[Federal Register Volume 75, Number 121 (Thursday, June 24, 2010)]
[Rules and Regulations]
[Pages 36158-36209]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-14999]



[[Page 36157]]

-----------------------------------------------------------------------

Part II





Department of Health and Human Services





-----------------------------------------------------------------------



45 CFR Part 170



Establishment of the Temporary Certification Program for Health 
Information Technology; Final Rule

Federal Register / Vol. 75 , No. 121 / Thursday, June 24, 2010 / 
Rules and Regulations

[[Page 36158]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 170

RIN 0991-AB59


Establishment of the Temporary Certification Program for Health 
Information Technology

AGENCY: Office of the National Coordinator for Health Information 
Technology, Department of Health and Human Services.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule establishes a temporary certification program 
for the purposes of testing and certifying health information 
technology. This final rule is established under the authority granted 
to the National Coordinator for Health Information Technology (the 
National Coordinator) by section 3001(c)(5) of the Public Health 
Service Act (PHSA), as added by the Health Information Technology for 
Economic and Clinical Health (HITECH) Act. The National Coordinator 
will utilize the temporary certification program to authorize 
organizations to test and certify Complete Electronic Health Records 
(EHRs) and/or EHR Modules, thereby making Certified EHR Technology 
available prior to the date on which health care providers seeking 
incentive payments available under the Medicare and Medicaid EHR 
Incentive Programs may begin demonstrating meaningful use of Certified 
EHR Technology.

DATES: These regulations are effective June 24, 2010. The incorporation 
by reference of certain publications listed in the rule is approved by 
the Director of the Federal Register as of June 24, 2010.

FOR FURTHER INFORMATION CONTACT: Steven Posnack, Director, Federal 
Policy Division, Office of Policy and Planning, Office of the National 
Coordinator for Health Information Technology, 202-690-7151.

SUPPLEMENTARY INFORMATION: 

Acronyms

APA Administrative Procedure Act
ARRA American Recovery and Reinvestment Act of 2009
CAH Critical Access Hospital
CCHIT Certification Commission for Health Information Technology
CGD Certification Guidance Document
CHPL Certified Health Information Technology Products List
CMS Centers for Medicare & Medicaid Services
CORE Committee on Operating Rules for Information Exchange[reg]
EHR Electronic Health Record
FACA Federal Advisory Committee Act
FFP Federal Financial Participation
FFS Fee for Service (Medicare Program)
HHS Department of Health and Human Services
HIPAA Health Insurance Portability and Accountability Act
HIT Health Information Technology
HITECH Health Information Technology for Economic and Clinical 
Health
ISO International Organization for Standardization
IT Information Technology
MA Medicare Advantage
NHIN Nationwide Health Information Network
NIST National Institute of Standards and Technology
OIG Office of Inspector General
OMB Office of Management and Budget
ONC Office of the National Coordinator for Health Information 
Technology
ONC-ACB ONC-Authorized Certification Body
ONC-ATCB ONC-Authorized Testing and Certification Body
OPM Office of Personnel Management
PHSA Public Health Service Act
RFA Regulatory Flexibility Act
RIA Regulatory Impact Analysis
SDO Standards Development Organization
SSA Social Security Act

Table of Contents

I. Background
    A. Previously Defined Terminology
    B. Legislative and Regulatory History
    1. Legislative History
    a. Standards, Implementation Specifications, and Certification 
Criteria
    b. Medicare and Medicaid EHR Incentive Programs
    i. Medicare EHR Incentive Program
    ii. Medicaid EHR Incentive Program
    c. HIT Certification Programs
    2. Regulatory History and Related Guidance
    a. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria Interim Final Rule
    b. Medicare and Medicaid EHR Incentive Programs Proposed Rule
    c. HIT Certification Programs Proposed Rule and the Temporary 
Certification Program Final Rule
    d. Recognized Certification Bodies as Related to the Physician 
Self-Referral Prohibition and Anti-Kickback EHR Exception and Safe 
Harbor Final Rules
II. Overview of the Temporary Certification Program
III. Provisions of the Temporary Certification Program; Analysis and 
Response to Public Comments on the Proposed Rule
    A. Overview
    B. Scope and Applicability
    C. Definitions and Correspondence
    1. Definitions
    a. Days
    b. Applicant
    c. ONC-ATCB
    2. Correspondence
    D. Testing and Certification
    1. Distinction Between Testing and Certification
    2. Types of Testing and Certification
    a. Complete EHRs and EHR Modules
    b. Complete EHRs for Ambulatory or Inpatient Settings
    c. Integrated Testing and Certification of EHR Modules
    E. Application Process
    1. Application Prerequisite
    2. Application
    a. Part 1
    b. Part 2
    3. Principles of Proper Conduct for ONC-ATCBs
    a. Operation in Accordance With Guide 65 and ISO 17025 Including 
Developing a Quality Management System
    b. Use of NIST Test Tools and Test Procedures
    i. Establishment of Test Tools and Test Procedures
    ii. Public Feedback Process
    c. ONC Visits to ONC-ATCB Sites
    d. Lists of Tested and Certified Complete EHRs and EHR Modules
    i. ONC-ATCB Lists
    ii. Certified HIT Products List
    e. Records Retention
    f. Refunds
    g. Suggested New Principles of Proper Conduct
    4. Application Submission
    5. Overall Application Process
    F. Application Review, Application Reconsideration and ONC-ATCB 
Status
    1. Review of Application
    2. ONC-ATCB Application Reconsideration
    3. ONC-ATCB Status
    G. Testing and Certification of Complete EHRs and EHR Modules
    1. Complete EHRs
    2. EHR Modules
    a. Applicable Certification Criteria or Criterion
    b. Privacy and Security Testing and Certification
    c. Identification of Certified Status
    H. The Testing and Certification of ``Minimum Standards''
    I. Authorized Testing and Certification Methods
    J. Good Standing as an ONC-ATCB, Revocation of ONC-ATCB Status 
and Effect of Revocation on Certifications Issued by a Former ONC-
ATCB
    1. Good Standing as an ONC-ATCB
    2. Revocation of ONC-ATCB Status
    3. Effect of Revocation on Certifications Issued by a Former 
ONC-ATCB
    K. Sunset of the Temporary Certification Program
    L. Recognized Certification Bodies as Related to the Physician 
Self-Referral Prohibition and Anti-Kickback EHR Exception and Safe 
Harbor Final Rules
    M. Grandfathering
    N. Concept of ``Self-Developed''
    O. Validity of Complete EHR and EHR Module Certification and 
Expiration of Certified Status
    P. General Comments
    Q. Comments Beyond the Scope of this Final Rule
IV. Provisions of the Final Regulation
V. Technical Correction to Sec.  170.100
VI. Waiver of 30-day Delay in the Effective Date

[[Page 36159]]

VII. Collection of Information Requirements
    A. Collection of Information: Application for ONC-ATCB Status 
Under the Temporary Certification Program
    B. Collection of Information: ONC-ATCB Collection and Reporting 
of Information Related to Complete EHR and/or EHR Module 
Certifications
    C. Collection of Information: ONC-ATCB Retention of Testing and 
Certification Records and the Submission of Copies of Records to ONC
VIII. Regulatory Impact Analysis
    A. Introduction
    B. Why is this Rule needed?
    C. Executive Order 12866--Regulatory Planning and Review 
Analysis
    1. Comment and Response
    2. Executive Order 12866 Final Analysis
    a. Temporary Certification Program Estimated Costs
    i. Application Process for ONC-ATCB Status
    ii. Testing and Certification of Complete EHRs and EHR Modules
    iii. Costs for Collecting, Storing, and Reporting Certification 
Results
    iv. Costs for Retaining Records and Providing Copies to ONC
    b. Temporary Certification Program Benefits
    D. Regulatory Flexibility Act
    E. Executive Order 13132--Federalism
    F. Unfunded Mandates Reform Act of 1995

I. Background

A. Previously Defined Terminology

    In addition to new terms and definitions created by this rule, the 
following terms have the same meaning as provided at 45 CFR 170.102.

     Certification criteria
     Certified EHR Technology
     Complete EHR
     Disclosure
     EHR Module
     Implementation specification
     Qualified EHR
     Standard

B. Legislative and Regulatory History

1. Legislative History
    The Health Information Technology for Economic and Clinical Health 
(HITECH) Act, Title XIII of Division A and Title IV of Division B of 
the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-
5), was enacted on February 17, 2009. The HITECH Act amended the Public 
Health Service Act (PHSA) and created ``Title XXX--Health Information 
Technology and Quality'' (Title XXX) to improve health care quality, 
safety, and efficiency through the promotion of health information 
technology (HIT) and electronic health information exchange. Section 
3001 of the PHSA establishes the Office of the National Coordinator for 
Health Information Technology (ONC). Title XXX of the PHSA provides the 
National Coordinator for Health Information Technology (the National 
Coordinator) and the Secretary of Health and Human Services (the 
Secretary) with new responsibilities and authorities related to HIT. 
The HITECH Act also amended several sections of the Social Security Act 
(SSA) and in doing so established the availability of incentive 
payments to eligible professionals and eligible hospitals to promote 
the adoption and meaningful use of interoperable HIT.
a. Standards, Implementation Specifications, and Certification Criteria
    With the passage of the HITECH Act, two new Federal advisory 
committees were established, the HIT Policy Committee and the HIT 
Standards Committee (sections 3002 and 3003 of the PHSA, respectively). 
Each is responsible for advising the National Coordinator on different 
aspects of standards, implementation specifications, and certification 
criteria. The HIT Policy Committee is responsible for, among other 
duties, recommending priorities for the development, harmonization, and 
recognition of standards, implementation specifications, and 
certification criteria, while the HIT Standards Committee is 
responsible for recommending standards, implementation specifications, 
and certification criteria for adoption by the Secretary under section 
3004 of the PHSA consistent with the ONC-coordinated Federal Health IT 
Strategic Plan (the ``strategic plan'').
    Section 3004 of the PHSA defines how the Secretary adopts 
standards, implementation specifications, and certification criteria. 
Section 3004(a) of the PHSA defines a process whereby an obligation is 
imposed on the Secretary to review standards, implementation 
specifications, and certification criteria and identifies the 
procedures for the Secretary to follow to determine whether to adopt 
any group of standards, implementation specifications, or certification 
criteria included among National Coordinator-endorsed recommendations.
b. Medicare and Medicaid EHR Incentive Programs
    Title IV, Division B of the HITECH Act establishes incentive 
payments under the Medicare and Medicaid programs for eligible 
professionals and eligible hospitals that meaningfully use Certified 
Electronic Health Record (EHR) Technology. The Centers for Medicare & 
Medicaid Services (CMS) is charged with developing the Medicare and 
Medicaid EHR incentive programs.
i. Medicare EHR Incentive Program
    Section 4101 of the HITECH Act added new subsections to section 
1848 of the SSA to establish incentive payments for the meaningful use 
of Certified EHR Technology by eligible professionals participating in 
the Medicare Fee-for-Service (FFS) program beginning in calendar year 
(CY) 2011 and beginning in CY 2015, downward payment adjustments for 
covered professional services provided by eligible professionals who 
are not meaningful users of Certified EHR Technology. Section 4101(c) 
of the HITECH Act added a new subsection to section 1853 of the SSA 
that provides incentive payments to Medicare Advantage (MA) 
organizations for their affiliated eligible professionals who 
meaningfully use Certified EHR Technology beginning in CY 2011 and 
beginning in CY 2015, downward payment adjustments to MA organizations 
to account for certain affiliated eligible professionals who are not 
meaningful users of Certified EHR Technology.
    Section 4102 of the HITECH Act added new subsections to section 
1886 of the SSA that establish incentive payments for the meaningful 
use of Certified EHR Technology by subsection (d) hospitals (defined 
under section 1886(d)(1)(B) of the SSA) that participate in the 
Medicare FFS program beginning in Federal fiscal year (FY) 2011 and 
beginning in FY 2015, downward payment adjustments to the market basket 
updates for inpatient hospital services provided by such hospitals that 
are not meaningful users of Certified EHR Technology. Section 4102(b) 
of the HITECH Act amends section 1814 of the SSA to provide an 
incentive payment to critical access hospitals that meaningfully use 
Certified EHR Technology based on the hospitals' reasonable costs 
beginning in FY 2011 and downward payment adjustments for inpatient 
hospital services provided by such hospitals that are not meaningful 
users of Certified EHR Technology for cost reporting periods beginning 
in FY 2015. Section 4102(c) of the HITECH Act adds a new subsection to 
section 1853 of the SSA to provide incentive payments to MA 
organizations for certain affiliated eligible hospitals that 
meaningfully use Certified EHR Technology and beginning in FY 2015, 
downward payment adjustments to MA organizations for those affiliated 
hospitals that are not meaningful users of Certified EHR Technology.

