Proposed Establishment of Certification Programs for Health Information Technology

FederalRegulations

Ask Donna

How this section applies to your facts.

Federal Register › Vol. 75 › 75 FR 11328

This text was captured on Aug 14, 2026. It is a snapshot, not a live feed, so check the official code before relying on it.

Text

DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Part 170 RIN 0991-AB59 Proposed Establishment of Certification Programs for Health Information Technology AGENCY:

Office of the National Coordinator for Health Information Technology, Department of Health and Human Services.

ACTION:

Proposed rule.

SUMMARY:

Under the authority granted to the National Coordinator for Health Information Technology (the National Coordinator) by section 3001(c)(5) of the Public Health Service Act (PHSA) as added by the Health Information Technology for Economic and Clinical Health (HITECH) Act, this rule proposes the establishment of two certification programs for purposes of testing and certifying health information technology. While two certification programs are described in this proposed rule, we anticipate issuing separate final rules for each of the programs. The first proposal would establish a temporary certification program whereby the National Coordinator would authorize organizations to test and certify Complete EHRs and/or EHR Modules, thereby assuring the availability of Certified EHR Technology prior to the date on which health care providers seeking the incentive payments available under the Medicare and Medicaid EHR Incentives Program may begin demonstrating meaningful use of Certified EHR Technology. The second proposal would establish a permanent certification program to replace the temporary certification program. The permanent certification program would separate the responsibilities for performing testing and certification, introduce accreditation requirements, establish requirements for certification bodies authorized by the National Coordinator related to the surveillance of Certified EHR Technology, and would include the potential for certification bodies authorized by the National Coordinator to certify other types of health information technology besides Complete EHRs and EHR Modules

g testing and certification, introduce accreditation requirements, establish requirements for certification bodies authorized by the National Coordinator related to the surveillance of Certified EHR Technology, and would include the potential for certification bodies authorized by the National Coordinator to certify other types of health information technology besides Complete EHRs and EHR Modules.

DATES:

To be assured consideration, written or electronic comments on the proposals for the temporary certification program must be received at one of the addresses provided below, no later than 5 p.m. on April 9, 2010. To be assured consideration, written or electronic comments on the proposals for the permanent certification program must be received at one of the addresses provided below, no later than 5 p.m. on May 10, 2010.

ADDRESSES:

Because of staff and resource limitations, we cannot accept comments by facsimile (FAX) transmission. You may submit comments, identified by RIN 0991-AB59, by any of the following methods (please do not submit duplicate comments).

• Federal eRulemaking Portal: Follow the instructions for submitting comments. Attachments should be in Microsoft Word, WordPerfect, or Excel; however, we prefer Microsoft Word. http://www.regulations.gov.

• Regular, Express, or Overnight Mail: Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, Attention: Certification Programs Proposed Rule, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201. Please submit one original and two copies.

SW., Washington, DC 20201. Please submit one original and two copies.

• Hand Delivery or Courier: Office of the National Coordinator for Health Information Technology, Attention: Certification Programs Proposed Rule, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201. Please submit one original and two copies. (Because access to the interior of the Hubert H. Humphrey Building is not readily available to persons without Federal government identification, commenters are encouraged to leave their comments in the mail drop slots located in the main lobby of the building.)

Inspection of Public Comments: All comments received before the close of the applicable comment period will be available for public inspection, including any personally identifiable or confidential business information that is included in a comment. Please do not include anything in your comment submission that you do not wish to share with the general public. Such information includes, but is not limited to: a person's social security number; date of birth; driver's license number; State identification number or foreign country equivalent; passport number; financial account number; credit or debit card number; any personal health information; or any business information that could be considered to be proprietary. We will post all comments received before the close of the applicable comment period at http://www.regulations.gov.

Docket: For access to the docket to read background documents or comments received, go to http://www.regulations.gov or U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201 (call ahead to the contact listed below to arrange for inspection).

FOR FURTHER INFORMATION CONTACT:

Steven Posnack, Policy Analyst, 202-690-7151

eceived, go to http://www.regulations.gov or U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201 (call ahead to the contact listed below to arrange for inspection).

FOR FURTHER INFORMATION CONTACT:

Steven Posnack, Policy Analyst, 202-690-7151.

SUPPLEMENTARY INFORMATION:

Acronyms

CAH Critical Access Hospital CCHIT Certification Commission for Health Information Technology CGD Certification Guidance Document CMS Centers for Medicare & Medicaid Services EHR Electronic Health Record FACA Federal Advisory Committee Act FFS Fee for Service (Medicare Program) HHS Department of Health and Human Services HIT Health Information Technology HITECH Health Information Technology for Economic and Clinical Health LOINC Logical Observation Identifiers Names and Codes MA Medicare Advantage NIST National Institute of Standards and Technology NVLAP National Voluntary Laboratory Accreditation Program OIG Office of Inspector General OMB Office of Management and Budget ONC Office of the National Coordinator for Health Information Technology ONC-AA ONC-Approved Accreditor ONC-ACB ONC-Authorized Certification Body ONC-ATCB ONC-Authorized Testing and Certification Body OPM Office of Personnel Management PHSA Public Health Service Act RFA Regulatory Flexibility Act RIA Regulatory Impact Analysis SSA Social Security Act Table of Contents

I. Background A. Previously Defined Terminology B. Legislative and Regulatory History 1. Legislative History a. Standards, Implementation Specifications, and Certification Criteria b. Medicare and Medicaid EHR Incentive Programs i. Medicare EHR Incentive Program ii. Medicaid EHR Incentive Program c. HIT Certification Programs 2. Regulatory History and Related Guidance a. Initial Set of Standards, Implementation Specifications, and Certification Criteria b. Medicare and Medicaid EHR Incentive Programs Proposed Rule c

, Implementation Specifications, and Certification Criteria b. Medicare and Medicaid EHR Incentive Programs i. Medicare EHR Incentive Program ii. Medicaid EHR Incentive Program c. HIT Certification Programs 2. Regulatory History and Related Guidance a. Initial Set of Standards, Implementation Specifications, and Certification Criteria b. Medicare and Medicaid EHR Incentive Programs Proposed Rule c. HIT Certification Programs Proposed Rule d. Physician Self-Referral Prohibition and Anti-Kickback EHR Exception and Safe Harbor Final Rules and ONC Interim C. Overview of Temporary Certification Program D. Overview of Permanent Certification Program E. Factors Influencing the Proposal of Both Temporary and Permanent Certification Programs 1. HIT Policy Committee Recommendations 2. Coordination With the HIT Standards and Certification Criteria Interim Final Rule and the Medicare and Medicaid EHR Incentive Programs Proposed Rule 3. Timeliness Related to the Beginning of the Medicare and Medicaid EHR Incentive Programs i. Public Comment Period ii. Urgency of Establishing the Temporary Certification Program 4. Consultations With NIST F. Additional Context for Comparing the Temporary and Permanent Certification Programs 1. The Distinction Between Testing and Certification 2. Accreditation 3. Surveillance II. Provisions of the Temporary Certification Program A. Applicability B. Definitions 1. Definition of Applicant 2. Definition of Day or Days 3. Definition of ONC-ATCB C. Correspondence With the National Coordinator D. Temporary Certification Program Application Process for ONC-ATCB Status 1. Application for ONC-ATCB Status a. Types of Applicants b. Types of ONC-ATCB Authorization c. Application Part One d. Application Part Two 2. Application Review a. Satisfactory Application b. Deficient Application Returned and Opportunity To Revise 3. ONC-ATCB Application Reconsideration Requests 4. ONC-ATCB Status a. Acknowledgement and Representation b. Expiration of Status Under the Temporary Certification Program E

TCB Status a. Types of Applicants b. Types of ONC-ATCB Authorization c. Application Part One d. Application Part Two 2. Application Review a. Satisfactory Application b. Deficient Application Returned and Opportunity To Revise 3. ONC-ATCB Application Reconsideration Requests 4. ONC-ATCB Status a. Acknowledgement and Representation b. Expiration of Status Under the Temporary Certification Program E. ONC-ATCB Performance of Testing and Certification and Maintaining Good Standing as an ONC-ATCB 1. Authorization To Test and Certify Complete EHRs 2. Authorization To Test and Certify EHR Modules a. Certification Criterion Scope b. When Privacy and Security Certification Criteria Apply to EHR Modules 3. Authorized Testing and Certification Methods 4. The Testing and Certification of “Minimum Standards” 5. Maintaining Good Standing as an ONC-ATCB; Violations That Could Lead to the Revocation of ONC-ATCB Status; Revocation of ONC-ATCB Status a. Type-1 Violations b. Type-2 Violations c. Proposed Revocation i. Opportunity To Respond to a Proposed Revocation Notice ii. Revocation of an ONC-ATCB's Status d. Extent and Duration of Revocation Under the Temporary Certification Program e. Alternative Considered 6. Validity of Complete EHR and EHR Module Certification F. Sunset III. Provisions of Permanent Certification Program A. Applicability B. Definitions 1. Definition of Applicant 2. Definition of ONC-Approved Accreditor 3. Definition of Day or Days 4. Definition of ONC-ACB C. Correspondence With the National Coordinator D. Permanent Certification Program Application Process for ONC-ACB Status 1. Application for ONC-ACB Status a. Types of Applicants b. Types of ONC-ACB Authorization c. Application for ONC-ACB Status d. Proficiency Examination 2. Application Review 3. ONC-ACB Application Reconsideration Requests 4. ONC-ACB Status a. Acknowledgement and Representation b. Expiration of Status Under the Permanent Certification Program E. ONC-ACB Performance of Certification and Maintaining Good Standing as ONC-ACB 1

Status a. Types of Applicants b. Types of ONC-ACB Authorization c. Application for ONC-ACB Status d. Proficiency Examination 2. Application Review 3. ONC-ACB Application Reconsideration Requests 4. ONC-ACB Status a. Acknowledgement and Representation b. Expiration of Status Under the Permanent Certification Program E. ONC-ACB Performance of Certification and Maintaining Good Standing as ONC-ACB 1. Authorization To Certify Complete EHRs 2. Authorization To Certify EHR Modules 3. Authorization To Certify Other HIT 4. Authorized Certification Methods 5. The Certification of “Minimum Standards” 6. Maintaining Good Standing as an ONC-ACB; Violations That Could Lead to Revocation of ONC-ACB Status; Revocation of ONC-ACB Status 7. Validity of Complete EHR and EHR Module Certification 8. Differential Certification F. ONC-Approved Accreditor 1. Requirements for Becoming an ONC-AA 2. ONC-AA Ongoing Responsibilities 3. Number of ONC-AAs and Length of Approval G. Promoting Participation in the Permanent Certification Program IV. Response to Comments V. Collection of Information Requirements A. Collection of Information #1: Application for ONC-ATCB Status Under the Proposed Temporary Certification Program B. Collection of Information #2: Application for ONC-ACB Status Under the Proposed Permanent Certification Program C. Collection of Information #3: ONC-ATCB and ONC-ACB Collection and Reporting of Information Related to Complete EHR and/or EHR Module Certifications D. Collection of Information #4: Required Documentation for Requesting ONC-Approved Accreditor Status VI. Regulatory Impact Analysis A. Introduction B. Why This Rule Is Needed? C. Executive Order 12866—Regulatory Planning and Review Analyses for the Proposed Temporary and Permanent Certification Programs 1. Temporary Certification Program Estimated Costs a. Application Process for ONC-ATCB status i. Applicant Costs ii. Costs to the Federal Government b. Temporary Certification Program: Testing and Certification of Complete EHRs and EHR Modules 2

Why This Rule Is Needed? C. Executive Order 12866—Regulatory Planning and Review Analyses for the Proposed Temporary and Permanent Certification Programs 1. Temporary Certification Program Estimated Costs a. Application Process for ONC-ATCB status i. Applicant Costs ii. Costs to the Federal Government b. Temporary Certification Program: Testing and Certification of Complete EHRs and EHR Modules 2. Permanent Certification Program Estimated Costs a. Request for ONC-AA Status i. Cost of Submission for Requesting ONC-AA Status ii. Cost to the Federal Government b. Application Process for ONC-ACB Status and Renewal i. Applicant Costs and ONC-ACB Renewal Costs ii. Costs to the Federal Government c. Permanent Certification Program: Testing and Certification of Complete EHRs and EHR Modules 3. Costs for Collecting, Storing, and Reporting Certification Results Under the Temporary and Permanent Certification Programs a. Costs to ONC-ATCBs and ONC-ACBs b. Costs to the Federal Government 4. Temporary and Permanent Certification Program Benefits D. Regulatory Flexibility Act E. Executive Order 13132—Federalism F. Unfunded Mandates Reform Act of 1995 I. Background

[If you choose to comment on the background section, please include at the beginning of your comment the caption “Background” and any additional information to clearly identify the information about which you are commenting.]

A. Previously Defined Terminology

This proposed rule is directly related to the recently published (January 13, 2010) health information technology (HIT) Standards and Certification Criteria interim final rule (75 FR 2014). Consequently, in addition to new terms and definitions discussed later in this proposed rule, the following terms have the same meaning as provided at 45 CFR 170.102

ting.]

A. Previously Defined Terminology

• Certification criteria means criteria: (1) To establish that health information technology meets applicable standards and implementation specifications adopted by the Secretary; or (2) that are used to test and certify that health information technology includes required capabilities.

• Certified EHR Technology means a Complete EHR or a combination of EHR Modules, each of which: (1) Meets the

• Complete EHR means EHR technology that has been developed to meet all applicable certification criteria adopted by the Secretary.

• Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

• EHR Module means any service, component, or combination thereof that can meet the requirements of at least one certification criterion adopted by the Secretary.

• Implementation specification means specific requirements or instructions for implementing a standard.

• Qualified EHR means an electronic record of health-related information on an individual that: (1) Includes patient demographic and clinical health information, such as medical history and problem lists; and (2) has the capacity: (i) To provide clinical decision support; (ii) to support physician order entry; (iii) to capture and query information relevant to health care quality; and (iv) to exchange electronic health information with, and integrate such information from other sources

that: (1) Includes patient demographic and clinical health information, such as medical history and problem lists; and (2) has the capacity: (i) To provide clinical decision support; (ii) to support physician order entry; (iii) to capture and query information relevant to health care quality; and (iv) to exchange electronic health information with, and integrate such information from other sources.

