate,” “extreme,” or otherwise compelling. We note that these terms are not self-defining and that assessing whether certified health IT poses serious risks to public health or safety will necessarily involve a careful consideration of the relevant facts and circumstances in each case. To this end, ONC would consider the nature, extent, and severity of the risk and the conditions giving rise to it, in light of the information available to ONC at the time. In addition to any other factors that may be relevant, ONC would consider the apparent severity of the harm that might result, or has resulted, from the suspected unsafe conditions, including the likelihood of death or serious injury; the number of persons who may be harmed in the event that the harm were to materialize; and the likelihood that harm will in fact materialize if appropriate action is not taken. ONC would also consider the extent to which the risk of harm may be imminent such that an immediate or coordinated governmental response is necessary to significantly reduce the likelihood of actual harm occurring or recurring (§ 170.580(a)(2)(i)(B)). In evaluating whether the risk of harm may be imminent, ONC would also take into

account any actions being taken to mitigate the risk, to the extent that ONC is aware of those actions. We have declined to adopt commenters' suggestions that

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2016-24908. Public record. Not legal advice.