[[Page 36160]]

ii. Medicaid EHR Incentive Program
    Section 4201 of the HITECH Act amends section 1903 of the SSA to 
provide 100 percent Federal financial participation (FFP) to States for 
incentive payments to eligible health care providers participating in 
the Medicaid program and 90 percent FFP for State administrative 
expenses related to the incentive program.
c. HIT Certification Programs
    Section 3001(c)(5) of the PHSA provides the National Coordinator 
with the authority to establish a certification program or programs for 
the voluntary certification of HIT. Specifically, section 3001(c)(5)(A) 
specifies that the ``National Coordinator, in consultation with the 
Director of the National Institute of Standards and Technology, shall 
keep or recognize a program or programs for the voluntary certification 
of health information technology as being in compliance with applicable 
certification criteria adopted under this subtitle'' (i.e., 
certification criteria adopted by the Secretary under section 3004 of 
the PHSA). The certification program(s) must also ``include, as 
appropriate, testing of the technology in accordance with section 
13201(b) of the [HITECH] Act.''
    Section 13201(b) of the HITECH Act requires that with respect to 
the development of standards and implementation specifications, the 
Director of the National Institute of Standards and Technology (NIST), 
in coordination with the HIT Standards Committee, ``shall support the 
establishment of a conformance testing infrastructure, including the 
development of technical test beds.'' The United States Congress also 
indicated that ``[t]he development of this conformance testing 
infrastructure may include a program to accredit independent, non-
Federal laboratories to perform testing.''
2. Regulatory History and Related Guidance
a. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria Interim Final Rule
    In accordance with section 3004(b)(1) of the PHSA, the Secretary 
issued an interim final rule with request for comments entitled 
``Health Information Technology: Initial Set of Standards, 
Implementation Specifications, and Certification Criteria for 
Electronic Health Record Technology'' (HIT Standards and Certification 
Criteria interim final rule) (75 FR 2014), which adopted an initial set 
of standards, implementation specifications, and certification 
criteria. The standards, implementation specifications, and 
certification criteria adopted by the Secretary establish the 
capabilities that Certified EHR Technology must include in order to, at 
a minimum, support the achievement of what has been proposed for 
meaningful use Stage 1 by eligible professionals and eligible hospitals 
under the Medicare and Medicaid EHR Incentive Programs proposed rule 
(see 75 FR 1844 for more information about meaningful use and the 
proposed Stage 1 requirements).
b. Medicare and Medicaid EHR Incentive Programs Proposed Rule
    On January 13, 2010, CMS published in the Federal Register (75 FR 
1844) the Medicare and Medicaid EHR Incentive Programs proposed rule. 
The rule proposes a definition for meaningful use Stage 1 and 
regulations associated with the incentive payments made available under 
Division B, Title IV of the HITECH Act. CMS has proposed that 
meaningful use Stage 1 would begin in 2011 and has proposed that Stage 
1 would focus on ``electronically capturing health information in a 
coded format; using that information to track key clinical conditions 
and communicating that information for care coordination purposes 
(whether that information is structured or unstructured), but in 
structured format whenever feasible; consistent with other provisions 
of Medicare and Medicaid law, implementing clinical decision support 
tools to facilitate disease and medication management; and reporting 
clinical quality measures and public health information.''
c. HIT Certification Programs Proposed Rule and the Temporary 
Certification Program Final Rule
    Section 3001(c)(5) of the PHSA, specifies that the National 
Coordinator ``shall keep or recognize a program or programs for the 
voluntary certification of health information technology as being in 
compliance with applicable certification criteria adopted [by the 
Secretary] under this subtitle.'' Based on this authority, we proposed 
both a temporary and permanent certification program for HIT in a 
notice of proposed rulemaking entitled ``Proposed Establishment of 
Certification Programs for Health Information Technology'' (75 FR 
11328, March 10, 2010) (RIN 0991-AB59) (the ``Proposed Rule''). In the 
Proposed Rule, we proposed to use the certification programs for the 
purposes of testing and certifying HIT. We also specified the processes 
the National Coordinator would follow to authorize organizations to 
perform the certification of HIT.
    We stated in the Proposed Rule that we expected to issue separate 
final rules for each of the certification programs. This final rule 
establishes a temporary certification program whereby the National 
Coordinator will authorize organizations to test and certify Complete 
EHRs and/or EHR Modules, thereby assuring the availability of Certified 
EHR Technology prior to the date on which health care providers seeking 
the incentive payments available under the Medicare and Medicaid EHR 
Incentive Programs may begin demonstrating meaningful use of Certified 
EHR Technology.
d. Recognized Certification Bodies as Related to the Physician Self-
Referral Prohibition and Anti-Kickback EHR Exception and Safe Harbor 
Final Rules
    In August 2006, HHS published two final rules in which CMS and the 
Office of Inspector General (OIG) promulgated an exception to the 
physician self-referral prohibition and a safe harbor under the anti-
kickback statute, respectively, for certain arrangements involving the 
donation of interoperable EHR software to physicians and other health 
care practitioners or entities (71 FR 45140 and 71 FR 45110, 
respectively). The exception and safe harbor provide that EHR software 
will be ``deemed to be interoperable if a certifying body recognized by 
the Secretary has certified the software no more than 12 months prior 
to the date it is provided to the [physician/recipient].'' ONC 
published separately a Certification Guidance Document (CGD) (71 FR 
44296) to explain the factors ONC would use to determine whether to 
recommend to the Secretary a body for ``recognized certification body'' 
status. The CGD serves as a guide for ONC to evaluate applications for 
``recognized certification body'' status and provides the information a 
body would need to apply for and obtain such status. To date, the 
Certification Commission for Health Information Technology (CCHIT) has 
been the only organization that has both applied for and been granted 
``recognized certification body'' status under the CGD.
    In section VI of the CGD, ONC notified the public, including 
potential applicants, that the recognition process explained in the CGD 
would be formalized through notice and comment rulemaking and that when 
a final rule has been promulgated to govern the process by which a 
``recognized certification body'' is determined, certification bodies 
recognized under the CGD would be required to complete

[[Page 36161]]

new applications and successfully demonstrate compliance with all 
requirements of the final rule.
    In the Proposed Rule, we began the formal notice and comment 
rulemaking described in the CGD. We stated that the processes we 
proposed for the temporary certification program and permanent 
certification program, once finalized, would supersede the CGD, and the 
authorization process would constitute the new established method for 
``recognizing'' certification bodies, as referenced in the physician 
self-referral prohibition and anti-kickback EHR exception and safe 
harbor final rules. As a result of our proposal, certifications issued 
by a certification body ``authorized'' by the National Coordinator 
would constitute certification by ``a certifying body recognized by the 
Secretary'' in the context of the physician self-referral EHR exception 
and anti-kickback EHR safe harbor. We requested public comment on this 
proposal and have responded to those comments in Section III of this 
final rule.

II. Overview of the Temporary Certification Program

    The temporary certification program provides a process by which an 
organization or organizations may become an ONC-Authorized Testing and 
Certification Body (ONC-ATCB) and be authorized by the National 
Coordinator to perform the testing and certification of Complete EHRs 
and/or EHR Modules.
    Under the temporary certification program, the National Coordinator 
will accept applications for ONC-ATCB status at any time. In order to 
become an ONC-ATCB, an organization or organizations must submit an 
application to the National Coordinator to demonstrate its competency 
and ability to test and certify Complete EHRs and/or EHR Modules. An 
applicant will need to be able to both test and certify Complete EHRs 
and/or EHR Modules. We anticipate that only a few organizations will 
qualify and become ONC-ATCBs under the temporary certification program. 
These organizations will be required to remain in good standing by 
adhering to the Principles of Proper Conduct for ONC-ATCBs. ONC-ATCBs 
will also be required to follow the conditions and requirements 
applicable to the testing and certification of Complete EHRs and/or EHR 
Modules as specified in this final rule. The temporary certification 
program will sunset on December 31, 2011, or if the permanent 
certification program is not fully constituted at that time, then upon 
a subsequent date that is determined to be appropriate by the National 
Coordinator.

III. Provisions of the Temporary Certification Program; Analysis and 
Response to Public Comments on the Proposed Rule

A. Overview

    This section discusses the 84 timely received comments on the 
Proposed Rule's proposed temporary certification program and our 
responses. We have structured this section of the final rule based on 
the proposed regulatory sections of the temporary certification program 
and discuss each regulatory section sequentially. For each discussion 
of the regulatory provision, we first restate or paraphrase the 
provision as proposed in the Proposed Rule as well as identify any 
correlated issues for which we sought public comment. Second, we 
summarize the comments received. Lastly, we provide our response to the 
comments, including stating whether we will finalize the provision as 
proposed in the Proposed Rule or modify the proposed provision in 
response to public comment. Comments on the incorporation of the 
``recognized certification body'' process, ``grandfathering'' of 
certifications, the concept of ``self-developed,'' validity and 
expiration of certifications, general comments, and comments beyond the 
scope of this final rule are discussed towards the end of the preamble.

B. Scope and Applicability

    In the Proposed Rule, we indicated in section 170.400 that the 
temporary certification program would serve to implement section 
3001(c)(5) of the Public Health Service Act, and that subpart D would 
also set forth the rules and procedures related to the temporary 
certification program for HIT administered by the National Coordinator. 
Under section 170.401, we proposed that subpart D would establish the 
processes that applicants for ONC-ATCB status must follow to be granted 
ONC-ATCB status by the National Coordinator, the processes the National 
Coordinator would follow when assessing applicants and granting ONC-
ATCB status, and the requirements of ONC-ATCBs for testing and 
certifying Complete EHRs and/or EHR Modules in accordance with the 
applicable certification criteria adopted by the Secretary in subpart C 
of this part.
    Comments. We received many comments that expressed support for our 
proposal for a temporary certification program that would provide the 
opportunity for Complete EHRs and EHR Modules to be tested and 
certified in advance of meaningful use Stage 1. The commenters 
expressed an understanding of the rationale we provided for proposing a 
temporary certification program and the urgency we associated with 
establishing the temporary certification program.
    Some commenters suggested that we use the terms ``interim,'' 
``transitional'' or ``provisional'' to describe the temporary 
certification program. One commenter asserted that the term ``interim'' 
is particularly appropriate because it is used in Federal rulemaking to 
denote regulatory actions that are fully in effect but will be replaced 
with more refined versions in the future. Other commenters contended 
that using the term ``temporary'' to describe the short-term program 
and its associated certifications may cause confusion in the market and 
prolong, instead of reduce, uncertainty among eligible professionals 
and eligible hospitals. One commenter recommended that we establish a 
comprehensive educational program about our proposed certification 
programs.
    Some commenters stated that the certification programs should not 
be vague and expansive by encompassing various, unidentified areas of 
HIT, but instead should be targeted to the objectives of achieving 
meaningful use of Certified EHR Technology. One commenter also 
mentioned the need for the certification programs to focus on the 
implementation of the Nationwide Health Information Network (NHIN).
    Response. We appreciate the commenters' expressions of support for 
the temporary certification program. We also appreciate the commenters' 
suggestions and rationale for renaming the temporary certification 
program. We believe, however, that we have described the temporary 
certification program in the Proposed Rule and this final rule in a 
manner that clearly conveys its purpose and scope such that renaming 
the program is not necessary. Furthermore, as generally recommended by 
a commenter, we will continue to communicate with and educate 
stakeholders about the temporary certification program and the eventual 
transition to the proposed permanent certification program.
    We believe that we clearly indicated in the Proposed Rule's 
preamble and the proposed temporary certification program's scope and 
applicability provisions that one of the goals of the temporary 
certification program is to support the achievement of meaningful use 
by testing and certifying Complete EHRs and EHR Modules to the 
certification criteria adopted by the

[[Page 36162]]

Secretary in subpart C of part 170. Therefore, we do not believe that 
the programs are overly vague or expansive. We believe that the 
commenters who expressed these concerns focused on our proposals to 
permit other types of HIT to be certified under the permanent 
certification program. We plan to address this issue in the final rule 
for the permanent certification program, but in the interim, we remind 
these commenters of a fact we stated in the Proposed Rule. The 
Secretary would first need to adopt certification criteria for other 
types of HIT before we would consider authorizing, in this case, ONC-
ACBs to certify those other types of HIT.
    We are revising Sec.  170.401 to clearly state that this subpart 
includes requirements that ONC-ATCBs must follow to maintain good 
standing under the temporary certification program. This reference was 
inadvertently left out of Sec.  170.401 in the Proposed Rule.

C. Definitions and Correspondence

    We proposed in the Proposed Rule to define three terms related to 
the temporary certification program and to establish a process for 
applicants for ONC-ATCB status and ONC-ATCBs to correspond with the 
National Coordinator.
1. Definitions
a. Days
    We proposed in the Proposed Rule to add the definition of ``day or 
days'' to section 170.102. We proposed to define ``day or days'' to 
mean a calendar day or calendar days. We did not receive any comments 
on this provision. Therefore, we are finalizing this definition without 
modification.
b. Applicant
    We proposed in section 170.402 to define applicant to mean a single 
organization or a consortium of organizations that seeks to become an 
ONC-ATCB by requesting and subsequently submitting an application for 
ONC-ATCB status to the National Coordinator.
    Comments. One commenter recommended that we encourage and support 
the establishment of coalitions or partnerships for testing and 
certification that leverage specialized expertise. Another commenter 
asked whether third-party organizations will be allowed to become 
testing laboratories for the temporary and permanent certification 
programs.
    Response. We agree with the commenter that coalitions or 
partnerships for testing and certification are capable of leveraging 
specialized expertise and we continue to support such an approach. We 
noted in the Proposed Rule that single organizations and consortia 
would be eligible to apply for ONC-ATCB status under the temporary 
certification program. We also stated that we would expect a consortium 
to be comprised of one organization that would serve as a testing 
laboratory and a separate organization that would serve as a 
certification body. We further stated that, as long as such an 
applicant could perform all of the required responsibilities of an ONC-
ATCB, we would fully support the approach. Accordingly, we are 
finalizing this provision without modification.
    Although we are unclear as to what the commenter meant by a 
``third-party organization,'' we can state that a testing laboratory 
could apply to become an ONC-ATCB in a manner described above (i.e., as 
a member or component of a consortium) or the laboratory could apply 
independently to become an ONC-ATCB, but it would need to meet all the 
application requirements, including the requisite certification body 
qualifications as specified in ISO/IEC Guide 65:1996 (Guide 65). In the 
Proposed Rule, we proposed that a testing laboratory would need to 
become accredited by the testing laboratory accreditor under the 
permanent certification program. This process and whether an 
organization that becomes an ONC-ACB under the permanent certification 
program can be affiliated with an accredited testing laboratory are 
matters we requested the public to comment on in the Proposed Rule and 
will be more fully discussed when we finalize the permanent 
certification program.
c. ONC-ATCB
    We proposed in section 170.402 to define an ONC-Authorized Testing 
and Certification Body (ONC-ATCB) to mean an organization or a 
consortium of organizations that has applied to and been authorized by 
the National Coordinator pursuant to subpart D to perform the testing 
and certification of Complete EHRs and/or EHR Modules under the 
temporary certification program. We did not receive any comments on 
this provision. Therefore, we are finalizing this definition without 
modification.
2. Correspondence
    We proposed in section 170.405 to require applicants for ONC-ATCB 
status and ONC-ATCBs to correspond and communicate with the National 
Coordinator by e-mail, unless otherwise necessary. We proposed that the 
official date of receipt of any e-mail between the National Coordinator 
and an applicant for ONC-ATCB status or an ONC-ATCB would be the day 
the e-mail was sent. We further proposed that in circumstances where it 
was necessary for an applicant for ONC-ATCB status or ONC-ATCB to 
correspond or communicate with the National Coordinator by regular or 
express mail, the official date of receipt would be the date of the 
delivery confirmation. We did not receive any comments on these 
proposals. We are, however, revising this section to include ``or ONC-
ATCB'' in paragraph (b) to clarify that either an applicant for ONC-
ATCB status or an ONC-ATCB may, when necessary, utilize the specified 
correspondence methods. This reference was inadvertently left out of 
Sec.  170.405(b) in the Proposed Rule.