• Standard means a technical, functional, or performance-based rule, condition, requirement, or specification that stipulates instructions, fields, codes, data, materials, characteristics, or actions.

B. Legislative and Regulatory History

1. Legislative History

The Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5), was enacted on February 17, 2009. The HITECH Act amended the Public Health Service Act (PHSA) and created “Title XXX—Health Information Technology and Quality” (Title XXX) to improve health care quality, safety, and efficiency through the promotion of health information technology (HIT) and electronic health information exchange. Section 3001 of the PHSA establishes by statute the Office of the National Coordinator for Health Information Technology (ONC). Title XXX of the PHSA provides the National Coordinator and the Secretary of the Department of Health and Human Services (the Secretary) with new responsibilities and authorities related to HIT. The HITECH Act also amended several sections of the Social Security Act (SSA) and in doing so established the availability of incentive payments to eligible professionals and eligible hospitals to promote the adoption and meaningful use of interoperable HIT.

nd the Secretary of the Department of Health and Human Services (the Secretary) with new responsibilities and authorities related to HIT. The HITECH Act also amended several sections of the Social Security Act (SSA) and in doing so established the availability of incentive payments to eligible professionals and eligible hospitals to promote the adoption and meaningful use of interoperable HIT.

a. Standards, Implementation Specifications, and Certification Criteria

With the passage of the HITECH Act, two new Federal advisory committees were established, the HIT Policy Committee and the HIT Standards Committee (sections 3002 and 3003 of the PHSA, respectively). Each is responsible for advising the National Coordinator on different aspects of standards, implementation specifications, and certification criteria. The HIT Policy Committee is responsible for, among other duties, recommending priorities for the development, harmonization, and recognition of standards, implementation specifications, and certification criteria while the HIT Standards Committee is responsible for recommending standards, implementation specifications, and certification criteria for adoption by the Secretary under section 3004 of the PHSA consistent with the ONC-Coordinated Federal Health IT Strategic Plan (the “strategic plan”).

Section 3004 of the PHSA defines how the Secretary adopts standards, implementation specifications, and certification criteria. Section 3004(a) of the PHSA defines a process whereby an obligation is imposed on the Secretary to review standards, implementation specifications, and certification criteria and identifies the procedures for the Secretary to follow to determine whether to adopt any grouping of standards, implementation specifications, or certification criteria included among National Coordinator-endorsed recommendations.

(a) of the PHSA defines a process whereby an obligation is imposed on the Secretary to review standards, implementation specifications, and certification criteria and identifies the procedures for the Secretary to follow to determine whether to adopt any grouping of standards, implementation specifications, or certification criteria included among National Coordinator-endorsed recommendations.

b. Medicare and Medicaid EHR Incentive Programs

Title IV, Division B of the HITECH Act establishes incentive payments under the Medicare and Medicaid programs for eligible professionals and eligible hospitals that meaningfully use Certified EHR Technology. The Centers for Medicare & Medicaid Services (CMS) is charged with developing the Medicare and Medicaid EHR incentive programs.

i. Medicare EHR Incentive Program

Section 4101 of the HITECH Act added new subsections to section 1848 of the SSA to establish incentive payments for the meaningful use of Certified EHR Technology by eligible professionals participating in the Medicare Fee-for-Service (FFS) program beginning in calendar year (CY) 2011 and beginning in CY 2015, downward payment adjustments for covered professional services provided by eligible professionals who are not meaningful users of Certified EHR Technology. Section 4101(c) of the HITECH Act added a new subsection to section 1853 of the SSA that provides incentive payments to Medicare Advantage (MA) organizations for their affiliated eligible professionals who meaningfully use Certified EHR Technology beginning in CY2011 and beginning in 2015, downward payment adjustments to MA organizations to account for certain affiliated eligible professionals who are not meaningful users of Certified EHR Technology

ion to section 1853 of the SSA that provides incentive payments to Medicare Advantage (MA) organizations for their affiliated eligible professionals who meaningfully use Certified EHR Technology beginning in CY2011 and beginning in 2015, downward payment adjustments to MA organizations to account for certain affiliated eligible professionals who are not meaningful users of Certified EHR Technology.

Section 4102 of the HITECH Act added new subsections to section 1886 of the SSA that establish incentive payments for the meaningful use of Certified EHR Technology by subsection (d) hospitals (defined under section 1886(d)(1)(B) of the SSA) that participate in the Medicare FFS program beginning in Federal fiscal year (FY) 2011 and beginning in FY 2015, downward payment adjustments to the market basket updates for inpatient hospital services provided by such hospitals that are not meaningful users of Certified EHR Technology. Section 4102(b) of the HITECH Act amends section 1814 of the SSA to provide an incentive payment to critical access hospitals that meaningfully use Certified EHR Technology based on the hospitals' reasonable costs beginning in FY 2011 and downward payment adjustments for inpatient hospital services provided by such hospitals that are not meaningful users of Certified EHR Technology for cost reporting periods beginning in FY 2015. Section 4102(c) of the HITECH Act adds a new subsection to section 1853 of the SSA to provide incentive payments to MA organizations for certain affiliated eligible hospitals that meaningfully use Certified EHR Technology and beginning in FY 2015, downward payment adjustments to MA organizations for those affiliated hospitals that are not meaningful users of Certified EHR Technology.

FY 2015. Section 4102(c) of the HITECH Act adds a new subsection to section 1853 of the SSA to provide incentive payments to MA organizations for certain affiliated eligible hospitals that meaningfully use Certified EHR Technology and beginning in FY 2015, downward payment adjustments to MA organizations for those affiliated hospitals that are not meaningful users of Certified EHR Technology.

ii. Medicaid EHR Incentive Program

Section 4201 of the HITECH Act amends section 1903 of the SSA to provide 100 percent Federal financial participation (FFP) to States for incentive payments to certain eligible health care providers participating in the Medicaid program to purchase, implement, and meaningfully use (including support services and training for staff) Certified EHR Technology and 90 percent FFP for State administrative expenses related to the incentive program.

c. HIT Certification Programs

Section 3001(c)(5) of the PHSA provides the National Coordinator with the authority to establish a certification program or programs for the voluntary certification of HIT. Specifically, section 3001(c)(5)(A) specifies that the “National Coordinator, in consultation with the Director of the National Institute of Standards and Technology, shall keep or recognize a program or programs for the voluntary certification of health information technology as being in compliance with applicable certification criteria adopted under this subtitle” ( i.e., certification criteria adopted by the Secretary under section 3004 of the PHSA)

National Coordinator, in consultation with the Director of the National Institute of Standards and Technology, shall keep or recognize a program or programs for the voluntary certification of health information technology as being in compliance with applicable certification criteria adopted under this subtitle” ( i.e., certification criteria adopted by the Secretary under section 3004 of the PHSA). The certification program(s) must also “include, as appropriate, testing of the technology in accordance with section 13201(b) of the [HITECH] Act.”

Section 13201(b) of the HITECH Act requires that with respect to the development of standards and implementation specifications, the Director of the National Institute of Standards and Technology (NIST), in coordination with the HIT Standards Committee, “shall support the establishment of a conformance testing infrastructure, including the development of technical test beds.” The United States Congress also indicated that “[t]he development of this conformance testing infrastructure may include a program to accredit independent, non-Federal laboratories to perform testing.”

2. Regulatory History and Related Guidance

a. Initial Set of Standards, Implementation Specifications, and Certification Criteria

In accordance with section 3004(b)(1) of the PHSA, the Secretary published an interim final rule with request for comments entitled “Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology” (HIT Standards and Certification Criteria interim final rule) (75 FR 2014), which adopted an initial set of standards, implementation specifications, and certification criteria

published an interim final rule with request for comments entitled “Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology” (HIT Standards and Certification Criteria interim final rule) (75 FR 2014), which adopted an initial set of standards, implementation specifications, and certification criteria. The standards, implementation specifications, and certification criteria adopted by the Secretary establish the capabilities that Certified EHR Technology must include in order to, at a minimum, support the achievement of what has been proposed for meaningful use Stage 1 by eligible professionals and eligible hospitals under the Medicare and Medicaid EHR Incentive Programs proposed rule ( see 75 FR 1844 for more information about meaningful use and the proposed Stage 1 requirements).

b. Medicare and Medicaid EHR Incentive Programs Proposed Rule

On January 13, 2010, CMS published in the Federal Register (75 FR 1844) the Medicare and Medicaid EHR Incentive Program proposed rule. The rule proposes a definition for meaningful use Stage 1 and regulations associated with the incentive payments made available under Division B, Title IV of the HITECH Act. CMS has proposed that meaningful use Stage 1 would begin in 2011 and has proposed that Stage 1 would focus on “electronically capturing health information in a coded format; using that information to track key clinical conditions and communicating that information for care coordination purposes (whether that information is structured or unstructured), but in structured format whenever feasible; consistent with other provisions of Medicare and Medicaid law, implementing clinical decision support tools to facilitate disease and medication management; and reporting clinical quality measures and public health information.”

and communicating that information for care coordination purposes (whether that information is structured or unstructured), but in structured format whenever feasible; consistent with other provisions of Medicare and Medicaid law, implementing clinical decision support tools to facilitate disease and medication management; and reporting clinical quality measures and public health information.”

c. HIT Certification Programs Proposed Rule

Section 3001(c)(5) of the PHSA, specifies that the National Coordinator “shall keep or recognize a program or programs for the voluntary certification of health information technology as being in compliance with applicable certification criteria adopted [by the Secretary] under this subtitle.” We are using this authority to propose both temporary and permanent certification programs for HIT. These certification programs are necessary in order to assure that eligible professionals and eligible hospitals are able to adopt and implement Certified EHR Technology in an effort to qualify for meaningful use incentive payments.

Although the initial and primary purpose of our proposed temporary and permanent certification programs would be to test and certify Complete EHRs and EHR Modules, we believe that Congress did not intend to limit the National Coordinator's authority solely to this purpose. The National Coordinator is expressly authorized to establish a voluntary certification program or programs for “health information technology,” not simply EHRs. As a result, we expect that our permanent certification program could also include the testing and certification of other types and aspects of HIT. Examples of other types of HIT that could be tested and certified under the permanent certification program include personal health records (PHRs) and networks designed for the electronic exchange of health information

ion technology,” not simply EHRs. As a result, we expect that our permanent certification program could also include the testing and certification of other types and aspects of HIT. Examples of other types of HIT that could be tested and certified under the permanent certification program include personal health records (PHRs) and networks designed for the electronic exchange of health information. We invite public comment on the need for additional HIT certifications, the types of HIT that would be appropriate for certification, and on any of the potential benefits or challenges associated with certifying other types of HIT.

d. Physician Self-Referral Prohibition and Anti-Kickback EHR Exception and Safe Harbor Final Rules and ONC Interim Guidance Regarding the Recognition of Certification Bodies

In August 2006, HHS published two final rules in which CMS and the Office of Inspector General (OIG) promulgated an exception to the physician self-referral prohibition and a safe harbor under the anti-kickback statute, respectively, for certain arrangements involving the donation of interoperable EHR software to physicians and other health care practitioners or entities (71 FR 45140 and 71 FR 45110, respectively). The exception and safe harbor provide that EHR software will be “deemed to be interoperable if a certifying body recognized by the Secretary has certified the software no more than 12 months prior to the date it is provided to the [physician/recipient].” ONC published separately a Certification Guidance Document (CGD) (71 FR 44296) to explain the factors ONC would use to determine whether to recommend to the Secretary a body for “recognized certification body” status. The CGD serves as a guide for ONC to evaluate applications for “recognized certification body” status and provides the information a body would need to apply for and obtain such status

C published separately a Certification Guidance Document (CGD) (71 FR 44296) to explain the factors ONC would use to determine whether to recommend to the Secretary a body for “recognized certification body” status. The CGD serves as a guide for ONC to evaluate applications for “recognized certification body” status and provides the information a body would need to apply for and obtain such status. To date, the Certification Commission for Health Information Technology (CCHIT) has been the only organization that has both applied for and been granted “recognized certification body” status under the CGD.

In section VI of the CGD, ONC notified the public, including potential

This proposed rule marks the beginning of the formal notice and comment rulemaking described in the CGD. As a result, the processes we propose for the temporary certification program and permanent certification program, once finalized, would supersede the CGD, and the authorization process would constitute the new established method for “recognizing” certification bodies, as referenced in the physician self-referral prohibition and anti-kickback EHR exception and safe harbor final rules. Consequently, certifications issued by a certification body “authorized” by the National Coordinator would enable Complete EHRs and EHR Modules to meet the definition of Certified EHR Technology, and it would constitute certification by “a certifying body recognized by the Secretary” in the context of the physician self-referral EHR exception and anti-kickback EHR safe harbor.

We request comment on whether we should construe the proposed new “authorization” process as the Secretary's method for “recognizing” certification bodies in the context of the physician self-referral EHR exception and anti-kickback EHR safe harbor.

y “a certifying body recognized by the Secretary” in the context of the physician self-referral EHR exception and anti-kickback EHR safe harbor.

C. Overview of Temporary Certification Program

We are proposing a temporary certification program to describe the process by which an organization would become an ONC-Authorized Testing and Certification Body (ONC-ATCB) and authorized under the temporary certification program to perform the testing and certification of Complete EHRs and/or EHR Modules. Under the temporary certification program, the National Coordinator would assume many of the responsibilities that we have proposed that other organizations would otherwise fulfill under the permanent certification program.

In order to become an ONC-ATCB, an organization (or organizations) would need to submit an application to the National Coordinator to demonstrate its competency and ability to test and certify Complete EHRs and/or EHR Modules. We propose under the temporary certification program that in order to become an ONC-ATCB, an applicant must be able to both test and certify Complete EHRs and/or EHR Modules. We anticipate that only a few organizations would qualify and become ONC-ATCBs under the temporary certification program. We also propose conditions and requirements applicable to the testing and certification of Complete EHRs and EHR Modules. Under the temporary program, the National Coordinator would accept applications for ONC-ATCB status at any time. The temporary program would sunset once the permanent certification program is established and at least one certification body has been authorized by the National Coordinator.

e conditions and requirements applicable to the testing and certification of Complete EHRs and EHR Modules. Under the temporary program, the National Coordinator would accept applications for ONC-ATCB status at any time. The temporary program would sunset once the permanent certification program is established and at least one certification body has been authorized by the National Coordinator.

D. Overview of Permanent Certification Program

For the permanent certification program, we are proposing that several of the responsibilities assumed by the National Coordinator under the temporary certification program would be fulfilled by others. The National Coordinator would, where appropriate, seek to move as many of the temporary certification program's processes as possible to organizations in the private sector. We are proposing a process in the permanent certification program by which an organization would become an ONC-Authorized Certification Body (ONC-ACB). Please note, that an “ONC-ACB” in the permanent certification program is different than an “ONC-ATCB” in the temporary certification program. Under the permanent certification program, we are proposing that the National Coordinator's authorization would be valid solely for certification. We are also proposing that an applicant for ONC-ACB status must be accredited prior to submitting an application to the National Coordinator. An applicant's accreditation would be a critical factor in the National Coordinator's decision to grant it ONC-ACB status. We discuss in section III.F the process by which the National Coordinator would approve an accreditor (an “ONC-Approved Accreditor” (ONC-AA)) for certification bodies who intend to apply for ONC-ACB status.

al Coordinator would approve an accreditor (an “ONC-Approved Accreditor” (ONC-AA)) for certification bodies who intend to apply for ONC-ACB status.

Accreditation would also play an important role with respect to testing. As we discuss, the National Coordinator's authorization in the permanent certification program would no longer be valid for the purposes of testing Complete EHRs and EHR Modules. Instead, we propose that NIST through the National Voluntary Laboratory Accreditation Program (NVLAP) (and in accordance with section 13201(b) of the HITECH Act) would be responsible for accrediting testing laboratories and determining their competency. In this role, NIST would be solely responsible for overseeing activities related to testing laboratories. We further propose that ONC-ACBs would only be permitted to accept test results from NVLAP-accredited testing laboratories when evaluating a Complete EHR or EHR Module for certification. We also propose for the permanent certification program, similar to the temporary certification program, conditions and requirements that would apply to the certification of Complete EHRs and EHR Modules. Finally, unlike the temporary certification program, we propose that an ONC-ACB would be required to renew its status every two years under the permanent certification program.

E. Factors Influencing the Proposal of both Temporary and Permanent Certification Programs

ld be required to renew its status every two years under the permanent certification program.

E. Factors Influencing the Proposal of both Temporary and Permanent Certification Programs

A number of factors played a role in our decision to propose a temporary certification program that could be implemented quickly, and a permanent certification program that would be established for the long term. These factors include the recommendations of the HIT Policy Committee; the interrelationships of this proposed rule with the HIT Standards and Certification Criteria interim final rule (75 FR 2014) and the Medicare and Medicaid EHR Incentive Programs proposed rule (75 FR 1844); the need for eligible professionals and eligible hospitals to have Certified EHR Technology available in a timely manner; and our consultations with NIST.

1. HIT Policy Committee Recommendations

As noted above, section 3002(b) requires the HIT Policy Committee to make recommendations to the National Coordinator related to the implementation of a nationwide health information technology infrastructure. As part of this responsibility, the HIT Policy Committee made five recommendations to the National Coordinator on August 14, 2009, which support the approach proposed in this rule. The recommendations addressed the scope of the certification process in general and the approach the National Coordinator should take to establish certification programs. The HIT Policy Committee recommended “that in defining the certification process…the following objectives are pursued:

(1) Focus certification on Meaningful Use.

(2) Leverage the certification process to improve progress on privacy, security, and interoperability.

(3) Improve the objectivity and transparency of the certification process.

(4) Expand certification to include a range of software sources, e.g., open source, self-developed, etc.

g the certification process…the following objectives are pursued:

(1) Focus certification on Meaningful Use.

(2) Leverage the certification process to improve progress on privacy, security, and interoperability.

(3) Improve the objectivity and transparency of the certification process.

(4) Expand certification to include a range of software sources, e.g., open source, self-developed, etc.

(5) Develop a short-term certification transition plan.”

The National Coordinator reviewed and considered the recommendations made by the HIT Policy Committee and concluded that they should be used to provide direction for the proposals included in this rule. We believe that the proposals in this rule reflect the overall intent of the HIT Policy Committee's recommendations.

We interpret the HIT Policy Committee's use of the word “self-developed” and use it throughout the preamble to mean a Complete EHR or EHR Module that has been designed, modified, or created by, or under contract for, a person or entity that will assume the total costs for its testing and certification and will be a primary user of the Complete EHR or EHR Module. Self-developed Complete EHRs and EHR Modules could include brand new Complete EHRs or EHR Modules developed by a health care provider or their contractor. It could also include a previously purchased Complete EHR or EHR Module which is subsequently modified by the health care provider or their contractor and where such modifications are made to capabilities addressed by certification criteria adopted by the Secretary. We limit the scope of “modification” to only those capabilities for which the Secretary has adopted certification criteria because other capabilities ( e.g., a different graphical user interface (GUI)) would not affect the underlying capabilities a Complete EHR or EHR Module would need to include in order to be tested and certified

ties addressed by certification criteria adopted by the Secretary. We limit the scope of “modification” to only those capabilities for which the Secretary has adopted certification criteria because other capabilities ( e.g., a different graphical user interface (GUI)) would not affect the underlying capabilities a Complete EHR or EHR Module would need to include in order to be tested and certified.

Accordingly, we would only refer to the Complete EHR or EHR Module as “self-developed” if the health care provider paid the total costs to have the Complete EHR or EHR Module tested and certified. For example, if hospital A self-develops a Complete EHR, pays for the Complete EHR to be tested and certified, and then goes on to sell or make it freely available to additional hospitals, we would not refer to the Complete EHRs used by those hospitals (other than hospital A) as being self-developed.

2. Coordination With the HIT Standards and Certification Criteria Interim Final Rule and the Medicare and Medicaid EHR Incentive Programs Proposed Rule

This proposed rule is the third and final element of HHS's coordinated rulemakings to define the meaningful use of Certified EHR Technology and support the achievement of meaningful use.

As required by the HITECH Act, eligible professionals and eligible hospitals must demonstrate meaningful use of Certified EHR Technology in order to receive incentive payments under the Medicare and Medicaid EHR Incentive Programs. This proposed rule would create the certification programs under which Complete EHRs and EHR Modules could be tested and certified and subsequently used as Certified EHR Technology by eligible professionals and eligible hospitals. Once authorized by the National Coordinator, ONC-ATCBs under the temporary certification program and ONC-ACBs under the permanent certification program would be obligated to use the certification criteria adopted by the Secretary and identified at 45 CFR 170.302, 45 CFR 170.304, and 45 CFR 170.306

d and subsequently used as Certified EHR Technology by eligible professionals and eligible hospitals. Once authorized by the National Coordinator, ONC-ATCBs under the temporary certification program and ONC-ACBs under the permanent certification program would be obligated to use the certification criteria adopted by the Secretary and identified at 45 CFR 170.302, 45 CFR 170.304, and 45 CFR 170.306. The Secretary intends to adopt subsequent certification criteria to support the requirements for future meaningful use stages once promulgated in regulation by CMS and may, where appropriate, adopt certification criteria for other types of HIT.

3. Timeliness Related to the Beginning of the Medicare and Medicaid EHR Incentive Programs

i. Public Comment Period

Congress established specific timeframes in the HITECH Act for the beginning of the Medicare EHR incentive program. The first payment year for eligible professionals was defined as calendar year 2011 ( i.e., the year beginning January 1, 2011) and the first payment year for eligible hospitals was defined as fiscal year 2011 ( i.e., the year beginning October 1, 2010). Congress specified in section 1903(t)(6)(C)(i)(I) of the SSA that “for the first year of payment to a Medicaid provider under this subsection, the Medicaid provider [must] demonstrate that it is engaged in efforts to adopt, implement, or upgrade certified EHR technology.” Although there is no specified date for States to begin implementing the Medicaid EHR incentives program, Congress did set a cutoff for when first payments would no longer be permitted to Medicaid providers (“for any year beginning after 2016”)

er under this subsection, the Medicaid provider [must] demonstrate that it is engaged in efforts to adopt, implement, or upgrade certified EHR technology.” Although there is no specified date for States to begin implementing the Medicaid EHR incentives program, Congress did set a cutoff for when first payments would no longer be permitted to Medicaid providers (“for any year beginning after 2016”). While the Medicare and Medicaid EHR Incentive Programs proposed rule provides more detail for this statutory provision, it is important to note that Medicaid providers will not be able to receive an incentive payment for “adopting, implementing, or upgrading Certified EHR Technology” until a certification program is established to allow for the testing and certification of Complete EHRs and EHR Modules.

To meet the previously mentioned timeframes, Certified EHR Technology must be available before the fall of 2010. Accomplishing this goal will require many simultaneous actions:

• Complete EHRs and EHR Modules may need to be reprogrammed or redesigned in order to meet the certification criteria adopted by the Secretary;

• A certification program must be established to allow for testing and certification of Complete EHRs and EHR Modules; and

• A collection of Complete EHRs and EHR Modules will need to be tested and certified under the established temporary certification program.

For these reasons, among others discussed below, we have chosen to propose the establishment of a temporary certification program that could be established and become quickly operational in order to assure the availability of Certified EHR Technology prior to the beginning of meaningful use Stage 1.

could be established and become quickly operational in order to assure the availability of Certified EHR Technology prior to the beginning of meaningful use Stage 1.

With these timing constraints in mind, we have provided for a 30-day public comment period on our proposals for the temporary certification program and a 60-day comment period on our proposals for the permanent certification program. Section 6(a)(1) of Executive Order 12866 on Regulatory Planning and Review (September 30, 1993, as further amended) states that “each agency should afford the public a meaningful opportunity to comment on any proposed regulation, which in most cases should include a comment period of not less than 60 days.” We believe that it is appropriate to follow this guidance in soliciting public comment on our proposed permanent certification program because the permanent certification program's final rule will be issued some months after the final rule for the temporary certification program. However, as discussed throughout the preamble, the circumstances and time constraints under which the temporary certification program must be established are different. As a result, we believe that a 30-day comment period provides a meaningful opportunity for the public to comment on our proposals for the temporary certification program

We have proposed a temporary certification program based on our estimates that it would take too long to establish some of the elements included in our proposed permanent certification program. For example, these elements include approximately 6-9 months for the establishment of the accreditation processes for both testing laboratories by NVLAP and certification bodies by an ONC-AA as well as the time following for organizations to gain their accreditation and then subsequently apply to the National Coordinator for ONC-ACB status

included in our proposed permanent certification program. For example, these elements include approximately 6-9 months for the establishment of the accreditation processes for both testing laboratories by NVLAP and certification bodies by an ONC-AA as well as the time following for organizations to gain their accreditation and then subsequently apply to the National Coordinator for ONC-ACB status. Given our goal to assure availability of Certified EHR Technology prior to the beginning of meaningful use Stage 1, we believe that the establishment of a temporary certification program is a pragmatic and prudent approach to take. Additionally, we believe that a temporary certification program is necessary because even assuming the National Coordinator receives applications from organizations seeking to become ONC-ATCBs under the temporary certification program on the first possible day they can apply, we efficiently process the applications, and ultimately authorize one or more organizations, it is likely that ONC-ATCBs will not exist until May or June 2010. It will also take ONC-ATCBs time to process requests for testing and certification under the temporary certification program.

ii. Urgency of Establishing the Temporary Certification Program

As we have discussed, the HITECH Act provides that eligible professionals and eligible hospitals must demonstrate meaningful use of Certified EHR Technology in order to receive incentive payments under the Medicare and Medicaid EHR Incentive Programs.

Medicaid EHR Incentive Programs.

This rule proposes the creation of a temporary certification program, in addition to a permanent certification program, under which Complete EHRs and EHR Modules could be tested and certified, and subsequently adopted and implemented by eligible professionals and eligible hospitals in order to attempt to qualify for incentive payments under meaningful use Stage 1. Establishing the temporary certification program in a timely fashion is critical to begin enabling eligible professionals and eligible hospitals to achieve meaningful use within the required timeframes. For this goal to be accomplished both the HIT industry and the Department will have to achieve several milestones before Complete EHRs and EHR Modules can be tested and certified. After the close of the public comment period for the proposed temporary certification program, ONC will review and consider timely submitted public comments and then draft and publish the temporary certification program's final rule. The HIT industry will then need to respond. Organizations seeking to apply for ONC-ATCB status will submit their applications, the National Coordinator will then review and assess them, and if necessary, seek additional information through the established process. Once the National Coordinator has authorized the first ONC-ATCB, the testing and certification of Complete EHRs and EHR Modules will need to take place in accordance with the temporary certification program provisions.

To facilitate an immediate launch of the ONC-ATCB application review process under the temporary certification program, we are also proposing that the National Coordinator accept and hold all applications for ONC-ATCB status received prior to the final rule effective date. Under the Administrative Procedure Act (5 U.S.C. 553(d)), publication of a substantive final rule must occur not less than 30 days before its effective date, absent certain statutory exceptions

w process under the temporary certification program, we are also proposing that the National Coordinator accept and hold all applications for ONC-ATCB status received prior to the final rule effective date. Under the Administrative Procedure Act (5 U.S.C. 553(d)), publication of a substantive final rule must occur not less than 30 days before its effective date, absent certain statutory exceptions. In other words, a substantive rule cannot become effective until 30 days after its publication, unless an exception applies. We are consequently proposing that the National Coordinator simply accept and hold all applications for ONC-ATCB status that are received prior to the temporary certification program's final rule's effective date, so that immediately upon the final rule becoming effective, the National Coordinator could begin reviewing received applications without further delay. We request public comment on this proposal and the urgency of establishing the temporary certification program, including how this provision might affect the ability of eligible professionals and eligible hospitals to timely achieve meaningful use Stage 1.

4. Consultations With NIST

Section 3001(c)(5) of the PHSA directs the National Coordinator to consult with the Director of the NIST in the development of a certification program or programs. Consistent with this statutory provision, we have developed our proposed certification programs with the guidance and cooperation of NIST subject matter experts in testing and certification. Based on NIST recommendations, we believe it is appropriate to use the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) ISO/IEC Guide 65, ISO/IEC 17025, and ISO/IEC 17011 to structure how testing, certification, and accreditation are conducted under our proposed certification programs

T subject matter experts in testing and certification. Based on NIST recommendations, we believe it is appropriate to use the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) ISO/IEC Guide 65, ISO/IEC 17025, and ISO/IEC 17011 to structure how testing, certification, and accreditation are conducted under our proposed certification programs. The ISO Committee on conformity assessment (CASCO) prepared ISO/IEC Guide 65, ISO/IEC 17025, and ISO/IEC 17011 and we believe the use of the ISO/IEC guide and standards will help ensure that the proposed certification programs operate in a manner consistent with national and international practices for testing and certification.