D. Testing and Certification

1. Distinction Between Testing and Certification
    We stated in the Proposed Rule that there is a distinct difference 
between the ``testing'' and ``certification'' of a Complete EHR and/or 
EHR Module. We described ``testing'' as the process used to determine 
the degree to which a Complete EHR or EHR Module can meet specific, 
predefined, measurable, and quantitative requirements. We noted that 
such results would be able to be compared to and evaluated in 
accordance with predefined measures. In contrast, we described 
``certification'' as the assessment (and subsequent assertion) made by 
an organization, once it has analyzed the quantitative results rendered 
from testing along with other qualitative factors, that a Complete EHR 
or EHR Module has met all of the applicable certification criteria 
adopted by the Secretary. We noted that qualitative factors could 
include whether a Complete EHR or EHR Module developer has a quality 
management system in place, or whether the Complete EHR or EHR Module 
developer has agreed to the policies and conditions associated with 
being certified (e.g., proper logo usage). We further stated that the 
act of certification typically promotes confidence in the quality of a 
product (and the Complete EHR or EHR Module developer that produced 
it), offers assurance that the product will perform as described, and 
helps consumers to differentiate which products have met specific 
criteria from others that have not.
    To further clarify, we stated that a fundamental difference between 
testing and certification is that testing is intended to result in 
objective,

[[Page 36163]]

unanalyzed data. In contrast, certification is expected to result in an 
overall assessment of the test results, consideration of their 
significance, and consideration of other factors to determine whether 
the prerequisites for certification have been achieved. To illustrate 
an important difference between testing and certification, we provided 
the example that we recite below.
    An e-prescribing EHR Module developer that seeks to have its EHR 
Module certified would first submit the EHR Module to be tested. To 
successfully pass the established testing requirements, the e-
prescribing EHR Module would, among other functions, need to transmit 
an electronic prescription using mock patient data according to the 
standards adopted by the Secretary. Provided that the e-prescribing EHR 
Module successfully passed this test it would next be evaluated for 
certification. Certification could require that the EHR Module 
developer agree to a number of provisions, including, for example, 
displaying the EHR Module's version and revision number so potential 
purchasers could discern when the EHR Module was last updated or 
certified. If the EHR Module developer agreed to all of the applicable 
certification requirements and the EHR Module achieved a passing test 
result, the e-prescribing EHR Module would be certified. In these 
situations, both the EHR Module passing the technical requirements 
tests and the EHR Module vendor meeting the other certification 
requirements would be required for the EHR Module to achieve 
certification.
    Comments. Multiple commenters asked for additional clarification 
for the distinction between testing and certification. Commenters were 
concerned that ONC-ATCBs would have too much discretion related to 
certification. The commenters asserted that ONC-ATCBs should only be 
empowered to assess whether adopted certification criteria have been 
met or whether other applicable policies adopted by the National 
Coordinator through regulation, such as ``labeling'' policies, have 
been complied with. Commenters expressed specific concern with one of 
our examples of potential qualitative factors, which was the need to 
have ``a quality management system in place.'' The commenters suggested 
that a requirement to have a quality management system in place is 
vague and gave too much discretion to an ONC-ATCB.
    Response. We require as a Principle of Proper Conduct that ONC-
ATCBs shall operate their certification programs in accordance with 
Guide 65. Guide 65 specifies the requirements that an organization must 
follow to operate a certification program. Moreover, because Guide 65 
states in section 4.6.1 that a ``certification body shall specify the 
conditions for granting, maintaining and extending certification,'' we 
believe that it would be inappropriate to dictate every specific aspect 
related to an ONC-ATCB's certification program operations. We 
understand the concerns expressed by commenters over our example of a 
``quality management system'' as another factor that ONC-ATCBs may 
choose to include, in accordance with Guide 65, as part of their 
certification requirements for assessing Complete EHRs and/or EHR 
Modules and have considered how to best address such concerns.
    With respect to those commenters who requested that we clarify the 
purview of ONC-ATCBs related to certification and expressed concerns 
about the discretion afforded to ONC-ATCBs, we agree that additional 
clarity is necessary regarding our intent and expectations of ONC-ATCBs 
in our discussion of the differences between testing and certification 
in the Proposed Rule. We believe commenters were expressing a concern 
that certification could include other factors beyond the certification 
criteria adopted by the Secretary in subpart C of part 170, which could 
prevent them from receiving a certification in a timely manner if they 
were not aware of those factors. We agree with commenters that this is 
a legitimate concern and did not intend to convey, through our 
examples, that we would adopt additional requirements for certification 
in this final rule beyond the certification criteria adopted by the 
Secretary in subpart C of part 170 and the other responsibilities 
specified in subpart D of part 170 that we require an ONC-ATCB to 
fulfill in order to perform the testing and certification of Complete 
EHRs and/or EHR Modules.
    We seek to make clear that the primary responsibility of ONC-ATCBs 
under the temporary certification program is to test and certify 
Complete EHRs and/or EHR Modules in accordance with the certification 
criteria adopted by the Secretary. In consideration of the comments and 
the preceding discussion, we have revised Sec.  170.445 and Sec.  
170.450 to make it explicitly clear that an ONC-ATCB must offer the 
option of testing and certification of a Complete EHR or EHR Module 
solely to the certification criteria adopted by the Secretary and no 
other certification criteria. In other words, an ONC-ATCB must comply 
with a request made by a Complete EHR or EHR Module developer to have 
its Complete EHR or EHR Module tested and certified solely to the 
certification criteria adopted by the Secretary and not to any other 
factors beyond those we require ONC-ATCBs to follow when issuing a 
certification as discussed above (i.e., responsibilities specified in 
subpart D of part 170). However, this does not preclude an ONC-ATCB 
from also offering testing and certification options that include 
additional requirements beyond the certification criteria adopted by 
the Secretary. If an ONC-ATCB chooses to offer testing and 
certification options that specify additional requirements as a matter 
of its own business practices, we expect that in accordance with Guide 
65, section 6, the ONC-ATCB would ``give due notice of any changes it 
intends to make in its requirements for certification'' and ``take 
account of views expressed by interested parties before deciding on the 
precise form and effective date of the changes.''
    We note, however, that while we do not preclude an ONC-ATCB from 
certifying HIT in accordance with its own requirements that may be 
unrelated to and potentially exceed the certification criteria adopted 
by the Secretary, such activities are not within the scope of an ONC-
ATCB's authority granted under the temporary certification program and 
are not endorsed or approved by the National Coordinator or the 
Secretary. Accordingly, we have added as a component of a new principle 
in the Principles of Proper Conduct for ONC-ATCBs (discussed in more 
detail in section O. Validity of Complete EHR and EHR Module 
Certification and Expiration of Certified Status) that any 
certifications issued to HIT that would constitute a Complete EHR or 
EHR Module and based on the applicable certification criteria adopted 
by the Secretary at subpart C must be separate and distinct from any 
other certification(s) that are based on other criteria or 
requirements. To further clarify, HIT which constitutes a Complete EHR 
or EHR Module that is tested and certified to the certification 
criteria adopted by the Secretary as well as an ONC-ATCB's own 
certification criteria would need to have its certified status as a 
Complete EHR or EHR Module noted separately and distinctly from any 
other certification the ONC-ATCB may issue based on the successful 
demonstration of compliance with its own certification criteria. For 
example, an ONC-ATCB should indicate that the HIT has been certified as 
a ``Complete

[[Page 36164]]

EHR in accordance with the applicable certification criteria adopted by 
the Secretary of Health and Human Services'' and, if applicable, 
separately indicate that the HIT meets ``XYZ certification criteria as 
developed and/or required by [specify certification body].''
2. Types of Testing and Certification
    We proposed in section 170.410 that applicants for ONC-ATCB status 
may seek authorization from the National Coordinator to perform 
Complete EHR testing and certification and/or EHR Module testing and 
certification.
    We received multiple comments on the types of testing and 
certification that ONC-ATCBs can and should perform. Many of these 
comments were in response to our requests for public comments on 
whether ONC-ATCBs should test and certify the integration of EHR 
Modules and on whether applicants should be permitted to apply to 
either test and certify only Complete EHRs designed for an ambulatory 
setting or Complete EHRs designed for an inpatient setting.
a. Complete EHRs and EHR Modules
    We proposed that potential applicants have the option of seeking 
authorization from the National Coordinator to perform Complete EHR 
testing and certification and/or EHR Module testing and certification.
    Comments. We received comments expressing support for our proposal 
because of the flexibility it would provide to applicants and the 
industry. We also received a few comments expressing positions contrary 
to our proposal. One commenter recommended that we add more flexibility 
by allowing applicants, similar to our proposals for the proposed 
permanent certification program, to either do only testing or 
certification. Conversely, a few commenters recommended that we not 
give applicants the option to select, but instead require ONC-ATCBs to 
perform testing and certification for both Complete EHRs and EHR 
Modules. One commenter wanted us to ensure that there were at least two 
ONC-ATCBs for both Complete EHR and EHR Module testing and 
certification.
    Response. We have attempted to create a temporary certification 
program that allows for as many qualified applicants to apply and 
become authorized as possible in the limited time allotted under the 
temporary certification program. We do not agree with the commenters 
that recommended that we pattern the applicant requirements after the 
proposed permanent certification program or that we ensure that there 
will be at least two ONC-ATCBs for both Complete EHR and EHR Module 
testing and certification. As discussed in the Proposed Rule, the 
temporary certification program's processes and requirements are 
different than the permanent certification program because of the 
urgency with which the temporary certification program must be 
established. We are also unable to ensure that there will be any 
specific number of ONC-ATCBs. We believe it is best to let the 
marketplace dictate the amount of qualified applicants that will apply 
for ONC-ATCB status. We are, however, confident that there are 
sufficient incentives for applicants to apply and that the program is 
structured in a manner that will maximize the number of qualified 
applicants.
b. Complete EHRs for Ambulatory or Inpatient Settings
    We requested public comment in the Proposed Rule on whether the 
National Coordinator should permit applicants to seek authorization to 
test and certify only Complete EHRs designed for an ambulatory setting 
or, alternatively, Complete EHRs designed for an inpatient setting. 
Under our proposal, an applicant seeking authorization to perform 
Complete EHR testing and certification would be required to test and 
certify Complete EHRs designed for both ambulatory and inpatient 
settings.
    Comments. We received comments ranging from support for providing 
the option for applicants to test and certify Complete EHRs for either 
ambulatory or inpatient settings to support for our proposal to require 
an ONC-ATCB to perform testing and certification for both settings. 
Some commenters thought that our proposal could stifle competition and 
expressed concern that there may not be enough entities capable of 
performing Complete EHR testing and certification for both settings. 
These commenters stated that allowing for Complete EHR testing and 
certification for either an ambulatory or inpatient setting could add 
competition and expedite certifications. Conversely, a few commenters 
stated that providing the option would multiply the National 
Coordinator's application workload and slow the authorization of ONC-
ATCBs. One commenter also thought that the option may lead to 
applicants for ONC-ATCB status competing for limited resources, such as 
specialized staff for conducting testing and certification.
    Some commenters expressed concern that if the National Coordinator 
were to allow applicants to test and certify Complete EHRs for either 
ambulatory or inpatient settings, there would not be enough ONC-ATCBs 
to test and certify Complete EHRs for each setting. Therefore, these 
commenters' support for the option was conditioned on the National 
Coordinator ensuring that there were an adequate number of ONC-ATCBs 
for each setting. One commenter only supported giving ONC-ATCBs an 
option to test and certify Complete EHRs for either ambulatory or 
inpatient settings if the option included testing and certification of 
EHR Module level interactions necessary for the exchange of data 
between ambulatory and inpatient Complete EHRs.
    Some commenters stated that the option could lead to ``almost 
complete'' EHRs, which could then lead to eligible professionals and 
eligible hospitals paying large sums for niche EHR Modules based on 
complicated certification criteria such as biosurveillance or quality 
reporting. One commenter asserted that under our current proposal an 
applicant for ONC-ATCB status could seek authorization to test and 
certify EHR Modules that together would essentially constitute a 
Complete EHR for an ambulatory setting (or an inpatient setting). 
Therefore, the commenter contended that we should allow an applicant 
for ONC-ATCB status the option to seek authorization to test and 
certify Complete EHRs for either ambulatory or inpatient settings 
because an applicant for ONC-ATCB status could essentially choose that 
option by seeking all the necessary EHR Module authorizations for 
either ambulatory or inpatient settings.
    Response. We believe that based on the concerns expressed by the 
commenters that it would be inappropriate at this time to allow 
applicants for ONC-ATCB status to seek authorization for the testing 
and certification of Complete EHRs for either ambulatory settings or 
inpatient settings. We will, however, reconsider this option for the 
permanent certification program based on the comments received on the 
proposed permanent certification program.
    To address the commenters' concerns about ``almost complete'' EHRs, 
we want to reiterate that for EHR technology to be considered a 
Complete EHR it would have to meet all applicable certification 
criteria adopted by the Secretary. For example, a Complete EHR for an 
ambulatory setting would have to meet all certification criteria 
adopted at Sec.  170.302 and Sec.  170.304. Therefore, if we had 
provided the option for ONC-ATCBs to seek authorization to test and 
certify Complete EHRs for either ambulatory or inpatient settings, the 
Complete EHRs that ONC-ATCBs tested