Under the temporary certification program we propose that applicants for ONC-ATCB status will need to demonstrate to the National Coordinator their conformance to both ISO/IEC Guide 65:1996 (Guide 65) and ISO/IEC 17025:2005 (ISO 17025). Under the permanent certification program applicants for ONC-ACB status would be required to be accredited by an ONC-AA for certification which would require a demonstration of conformance to Guide 65. Guide 65 specifies the “general requirements for bodies operating product certification systems.” The certification of products (including processes and services) to this standard provides assurance that the products comply with specified technical and business requirements. ISO 17025 is an international standard that specifies the “general requirements for competence of testing and calibration laboratories.” This standard addresses how testing should be performed using standard methods, non-standard methods, and laboratory-developed methods

s and services) to this standard provides assurance that the products comply with specified technical and business requirements. ISO 17025 is an international standard that specifies the “general requirements for competence of testing and calibration laboratories.” This standard addresses how testing should be performed using standard methods, non-standard methods, and laboratory-developed methods. We believe Guide 65 and ISO 17025 are necessary and appropriate for ONC-ATCBs to follow under the temporary certification program because they provide standard procedures and requirements for testing and certification widely accepted by the information technology industry and would ensure consistency and efficiency in the testing and certification procedures ONC-ATCBs would perform.

Under the permanent certification program we believe and have proposed that an ONC-AA for certification would have to conform to ISO/IEC 17011:2004 (ISO 17011). ISO 17011 is an international standard that specifies the “general requirements for accreditation bodies accrediting conformity

The ISO/IEC documents use certain terminology that differs from the terminology used in this proposed rule. We recognize that this proposed rule has been drafted to ensure consistency with existing regulatory and/or statutory terms, whereas the ISO/IEC documents were drafted for a different purpose and have a broader application to a variety of industries. Nevertheless, we intend certain terms in Guide 65, ISO 17025, and ISO 17011 to have the same meaning as related terms in this proposed rule. To ensure a consistent application of the ISO/IEC documents in the context of this proposed rule, we are therefore proposing the following crosswalk. The indicated terms in the documents specified below would have the meanings attributed to the related terms used in this proposed rule, as provided in the following table

and ISO 17011 to have the same meaning as related terms in this proposed rule. To ensure a consistent application of the ISO/IEC documents in the context of this proposed rule, we are therefore proposing the following crosswalk. The indicated terms in the documents specified below would have the meanings attributed to the related terms used in this proposed rule, as provided in the following table.

Terms used in Guide 65, ISO 17025, and ISO 17011 Terms used in this Proposed Rule • Bodies operating product certification systems • ONC-ATCB. • ONC-ACB. • Certification body • Testing and certification body. • Conformity assessment bodies • Certification body. • Testing and calibration laboratories • Testing laboratory. • Accreditation body • Accreditation organization. • ONC-AA. • Products • Complete EHRs. • EHR Modules. • HIT. F. Additional Context for Comparing the Temporary and Permanent Certification Programs

Rather than proposing the temporary and permanent certification programs in two separate proposed rules, we have proposed them together in this notice of proposed rulemaking because we believe this approach provides the public with a broader context for each of the programs and a better opportunity to make informed comments. In an effort to prevent confusion, though, we first discuss our complete set of proposals for the temporary certification program (section II) and then our complete set of proposals for the permanent certification program (section III). As a result, some of the proposals discussed below for both proposed certification programs are very similar, if not the same, and are included twice—in the discussions of the temporary certification program and the permanent certification program. In other cases, there are significant differences between our proposals underlying the temporary and permanent certification programs

am (section III). As a result, some of the proposals discussed below for both proposed certification programs are very similar, if not the same, and are included twice—in the discussions of the temporary certification program and the permanent certification program. In other cases, there are significant differences between our proposals underlying the temporary and permanent certification programs. Before discussing our complete set of proposals for the temporary certification program and to provide additional context for the temporary program, we summarize some of the more significant differences between the temporary and permanent certification programs.

1. The Distinction Between Testing and Certification

We believe that there is a distinct difference between the “testing” and “certification” of a Complete EHR and/or EHR Module. In this proposed rule, “testing” is meant to describe the process used to determine the degree to which a Complete EHR or EHR Module can meet specific, predefined, measurable, quantitative requirements. These results would be able to be compared to and evaluated in accordance with predefined measures. In contrast, “certification” is meant to describe the assessment (and subsequent assertion) made by an organization, once it has analyzed the quantitative results rendered from testing along with other qualitative factors, that a Complete EHR or EHR Module has met all of the applicable certification criteria adopted by the Secretary. Qualitative factors could include whether a Complete EHR or EHR Module developer has a quality management system in place, or whether the Complete EHR or EHR Module developer has agreed to the policies and conditions associated with being certified ( e.g., proper logo usage)

ve factors, that a Complete EHR or EHR Module has met all of the applicable certification criteria adopted by the Secretary. Qualitative factors could include whether a Complete EHR or EHR Module developer has a quality management system in place, or whether the Complete EHR or EHR Module developer has agreed to the policies and conditions associated with being certified ( e.g., proper logo usage). Above and beyond testing, the act of certification typically promotes confidence in the quality of a product (and the vendor that produced it), offers assurance that the product will perform as described, and helps to make it easier for consumers to differentiate which products have met specific criteria from others that have not.

A fundamental difference between testing and certification is that testing is intended to result in objective, unanalyzed data. In contrast, certification is expected to result in an overall assessment of the test results, consideration of their significance, and consideration of other factors to determine whether the prerequisites for certification have been achieved. The following is a simple example to illustrate an important difference between testing and certification.

An e-prescribing EHR Module developer that seeks to have its EHR Module certified would first submit the EHR Module to be tested. To successfully pass the established testing requirements, the e-prescribing EHR Module would, among other functions, need to transmit an electronic prescription using mock patient data according to the standards adopted by the Secretary. Provided that the e-prescribing EHR Module successfully passed this test it would next be evaluated for certification. Certification could require that the EHR Module developer agree to a number of provisions, including, for example, displaying the EHR Module's version and revision number so potential purchasers could compare when the EHR Module was last updated or certified

pted by the Secretary. Provided that the e-prescribing EHR Module successfully passed this test it would next be evaluated for certification. Certification could require that the EHR Module developer agree to a number of provisions, including, for example, displaying the EHR Module's version and revision number so potential purchasers could compare when the EHR Module was last updated or certified. If the EHR Module developer agreed to all of the applicable certification requirements and the EHR Module achieved a passing test result, the e-prescribing EHR Module would be certified. In these situations, both the EHR Module passing the technical requirements tests and the EHR Module vendor meeting the other certification requirements would be required for the EHR Module to achieve certification.

2. Accreditation

We have proposed, in the interest of expediency and to facilitate timely certification of Complete EHRs and EHR Modules, that ONC-ATCBs under temporary certification program would be authorized (and required) to perform both the testing and certification of Complete EHRs and/or EHR Modules. Under the temporary certification program, the National Coordinator would serve in a role similar to an accreditor and would assess an ONC-ATCB applicant's competency to perform both testing and certification before granting the applicant ONC-ATCB status. However, we do not believe that this would be an optimal or practical approach for the long-term because specialized accreditors in the private sector are better equipped to react effectively and efficiently to changes in the HIT market and to more rigorously oversee the certification bodies they accredit. Moreover, we have observed in other industries, such as the manufacturing of water-conserving products, that testing and certification processes are typically handled independently and separately

e specialized accreditors in the private sector are better equipped to react effectively and efficiently to changes in the HIT market and to more rigorously oversee the certification bodies they accredit. Moreover, we have observed in other industries, such as the manufacturing of water-conserving products, that testing and certification processes are typically handled independently and separately. 1 Consequently, under the permanent certification program, we have proposed to shift the accreditation responsibilities for testing laboratories and certification bodies from the National Coordinator to other organizations. As previously

1 See http://www.epa.gov/watersense/partners/certification.html.

Under the permanent certification program, we propose the use of accreditation as a mechanism to ensure that organizations that test and certify Complete EHRs and/or EHR Modules possess the requisite competencies to perform such actions with a high degree of precision. We believe that the proposed accreditation process will also introduce rigor, transparency, trust, and objectivity to the permanent certification program. Additionally, accreditation provides an oversight mechanism to ensure that testing laboratories and certification bodies are properly performing their respective duties. Consequently, in order for an applicant under the permanent certification program to become an ONC-ACB, we would require that it be accredited by an “ONC-Approved Accreditor” (ONC-AA) for certification in addition to meeting our other proposed application requirements. Along these lines, we propose a process by which accreditation organizations can request the National Coordinator's approval to become an ONC-AA. We believe this process is necessary because we propose several responsibilities for an ONC-AA to fulfill in order to ensure our programmatic objectives for the permanent certification program are met

meeting our other proposed application requirements. Along these lines, we propose a process by which accreditation organizations can request the National Coordinator's approval to become an ONC-AA. We believe this process is necessary because we propose several responsibilities for an ONC-AA to fulfill in order to ensure our programmatic objectives for the permanent certification program are met. Additionally, an approval process for an ONC-AA is necessary in order for potential applicants for ONC-ACB status to know from whom they can request accreditation.

As we mention above, under the permanent certification program, the National Coordinator would only authorize organizations to engage in certification. We emphasize that this is not meant to preclude, limit, or in any way prevent an organization from also performing the testing of Complete EHRs and/or EHR Modules. However, in order for a single organization (which may comprise subsidiaries or components) to perform both testing and certification under the permanent certification program it would need to be: (1) Accredited by an ONC-AA and subsequently become an ONC-ACB; and (2) accredited by the NVLAP. We request public comment on whether we should give organizations who are “dual accredited” and also become an ONC-ACB a special designation to indicate to the public that such an organization would be capable of performing both testing and certification under the permanent certification program.

The NVLAP, established by the NIST, develops specific laboratory accreditation programs (LAPs) for testing and calibration laboratories in response to legislative or administrative actions, requests from government agencies or, in special circumstances, from private sector entities. 2 The National Coordinator would make a final determination about whether to issue a request to NVLAP to develop a LAP for testing laboratories after considering public comments on our proposals for the permanent certification program

tion laboratories in response to legislative or administrative actions, requests from government agencies or, in special circumstances, from private sector entities. 2 The National Coordinator would make a final determination about whether to issue a request to NVLAP to develop a LAP for testing laboratories after considering public comments on our proposals for the permanent certification program. To ensure that ONC-ACBs review test results from legitimate and competent testing laboratories, we propose that ONC-ACBs would only be permitted to certify Complete EHRs and/or EHR Modules that have been tested by a NVLAP-accredited testing laboratory.

2 “What is the NVLAP” http://ts.nist.gov/Standards/upload/What-is-the-NVLAP.pdf.

3. Surveillance

Under the permanent certification program we propose requirements for ONC-ACBs related to the surveillance of certified Complete EHRs and certified EHR Modules. We also propose certain requirements relating to surveillance for ONC-ATCBs under the temporary certification program. However, we anticipate that the temporary certification program would end close to the time an appropriate sample size of implemented certified Complete EHRs and certified EHR Modules would be available for ONC-ATCBs to perform ongoing surveillance. As a result of this limitation, we have proposed affording less weight to surveillance requirement compliance as well as less stringent requirements for ONC-ATCBs related to surveillance in the temporary certification program than we have proposed for ONC-ACBs under the permanent certification program.

requirements for ONC-ATCBs related to surveillance in the temporary certification program than we have proposed for ONC-ACBs under the permanent certification program.

We previously mentioned that we would require applicants for ONC-ACB status to be accredited by an ONC-AA. We propose that an ONC-AA in performing accreditation verify a certification body's conformance, at a minimum, to Guide 65. As a result, we expect that ONC-ACBs will perform surveillance in accordance at a minimum with Guide 65, which in section 13, among other provisions, provides that the “certification body [or `ONC-ACB'] shall periodically evaluate the marked [or `certified'] products to confirm that they continue to conform to the [adopted] standards.” ONC-ACBs consequently would be required to evaluate and reevaluate previously certified Complete EHRs and/or EHR Modules to determine whether the Complete EHRs and/or EHR Modules they had certified in a controlled environment also perform in an acceptable, if not the same, manner in the field as they had performed when they were being certified. We discuss our proposals related to surveillance in the permanent certification program at section III.D.1.c.iii.

II. Provisions of the Temporary Certification Program

[If you choose to comment on the provisions of the temporary certification program, please include at the beginning of your comment the specific section title and any additional information to clearly identify the proposal about which you are commenting. For example, “Definitions” or “Sunset.”]

A. Applicability

This subpart would establish the processes that applicants for ONC-ATCB status must follow to be granted ONC-ATCB status by the National Coordinator, the processes the National Coordinator would follow when assessing applicants and granting ONC-ATCB status, and the requirements of ONC-ATCBs for testing and certifying Complete EHRs and/or EHR Modules in accordance with the applicable certification criteria adopted by the Secretary in subpart C.

B. Definitions

TCB status must follow to be granted ONC-ATCB status by the National Coordinator, the processes the National Coordinator would follow when assessing applicants and granting ONC-ATCB status, and the requirements of ONC-ATCBs for testing and certifying Complete EHRs and/or EHR Modules in accordance with the applicable certification criteria adopted by the Secretary in subpart C.

B. Definitions

1. Definition of Applicant

We propose that the term applicant mean a single organization or a consortium of organizations that seeks to become an ONC-ATCB by requesting and subsequently submitting an application for ONC-ATCB status to the National Coordinator.

2. Definition of Day or Days

We propose that unless otherwise explicitly specified, the term day or day s shall mean a calendar day or calendar days.

3. Definition of ONC-ATCB

We propose ONC-ATCB to mean an organization or a consortium of organizations that has applied to and been authorized by the National Coordinator pursuant to the sections

C. Correspondence With the National Coordinator

Throughout the following sections, we have proposed numerous instances where applicants for ONC-ATCB status and ONC-ATCBs would have to correspond with the National Coordinator and vice versa. These instances are almost always associated with specific timeframes ( e.g., the amount of days an applicant has to respond to a deficient application notice, etc. ). Additionally, because such timeframes either trigger the beginning of a review process or the close of a response period it is important for there to be clear, unambiguous beginnings and endings for when such events must occur ( e.g., receipt of an application).