[[Page 36165]]

and certified would have had to meet all the applicable certification 
criteria adopted by the Secretary.
    We agree with the one commenter that an applicant for ONC-ATCB 
status could seek authorization to test and certify EHR Modules that 
together would potentially cover all the applicable certification 
criteria for an ambulatory setting. In fact, in relation to the privacy 
and security testing and certification of EHR Modules, we state in this 
final rule that if EHR Modules are presented for testing and 
certification as an integrated bundle that would otherwise constitute a 
Complete EHR we would consider them a Complete EHR for the purposes of 
being certified by an ONC-ATCB. The important distinction between the 
commenter's suggested approach and the option we proposed is that under 
the commenter's approach the ONC-ATCB would not be able to issue a 
``Complete EHR certification'' for a combination of EHR Modules because 
the ONC-ATCB had not received authorization to test and certify 
Complete EHRs. Consequently, if a Complete EHR developer wanted to 
obtain Complete EHR certification, they could not seek such 
certification from an ONC-ATCB that did not have authorization to grant 
Complete EHR certifications. We would assume that a potential applicant 
for ONC-ATCB status would consider this impact on its customer base 
when determining what type of authorization to seek.
c. Integrated Testing and Certification of EHR Modules
    In the Proposed Rule, we requested public comment on whether ONC-
ATCBs should be required to test and certify that any EHR Module 
presented by one EHR Module developer for testing and certification 
would properly work (i.e., integrate or be compatible) with other EHR 
Modules presented by different EHR Module developers.
    Comments. Multiple commenters stated that testing and certifying 
EHR Modules to determine whether they can integrate with one another is 
a worthwhile endeavor. These commenters stated that such testing and 
certification would make it easier for eligible professionals and 
eligible hospitals to purchase certified EHR Modules that are 
compatible and could be used together to achieve meaningful use and 
could increase or improve interoperability among HIT in general. 
Conversely, many other commenters strongly disagreed with requiring EHR 
Modules to be tested and certified for compatibility. Overall, these 
commenters asserted that it would be technically infeasible as well as 
both logistically (e.g., multiple testing and certification sites and 
multiple EHR Module developers) and financially impractical to attempt 
to test and certify for integration given the huge and shifting numbers 
of possible combinations. Some commenters, however, suggested that EHR 
Modules could be tested and certified as integrated bundles. One 
commenter recommended that if we were to pursue any type of EHR Module-
to-EHR Module integration, it should be no earlier than when we adopt 
the next set of standards, implementation specifications, and 
certification criteria, and then it should only be done selectively 
based on meaningful use requirements. Another commenter suggested that 
ONC-ATCBs be given the option, but not be required, to determine if EHR 
Modules are compatible.
    Response. We believe that the testing and certification of EHR 
Modules for the purposes of integration is inappropriate for the 
temporary certification program due to various impracticalities. We 
believe that EHR Module-to-EHR Module integration is inappropriate 
primarily because of the impracticalities pointed out by commenters 
related to the numerous combinations of EHR Modules that will likely 
exist and the associated technical, logistical, and financial costs of 
determining EHR Module-to-EHR Module integration. To the extent that an 
EHR Module developer or developers present EHR Modules together as an 
integrated bundle for testing and certification, we would allow the 
testing and certification of the bundle only if it was capable of 
meeting all the applicable certification criteria and would otherwise 
constitute a Complete EHR. In all other circumstances, we would not 
require testing and certification for EHR Module-to-EHR Module 
integration as part of the temporary certification program. Nothing in 
this final rule precludes an ONC-ATCB or other entity from offering a 
service to test and certify EHR Module-to-EHR Module integration. 
However, to be clear, although we do not require or specifically 
preclude an ONC-ATCB from testing and certifying EHR Module-to-EHR 
Module integration, any EHR Module-to-EHR Module testing and 
certification done by an ONC-ATCB or other entity will be done so 
without specific authorization from the National Coordinator and will 
not be considered part of the temporary certification program. We 
understand that testing and certification for EHR Module-to-EHR Module 
integration may be advantageous in certain instances, but we do not 
believe, for the reasons discussed above, that we could set all the 
necessary parameters for testing EHR Module-to-EHR Module integration 
within the allotted timeframe of the temporary certification program.

E. Application Process

    As outlined in greater detail below, the proposed application 
process consisted of an applicant abiding by certain prerequisites 
before receiving an application, adhering to the application 
requirements and submitting the application by one of the proposed 
methods.
1. Application Prerequisite
    We proposed in section 170.415 that applicants would be required to 
request, in writing, an application for ONC-ATCB status from the 
National Coordinator. We further proposed that applicants must indicate 
the type of authorization sought pursuant to Sec.  170.410, and if 
seeking authorization to perform EHR Module testing and certification, 
the specific type(s) of EHR Module(s) they seek authorization to test 
and certify. Finally, we proposed that applicants would only be 
authorized to test and certify the types of EHR Modules for which the 
applicants sought and received authorization.
    Comments. A commenter expressed agreement with our proposal to 
limit an applicant's authorization to test and certify EHR Modules to 
the EHR Modules specified in the applicant's application. The commenter 
requested, however, that we establish a process for allowing ONC-ATCBs 
to apply for additional authorization to test and certify additional 
EHR Modules and to allow for the expansion of authorization over time. 
Another commenter asked that we clarify that ONC-ATCBs that choose to 
only test and certify EHR Modules be allowed to limit their testing and 
certification to one health care setting, such as testing and 
certifying a ``laboratory'' EHR Module solely for an ambulatory 
setting.
    Response. The only process that we intend to use to authorize ONC-
ATCBs under the temporary certification program is the application 
process that we have proposed. Therefore, if an ONC-ATCB authorized to 
test and certify a certain type(s) of EHR Module(s) wanted to seek 
additional authorization for the testing and certification of other 
types of EHR Modules, it would need to submit another application 
requesting that specific authorization. We would

[[Page 36166]]

anticipate in that situation, however, that the application process and 
review would proceed fairly quickly. In addition, we will consider 
whether an alternative method would be appropriate for such a situation 
under the proposed permanent certification program. Lastly, we note, in 
response to a commenter's question about whether an ONC-ATCB authorized 
to test and certify a certain type of EHR Module is required to test 
and certify for both ambulatory and inpatient settings, that the answer 
would depend on what type of EHR Module authorization the applicant for 
ONC-ATCB status sought. As previously noted, it is possible to seek 
authorization to test and certify EHR Modules that address only an 
ambulatory or inpatient setting. Accordingly, we are finalizing this 
provision without modification.
2. Application
    We proposed in section 170.420 that the application for ONC-ATCB 
status would consist of two parts. We further proposed that applicants 
would be required to complete both parts of the application and submit 
them to the National Coordinator for the application to be considered 
complete.
a. Part 1
    In Part 1 of the application, we proposed that an applicant provide 
general identifying information including the applicant's name, 
address, city, state, zip code, and Web site. We proposed that an 
applicant also designate an authorized representative and provide the 
name, title, phone number, and e-mail address of the person who would 
serve as the applicant's point of contact. We proposed that an 
applicant complete and submit self audits to all sections of Guide 65 
and ISO/IEC 17025:2005 (ISO 17025) as well as submit additional 
documentation related to Guide 65 and ISO 17025. We also proposed that 
an applicant had to agree to adhere to the Principles of Proper Conduct 
for ONC-ATCBs.
    Comments. We received several comments expressing agreement with 
the application requirements, including the use of Guide 65 and ISO 
17025. One commenter specifically stated that requiring applicants for 
ONC-ATCB status to demonstrate their conformance to both Guide 65 and 
ISO 17025 is an appropriate and effective means to demonstrate an 
applicant's competency and ability to test and certify Complete EHRs 
and/or EHR Modules and, therefore, an appropriate means for initiating 
our proposed testing and certification program. However, we also 
received multiple comments requesting that we provide more explanation 
about Guide 65 and ISO 17025. The commenters requested information 
about how Guide 65 and ISO 17025 are related to Complete EHRs and EHR 
Modules, why we selected Guide 65 and ISO 17025 as conformance 
requirements for the temporary certification program, and how Guide 65 
and ISO 17025 are related to one another, including explaining why ISO 
17025 is appropriate for the temporary certification program but not 
for the permanent certification program. Commenters also recommended 
that we consult with NIST to develop an ``information paper'' or other 
supplemental guidance document to assist the industry with 
understanding Guide 65 and ISO 17025 and how they will apply to the 
certification programs.
    One commenter stated that conformance to ISO 17025 was not a 
barrier to entry because there are at least two commercial laboratories 
currently accredited to ISO 17025 and performing testing in a similar 
government program (USGv6 Testing Program). Conversely, other 
commenters expressed concern that Guide 65 and ISO 17025 were possible 
barriers to entry. Some commenters thought that the documentation 
requirements would be too high an administrative burden for applicants, 
while others thought there was not enough time for applicants to 
demonstrate compliance with Guide 65 and ISO 17025 in time to apply 
for, and receive authorization, under the temporary certification 
program.
    The commenters offered various recommendations for addressing their 
stated concerns. One commenter suggested that we delay compliance with 
Guide 65 and ISO 17025 until the permanent certification program is 
implemented. A second option recommended by commenters was to not 
require strict compliance with Guide 65 and ISO 17025, but rather allow 
for material compliance. In support of this recommendation, one 
commenter contended that certain provisions of ISO 10725 (i.e., 
provisions on uncertainty of measurements, sampling, calibration 
methods, and environmental conditions that impact results) do not 
appropriately address HIT testing and therefore should not apply. A 
third option presented by commenters was for us to embrace a glide path 
that would allow qualified organizations to move towards compliance in 
a systematic way. A more specific recommendation illustrating this 
sentiment was to allow applicants for ONC-ATCB status to meet certain 
requirements on a timeline that would enable a new entrant to build and 
demonstrate their capabilities throughout the application process while 
still requiring full adherence to the application requirements before 
an applicant is granted ONC-ATCB status.
    Response. With respect to those comments that requested further 
explanation about Guide 65 and ISO 17025, we would note that the 
International Organization for Standardization (ISO) developed both 
standards. As explained in the Introduction of Guide 65, the observance 
of the Guide's specifies requirements is intended to ensure that 
certification bodies operate third-party certification systems in a 
consistent and reliable manner, which will facilitate their acceptance 
on a national and international basis. ISO 17025 is also an 
international standard intended to serve as a basis for accreditation, 
which accreditation bodies use when assessing the competence of testing 
and calibration laboratories. We note that both standards have been 
developed by a voluntary consensus standards body, as required by the 
National Technology Transfer and Advancement Act of 1995 and the Office 
of Management and Budget (OMB) Circular A-119, and we are aware of no 
alternative voluntary consensus standards that would serve the purpose 
for which these standards are intended to serve.
    Guide 65 will be utilized to determine if an applicant for ONC-ATCB 
status is capable of conducting an appropriate certification program 
for certifying Complete EHRs and/or EHR Modules. ISO 17025 will be 
utilized to determine if an applicant for ONC-ATCB status is capable of 
conducting an appropriate testing program for testing Complete EHRs 
and/or EHR Modules. We believe that Guide 65 and ISO 17025 are clear in 
the requirements they impose on a testing and certification body, and 
therefore, we do not see the need for an ``information'' paper or 
additional guidance at this time. We would, as appropriate, consider 
issuing guidance to further clarify any requirements of this final 
rule.
    We agree with the commenters that stated that our application 
requirements for the temporary certification program are appropriate 
and do not constitute a barrier to entry. As stated by commenters, 
requiring applicants for ONC-ATCB status to demonstrate their 
conformance to both Guide 65 and ISO 17025 is an appropriate and 
effective method for determining an applicant's competency and ability 
to test and certify Complete EHRs and/or EHR Modules and, therefore, an 
appropriate method for initiating our proposed

[[Page 36167]]

temporary certification program. By proposing these requirements, we 
have not only indicated that we believe them to be appropriate measures 
of applicants' competencies, but that they are also not overly 
burdensome and that applicants will have sufficient time to meet the 
requirements in time to apply under the temporary certification 
program. As we noted in the Proposed Rule, applicants under the 
permanent certification program may have to meet potentially more 
comprehensive requirements in order to meet the proposed accreditation 
requirement. In regard to the commenter's question about the 
application of ISO 17025 to the proposed permanent certification 
program, we have proposed that a separate accreditation process for 
testing laboratories would exist through the National Voluntary 
Laboratory Accreditation Program (NVLAP) and anticipate that process 
would include compliance with ISO 17025.
    By ensuring that an ONC-ATCB is capable of performing its 
responsibilities related to testing and certification we believe 
industry and consumer confidence will be established in the temporary 
certification program and in the Complete EHRs and EHR Modules tested 
and certified under the program. Based on these reasons and our stated 
belief that there is sufficient time for an applicant to apply for ONC-
ATCB status, we do not believe that any type of application or 
authorization process that would provide for any less than full 
achievement and compliance with the application requirements of the 
temporary certification program is appropriate, including allowing for 
material compliance or a glide path to full compliance. As to the one 
commenter's contention that certain provisions of ISO 17025 do not 
apply to the testing of HIT, it is incumbent upon an applicant for ONC-
ATCB status to demonstrate in its self audit to ISO 17025 and/or Guide 
65 why provisions or requirements do not apply to its request for 
authorization to test and certify Complete EHRs and/or EHR Modules.
    We are finalizing this provision without modification.
b. Part 2
    We proposed for Part 2 of the application that an applicant must 
submit a completed proficiency examination. We did not receive any 
comments on this provision. Therefore, we are finalizing this provision 
without modification.
3. Principles of Proper Conduct for ONC-ATCBs
    We received multiple comments on the proposed Principles of Proper 
Conduct for ONC-ATCBs. We did not, however, receive any comments on the 
Principles of Proper Conduct proposed in paragraphs (c), (d) and (f) of 
Sec.  170.423. Therefore, we are finalizing these Principles of Proper 
Conduct without modification. While we received comments on all the 
other proposed Principles of Proper Conduct for ONC-ATCBs and 
suggestions for additional principles of proper conduct, the majority 
of the comments were focused on compliance with Guide 65 and ISO 17025, 
the proposed use of NIST test tools and test procedures, the 
requirement that ONC-ATCBs provide ONC, no less frequently than weekly, 
a current list of Complete EHRs and EHR Modules that have been tested 
and certified, the proposed records retention requirement, and our 
proposed requirement that ONC-ATCBs issue refunds for tests and 
certifications that were not completed.
a. Operation in Accordance With Guide 65 and ISO 17025 Including 
Developing a Quality Management System
    We proposed in section 170.423(a) that an ONC-ATCB would be 
required to operate its certification program in accordance with Guide 
65 and its testing program in accordance with ISO 17025. We also 
proposed in Sec.  170.423(b) that an ONC-ATCB be required to maintain 
an effective quality management system which addresses all requirements 
of ISO 17025.
    The comments we received on Guide 65 and ISO 17025 were repetitive 
and essentially indistinguishable from the comments we received on 
Guide 65 and ISO 17025 in relation to our proposed application process. 
Therefore, we do not discuss them again in this section and we are 
finalizing this Principle of Proper Conduct for ONC-ATCBs without 
modification.
b. Use of NIST Test Tools and Test Procedures
    We proposed in section 170.423(e), that an ONC-ATCB would be 
required to ``[u]se testing tools and procedures published by NIST or 
functionally equivalent testing tools and procedures published by 
another entity for the purposes of assessing Complete EHRs and/or EHR 
Modules compliance with the certification criteria adopted by the 
Secretary.''
    We received a number of comments on this proposed Principle of 
Proper Conduct for ONC-ATCBs. We have divided the comments into two 
categories, which are: Establishment of test tools and test procedures; 
and public feedback process.
i. Establishment of Test Tools and Test Procedures
    Comments. While some commenters expressed agreement with the use of 
NIST test tools and test procedures, many commenters requested 
clarification on NIST's role and scope of authority. A commenter 
specifically asked whether NIST would be the author of both the test 
tools and test procedures for each and every certification criterion. 
Other commenters requested clarification of the phrase ``functionally 
equivalent testing tools and procedures published by another entity'' 
and specifically requested that we create a process for the timely 
establishment of functionally equivalent test tools and test 
procedures, with one commenter recommending that ``functionally 
equivalent'' be determined by ONC during the application process. 
Commenters noted that NIST has published draft versions of test 
procedures that will likely change once the final rules for both the 
HIT Standards and Certification Criteria interim final rule and the CMS 
Medicare and Medicaid EHR Incentive Programs proposed rule are issued. 
One commenter concluded that ``functionally equivalent'' would not be 
able to be determined until the final NIST test procedures are issued. 
To address this issue, the commenter recommended that we adopt CCHIT 
``IFR Stage 1 Certification'' procedures (with appropriate 
modifications once a final rule is published) for testing at the start 
of the temporary certification program and that ONC-ATCBs use NIST test 
procedures once they became available at which point the NIST test 
procedures could serve as an option for the temporary certification 
program, and subsequently be deemed the only acceptable set of test 
procedures for the proposed permanent certification program. Another 
commenter expressed a lack of confidence in functionally equivalent 
test tools and test procedures and requested that we confirm that 
Complete EHR and EHR Module developers would have no liability 
regarding the functional equivalence of an ONC-ATCB's test tools and 
test procedures. The commenter stated that if this assurance could not 
be provided then only NIST test tools and test procedures should be 
utilized. Commenters also asked for clarification on the extent to 
which ONC-ATCBs are permitted to modify test procedures/test

[[Page 36168]]

scripts and how test procedures/test scripts could be corrected, if 
necessary. Some commenters expressed a preference for consistency of 
test data and test criteria across all testing organizations and were 
concerned about allowing ONC-ATCBs to define their own test scripts or 
test procedures. The commenters reasoned that some ONC-ATCBs may have 
``easier'' tests than others, and therefore, the credibility of the 
process will be uneven and questionable. Finally, a commenter also 
asked who would develop implementation guidance for standards adopted 
in the HIT Standards and Certification Criteria interim final rule and 
how this guidance would be linked to the test methods in a way that 
would accurately reflect a common interpretation of a standard.
    Response. First and foremost, we reiterate that the National 
Coordinator is responsible for administering the temporary 
certification program. Consistent with the HITECH Act, we are in 
consultation with NIST to learn from its resident experts and have 
requested NIST's assistance in the development of test tools and test 
procedures that all ONC-ATCBs could use to properly and consistently 
test and certify Complete EHRs and EHR Modules in accordance with the 
standards, implementation specifications, and certification criteria 
adopted by the Secretary. We expect that NIST will develop a test tool 
and test procedure for each and every certification criterion.
    We have reviewed the commenters' concerns and requests for 
clarification. After further consideration, we have decided to modify 
this Principle of Proper Conduct for ONC-ATCBs to more thoroughly 
clarify our intent. We have revised the Principle of Proper Conduct for 
ONC-ATCBs to remove the concept of ``functionally equivalent'' and to 
clearly state that the National Coordinator would play the central role 
in determining which test tools and test procedures will be approved 
for ONC-ATCBs to use. The revised Principle of Proper Conduct requires 
ONC-ATCBs to ``[u]se test tools and test procedures approved by the 
National Coordinator for the purposes of assessing Complete EHRs' and/
or EHR Modules' compliance with the certification criteria adopted by 
the Secretary.''
    We believe that this revision provides the National Coordinator 
with greater flexibility and discretion to ensure that Complete EHRs 
and EHR Modules are being tested and certified by ONC-ATCBs according 
to the best test tools and test procedures available. In that regard, 
we believe that NIST test tools and test procedures will likely be a 
primary source for ONC-ATCBs to use as they develop their test scripts. 
We understand that NIST may establish test tools and test procedures 
based on multiple sources, such as NIST-developed tools, industry-
developed tools, or open source tools, as appropriate. NIST has been 
exploring and will likely utilize all three of these options. That 
being said, this revised Principle of Proper Conduct for ONC-ATCBs will 
provide the National Coordinator with the ability to approve not only 
NIST test tools and test procedures, but potentially other test tools 
and test procedures that are identified or developed by other 
organizations. We understand that commenters would prefer to have the 
National Coordinator serve as the locus of control with respect to 
which test tools and test procedures ONC-ATCBs are permitted to use. We 
also inferred from the comments that such an approach would provide 
greater certainty to Complete EHR and EHR Module developers as to which 
test tools and test procedures may be used by ONC-ATCBs, as well as 
greater consistency among ONC-ATCBs' testing and certification 
processes.
    A person or entity may submit a test tool and/or test procedure to 
the National Coordinator to be considered for approval to be used by 
ONC-ATCBs. The submission should identify the developer of the test 
tool and/or test procedure, specify the certification criterion or 
criteria that is/are addressed by the test tool and/or test procedure, 
and explain how the test tool and/or test procedure would evaluate a 
Complete EHR's or EHR Module's compliance with the applicable 
certification criterion or criteria. The submission should also provide 
information describing the process used to develop the test tool and/or 
test procedure, including any opportunity for the public to comment on 
the test tool and/or test procedure and the degree to which public 
comments were considered. In determining whether to approve a test tool 
and/or test procedure, the National Coordinator will consider whether 
it is clearly traceable to a certification criterion or criteria 
adopted by the Secretary, whether it is sufficiently comprehensive 
(assesses all required capabilities) for ONC-ATCBs to use in testing 
and certifying a Complete EHR's or EHR Module's compliance with the 
certification criterion or criteria adopted by the Secretary, whether 
an appropriate public comment process was used during the development 
of the test tool and/or test procedure, and any other relevant factors. 
When the National Coordinator has approved test tools and/or test 
procedures, we will publish a notice of availability in the Federal 
Register and identify the approved test tools and test procedures on 
the ONC Web site.
    Once test tools and test procedures have been approved by the 
National Coordinator, ONC-ATCBs will have the responsibility and 
flexibility to configure their own test scripts (i.e., specific 
scenarios using the test tools and test procedures), to create, for 
example, a testing sequence that an ONC-ATCB believes is the most 
efficient way for testing a certain suite of capabilities. Given the 
level and type of adjustments that we expect ONC-ATCBs to make, we do 
not believe that it will be possible for ONC-ATCBs to include 
significant variations in their test scripts such that a Complete EHR 
or EHR Module will pass a test administered by one ONC-ATCB but fail a 
test administered by a different ONC-ATCB. As to the commenter's 
inquiry about how ``implementation guidance'' will link to test tools 
and test procedures, we believe that, where implementation 
specifications have been adopted in the HIT Standards and Certification 
Criteria interim final rule, they will be considered in the development 
of test tools and test procedures.
    Comments. A commenter recommended, based on the increased focus on 
the safety of EHRs, that the NIST testing framework be developed using 
auditable quality guidelines, including documentation on the purpose, 
installation, configuration, use and traceability of the NIST testing 
framework. Some commenters provided recommendations on the processes 
for the development of test tools and test procedures. A commenter 
suggested that NIST look to adopt existing test tools and test 
procedures currently operational and developed via industry consensus, 
while other commenters specifically recommended that we utilize HL7 
EHR-S FM and its profiles and the Committee on Operating Rules for 
Information Exchange[reg] (CORE) testing processes. Other 
commenters contended that the scope of the test procedures currently 
developed by NIST is too narrow and does not take into account clinical 
realities when systems are implemented in a clinical setting. Another 
commenter recommended that the test tools and test procedures support 
end-user needs.
    Response. The NIST test tools and test procedures include 
components to help ensure traceability of a specific certification 
criterion. The test tools and test procedures also have

[[Page 36169]]

documentation for installation, configuration and use. As noted above, 
the National Coordinator may approve test tools and test procedures for 
the temporary certification program based on multiple sources, as 
appropriate. We would further note that while we recognize the utility 
of other sources, such as HL7 EHR-S FM or CORE testing processes, the 
temporary certification program's primary focus is to test and certify 
Complete EHRs and EHR Modules to the certification criteria adopted by 
the Secretary. The scope of the test tools and test procedures is 
defined by the applicable certification criterion or criteria. 
Therefore, the test tools and test procedures are not currently focused 
on addressing matters outside the scope of adopted certification 
criteria such as usability or ``end-user needs.''
ii. Public Feedback Process
    Comments. Commenters expressed concern that there was a lack of a 
specified process for stakeholders, particularly Complete EHR and EHR 
Module developers, to participate in the development, review and 
validation of test procedures. Multiple commenters asked for a formal 
role for Complete EHR and EHR Module developers as well as eligible 
professionals and eligible hospitals to give feedback to NIST. A 
commenter noted that the Proposed Rule stated that the test tools and 
test procedures would be published by NIST on its Web site or through a 
notice in the Federal Register, but that the Proposed Rule did not 
clearly delineate the processes, how the processes will be managed, and 
a timeline. Another commenter stated that when ``test scripts'' involve 
or relate to the implementation of an adopted standard, NIST should be 
required to consult with the standards development organization (SDO) 
publisher of the standard for review of proposed ``test scripts,'' and 
should be required to consider comments made by the SDO prior to 
publication of final ``test scripts.'' A final comment expressed 
concern that the test tools and test procedures being developed by NIST 
are not following the government protocol for openness and transparency 
by allowing for an open, public comment period on the test tools and 
test procedures before adoption.
    Response. We noted in the Proposed Rule that the test tools and 
test procedures would be published in some manner and suggested, as 
examples, that publication on NIST's Web site or by notice in the 
Federal Register would be acceptable methods. As noted above, NIST has 
published drafts of the test tools and test procedures on its Web site 
and has been accepting and reviewing public comments since releasing 
the drafts. Specifically, NIST began publishing test tools and test 
procedures on its Web site on February 23, 2010. The test tools and 
test procedures have been published in four ``waves'' or groups of test 
tools and test procedures. At the time this final rule was prepared, 
NIST had received over 100 public comments on its drafts. In response, 
NIST has issued revised drafts of the test tools and test procedures 
and is developing ``frequently asked questions and answers'' that it 
plans to post on its Web site to address common comments on the draft 
test tools and test procedures. NIST intends to continue to seek and 
consider public feedback until the test tools and test procedures are 
finalized, which will likely occur in conjunction with the publication 
of the final rules for both the HIT Standards and Certification 
Criteria interim final rule and the Medicare and Medicaid EHR Incentive 
Programs proposed rule.
    It is not within the scope of this rulemaking to instruct NIST to 
consult with other entities. However, we note that all stakeholders, 
including Complete EHR and EHR Module developers and SDO publishers, 
may participate in the public comment process described above. 
Furthermore, we believe that the feedback process currently employed by 
NIST is an appropriate and acceptable method for soliciting, accepting 
and meaningfully considering public comments on the test tools and test 
procedures.
c. ONC Visits to ONC-ATCB Sites
    We proposed in section 170.423(g) to require an ONC-ATCB to allow 
ONC, or its authorized agent(s), to periodically observe on site 
(unannounced or scheduled), during normal business hours, any testing 
and/or certification performed to demonstrate compliance with the 
requirements of the temporary certification program.
    Comments. A commenter stated that if visits are unannounced, then 
there can be no assurance that a test or certification will actually be 
underway upon arrival of an ONC representative. Therefore, the 
commenter recommended that we should revise the requirement to require 
that an ONC-ATCB respond within 2 business days to an ONC request to 
observe testing and/or certification by providing the date, time, and 
location of the next scheduled test or certification. The commenter 
further stated that ONC observers for site visits would likely need to 
execute confidentiality and/or business associate agreements because 
some HIT vendors treat their software screens and other elements as 
trade secrets. Additionally, the commenter stated that during site 
testing of hospital-developed EHRs, protected health information may 
inadvertently appear on screen in reports or audit trails. The 
commenter contended that if ONC or its authorized agent(s) were unable 
to execute such confidentiality and/or business associate agreements, 
then ONC observation may have to be limited to those elements of 
testing that do not risk revealing vendor trade secrets or protected 
health information; or ONC might have observation of testing limited to 
Complete EHR or EHR Module developers who waive their confidentiality 
requirements for ONC observers.
    Response. Our original proposal gave us the option to either 
conduct scheduled or unannounced visits. After considering the 
comments, we believe it is appropriate to maintain both options. If we 
determine that there is a specific testing and/or certification that 
would be appropriate for us or our authorized agent(s) to observe, we 
may find it is more prudent to schedule a visit. However, to monitor 
compliance with the provisions of the temporary certification program 
and to maintain the integrity of the program, we believe that 
unannounced visits are appropriate. In addition, we expect that any 
confidentiality agreement executed between an ONC-ATCB and a customer, 
such as Complete EHR and EHR Module developers, for the purposes of 
testing and certification under the temporary certification program 
would include ONC and its authorized representatives as parties who may 
observe the testing and certification of the customer's Complete EHR or 
EHR Module. We would also expect that the confidentiality agreement 
would cover any proprietary information, trade secrets, or protected 
health information. Therefore, we are finalizing this Principle of 
Proper Conduct without modification.
d. Lists of Tested and Certified Complete EHRs and EHR Modules
i. ONC-ATCB Lists
    We proposed in section 170.423(h) to require an ONC-ATCB to provide 
ONC, no less frequently than weekly, a current list of Complete EHRs 
and/or EHR Modules that have been tested and certified which includes, 
at a minimum, the vendor name (if applicable), the date certified, 
product version, the unique certification number or other specific 
product identification, and where applicable, the certification 
criterion or