Moreover, it is the National Coordinator's preference to use e-mail whenever possible to communicate with an applicant for ONC-ATCB status or an ONC-ATCB

use such timeframes either trigger the beginning of a review process or the close of a response period it is important for there to be clear, unambiguous beginnings and endings for when such events must occur ( e.g., receipt of an application).

Moreover, it is the National Coordinator's preference to use e-mail whenever possible to communicate with an applicant for ONC-ATCB status or an ONC-ATCB. Therefore, we generally propose that any communication by the National Coordinator would be via e-mail and, where applicable, that we would consider the official date of receipt of any e-mail between the National Coordinator and an applicant for ONC-ATCB status or an ONC-ATCB to be the day the e-mail was sent, as indicated by the e-mail time-stamp. Where it is necessary for correspondence to take place via regular or express mail, we propose to use “delivery confirmation” documentation to establish the official date of receipt.

D. Temporary Certification Program Application Process for ONC-ATCB Status

1. Application for ONC-ATCB Status

In order to be considered for ONC-ATCB status, we propose that an applicant must submit an application to the National Coordinator. The application would be comprised of two parts. In order to receive an application, an applicant would have to request one in writing from the National Coordinator (requests would be made to the following e-mail address: ATCBapplication@hhs.gov ).

a. Types of Applicants

We propose that single organizations and consortia would be eligible to apply for ONC-ATCB status under the temporary certification program. We expect a consortium, for example, would be comprised of one organization that would serve as a testing laboratory and a separate organization that would serve as a certification body. When viewed as a single applicant, this applicant would be able to perform all of the required responsibilities of an ONC-ATCB under the temporary certification program

s under the temporary certification program. We expect a consortium, for example, would be comprised of one organization that would serve as a testing laboratory and a separate organization that would serve as a certification body. When viewed as a single applicant, this applicant would be able to perform all of the required responsibilities of an ONC-ATCB under the temporary certification program. We support this approach and believe that the combined expertise of two or more organizations could also result in a qualified applicant.

b. Types of ONC-ATCB Authorization

In order to properly categorize the application provided to an applicant, we would require applicants to indicate the type of testing and certification they seek authorization to perform under the temporary certification program. We propose that applicants must request authorization to perform the testing and certification of Complete EHRs or solely EHR Modules. We would treat a request for authorization to perform the testing and certification of Complete EHRs to encompass a request for authorization to perform the testing and certification of EHR Modules because, by default, an ONC-ATCB authorized to test and certify Complete EHRs would be able to test and certify all of the certification criteria adopted by the Secretary at 45 CFR part 170, subpart C. Therefore, we believe, from a technical perspective, that if an ONC-ATCB can test and certify a Complete EHR it would also be capable of testing and certifying EHR Modules. With respect to EHR Modules, this does not mean that an ONC-ATCB would be expected to determine whether one certified EHR Module would be able to seamlessly integrate with another EHR Module

etary at 45 CFR part 170, subpart C. Therefore, we believe, from a technical perspective, that if an ONC-ATCB can test and certify a Complete EHR it would also be capable of testing and certifying EHR Modules. With respect to EHR Modules, this does not mean that an ONC-ATCB would be expected to determine whether one certified EHR Module would be able to seamlessly integrate with another EHR Module. Again, as discussed in the HIT Standards and Certification Criteria interim final rule, if an eligible professional or eligible hospital chooses to use a combination of certified EHR Modules to customize their HIT to meet the definition of Certified EHR Technology, they have the responsibility to ensure that the certified EHR Modules can properly work together. Please note, though, that some EHR Modules may be subject to certain additional Federal requirements.

We request public comment on whether ONC-ATCBs should also be required to test and certify that any EHR Module presented by one EHR Module developer for testing and certification would properly work ( i.e., integrate) with another EHR Module presented by a different EHR Module developer (this request for public comment would also apply to ONC-ACBs under the permanent certification program).

Additionally, we request public comment on whether the National Coordinator should permit applicants to seek authorization to test and certify only Complete EHRs designed for an ambulatory setting or, alternatively, Complete EHRs designed for an inpatient setting. Under our current proposal, an applicant seeking authorization to perform Complete EHR testing and certification would be required to test and certify Complete EHRs designed for both ambulatory and inpatient settings. However, if we were to separately authorize Complete EHR testing and certification, we see certain benefits for the temporary certification program as well as some negative effects

. Under our current proposal, an applicant seeking authorization to perform Complete EHR testing and certification would be required to test and certify Complete EHRs designed for both ambulatory and inpatient settings. However, if we were to separately authorize Complete EHR testing and certification, we see certain benefits for the temporary certification program as well as some negative effects. Among the benefits, this approach could create the potential that more organizations would apply for ONC-ATCB status because fewer resources may be needed and could be focused on one type of testing and certification. Among the negative effects, this approach could result in a situation in which no ONC-ATCB exists to certify one or another type of Complete EHR. This would prevent the testing and certification of Complete EHRs designed for either an ambulatory or inpatient setting from being able to be tested and certified.

With respect to EHR Modules, we would require applicants to identify the type(s) of EHR Module(s) they seek authorization to test and certify and would restrict any authorization granted to only those types of EHR Module(s). For example, if an applicant requests authorization to test and certify electronic prescribing EHR Modules, and is subsequently authorized to do so, it would not also be authorized to test and certify other EHR Modules, such as those related to clinical decision support.

c. Application Part One

We propose that an applicant must address the following four sections in part one of its application:

i. Under section one, the applicant would be required to provide the following general information to, among other reasons, ensure that we have proper contact information:

• The name, address, city, State, ZIP code, and Web site of the applicant;

• The name, title, phone number, and e-mail of the person who will serve as the point of contact for the applicant

in part one of its application:

i. Under section one, the applicant would be required to provide the following general information to, among other reasons, ensure that we have proper contact information:

• The name, address, city, State, ZIP code, and Web site of the applicant;

• The name, title, phone number, and e-mail of the person who will serve as the point of contact for the applicant. This person must be legally authorized to execute and submit an application on behalf of the applicant (we refer to this person as an “authorized representative”).

ii. Under section two, the applicant would be required to provide the following information in an effort to demonstrate conformance to Guide 65

• The results of a completed self-audit to all sections of Guide 65. We expect that applicants would complete this self-audit to the best of their ability. Because the temporary certification program will only be in existence for a relatively short period of time, we recognize that certain limitations exist with respect to specific sections of Guide 65. In particular, while we expect an applicant to address Guide 65 section 13 (surveillance), we anticipate putting relatively little weight on the specific responsibilities for ONC-ATCBs related to surveillance in the temporary certification program;

• A description of the applicant's management structure according to section 4.2 of Guide 65 (Section 4.2 requires an applicant to provide a description of its organization including, but not limited to, legal or ownership status, decision making processes, assurance of objectivity and impartiality in order to justify its ability to appropriately operate a certification program);

• A copy of the applicant's quality manual that has been developed according to section 4.5.3 of Guide 65 (Section 4.5.3 requires a quality manual documenting the organization's quality system, including, but not limited to, quality objectives and commitment to quality, and associated policies and procedures to ensure quality);

• The appl

lity to appropriately operate a certification program);

• The applicant's policies and approach to confidentiality according to section 4.10 of Guide 65 (Section 4.10 requires documentation of arrangements for safeguarding confidentiality of information, consistent with applicable laws);

• The qualifications of each of the applicant's personnel who oversee or perform certification according to section 5.2 of Guide 65 (Section 5.2 requires information on the relevant qualifications, training, and expertise of each staff member involved in the certification process to be retained and kept up-to-date);

• A copy of the applicant's evaluation reporting procedures according to section 11 of Guide 65 (Section 11 requires a description of evaluation reporting procedures for conformity or nonconformity of products with all certification requirements, including any remedial actions necessary for conformity); and

• A copy of the applicant's policies for use and display of certificates ( e.g., logos) according to section 14 of Guide 65 (Section 14 requires evidence of policies and procedures for use and display of certificates, as appropriate).

iii

ing procedures for conformity or nonconformity of products with all certification requirements, including any remedial actions necessary for conformity); and

iii. Under section three, the applicant would be required to provide the following information in an effort to demonstrate conformance to ISO 17025 (which specifies the standards for operating a testing program):

• The results of a completed self-audit to all sections of ISO 17025;

• A copy of the applicant's quality system document according to section 4.2.2 of ISO 17025 (Section 4.2.2 requires a quality system document to describe the management system policies related to quality, including a quality policy statement covering such items as purpose, objectives, and commitment to appropriate standards and best professional practices);

• A copy of the applicant's policies and procedures for handling testing nonconformities according to section 4.9.1 of ISO 17025 (Section 4.9.1 requires a description of policies and procedures used to identify, evaluate, and correct any nonconformity to testing procedures or other requirements); and

• The qualifications of each of the applicant's personnel who oversee or perform testing according to section 5.2 of ISO 17025 (Section 5.2 requires personnel competency records on the relevant qualifications, training, and expertise of each staff member involved in performing testing to be retained and kept up-to-date).

iv. Under section four, the applicant would be required to submit a properly executed agreement that it will adhere to the “Principles of Proper Conduct for ONC-ATCBs.” The Principles of Proper Conduct for ONC-ATCBs would require an ONC-ATCB to:

• Operate its certification program in accordance with Guide 65 and its testing program in accordance with ISO 17025

be retained and kept up-to-date).

• Operate its certification program in accordance with Guide 65 and its testing program in accordance with ISO 17025.

• Maintain an effective quality management system which addresses all requirements of ISO 17025.

• Attend all mandatory ONC training and program update sessions.

• Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to test and certify Complete EHRs and/or EHR Modules.

• Use testing tools and procedures published by NIST ( e.g., published on its Web site or through a notice in the Federal Register ) or functionally equivalent testing tools and procedures published by another entity for the purposes of assessing Complete EHRs and/or EHR Modules compliance with the certification criteria adopted by the Secretary.

• Report to ONC within 15 days any changes that materially affect its:

○ Legal, commercial, organizational, or ownership status;

○ Organization and management, including key testing and certification personnel;

○ Policies or procedures;

○ Location;

○ Facilities, working environment or other resources;

○ ONC authorized representative (point of contact); or

○ Other such matters that may otherwise materially affect its ability to test and certify Complete EHRs and/or EHR Modules.

• Allow ONC, or its authorized agents(s), to periodically observe on site (unannounced or scheduled) during normal business hours, any testing and/or certification performed to demonstrate compliance with the requirements of the temporary certification program

ontact); or

○ Other such matters that may otherwise materially affect its ability to test and certify Complete EHRs and/or EHR Modules.

• Provide ONC, no less frequently than weekly, a current list of Complete EHRs and/or EHR Modules that have been tested and certified which includes, at a minimum, the vendor name (if applicable), the date certified, product version, the unique certification number or other specific product identification, and where applicable, the certification criterion or certification criteria to which each EHR Module has been tested and certified.

• Retain all records related to the testing and certification of Complete EHRs and/or EHR Modules for the duration of the temporary certification program and provide copies of all testing and certification records to ONC at the sunset of the temporary certification program.

• Promptly refund any and all fees received for tests and certifications that will not be completed.

We believe that adherence to these principles is necessary because they will help protect the integrity of the certification program and ensure that an applicant is capable of satisfactorily carrying out the required duties and responsibilities of an ONC-ATCB.

With respect to the third-to-the last principle listed, and in an effort to make it easier for eligible professionals and eligible hospitals to cross-validate that they have in fact adopted Certified EHR Technology, the National Coordinator intends to make a master “certified HIT products list” of all Complete EHRs and EHR Modules tested and certified by ONC-ATCBs available on the ONC Web site

With respect to the second to the last listed principle of proper conduct, because we anticipate that the temporary certification program will sunset in a relatively short period of time, we have proposed that all testing and certification records created by ONC-ATCBs must be retained, at a minimum, for the duration of the temporary certification program rather than proposing a specific preset length of time for record retention. Further, we propose that when the temporary certification program sunsets, all ONC-ATCBs would be required to provide to the National Coordinator copies of all of their testing and certification records. We also propose a specific minimum time period for record retention in the permanent certification program.

d. Application Part Two

In part two of the ONC-ATCB application process, applicants would be required to complete a proficiency examination. A proficiency examination would be used to assess whether an applicant can competently test and certify Complete EHRs and/or EHR Modules. Because the National Coordinator under the temporary certification program is performing a role similar to an accreditor, we believe a proficiency examination is a necessary requirement

process, applicants would be required to complete a proficiency examination. A proficiency examination would be used to assess whether an applicant can competently test and certify Complete EHRs and/or EHR Modules. Because the National Coordinator under the temporary certification program is performing a role similar to an accreditor, we believe a proficiency examination is a necessary requirement. We propose to create the proficiency examination with NIST's assistance and to design it to evaluate an applicant's knowledge and understanding of HIT functionality and standards and certification criteria, as well as their ability to properly test and certify Complete EHRs and/or EHR Modules. We believe that key personnel directly employed by applicants should be primarily responsible for completing the proficiency examination. Due to the topics it will cover, we anticipate that several key personnel may be required to complete the proposed proficiency examination. While we have not proposed to prohibit applicants from consulting with outside experts to complete their application, applicants would still need to clearly demonstrate in the material they submit to the National Coordinator that they will be able to competently operate a testing and certification program. In reviewing applications, the National Coordinator would take such assistance into account in order to determine whether an applicant's purported competency is not artificially inflated by temporarily retained outside expertise.

We propose to include questions in each proficiency exam from the following three sections. While a proficiency examination would address each of the sections below, we plan to generate a pool of questions from which a random selection would be used for an individual proficiency examination to ensure that no two proficiency examinations will be exactly the same. We have provided example questions for each section, but we do not believe that the specific proficiency exam questions should be made publicly available

ation would address each of the sections below, we plan to generate a pool of questions from which a random selection would be used for an individual proficiency examination to ensure that no two proficiency examinations will be exactly the same. We have provided example questions for each section, but we do not believe that the specific proficiency exam questions should be made publicly available. The purpose of a proficiency examination is for an applicant to prove to the National Coordinator at the time of application submission that it possesses an adequate level of knowledge to competently perform the testing and certification of Complete EHRs and/or EHR Modules. Consequently, our rationale for posing different questions in each proficiency examination is the same as our reason for not making the specific proficiency examination questions available prior to an applicant submitting a satisfactory application—we seek to prevent an applicant from preparing answers in advance, which could inaccurately reflect an applicant's true competency. We are proposing that the applicant also affirmatively attest that it will not copy, retain, disclose, or in any way divulge any information from the proficiency examination.