[[Page 36170]]

certification criteria to which each EHR Module has been tested and 
certified.
    Comments. Many provider organizations expressed appreciation for 
the proposed requirement and the proposed frequency for which the lists 
were to be updated. In relation to what ONC-ATCBs report, a commenter 
specifically expressed support for making timely, complete, and useful 
information available to eligible professionals and eligible hospitals 
as they work to purchase and implement Certified EHR Technology that 
will enable them to demonstrate meaningful use.
    Some commenters requested clarification and made recommendations 
for revisions to the provision. One commenter suggested that the 
provision should be revised to require an ONC-ATCB to notify ONC within 
a week of successful testing and certification of new Complete EHRs 
and/or EHR Modules. Additionally, the commenter contended that the 
proposed provision was unclear as to whether an ONC-ATCB was required 
to send a complete, current list or only new additions and whether the 
list could be sent via e-mail. Another commenter suggested revising the 
provision to require an ONC-ATCB to also report a current list of 
``applicants'' and their status in the testing or certification queue.
    Response. We will, as proposed, require that ONC-ATCBs provide the 
National Coordinator with a current list of Complete EHRs and/or EHR 
Modules that have been tested and certified no less frequently than 
weekly. We anticipate only requiring weekly updates, but ONC-ATCBs are 
free to provide more frequent updates. We believe that weekly updates 
are sufficient for providing current information to the market on the 
status of Complete EHRs and EHR Modules without placing an 
administrative burden on ONC-ATCBs. In this regard, we have previously 
stated and continue to expect that the information would be provided 
electronically, such as through e-mail. We also agree with the 
commenter that it would be unnecessary for an ONC-ATCB to continue to 
report on previously certified Complete EHRs and/or EHR Modules and, 
therefore, only expect these weekly reports to include new 
certifications issued between the last weekly report and the newly 
submitted weekly report. Additionally, we do not believe that any 
substantial benefit would come from having an ONC-ATCB report on the 
status of Complete EHRs and/or EHR Modules currently being tested and 
certified. The time needed for testing and certification of Complete 
EHRs and EHR Modules will likely vary based on many factors and, in 
some cases, may not be completed due to various reasons. Therefore, we 
do not believe that the reporting of products in an ONC-ATCB's queue 
should be a requirement at this time.
    We agree with the commenter who indicated that useful information 
should be made available to eligible professionals and eligible 
hospitals as they decide which Certified EHR Technology to adopt. 
Moreover, we note that much of the information reported by ONC-ATCBs 
will be included in the Certified HIT Products List (CHPL) that will be 
available on ONC's Web site. After consideration of public comments and 
our own programmatic objectives, we accordingly believe that two 
additional elements should be reported by ONC-ATCBs in order to improve 
transparency and assist eligible professionals and eligible hospitals 
who seek to adopt certified Complete EHRs and EHR Modules. The two 
additional elements we will require ONC-ATCBs to report are the 
clinical quality measures to which a Complete EHR or EHR Module has 
been tested and certified and, where applicable, any additional 
software a Complete EHR or EHR Module relied upon to demonstrate its 
compliance with a certification criterion or criteria adopted by the 
Secretary. As with the other information that ONC-ATCBs must report, 
these two additional elements, as suggested by the commenter, will 
enable eligible professionals and eligible hospitals to make informed 
purchasing decisions.
    The reporting of clinical quality measures to which a Complete EHR 
or EHR Module has been tested and certified will enable an eligible 
professional or eligible hospital to identify and adopt a Complete EHR 
or EHR Module that includes the clinical quality measures they seek to 
implement. Knowledge of the additional software a Complete EHR or EHR 
Module has relied upon to demonstrate compliance with a certification 
criterion or criteria will be useful, and in some cases essential, for 
eligible professionals and eligible hospitals who are deciding which 
Complete EHR or EHR Module to adopt. With this information, eligible 
professionals and eligible hospitals would be able to assess whether a 
specific certified Complete EHR or EHR Module may be incompatible with 
their current information technology (IT) or would require them to 
install additional IT. We stress that this reporting requirement only 
relates to software that is relied upon by a Complete EHR or EHR Module 
to demonstrate compliance with a certification criterion or criteria 
adopted by the Secretary. We do not intend or expect this requirement 
to be construed as a comprehensive specifications list or similar type 
of inclusive list. Rather, our rationale for including this requirement 
is to ensure that eligible professionals and eligible hospitals who 
adopt a certified Complete EHR or EHR Module understand what is 
necessary for the Complete EHR or EHR Module to operate in compliance 
with the certification criterion or criteria to which it was tested and 
certified.
    For example, if a Complete EHR relied upon an operating system's 
automatic log-off functionality to demonstrate its compliance with this 
certification criterion, we would expect the operating system relied 
upon to be reported. Conversely, if a Complete EHR included its own 
automatic log-off capability, even though the Complete EHR may have 
been tested and certified on a particular operating system, we would 
not require the operating system to be reported because it was not 
relied upon to demonstrate compliance with the certification criterion.
    Finally, we note that our required reporting elements constitute a 
minimum. We do not preclude ONC-ATCBs from including in their weekly 
reports additional information that prospective purchasers and users of 
Complete EHRs and EHR Modules would find useful, such as specifying the 
Complete EHR or EHR Module's compatibility with other software or 
compatibility with other EHR Modules. If not reported to the National 
Coordinator, we encourage ONC-ATCBs to consider making such information 
available on their own Web sites to better inform prospective 
purchasers and users of Complete EHRs and EHR Modules.
    We are revising Sec.  170.423(h) consistent with our discussion 
above.
ii. Certified HIT Products List
    We stated in the Proposed Rule that in an effort to make it easier 
for eligible professionals and eligible hospitals to cross-validate 
that they have in fact adopted Certified EHR Technology, the National 
Coordinator intends to make a master CHPL of all Complete EHRs and EHR 
Modules tested and certified by ONC-ATCBs available on the ONC Web 
site. The CHPL would be a public service and would be a single, 
aggregate source of all the certified product information ONC-ATCBs 
provide to the National Coordinator. The CHPL would also represent all 
of the Complete EHRs and EHR Modules that could be used to meet the 
definition of Certified EHR

[[Page 36171]]

Technology. We also noted that, over time, we anticipate adding 
features to the Web site, which could include interactive functions to 
enable eligible professionals and eligible hospitals to determine 
whether a combination of certified EHR Modules could constitute 
Certified EHR Technology.
    Comments. Many commenters expressed support for our decision to 
create a list of certified Complete EHRs and EHR Modules and to post a 
link to that list on our Web site. Many commenters also provided 
recommendations for how to enhance the list. One commenter endorsed an 
online system whereby physicians could type in or select information on 
the Complete EHR or EHR Module they planned on using to determine 
whether their selected combination would enable them to meet the CMS 
Medicare and Medicaid EHR Incentive Programs requirements. The 
commenter reasoned that the steps were necessary because eligible 
professionals, especially in smaller practices, did not have the 
technical expertise or support to ascertain whether or not a Complete 
EHR, EHR upgrades, EHR Module(s), or a combination of EHR Modules would 
enable them to perform the meaningful use requirements. Another 
commenter requested an explicit commitment from ONC that the use of 
certified Complete EHRs and/or EHR Modules on the CHPL will support 
their ability to report all required meaningful use measures.
    Some commenters expressed a preference that the CHPL contain 
information on the capabilities of certified Complete EHRs and EHR 
Modules associated with adopted certification criteria. Other 
commenters requested that the CHPL contain information on whether 
certified Complete EHRs or EHR Modules are compatible with other HIT. 
In particular, commenters stated that it was important to eligible 
professionals and eligible hospitals for Complete EHR and EHR Module 
developers to fully disclose the functions for which their products are 
certified, which software components are necessary to meet 
certification criteria, and to also fully disclose any compatibility 
issues. A few commenters also suggested that the CHPL contain data on 
usability features of certified Complete EHRs and EHR Modules.
    One commenter recommended that ONC and each ONC-ATCB maintain a 
list of certified Complete EHRs and EHR Modules. Another commenter 
recommended that, in order to prevent the conveyance of potentially 
inaccurate information and confusion in the market, an ONC-ATCB should 
not maintain on its own Web site a current list of the Complete EHRs 
and/or EHR Modules that it has certified, but instead reference the 
CHPL on ONC's Web site for the complete list of certified Complete EHRs 
and EHR Modules.
    Response. We appreciate the commenters' support for the CHPL and 
their recommendations for its enhancement. We intend for the CHPL to be 
a single, aggregate source of all certified Complete EHRs and EHR 
Modules reported by ONC-ATCBs to the National Coordinator. The CHPL 
will comprise all of the certified Complete EHRs and EHR Modules that 
could be used to meet the definition of Certified EHR Technology. It 
will also include the other pertinent information we require ONC-ATCBs 
to report to the National Coordinator, such as a certified Complete 
EHR's version number. Eligible professionals and eligible hospitals 
that elect to use a combination of certified EHR Modules may also use 
the CHPL Web page to validate whether the EHR Modules they have 
selected satisfy all of the applicable certification criteria that are 
necessary to meet the definition of Certified EHR Technology. The CHPL 
Web page will include a unique identifier (such as a code or number) 
for each certified Complete EHR and each combination of certified EHR 
Modules that satisfies all of the applicable certification criteria 
necessary to meet the definition of Certified EHR Technology. The 
unique code or number listed on the CHPL Web page could subsequently be 
used to submit to CMS for attestation purposes.
    We believe that only ONC should maintain the CHPL to ensure that 
the CHPL is accurate and comprehensive. However, we do not believe that 
it is appropriate to preclude an ONC-ATCB from maintaining on its own 
Web site a list of Complete EHRs and/or EHR Modules that it tests and 
certifies. An ONC-ATCB's own list could have benefits for the market in 
identifying the specific ONC-ATCB that tested and certified a Complete 
EHR or EHR Module. The ONC-ATCB may also create a link on its Web site 
to the CHPL, which conceivably would be a user-friendly feature.
e. Records Retention
    We proposed in section 170.423(i) to require an ONC-ATCB to retain 
all records related to the testing and certification of Complete EHRs 
and/or EHR Modules for the duration of the temporary certification 
program and to provide copies of all testing and certification records 
to ONC at the sunset of the temporary certification program.
    Comments. A commenter asserted that requesting ``all'' testing and 
certification records will lead to ONC receiving a voluminous amount of 
records that we likely never intended to receive. The commenter 
recommended that we be more specific about the records ONC-ATCBs will 
need to provide copies of to ONC.
    Many commenters noted that CMS has proposed in its Medicare and 
Medicaid EHR Incentive Programs proposed rule to require providers to 
maintain records demonstrating meaningful use, which includes the use 
of Certified EHR Technology, for 10 years. The commenters noted that in 
the event of an audit, eligible professionals and eligible hospitals 
may need to go back to the certification body or ONC, in the case of 
the temporary certification program, to verify that a particular 
product was indeed certified at a particular point in time. Therefore, 
the commenters recommended that our proposed retention period for 
certification bodies needs to be equal to the length of time that 
eligible professionals and eligible hospitals must maintain records 
under CMS's proposal, plus two or more additional years to ensure that 
records are available during an audit process. A commenter also 
requested that ONC specify how long it would retain copies of records 
provided by ONC-ATCBs at the sunset of the temporary certification 
program.
    Response. To address the commenter's concern about voluminous 
records being provided to ONC and to provide clarity to ONC-ATCBs about 
their records retention responsibility, we are clarifying the language 
of this Principle of Proper Conduct. For the duration of the temporary 
certification program, an ONC-ATCB will be required to retain all 
records related to tests and certifications in accordance with Guide 65 
and ISO 17025. Upon the conclusion of testing and certification 
activities under the temporary certification program, ONC-ATCBs will be 
required to provide copies of the final results of all completed tests 
and certifications to ONC (i.e., all passed and failed results). ONC 
will retain all records received from ONC-ATCBs in accordance with 
applicable federal law and may use the records for assessing compliance 
with temporary certification program requirements. Our records 
retention requirement should be construed as an independent 
requirement. Any other records retention requirements or potential 
legal compliance requirements should be complied with fully and not in 
association or correlation with our records retention requirements.

[[Page 36172]]

    We are revising Sec.  170.423(i) consistent with our discussion 
above.
f. Refunds
    We proposed in section 170.423(j) to require an ONC-ATCB to 
promptly refund any and all fees received for tests and certifications 
that will not be completed.
    Comments. While a vendor organization expressed agreement with our 
proposed refund requirement, potential applicants for ONC-ATCB status 
requested that we clarify that refunds would only be required where an 
ONC-ATCB's conduct caused the testing and certification to be 
incomplete as opposed to a Complete EHR or EHR Module developer's 
conduct or a Complete EHR's or EHR Module's failure to achieve a 
certification. One commenter asked whether this clause was meant to 
apply only when an ONC-ATCB had its status revoked. Another commenter 
suggested that our proposed requirement for ONC-ATCBs to return funds 
should also apply to situations where Complete EHR or EHR Module 
developers are required to recertify their products because of 
misconduct by an ONC-ATCB.
    Response. We agree with the commenters that suggested our proposed 
refund requirement needs clarification. As advocated by the commenters, 
it was our intention to require ONC-ATCBs to issue refunds only in 
situations where an ONC-ATCB's conduct caused testing and certification 
to not be completed. We also agree with the one commenter that this 
would include situations where a Complete EHR or EHR Module is required 
to be recertified because of the conduct of an ONC-ATCB. Similarly, if 
an ONC-ATCB were to be suspended by the National Coordinator under the 
suspension provisions we have incorporated in this final rule, an ONC-
ATCB would be required to refund all fees paid for testing and 
certification if a Complete EHR or EHR Module developer withdraws a 
request for testing and certification while the ONC-ATCB is under 
suspension.
    We are revising Sec.  170.423(j) consistent with our discussion 
above.
g. Suggested New Principles of Proper Conduct
    We received a few comments that suggested we adopt additional 
principles of proper conduct. These comments concerned the impartiality 
and business practices of ONC-ATCBs.
    Comments. A commenter recommended that applicants for ONC-ATCB 
status should be required to not have an interest, stake and/or 
conflict of interest in more than one entity receiving ONC-ATCB status 
nor have any conflict of interest with EHR product companies actively 
promoting EHR products in the marketplace.
    Response. Applicants for ONC-ATCB status and ONC-ATCBs must adhere 
to the requirements of Guide 65 and ISO 17025. These requirements 
explicitly obligate testing and certification bodies to conduct 
business in an impartial manner. For instance, an applicant for ONC-
ATCB status and/or an ONC-ATCB must have policies and procedures to 
avoid involvement in any activities that would diminish confidence in 
its competence, impartiality, judgment or operational integrity and 
must ensure that activities of related bodies do not affect the 
confidentiality, objectivity and impartiality of its certifications. We 
believe these provisions as well as other impartiality provisions 
contained in Guide 65 and ISO 17025 adequately address any potential 
conflicts of interest or other situations that might jeopardize the 
integrity of the temporary certification program.
    Comments. We received a few comments recommending that ONC-ATCBs' 
business practices be considered and evaluated. In particular, one 
commenter recommended that we adopt a principle of proper conduct that 
requires an ONC-ATCB to establish, publish and adhere to a non-
discriminatory protocol to ensure that requests for testing and 
certification are processed in a timely manner beginning on the date 
the ONC-ATCB sets for accepting requests for testing and certification. 
The commenter asserted that no one should be allowed to make a request 
prior to the date set by the ONC-ATCB and requests should be processed 
in the order in which they are received without regard to whether they 
are for Complete EHRs or EHR Modules. The commenter further asserted 
that in the event of simultaneously submitted requests, the National 
Coordinator should conduct a randomized, fair and transparent method 
for selecting the order in which the requests will be reviewed. 
Conversely, another commenter suggested that requests for testing and 
certification of Complete EHRs and/or EHR Modules that cover the 
largest market share should be processed first. One commenter 
recommended that all requests for testing and certification be required 
to be processed within six months of receipt by an ONC-ATCB.
    Response. We have established the Principles of Proper Conduct for 
ONC-ATCBs. ONC-ATCBs must abide by these Principles of Proper Conduct 
to remain in good standing. As noted in the previous response, a 
Principle of Proper Conduct for ONC-ATCBs requires ONC-ATCBs to adhere 
to the provisions of Guide 65 and ISO 17025, which require an ONC-ATCB 
to have policies and procedures to avoid involvement in any activities 
that would diminish confidence in its competence, impartiality, 
judgment or operational integrity as well as have a documented 
structure that safeguards impartiality including provisions that ensure 
the impartiality of its operations. The National Coordinator will 
review the policies, procedures, and documented structure of applicants 
for ONC-ATCB status during the application process to ensure that a 
potential ONC-ATCB meets the impartiality requirements. An ONC-ATCB 
would also have to maintain impartiality in its operations to remain in 
good standing under the temporary certification program.
    We believe that the requirements of Guide 65 and ISO 17025 clearly 
require ONC-ATCBs to develop an impartial process for handling requests 
for the testing and certification of Complete EHRs and EHR Modules. 
Guide 65 specifically states that ``access shall not be conditional 
upon the size of the [Complete EHR or EHR Module developer] or 
membership [in] any association or group, nor shall certification be 
conditional upon the number of certificates already issued.'' As for 
the one commenter's recommendation that we require requests for testing 
and certification to be completed within six months, we will not adopt 
such a requirement. Due to factors such as the uncertainty of how many 
ONC-ATCBs will exist and how many requests for the testing and 
certification of Complete EHRs and EHR Modules will be received by each 
ONC-ATCB, we do not believe such a requirement would be equitable or 
enforceable.
4. Application Submission
    We proposed in section 170.425 to allow an applicant for ONC-ATCB 
status to submit its application either electronically via e-mail (or 
web submission if available), or by regular or express mail at any time 
during the existence of the temporary certification program. We did not 
receive any comments on this provision. Therefore, we are finalizing 
this provision without modification.
5. Overall Application Process
    We received a few comments regarding the overall application 
process.

[[Page 36173]]

    Comment. One commenter suggested that applicants for ONC-ATCB 
status preferably be not-for-profit companies, while another commenter 
suggested that the number of applicants be limited to five.
    Response. We believe it is appropriate to allow all qualified 
applicants to apply and obtain ONC-ATCB status. We believe that the 
more applicants that can obtain ONC-ATCBs status the more the market 
will benefit in terms of increased competition and more options for the 
testing and certification of Complete EHRs and EHR Modules. 
Restrictions on the number of applicants that can apply or requiring an 
applicant for ONC-ATCB status to be a not-for-profit entity will only 
limit these potential benefits.
    Comment. A commenter recommended as part of the ONC-ATCB 
application process that an applicant indicate the testing site methods 
it is capable of supporting. The commenter reasoned that this would 
provide another basis for vendors to select an ONC-ATCB.
    Response. An ONC-ATCB is required to provide the types of testing 
and certification methods that we have specified in Sec.  170.457. We 
believe that an applicant will make such methods and any additional 
methods it offers known to the market as a means of attracting 
customers.
    Comment. A commenter recommended that the temporary certification 
program serve as a ``test bed'' for the accreditation process so that 
the permanent certification program may limit the frequency with which 
applicants can reapply for ONC-ACB status.
    Response. As discussed in the Proposed Rule, we are unable to 
establish an accreditation process for the temporary certification 
program due to the need to establish a certification program as soon as 
possible. Although we do not have sufficient time to establish an 
accreditation program, we believe that we have established sufficiently 
stringent requirements for ONC-ATCB applicants and ONC-ATCBs that, if 
an ONC-ATCB chose to apply for accreditation under the proposed 
permanent certification program, it would be well situated to 
successfully navigate the process.

F. Application Review, Application Reconsideration and ONC-ATCB Status

    We proposed in the Proposed Rule to review an application for ONC-
ATCB status and, in most circumstances, issue a decision within 30 
days. We proposed that if an application was rejected and certain 
criteria were met, an applicant could seek reconsideration of the 
denial. We proposed that if an application were deemed satisfactory, we 
would make it publicly known that the applicant had achieved ONC-ATCB 
status and the ONC-ATCB would be able to begin testing and certifying 
consistent with the authorization granted by the National Coordinator. 
In association with these proposals, we specifically requested that the 
public comment on whether we should review an entire application at 
once or as proposed, in parts; and whether we should reconsider a twice 
deficient application for any reason besides a clear factual error.
1. Review of Application
    We proposed in section 170.430 that we would review applications in 
the order in which we received them, that the National Coordinator 
would review Part 1 of the application and determine whether Part 1 of 
the application was complete and satisfactory before proceeding to 
review Part 2 of the application, and that the National Coordinator 
would issue a decision within 30 days of receipt of an application 
submitted for the first time.
    We proposed that the National Coordinator would be able to request 
clarification of statements and the correction of inadvertent errors or 
minor omissions. We proposed that the National Coordinator would 
identify any deficiencies in an application part and provide an 
applicant with an opportunity to both correct any deficiencies and 
submit a revised application in response to a deficiency notice on each 
part of the application. We further proposed that if the National 
Coordinator determined that a revised application still contained 
deficiencies, the applicant would be issued a denial notice related to 
that part of the application. We proposed that the denial notice would 
indicate that the applicant would no longer be considered for 
authorization under the temporary certification program, but that the 
applicant could request reconsideration of the decision in accordance 
with Sec.  170.435. In association with these proposals, we 
specifically requested that the public comment on whether it would be 
preferable for applicants to have their entire application reviewed all 
at once and then issued a formal deficiency notice or whether we 
should, as proposed, review applications in parts.
    We proposed that an application would be deemed satisfactory if it 
met all the application requirements. We further proposed that once the 
applicant was notified of this determination, the applicant would be 
able to represent itself as an ONC-ATCB and begin testing and 
certifying Complete EHRs and EHR Modules consistent with its 
authorization.
    Comments. A commenter requested that the National Coordinator 
clarify that an application will be deemed satisfactory based on the 
submission of an application that substantially or materially complied 
with the requirements set forth in regulation. Another commenter 
recommended that we develop an expeditious internal review and approval 
process for ONC-ATCB applications. The commenter suggested that this 
process include a fast-track reprocessing system, as necessary, to 
allow ONC-ATCB applicants to swiftly correct initial errors and 
deficiencies.
    A commenter expressed agreement and support for the proposed 
process affording the National Coordinator discretion to request 
clarifications of statements or corrections of errors or omissions, but 
the commenter did not agree that such requests should be limited to 
only inadvertent or minor errors. The commenter reasoned that given the 
time constraints and complexity of the application process, the 
National Coordinator should be able to consider requesting 
clarifications or corrections in a collaborative process with 
applicants, as appropriate. The commenter also expressed general 
agreement with our proposal that an applicant be provided up to fifteen 
(15) days to respond to a formal deficiency notice. The commenter 
suggested, however, that considering the National Coordinator's opinion 
that few organizations will be able to meet the criteria in the 
temporary certification program, the National Coordinator should have 
the discretion to grant an extension beyond the 15 days upon a showing 
of good cause by the applicant. The commenter asserted that this 
proposal would provide flexibility and assist in ensuring that the 
process for approving ONC-ATCBs is successful.
    We received two comments that expressed agreement with our proposal 
to review ONC-ATCB applications in parts and two comments recommending 
that we review the whole application before issuing a deficiency 
notice. One commenter recommended processing the application based on 
the request of the applicant or the needs of the reviewer. Both sides 
contended that their recommended method was more efficient and better 
for the applicant and reviewer. A couple of commenters requested that, 
if the review process were to remain a two part process, we make clear 
that each part of the application will be reviewed in its