• Section 1—Knowledge Quiz

This section would require an applicant to demonstrate a solid understanding of, and technical expertise in, Complete EHRs and/or EHR Modules. The applicant would be required to address the following concepts in a quiz format: Basic health IT knowledge; familiarity with the standards, implementation specifications, and certification criteria adopted by the Secretary; familiarity with test methods associated with the certification criteria adopted by the Secretary; and ability to determine how a test should be performed for a particular set of certification criteria.

An example question for section 1 would be: Please indicate the certification criteria adopted by the Secretary that also require compliance with specific standards

eria adopted by the Secretary; familiarity with test methods associated with the certification criteria adopted by the Secretary; and ability to determine how a test should be performed for a particular set of certification criteria.

An example question for section 1 would be: Please indicate the certification criteria adopted by the Secretary that also require compliance with specific standards. For each certification criterion, indicate its purpose and, if applicable, the potential alternative standard(s) adopted by the Secretary to which a Complete EHR or EHR Module could be tested and certified.

• Section 2—Identification of Test Tools

This section would require an applicant to demonstrate that it can correctly identify and use test tools published by ONC for Complete EHRs and EHR Modules. The test tools and functional testing techniques for the certification criteria adopted by the Secretary have been or will be developed by NIST. We expect that these test tools will available prior to, or at the same time as the temporary certification program's final rule is published.

An example question for section 2 would be: Please describe the steps you would take to test the capability of a Complete EHR or EHR Module to generate a patient summary record.

• Section 3—Proper Use of Test Tools and Understanding Test Results

This section would require an applicant to demonstrate that it can properly use test tools ( e.g., a continuity of care document (CCD) validation tool), can correctly interpret test results generated by test tools, and further when using test tools that the test results the applicant produces are consistent.

An example question for section 3 would be: Using the XYZ test tool with the following sample data sets, please indicate which data sets passed the test, which data sets failed because of errors, and for those that data sets that resulted in a failure discuss why such a failure occurred.

est tools, and further when using test tools that the test results the applicant produces are consistent.

2. Application Review

An applicant would be permitted to submit its application electronically via e-mail or on paper, or via regular or express mail (we believe that electronic applications would be the most efficient). We propose that the National Coordinator be permitted up to 30 days to review an application once it has been received (the National Coordinator would notify the applicant's authorized representative to acknowledge that the application was received). We propose to review applications for ONC-ATCB status in the order in which they are received and to review and rule on an application's parts sequentially ( i.e., we will first review part one of an application and if deficiencies are found we will not review part two). We propose to notify the applicant if: (1) Its entire application was reviewed and

a. Satisfactory Application

Applicants with satisfactory applications would be notified of their successful achievement of ONC-ATCB status and upon receipt of this notification would be permitted to represent themselves as “ONC-ATCBs” and begin testing and certifying Complete EHRs and/or EHR Modules, as applicable.

b. Deficient Application Returned and Opportunity To Revise

tted to represent themselves as “ONC-ATCBs” and begin testing and certifying Complete EHRs and/or EHR Modules, as applicable.

b. Deficient Application Returned and Opportunity To Revise

We propose to formally return an application if part one or part two contains deficiencies. If we discover deficiencies in part one of an application, we would not review part two until part one is satisfactory. In the event that a portion of an applicant's response to its proficiency examination is determined to be deficient, the National Coordinator may pose an equivalent replacement question for an applicant to respond to from the appropriate question pool. We propose that the National Coordinator would have the discretion to have an element of an application clarified or request that an inadvertent error or minor omission be corrected. In these cases, before issuing a formal deficiency notice, we propose that the National Coordinator may request such information from the applicant's authorized representative as an addendum to its application. If the applicant fails to provide such information to the National Coordinator in the timeframe specified by the National Coordinator, but no less than 5 days, the National Coordinator could issue a formal deficiency notice. In other circumstances, the National Coordinator could immediately send a formal deficiency notice if it is determined that significant deficiencies exist which cannot be addressed by a clarification or correction of a minor omission. A formal deficiency notice would be sent to the applicant's authorized representative and would include all deficiencies related to a part of an application requiring correction. If the National Coordinator issues a formal deficiency notice, we propose to permit an applicant one opportunity per application part to revise the relevant application part in response and that a revised application part must be received by the National Coordinator within 15 days of the applicant's receipt of a formal deficiency notice

ies related to a part of an application requiring correction. If the National Coordinator issues a formal deficiency notice, we propose to permit an applicant one opportunity per application part to revise the relevant application part in response and that a revised application part must be received by the National Coordinator within 15 days of the applicant's receipt of a formal deficiency notice. If an applicant receives a formal deficiency notice related to part one of its application, because we have noted that part two would not have been reviewed, the applicant would be free to revise part two at the same time it is revising part one and resubmit an entirely updated application.

We propose that the National Coordinator be permitted up to 15 days to review a revised application once it has been received. If, upon a second review of the application, the National Coordinator determines that the revised application still contains deficiencies, the applicant will be issued a denial notice stating that it will no longer be considered for ONC-ATCB status under the temporary certification program. We propose to permit applicants to request that the National Coordinator reconsider this decision only when the applicant can demonstrate that clear, factual errors were made in the review of its application and that the errors' correction could lead to the applicant receiving ONC-ATCB status. Requests for reconsideration of revised applications will be conducted according to the process described in the next section. We seek public comment on whether there are other instances in which the National Coordinator should reconsider an application that has been deemed deficient multiple times.

omment on whether there are other instances in which the National Coordinator should reconsider an application that has been deemed deficient multiple times.

We also request public comment on whether it would be preferable for applicants to have their entire application reviewed all at once and then issued a formal deficiency notice or whether we should, as proposed, review applications in parts. While the former may seem more efficient for an applicant, the latter would potentially be more efficient overall because the National Coordinator would be able to notify an applicant about deficiencies earlier as well as spend less time and resources reviewing an application that may need significant corrections.

3. ONC-ATCB Application Reconsideration Requests

We propose that an applicant for ONC-ATCB status who has had part 1 or part 2 of its application returned twice because of deficiencies and has subsequently received a denial notice would be able to request that the National Coordinator reconsider this determination. For applicants, this would be at most a formal third and final opportunity (per application part) to continue their pursuit of ONC-ATCB status. While we believe the following would be highly unlikely, it is possible that an applicant's request for reconsideration of part 2 of their application could constitute their sixth formal opportunity ( i.e., three opportunities for part 1 and two prior opportunities for part 2 before the reconsideration request) to continue their pursuit of ONC-ATCB status. Again, per our request for public comment above, if we were to change our approach to reviewing applications for ONC-ATCB status, the amount of formal opportunities to revise an application would be reduced

te their sixth formal opportunity ( i.e., three opportunities for part 1 and two prior opportunities for part 2 before the reconsideration request) to continue their pursuit of ONC-ATCB status. Again, per our request for public comment above, if we were to change our approach to reviewing applications for ONC-ATCB status, the amount of formal opportunities to revise an application would be reduced.

As previously discussed, we would only permit applicants to request the National Coordinator to reconsider a deficient application when the applicant could demonstrate that clear, factual errors were made in the review of its application and that the errors' correction could lead to the applicant receiving ONC-ATCB status.

In order to make a reconsideration request, an applicant would be required to submit to the National Coordinator, within 15 days of receipt of a denial notice, a written statement (preferably via e-mail) contesting the decision and explaining what factual errors it believes can account for the denial. An applicant would be required to include sufficient documentation to support its explanation. If the applicant does not file the reconsideration request within the specified timeframe, the National Coordinator could reject the reconsideration request.

Upon receipt of the reconsideration request, the National Coordinator would be permitted up to 15 days to review the information submitted by the applicant. If, based on the documentation submitted, the National Coordinator determines that when the application was reviewed a clear factual error(s) was made and that correction of the error(s) would lead to the applicant receiving ONC-ATCB status, the National Coordinator would notify the applicant's authorized representative that such an error occurred and that its application would continue to be processed

ased on the documentation submitted, the National Coordinator determines that when the application was reviewed a clear factual error(s) was made and that correction of the error(s) would lead to the applicant receiving ONC-ATCB status, the National Coordinator would notify the applicant's authorized representative that such an error occurred and that its application would continue to be processed. If the National Coordinator determined that a clear factual error(s) was made in part 1 of an application and that correction of the error(s) would lead to a satisfactory submission for part 1 of an application, the National Coordinator would subsequently review part 2 of the application. If the National Coordinator determined that a clear factual error(s) was made in part 2 of an application and that correction of the error(s) would lead to a completely satisfactory application, the applicant's authorized representative would be

4. ONC-ATCB Status

a. Acknowledgement and Representation

We propose to make publicly available at http://healthit.hhs.gov the name of each ONC-ATCB, the date each ONC-ATCB was authorized by the National Coordinator, and the type(s) of testing and certification each ONC-ATCB is authorized to perform. Further, to prevent an ONC-ATCB from misrepresenting the scope of its authorization, we propose that an ONC-ATCB must prominently and unambiguously identify on its Web site and in all marketing and communications statements (written and oral) the scope of its authorization ( e.g., the HIT Certification Group is an ONC-ATCB for e-prescribing EHR Modules).

b. Expiration of Status Under the Temporary Certification Program

As previously mentioned, we expect to publish a final rule for the permanent certification program within a few months of publishing the temporary certification program's final rule

ions statements (written and oral) the scope of its authorization ( e.g., the HIT Certification Group is an ONC-ATCB for e-prescribing EHR Modules).

b. Expiration of Status Under the Temporary Certification Program

As previously mentioned, we expect to publish a final rule for the permanent certification program within a few months of publishing the temporary certification program's final rule. When this occurs, we would immediately begin to implement the permanent certification program's final provisions with the goal of having ONC-ACBs authorized under the permanent certification program by or before the beginning of calendar year 2012 in order to coincide with the certification activities that would need to take place in the coming months for meaningful use Stage 2. We believe it will take between 8 to 16 months to implement the permanent certification program, and therefore, we expect ONC-ATCBs under the temporary certification program would only be responsible for testing and certifying Complete EHRs and/or EHR Modules to the certification criteria adopted by the Secretary that are applicable to meaningful use Stage 1. Moreover, we will be working to assure that ONC-ACBs authorized under the permanent certification program will be in place with sufficient time to certify Complete EHRs and EHR Modules to the certification criteria adopted by the Secretary that are applicable to meaningful use Stage 2. However, if the transition to the permanent certification program occurs prior to the end of 2011, it is possible that a small percentage of late or new-to-market Complete EHRs and/or EHR Modules developed to meet the certification criteria associated with meaningful use Stage 1 may wind up being tested and certified according to the policies established in the permanent certification program

e 2. However, if the transition to the permanent certification program occurs prior to the end of 2011, it is possible that a small percentage of late or new-to-market Complete EHRs and/or EHR Modules developed to meet the certification criteria associated with meaningful use Stage 1 may wind up being tested and certified according to the policies established in the permanent certification program.

Because the temporary certification program would be operational only for a short period of time (less than 2 years), we do not believe that it is necessary to require an ONC-ATCB to renew their “authorized status” under the temporary certification program. As a result, we have not proposed a renewal requirement for ONC-ATCB status. All ONC-ATCBs would maintain their status (unless revoked) until the temporary certification program sunsets ( see section II.F). The chart below illustrates the anticipated operational periods (denoted by quarters within each calendar year) for the temporary and permanent certification programs, along with the respective proposed meaningful use Stage 1 and 2 beginning points for eligible hospitals (Q4) and eligible professionals (Q1).

EP10MR10.036

E. ONC-ATCB Performance of Testing and Certification and Maintaining Good Standing as an ONC-ATCB

1. Authorization To Test and Certify Complete EHRs

We propose that authorization to test and certify Complete EHRs under the temporary certification program would require an ONC-ATCB to be capable of performing “complete” testing and certification. Complete testing and certification would result in the ONC-ATCB testing and certifying Complete EHRs to all applicable certification criteria adopted by the Secretary. For example, the certification criteria applicable to Complete EHRs that eligible professionals would adopt would need to be tested and certified to all of the certification criteria at 45 CFR 170.302 and 45 CFR 170.304.

cation. Complete testing and certification would result in the ONC-ATCB testing and certifying Complete EHRs to all applicable certification criteria adopted by the Secretary. For example, the certification criteria applicable to Complete EHRs that eligible professionals would adopt would need to be tested and certified to all of the certification criteria at 45 CFR 170.302 and 45 CFR 170.304.

2. Authorization To Test and Certify EHR Modules

We propose that authorization to test and certify EHR Modules under the temporary certification program would require an ONC-ATCB to do so in accordance with the applicable certification criterion or certification criteria adopted by the Secretary. Furthermore, because an EHR Module, once certified, can be used in combination with other certified EHR Modules to meet the definition of Certified EHR Technology, we propose that an ONC-ATCB authorized to test and certify EHR Modules would be required to clearly indicate the certification criterion or certification criteria to which an EHR Module has been tested and certified. We believe this requirement would benefit potential adopters of certified EHR Modules and make it easier for them to determine the full capabilities that a combination of certified EHR Modules includes. To benefit potential adopters of certified EHR Modules, we would also expect EHR Module developers to clearly indicate the certification criterion or certification criteria to which an EHR Module they have developed has been tested and certified.

a. Certification Criterion Scope

As specified at 45 CFR 170.102, the definition of EHR Module means “any service, component, or combination thereof that can meet the requirements of at least one certification criterion adopted by the Secretary.” In some cases, the certification criteria specified at 45 CFR 170.302, 45 CFR 170.304, and 45 CFR 170.306 simply reference a criterion at the first paragraph level, for example, 45 CFR 170.302, paragraph “(f)” states, “Smoking Status

of EHR Module means “any service, component, or combination thereof that can meet the requirements of at least one certification criterion adopted by the Secretary.” In some cases, the certification criteria specified at 45 CFR 170.302, 45 CFR 170.304, and 45 CFR 170.306 simply reference a criterion at the first paragraph level, for example, 45 CFR 170.302, paragraph “(f)” states, “Smoking Status. Enable a user to electronically record, modify, and retrieve the smoking status of a patient. Smoking status types must

b. When Privacy and Security Certification Criteria Apply to EHR Modules

We believe that EHR Modules hold great promise with respect to innovation. However, we also recognize that the potential innovative benefits EHR Modules can provide will be significantly compromised if these same EHR Modules do not include appropriate privacy and security safeguards to instill trust.

EHR Modules can come in many forms and can provide a large set of capabilities or a single capability. This variability, which promotes innovation, also poses several challenges to determining when it is appropriate to require EHR Modules be tested and certified to the privacy and security certification criteria adopted by the Secretary (45 CFR 170.302(o) through (v)). Our goal for determining when this should occur is two-fold: (1) Assure eligible professionals and eligible hospitals that EHR Modules will not negatively affect how Certified EHR Technology in its entirety protects electronic health information; and (2) appropriately require (or not require) the testing and certification of EHR Modules to privacy and security certification criteria.

the testing and certification of EHR Modules to privacy and security certification criteria.

In the context of EHR Modules and testing and certification, it is important to keep in mind that we are discussing a point before “implementation” in the HIT lifecycle. Accordingly, ONC-ATCBs will test and certify EHR Modules independent of, and disassociated from, their potential operating environments. Below, we identify several challenges to determining when an ONC-ATCB should be required to test and certify EHR Modules to the privacy and security certification criteria adopted by the Secretary. After discussing these challenges, we propose, and request public comment on a potential approach that establishes when ONC-ATCBs should be required to test and certify EHR Modules to the privacy and security certification criteria adopted by the Secretary in addition to the capability or capabilities the EHR Module may be specifically designed to provide.

One challenge with respect to determining when EHR Modules should be tested and certified to the privacy and security certification criteria adopted by the Secretary occurs when EHR Modules operate in an environment separate from other EHR Modules—when they are so-to-speak “autonomous.” For example, an e-prescribing EHR Module or a patient portal EHR Module provided by an application service provider (ASP) could be hosted and maintained by the ASP (not by the end-user). In these cases, an end-user ( e.g., eligible professional) may be unable to control or specify the level or amount of privacy and security safeguards associated with the health information stored, modified, or transmitted by the EHR Module. We believe that it would be irresponsible and potentially dangerous to permit such EHR Modules to be tested and certified solely to their specific capability, and not to the privacy and security certification criteria adopted by the Secretary

or specify the level or amount of privacy and security safeguards associated with the health information stored, modified, or transmitted by the EHR Module. We believe that it would be irresponsible and potentially dangerous to permit such EHR Modules to be tested and certified solely to their specific capability, and not to the privacy and security certification criteria adopted by the Secretary.

On the flipside, a second challenge relates to EHR Modules that, by design, may provide specific capabilities which make it technically infeasible to require that they separately meet the privacy and security certification criteria adopted by the Secretary. One example could be a medication reconciliation EHR Module which, from a technical perspective, would be designed to function “behind the scenes” as part of the internal workings of Certified EHR Technology. In all likelihood, it would therefore depend on another EHR Module's or EHR Modules' privacy and security capabilities. In this example, we believe that it would be technically infeasible for the medication reconciliation EHR Module to have its own authentication capability because, in all likelihood, an end-user would have had to have been authenticated prior to gaining access to the medication reconciliation EHR Module. Conversely, while it is unlikely that the medication reconciliation EHR Module would retain or store health information, other EHR Modules might, and it may be appropriate to require such EHR Modules to be tested and certified to some or all of the privacy and security certification criteria adopted by the Secretary.

d it may be appropriate to require such EHR Modules to be tested and certified to some or all of the privacy and security certification criteria adopted by the Secretary.

Because of the context specific nature of EHR Modules, and the fact that we expect them to provide many different capabilities, it is difficult to establish with absolute certainty an approach that will work for all EHR Modules. However, we believe that an appropriate starting point for such an approach should focus first on protecting individuals' health information and then on whether there exist appropriate exceptions to the approach that would exempt EHR Modules from the requirement to be tested and certified to adopted privacy and security certification criteria. As a result, we propose that ONC-ATCBs would be required to test and certify all EHR Modules to the privacy and security certification criteria adopted by the Secretary unless the EHR Modules is/are presented for testing and certification in one of the following manners:

• The EHR Module(s) are presented for testing and certification as a pre-coordinated, integrated “bundle” of EHR Modules, which could otherwise constitute a Complete EHR. In such instances, the EHR Module(s) would be tested and certified in the same manner as a Complete EHR. Because the bundle of EHR Modules would constitute a single, integrated product, we believe that it would be unnecessary in such cases to require each EHR Module to be tested and certified independently to privacy and security certification criteria. We propose one variation to this exception for pre-coordinated bundles of EHR Modules which include EHR Module(s) that would not be part of an eligible professional or eligible hospital's local system and under its direct control ( e.g., a patient portal EHR Module that is not hosted and maintained)

EHR Module to be tested and certified independently to privacy and security certification criteria. We propose one variation to this exception for pre-coordinated bundles of EHR Modules which include EHR Module(s) that would not be part of an eligible professional or eligible hospital's local system and under its direct control ( e.g., a patient portal EHR Module that is not hosted and maintained). In these situations, the constituent EHR Modules of such an integrated bundle would need to be separately tested and certified to all privacy and security certification criteria;

• An EHR Module is presented for testing and certification, and the presenter can demonstrate to the ONC-ATCB that it would be technically infeasible for the EHR Module to be tested and certified in accordance with some or all of the privacy and security certification criteria. For example, we believe that it would be technically infeasible for an EHR Module that does not store even temporarily, or maintain any health information to be required to include a capability to encrypt health information at rest or include an audit log. Alternatively, it would presumably be technically infeasible for an EHR Module that does not provide a capability for exchange to be required to include the capabilities to encrypt health information for exchange or account for treatment, payment, or health care operations disclosures; or

• An EHR Module is presented for testing and certification, and the presenter can demonstrate to the ONC-ATCB that the EHR Module is designed to perform a specific privacy and security capability. In such instances, we do not believe that it should be tested and certified to the other privacy and security certification criteria adopted by the Secretary. For example, an encryption EHR Module would not be required to be tested and certified as also including the capability to terminate an electronic session after a predetermined time of inactivity

m a specific privacy and security capability. In such instances, we do not believe that it should be tested and certified to the other privacy and security certification criteria adopted by the Secretary. For example, an encryption EHR Module would not be required to be tested and certified as also including the capability to terminate an electronic session after a predetermined time of inactivity.

We believe that the approach we have articulated above provides an appropriate framework for determining when ONC-ATCBs would be required to test and certify EHR Modules to the privacy and security certification criteria adopted by the Secretary. We request public comment on whether there are additional alternatives to the ones proposed above and other circumstances where an EHR Module should be tested and certified to none, some, or all of the privacy and security certification criterion adopted by the Secretary.

3. Authorized Testing and Certification Methods

We propose that in being authorized to test and certify Complete EHRs and/or EHR Modules, ONC-ATCBs must have the capacity to test and certify Complete EHRs and/or EHR Modules at their facility. We propose further that an ONC-ATCB must also have the capacity to test and certify Complete EHRs and/or EHR Modules through some secondary means or at a secondary location. Such secondary methods would include testing and certification: (1) At the site ( i.e., physical location) where a Complete EHR or EHR Module has been developed ( e.g., at a Complete EHR developer's facility); or (2) at the site ( i.e., physical location) where the Complete EHR or EHR Module resides ( e.g., at a hospital where the HIT has been installed); or (3) remotely ( i.e., through other means, such as through secure electronic transmissions and automated Web-based tools, or at a location other than the ONC-ATCB's facilities). We believe that these secondary testing and certification methods will better accommodate self-developed Complete EHRs and EHR Modules

te EHR or EHR Module resides ( e.g., at a hospital where the HIT has been installed); or (3) remotely ( i.e., through other means, such as through secure electronic transmissions and automated Web-based tools, or at a location other than the ONC-ATCB's facilities). We believe that these secondary testing and certification methods will better accommodate self-developed Complete EHRs and EHR Modules. For example, a Complete EHR developer may submit a Complete EHR to an ONC-ATCB to be tested and certified at the ONC-ATCB's facility. In other cases, it may not be practicable for a hospital with a self-developed Complete EHR to submit its Complete EHR to an ONC-ATCB for testing and certification at the ONC-ATCBs facility and, in these cases, we expect that ONC-ATCBs would either test and certify the hospital's Complete EHR at the hospital where the Complete EHR resides or remotely through other means that do not require the ONC-ATCB to be physically present at the hospital. We expect that the most common form of remote testing and certification will employ the use of automated programs that can be accessed by the hospital via the Internet to demonstrate to the ONC-ATCB that its Complete EHR meets all applicable certification criteria adopted by the Secretary. Other forms of remote testing and certification may include an employee of the ONC-ATCB walking through a particular scripted scenario with predefined data that the hospital would have to “plug-in” to their Complete EHR and then convey the result ( e.g., the hospital would be asked to enter fabricated information on a group of “test” patients into its Complete EHR and provide responses to specific questions asked by the ONC-ATCB employee). We request public comment on whether an ONC-ATCB should be required to perform any of the secondary methods discussed above in addition to testing and certifying Complete EHRs and/or EHR Modules at its facility

the hospital would be asked to enter fabricated information on a group of “test” patients into its Complete EHR and provide responses to specific questions asked by the ONC-ATCB employee). We request public comment on whether an ONC-ATCB should be required to perform any of the secondary methods discussed above in addition to testing and certifying Complete EHRs and/or EHR Modules at its facility.

Our proposals do not preclude eligible professionals and eligible hospitals who have already adopted and implemented HIT that they believe meets the definition of Certified EHR Technology from seeking to have such HIT tested and certified themselves. Rather than relying on the vendor(s) that supplied their HIT to them to apply for testing and certification, eligible professionals and eligible hospitals could go directly to an ONC-ATCB to get their HIT tested and certified. However, eligible professionals and eligible hospitals should keep in mind that they alone would bear the full costs of testing and certification if they went directly to an ONC-ATCB.

4. The Testing and Certification of “Minimum Standards”

In the HIT Standards and Certification Criteria interim final rule (75 FR 2014), we explained how we would approach the testing and certification of Complete EHRs and EHR Modules for certain vocabulary code set standards. Our approach included the establishment of these standards as “minimum standards.” Adopting a particular version of the code set as a “minimum” permits a Complete EHR and/or EHR Module to be tested and certified to a permitted newer version of an adopted code set without the need for additional rulemaking on the part of the Secretary. For example, on the day the HIT Standards and Certification Criteria interim final rule was put on display by the Federal Register for public inspection a new version (version 2.29) of Logical Observation Identifiers Names and Codes (LOINC®) was released

tested and certified to a permitted newer version of an adopted code set without the need for additional rulemaking on the part of the Secretary. For example, on the day the HIT Standards and Certification Criteria interim final rule was put on display by the Federal Register for public inspection a new version (version 2.29) of Logical Observation Identifiers Names and Codes (LOINC®) was released. In that regard, we stated the following in the HIT Standards and Certification Criteria interim final rule:

[W]e understand that certain types of standards, specifically code sets, must be maintained and frequently updated to serve their intended purpose effectively * * * To address this need and accommodate industry practice, we have in this interim final rule indicated that certain types of standards will be considered a floor for certification. We have implemented this approach by preceding references to specific adopted standards with the phrase, “at a minimum.” In those instances, the certification criterion requires compliance with the version of the code set that has been adopted through incorporation by reference, or any subsequently released version of the code set. This approach will permit Complete EHRs and EHR Modules to be tested and certified, to, “at a minimum,” the version of the standard that has been adopted or a more current or subsequently released version. This will also enable Certified EHR Technology to be updated from an older, “minimum,” adopted version of a code set to a more current version without adversely affecting Certified EHR Technology's “certified status.” We intend to elaborate in the upcoming HIT Certification Programs proposed rule on how testing and certification would be conducted using standards we have adopted and designated as “minimums” in certain certification criteria. That being said, we understand that this approach has certain limitations

a more current version without adversely affecting Certified EHR Technology's “certified status.” We intend to elaborate in the upcoming HIT Certification Programs proposed rule on how testing and certification would be conducted using standards we have adopted and designated as “minimums” in certain certification criteria. That being said, we understand that this approach has certain limitations. In some cases, for instance, rather than simply maintaining, correcting, or slightly revising a code set, a code set maintaining organization will modify the structure or framework of a code set to meet developing industry needs. We would consider this type of significant revision to a code set to be a “modification,” rather than maintenance or a minor update of the code set. An example of a code set “modification” would be if a hypothetical XYZ code set version 1 were to use 7-digit numeric codes to represent health information while XYZ code set version 2 used 9-digit alphanumeric codes to represent health information. In such cases, interoperability would likely be reduced among Complete EHRs and EHR Modules that have adopted different versions of the structurally divergent code sets. If a code set that we have adopted through incorporation by reference is modified significantly, we will update the incorporation by reference of the adopted version with the more recent version of the code set prior to requiring or permitting certification according to the newer version.

At the end of this discussion we provided examples of when a standard would be considered a “minimum

The first method would allow for any member of the general public to notify the National Coordinator about a new version of an identified “minimum standard” code set

rsion with the more recent version of the code set prior to requiring or permitting certification according to the newer version.

At the end of this discussion we provided examples of when a standard would be considered a “minimum

The first method would allow for any member of the general public to notify the National Coordinator about a new version of an identified “minimum standard” code set. For this method, we would encourage the person or entity who submits a notification to the National Coordinator to include any relevant information the National Coordinator would need to correctly identify the “minimum standard” code set ( e.g., name and version) and any additional information that the National Coordinator could use to determine whether the new version constitutes general maintenance or minor updates, or a significant revision or modification. Upon receipt of these notifications and a determination by the National Coordinator that the new version of the code set did not represent a significant revision or modification, the National Coordinator would request the Secretary to permit the use of the identified new version for testing and certification purposes.

The second method we considered, and solicit public comment on, would be for the Secretary to proactively identify newly published versions of adopted minimum standard code sets and issue determinations as to whether they reflect maintenance efforts or minor updates of the adopted code set and would be permitted for testing and certification.

For either method above, we propose that once the Secretary has granted permission for a new version of an adopted minimum standard code to be used:

(1) Any ONC-ATCB may test and certify Complete EHRs and/or EHR Modules according to the new version;

(2) Certified EHR Technology may be upgraded to comply with the new version of an adopted minimum standard accepted by the Secretary without adversely affecting the certification status of the Certified EHR Technology; and

ssion for a new version of an adopted minimum standard code to be used:

(1) Any ONC-ATCB may test and certify Complete EHRs and/or EHR Modules according to the new version;

(3) ONC-ATCBs would not be required to test and certify Complete EHRs and/or EHR Modules according to the new version until we updated the incorporation by reference of the adopted version to a newer version.

For either method, we also propose to regularly publish (on quarterly basis) either by presenting to the HIT Standards Committee or by posting a notification on our Web site, any Secretarial determinations that have been made with respect to “minimum standard” code sets. We request public comment on whether a quarterly publication is an appropriate notification interval. We also seek public comment on other methods we might take to identify acceptable newer versions of minimum standard code sets in addition to the two methods we have discussed. Please note that the two methods we have proposed are not mutually exclusive and we request public comment on whether it would be advantageous to pursue both methods.

5. Maintaining Good Standing as an ONC-ATCB; Violations That Could Lead to the Revocation of ONC-ATCB Status; Revocation of ONC-ATCB Status

In order to maintain good standing as an ONC-ATCB, we propose that an ONC-ATCB would have to abide by the Principles of Proper Conduct for ONC-ATCBs. In addition, we expect that an ONC-ATCB would follow other Federal and State laws to which it is subject and refrain from engaging in other types of inappropriate behavior.

Further, we propose that the National Coordinator would be capable of revoking an ONC-ATCB's status under the temporary certification program when either of two types of violations occurs

ples of Proper Conduct for ONC-ATCBs. In addition, we expect that an ONC-ATCB would follow other Federal and State laws to which it is subject and refrain from engaging in other types of inappropriate behavior.

Further, we propose that the National Coordinator would be capable of revoking an ONC-ATCB's status under the temporary certification program when either of two types of violations occurs. We describe these violations and the revocation process below.

a. Type-1 Violations

Type-1 violations would include violations of law or temporary certification program policies that threaten or significantly undermine the integrity of the temporary certification program. Type-1 violations would include, but are not limited to, false, fraudulent, or abusive activities that affect: The temporary certification program; a program administered by HHS; or any program administered by the Federal government. These violations could jeopardize the integrity of the temporary certification program and would include examples such as, the ONC-ATCB or a principal employee, owner, or agent of an ONC-ATCB being convicted of fraud, embezzlement or extortion or of violating a similar Federal or State securities laws while participating in the temporary certification program, falsifying or manipulating test results and certifications, or withholding information that would indicate false or fraudulent activity had occurred within the temporary certification program.

We believe that the National Coordinator must ensure that the certification program is fair and honest and provides users of Certified EHR Technology with faith in the integrity of the temporary certification program ( e.g., that Complete EHRs and EHR Modules have been properly tested and certified). Therefore, if the National Coordinator has evidence that an ONC-ATCB committed one or more of the above-mentioned violations (false, fraudulent, and abusive activities) the National Coordinator could issue the ONC-ATCB a notice proposing to revoke its ONC-ATCB status.

ity of the temporary certification program ( e.g., that Complete EHRs and EHR Modules have been properly tested and certified). Therefore, if the National Coordinator has evidence that an ONC-ATCB committed one or more of the above-mentioned violations (false, fraudulent, and abusive activities) the National Coordinator could issue the ONC-ATCB a notice proposing to revoke its ONC-ATCB status.

b. Type-2 Violations

“Type-2” violations would include inappropriate conduct by an ONC-ATCB under the temporary certification program. A Type-2 violation would include, but not be limited to, the failure of an ONC-ATCB to adhere to the Principles of Proper Conduct for ONC-ATCBs and engaging in other types of inappropriate behavior. Examples of these types of violations include, but are not limited to: failing to attend mandatory ONC training programs, failing to meet specified reporting requirements, misrepresenting the scope of its authorization, and an ONC-ATCB testing and certifying Complete EHRs and/or EHR Modules for which it does not have authorization.

If the National Coordinator obtains reliable evidence from fact-gathering, requesting information from an ONC-ATCB, contacting an ONC-ATCB's customers, witnessing an ONC-ATCB perform testing or certification, and/or substantiated complaints that an ONC-ATCB's conduct may indicate a failure to adhere to the Principles of Proper Conduct for ONC-ATCBs or exhibited other inappropriate behavior, the National Coordinator would notify the ONC-ATCB of a possible Type-2 violation. The notification would include all pertinent information regarding the National Coordinator's assessment

m testing or certification, and/or substantiated complaints that an ONC-ATCB's conduct may indicate a failure to adhere to the Principles of Proper Conduct for ONC-ATCBs or exhibited other inappropriate behavior, the National Coordinator would notify the ONC-ATCB of a possible Type-2 violation. The notification would include all pertinent information regarding the National Coordinator's assessment.

Unless otherwise specified by the National Coordinator, an ONC-ATCB would be permitted up to 30 days from the date it is notified about possible Type-2 violation(s) to submit a written response and any accompanying documentation that could demonstrate

If an ONC-ATCB submits a response, the National Coordinator would be permitted up to 30 days to evaluate the ONC-ATCB's response (and request additional information, if necessary). If the National Coordinator determines that the ONC-ATCB did not commit a Type-2 violation, or may have committed a Type-2 violation but satisfactorily corrected any violation(s) that may have occurred, a memo will be issued to the ONC-ATCB to confirm this determination. If the National Coordinator determines that the ONC-ATCB's response is insufficient and that a Type-2 violation had occurred and had not been adequately corrected, then the National Coordinator could propose to revoke an ONC-ATCB's status.

c. Proposed Revocation

We propose that the National Coordinator could propose the revocation of an ONC-ATCB's status for alleged Type-1 violations and for failing to respond to, or satisfactorily address, a notification related to a Type-2 violation.

ONC-ATCB's status for alleged Type-1 violations and for failing to respond to, or satisfactorily address, a notification related to a Type-2 violation.

We request public comment on whether the National Coordinator should also consider proposing the revocation of an ONC-ATCB's status for repeatedly committing Type-2 violations even if the ONC-ATCB has adequately corrected the violations each time. We further request comment on how many corrected Type-2 violations would be sufficient for proposing revocation of an ONC-ATCB and to what extent the frequency of these violations should be a consideration. While we have not repeated this request for public comment in our discussion of the permanent certification program, we nevertheless encourage comments regarding this option for that program as well.

i. Opportunity To Respond to a Proposed Revocation Notice

We propose that an ONC-ATCB could respond to a proposed revocation notice within 10 days of receipt of the proposed revocation notice in order to contest the proposed revocation and explain why its status should not be revoked. We propose that if an ONC-ATCB responds to a revocation notice, it must include sufficient documentation to support its explanation. Upon receipt of an ONC-ATCB's response to a proposed revocation notice, the National Coordinator would be permitted up to 30 days to review the information submitted by the ONC-ATCB.

During the time period provided for an ONC-ATCB to respond to the proposed revocation notice and the National Coordinator's review period, we propose to permit the ONC-ATCB to continue its operations under the temporary certification program. We believe this proposal affords the ONC-ATCB meaningful due process and would minimally impact the temporary certification program because we have proposed procedures for reaching a timely final decision on revocation

the proposed revocation notice and the National Coordinator's review period, we propose to permit the ONC-ATCB to continue its operations under the temporary certification program. We believe this proposal affords the ONC-ATCB meaningful due process and would minimally impact the temporary certification program because we have proposed procedures for reaching a timely final decision on revocation. We welcome comments on this proposal and whether it would be more appropriate for the National Coordinator to immediately suspend an ONC-ATCB's operations for the time between the issuance of a proposed revocation notice and a final decision on revocation.

If the National Coordinator determines that an ONC-ATCB's status should not be revoked, the National Coordinator would notify the ONC-ATCB's authorized representative in writing to express this determination.

ii. Revocation of an ONC-ATCB's Status

We propose that the National Coordinator could revoke an ONC-ATCB's status if it is determined that revocation is appropriate after considering the information provided by the ONC-ATCB in response to the proposed revocation notice or if the ONC-ATCB does not respond to a proposed revocation notice within the specified timeframe.

We propose that a decision to revoke an ONC-ATCB's status would be final and would not be subject to further review unless the National Coordinator chooses to reconsider the revocation.

d. Extent and Duration of Revocation Under the Temporary Certification Program

We propose that the revocation of an ONC-ATCB's status would become effective as soon as the ONC-ATCB receives the revocation notice

e propose that a decision to revoke an ONC-ATCB's status would be final and would not be subject to further review unless the National Coordinator chooses to reconsider the revocation.

d. Extent and Duration of Revocation Under the Temporary Certification Program

We propose that the revocation of an ONC-ATCB's status would become effective as soon as the ONC-ATCB receives the revocation notice. A testing and certification body whose ONC-ATCB status has been revoked would be prohibited from accepting new requests for testing and certification and would be required to cease its current testing and certification operations related to Complete EHRs and/or EHR Modules ( i.e., the National Coordinator's revocation would not apply to other testing and certification operations that are not within the scope of this rule). We would also expect it to issue a complete refund to any entity whose Complete EHR or EHR Module was being tested and certified by the ONC-ATCB at the time its status was revoked. If a testing and certification body were to refuse or fail to issue a complete refund(s) upon having its ONC-ATCB status revoked, we propose that the refusal or failure should be a consideration in determining the qualifications of a testing and certification body if it were to apply at a later date to be an ONC-ACB under the proposed permanent certification program. We welcome comments on this proposal, including any potential alternatives.

Once an ONC-ATCB has had its status revoked, the testing and certification body would be permitted to reapply for ONC-ATCB status under the temporary certification program and apply under our proposed permanent certification program unless it had its status revoked for a Type-1 violation. Type-1 violations would significantly undermine the integrity of the temporary certification program and we do not believe it would be appropriate to allow the same testing and certification body to reapply for ONC-ATCB right away

CB status under the temporary certification program and apply under our proposed permanent certification program unless it had its status revoked for a Type-1 violation. Type-1 violations would significantly undermine the integrity of the temporary certification program and we do not believe it would be appropriate to allow the same testing and certification body to reapply for ONC-ATCB right away. Further, we believe that Type-1 violations could so significantly undermine the public's faith in our proposed certification programs that we propose to prohibit the testing and certification body from reapplying for ONC-ATCB status for 1 year and to count that 1 year prohibition towards the ONC-ACB application period under the permanent certification program if the temporary certification program sunsets during this time. We request public comment on any other alternatives regarding the treatment of “former ONC-ATCBs” that have had their status revoked.

We recognize that in instances where an ONC-ATCB has had its status revoked, some people may call into question the legitimacy of the certifications issued by the former ONC-ATCB. To address this matter, we propose that the “certified status” of Complete EHRs and/or EHR Modules certified by the former ONC-ATCB will remain intact unless a Type-1 violation was committed that calls into question the legitimacy of the certifications issued by the former ONC-ATCB. In these circumstances, which we believe would be extremely rare, we propose that the National Coordinator would review the facts surrounding the revocation of the ONC-ATCB's status and publish a notice on ONC's Web site if the National Coordinator believes that Complete EHRs and/or EHR Modules were fraudulently certified by a former e.g., eligible professionals and eligible hospitals) that have adopted the Complete EHR or EHR Module developer's product would no longer have HIT that meets the definition of Certified EHR Technology.

the revocation of the ONC-ATCB's status and publish a notice on ONC's Web site if the National Coordinator believes that Complete EHRs and/or EHR Modules were fraudulently certified by a former e.g., eligible professionals and eligible hospitals) that have adopted the Complete EHR or EHR Module developer's product would no longer have HIT that meets the definition of Certified EHR Technology.

e. Alternative Considered

As noted briefly above, another alternative approach to the revocation process described above (where the National Coordinator would issue a notice to an ONC-ATCB proposing to revoke its status) would be a suspension process whereby an ONC-ATCB's status would be suspended if the ONC-ATCB is reasonably suspected of having committed a Type-1 violation or if the ONC-ATCB fails to respond in a timely manner to a possible Type-2 violation or has not appropriately addressed an admitted Type-2 violation. Such a process would result in the National Coordinator issuing an ONC-ATCB a suspension notification. Upon receipt of a suspension notification, an ONC-ATCB would have to temporarily cease testing and certifying Complete EHRs and/or EHR Modules. Additionally, during the suspension an ONC-ATCB would also be prohibited from accepting new requests for testing and certification.

If the National Coordinator issues a suspension notice to an ONC-ATCB, the ONC-ATCB could respond directly to the National Coordinator and explain in writing why its status should not have been suspended. Upon receiving the ONC-ATCB's response, the National Coordinator would review the information submitted by the ONC-ATCB and reply within 7 days. In the reply, the National Coordinator could extend the suspension for an additional 14 days to obtain further information, terminate the suspension, or propose revocation while extending suspension during the pendency of the revocation process

suspended. Upon receiving the ONC-ATCB's response, the National Coordinator would review the information submitted by the ONC-ATCB and reply within 7 days. In the reply, the National Coordinator could extend the suspension for an additional 14 days to obtain further information, terminate the suspension, or propose revocation while extending suspension during the pendency of the revocation process.

We believe that a suspension process is an alternative worth considering because it could assist the National Coordinator in preventing further untoward actions by an ONC-ATCB, whereas the process we discuss above would permit, albeit presumably for a short amount of time, an ONC-ATCB to continue to test and certify Complete EHRs and/or EHR Modules while revocation procedures are underway. Therefore, we request public comment on whether the National Coordinator should also include a process to suspend an ONC-ATCB's status. We have not repeated this request for public comment in our discussion of the permanent certification program, but we encourage commenters to consider this as an option for that program as well and provide comments.

6. Validity of Complete EHR and EHR Module Certification

In the HIT Standards and Certification Criteria interim final rule, we defined Certified EHR Technology to mean “a Complete EHR or a combination of EHR Modules, each of which: (1) Meets the requirements included in

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.