[[Page 36174]]

entirety before a deficiency notice would be issued. One of the 
commenters also requested that we make clear that each part receives 
two review opportunities.
    Response. We believe that applicants should be required to fully 
meet all the requirements of the application process to ensure that 
they are properly qualified to be an ONC-ATCB. We believe that our 
proposed process provides for a thorough and expeditious review of an 
application, which is in the best interest of all parties. We also 
believe that reviewing applications in two parts is the most efficient 
method, offers the most flexibility, and provides an applicant with the 
best opportunity to be successful. We do believe, however, that making 
some modifications to the application review process in response to 
comments will benefit both the applicants and the National Coordinator.
    We agree with the commenter that additional clarity can be provided 
by specifically stating that the National Coordinator will review each 
part of the application in its entirety. Therefore, we have modified 
Sec.  170.430(a)(2) to emphasize this point. We also can confirm that 
an applicant will have its initial Part 1 application reviewed and then 
have an opportunity to submit a revised application if necessary. Part 
2 of an applicant's application will be given these same two 
opportunities for review only if Part 1 of the application is deemed 
satisfactory.
    We agree with the commenter that the process for the National 
Coordinator to seek corrections of errors and omissions should be 
revised. Therefore, as recommended by the commenter, we are removing 
the words ``inadvertent'' and ``minor'' from Sec.  170.430(b)(1). 
Although we anticipate that the National Coordinator would likely only 
seek correction of minor errors or omissions, these revisions provide 
the National Coordinator with more flexibility to allow an error or 
omission to be corrected instead of issuing a deficiency notice. This 
flexibility will be beneficial for both applicants and the National 
Coordinator considering the limited opportunities and short timeframes 
for correcting applications. In an effort to further increase the 
flexibility of the process, we are making additional revisions to Sec.  
170.430 in response to a commenter's recommendation. The commenter 
recommended that the National Coordinator should have the discretion, 
upon a showing of good cause by the applicant, to grant an extension 
beyond 15 days for an applicant to submit a revised application in 
response to a deficiency notice.
    We agree with the commenter's recommendation and are revising Sec.  
170.430 to allow an applicant for ONC-ATCB status to request an 
extension of the 15-day period to submit a revised application in 
response to a deficiency notice and to provide the National Coordinator 
with the option of granting an applicant's request for additional time 
to respond to a deficiency notice upon a showing of good cause by the 
applicant. In determining whether good cause exists, the National 
Coordinator will consider factors such as: change in ownership or 
control of the applicant organization; the unexpected loss of a key 
member of the applicant's personnel; damage to or loss of use of the 
applicant's facilities, working environment or other resources; or 
other relevant factors that would prevent the applicant from submitting 
a timely response to a deficiency notice.
    We believe it is unnecessary to establish a predetermined length of 
time for a good cause extension in the regulation text. The length of 
time for an extension will be based on an applicant's particular 
circumstances that constitute good cause for an extension. For example, 
if an applicant lost a key member of its personnel, then the timeframe 
extension would reflect a reasonable period of time in which the 
applicant could remedy that particular issue.
    We believe that another means of adding greater flexibility to the 
application review process as sought by the commenter is to provide the 
National Coordinator with the same ability to request clarification of 
statements and the correction of errors or omissions in a revised 
application as the National Coordinator can do prior to issuing a 
deficiency notice. Accordingly, we are revising Sec.  170.430 to state 
that the National Coordinator may request clarification of statements 
and the correction of errors or omissions during the 15-day period 
provided for review of a revised application.
2. ONC-ATCB Application Reconsideration
    We proposed in section 170.435 that an applicant may request that 
the National Coordinator reconsider a denial notice issued for each 
part of an application only if the applicant can demonstrate that a 
clear, factual error(s) was made in the review of the application part 
and that the error's correction could lead to the applicant obtaining 
ONC-ATCB status. We proposed that the National Coordinator would have 
up to 15 days to consider a timely reconsideration request. We further 
proposed that if, after reviewing an applicant's reconsideration 
request, the National Coordinator determined that the applicant did not 
identify any factual errors or that correction of those factual errors 
would not remove all identified deficiencies in the application, the 
National Coordinator could reject the applicant's reconsideration 
request and that this decision would be final and not subject to 
further review.
    In association with these proposals, we specifically requested that 
the public comment on whether there are instances, besides an applicant 
demonstrating that a clear, factual error was made in the review of its 
application and that the error's correction could lead to the applicant 
receiving ONC-ATCB status, in which the National Coordinator should 
reconsider an application that has been deemed deficient multiple 
times.
    Comments. A commenter expressed agreement with our proposed ONC-
ATCB application reconsideration process. Another commenter stated, 
however, that the National Coordinator should have discretion to 
reconsider an application that has been deemed deficient multiple times 
for reasons besides a clear factual error that could lead to the 
applicant receiving ONC-ATCB status. The commenter concluded that the 
National Coordinator is in the unique position to determine on a case-
by-case basis whether multiple deficiencies should prevent 
reconsideration of a particular application. The commenter suggested 
that the National Coordinator should consider several factors in 
determining whether to reconsider an application that has been deemed 
deficient multiple times, including the severity and type of the 
deficiency, the implications of the deficiencies, the applicant's level 
of responsiveness and cooperation, and the remedial efforts taken by 
the applicant. The commenter also requested that, due to the 
differences between the proposed temporary and permanent certification 
programs and the timeframes associated with each, we consider 
applications for each program independently (i.e., a reconsideration 
denial of an application under the temporary certification program 
would not impact an applicant's ability to apply to be an ONC-ACB under 
the permanent certification program).
    Response. We appreciate the one commenter's expression of support 
for our proposals. We do not agree with the commenter that the National 
Coordinator should reconsider all twice-

[[Page 36175]]

deficient applications for any reason. Rather, we continue to believe 
that the National Coordinator should only reconsider an application if 
the applicant for ONC-ATCB status can demonstrate that there was a 
clear factual error in the review of its application that could lead to 
the applicant obtaining ONC-ATCB status. We believe that the 
application requirements and application review processes that we have 
proposed ensure that only qualified applicants are timely authorized to 
be ONC-ATCBs. The application requirements proposed are designed to 
ensure that applicants are qualified to both test and certify Complete 
EHRs and/or EHR Modules. Our review process is designed to establish 
the veracity of an application and to test and verify that an applicant 
has the necessary capabilities to be authorized to conduct the testing 
and certification sought by the applicant. Our review process is also 
designed to reach final decisions in a manner that will allow the 
temporary certification program to become operational in a timely 
manner. We believe the application review process contains sufficient 
opportunities for an applicant to demonstrate that it is qualified to 
be an ONC-ATCB, including opportunities under both Parts 1 and 2 of an 
application for the National Coordinator to request clarifications and 
corrections to the application, opportunities for an applicant to 
respond to a deficiency notice, and opportunities to request 
reconsideration of a denial notice if there is a clear, factual error 
that, if corrected, could lead to the applicant obtaining ONC-ATCB 
status. Accordingly, we have finalized this provision without 
modification.
    We do, however, want to assure the commenter that a negative 
reconsideration decision regarding an application under the temporary 
certification program will not impact an applicant's ability to apply 
to be an ONC-ACB under the permanent certification program.
3. ONC-ATCB Status
    We proposed in section 170.440 that the National Coordinator will 
acknowledge and make publicly available the names of ONC-ATCBs, 
including the date each was authorized and the type(s) of testing and 
certification each has been authorized to perform. We proposed that 
each ONC-ATCB would be required to prominently and unambiguously 
identify on its Web site and in all marketing and communications 
statements (written and oral) the scope of its authorization. We also 
proposed that an ONC-ATCB would not need to renew its status during the 
temporary certification program, but that an ONC-ATCB's status would 
expire upon the sunset of the temporary certification program in 
accordance with Sec.  170.490.
    Comments. A commenter expressed support for our proposal that an 
ONC-ATCB may only test and certify HIT that it is authorized to test 
and certify. Another commenter expressed an opinion that is important 
to the industry that the National Coordinator makes distinctions as to 
what a certifying body is approved to certify. One commenter 
recommended that our requirements related to marketing and 
communications be limited to the ONC-ATCB's Web site and all marketing 
and communications pertaining to its role in the testing and 
certification of EHRs and HIT. As currently written, the commenter 
contended that the requirements apply to all marketing and 
communications made by the entity even if unrelated to their ONC-ATCB 
status.
    A commenter recommended that the authorization status of ONC-ATCBs 
should be limited to Stage 1 certification. Based on this 
recommendation, the commenter stated that the authorization should 
remain valid as long as Stage I incentives are available (i.e., through 
2014) and not expire upon the proposed sunset of the temporary 
certification program.
    Response. We appreciate the support for our proposals and reiterate 
that, as proposed, an ONC-ATCB will only be able to test and certify 
Complete EHRs and/or EHR Modules consistent with the scope of 
authorization granted by the National Coordinator. Additionally, as 
proposed, the ONC-ATCB will have to prominently and unambiguously 
display the scope of authorization granted to it by the National 
Coordinator. To address the commenter's concern about the overreach of 
our proposed requirement that an ONC-ATCB ``identify on its Web site 
and in all marketing and communications statements (written and oral) 
the scope of its authorization'' we have clarified the language to 
clearly state that the requirement only applies to activities conducted 
by the ONC-ATCB under the temporary certification program. 
Specifically, we have revised the provision to state, in relevant part, 
``each ONC-ATCB must prominently and unambiguously identify the scope 
of its authorization on its Web site, and in all marketing and 
communications statements (written and oral) pertaining to its 
activities under the temporary certification program.''
    We do not accept the commenter's recommendation to associate 
authorization and the expiration of authorization to the stages of 
meaningful uses. As previously noted, the temporary certification 
program will sunset on December 31, 2011, or if the permanent 
certification program is not fully constituted at that time, then upon 
a subsequent date that is determined to be appropriate by the National 
Coordinator. Therefore, the temporary certification program must be 
capable of conducting testing and certification for the applicable 
stage(s) of meaningful use.

G. Testing and Certification of Complete EHRs and EHR Modules

    We proposed in the Proposed Rule the scope of authority granted to 
ONC-ATCBs by ONC authorization. We also specified which certification 
criteria or certification criterion ONC-ATCBs would be required to use 
to test and certify Complete EHRs and EHR Modules.
1. Complete EHRs
    We proposed in section 170.445 that to be authorized to test and 
certify Complete EHRs under the temporary certification program, an 
ONC-ATCB would need to be capable of testing and certifying Complete 
EHRs to all applicable certification criteria adopted by the Secretary 
at subpart C of part 170. We further proposed that an ONC-ATCB that had 
been authorized to test and certify Complete EHRs would also be 
authorized to test and certify all EHR Modules under the temporary 
certification program.
    Comments. Commenters expressed agreement with our proposals that, 
in order to be authorized to test and certify Complete EHRs under the 
temporary certification program, an ONC-ATCB must be capable of testing 
and certifying Complete EHRs to all applicable certification criteria 
and that such an ONC-ATCB would also be authorized to test and certify 
all EHR Modules under the temporary certification program. One 
commenter recommended that we require ONC-ATCBs authorized to test and 
certify Complete EHRs to also test and certify EHR Modules.
    Response. We appreciate the commenters' support for our proposals, 
but we do not adopt the one commenter's recommendation that we require 
an ONC-ATCB that is authorized to test and certify Complete EHRs to 
also test and certify EHR Modules. We clearly acknowledged in the 
preamble of the Proposed Rule and in our proposed regulatory provision 
that an ONC-ATCB authorized to test

[[Page 36176]]

and certify Complete EHRs would also have the capability and, more 
importantly, the authorization from the National Coordinator to test 
and certify EHR Modules. We do not, however, believe that we should 
regulate a private entity's business practices to require it to test 
and certify EHR Modules. An ONC-ATCB, despite authorization to do so, 
might have multiple business justifications for not testing and 
certifying EHR Modules, such as an insufficient number of qualified 
employees to conduct the testing and certification of EHR Modules in 
addition to conducting testing and certification of Complete EHRs, or 
that doing both would not be as profitable a business model.
    Based on consideration of the comments received and review of the 
proposed provision, we are revising Sec.  170.445(a) to state that ``An 
ONC-ATCB must test and certify Complete EHRs to all applicable 
certification criteria adopted by the Secretary at subpart C of this 
part.'' This revision is consistent with our description of testing and 
certification of Complete EHRs in the Proposed Rule preamble. It also 
makes explicit that ONC-ATCBs must not only be capable, but as with EHR 
Modules, are required to test and certify Complete EHRs to the 
applicable certification criteria adopted by the Secretary under 
subpart C of Part 170.
2. EHR Modules
a. Applicable Certification Criteria or Criterion
    We proposed in sections 170.450(a) and (b) that an ONC-ATCB must 
test and certify EHR Modules in accordance with the applicable 
certification criterion or criteria adopted by the Secretary at subpart 
C of part 170. In the preamble of the Proposed Rule, we clarified that 
a single certification criterion would encompass all of the specific 
capabilities referenced below the first paragraph level. For example, 
45 CFR 170.302, paragraph ``(e)'' (the first paragraph level) 
identifies that this certification criterion relates to recording and 
charting vital signs. It includes three specific capabilities at 
(e)(1), (2), and (3) (the second paragraph level): The ability to 
record, modify, and retrieve patients' vital signs; the ability to 
calculate body mass index (BMI); and the ability to plot and display 
growth charts. We stated that we viewed the entire set of specific 
capabilities required by paragraph ``(e)'' (namely, (e)(1), (2), and 
(3)) as one certification criterion. The specific capability to 
calculate BMI, for example, would not be equivalent to one 
certification criterion.
    Comments. We received two comments on our proposal. One commenter 
expressed agreement with our proposal, including the appropriateness of 
requiring an EHR Module to be capable of performing all the functions 
specified at the paragraph level of a certification criterion. The 
commenter reasoned that to allow testing and certification at a lower 
level (subparagraph) would result in a very large number of modules 
that would overcomplicate the certification program. The commenter 
stated that the only exception might be if there were a very large 
number of subparagraphs within a criterion or a very large number of 
criterion within a single objective (e.g., if the number of quality 
measures remains very high). In that case, the commenter asserted that 
the module might be divided into two or more logically related groups. 
But in general, the commenter stated that having a range of 20-25 
certification criteria, and therefore potential EHR Modules, was an 
appropriate level of granularity.
    The other commenter stated that requiring a module to perform all 
of the listed functions or capabilities associated with a specific 
certification criterion would create a significant problem. In 
particular, the commenter stated that for the ``drug-drug, drug-
allergy, drug-formulary checks'' certification criterion, there did not 
appear to be a single EHR Module in the current HIT marketplace that 
performs all of the four listed capabilities under the criterion. The 
commenter also surmised that the ``incorporate clinical lab-test 
results into EHR as structured data'' certification criterion may cause 
similar problems due to its multiple capabilities. Based on these 
considerations, the commenter recommended that we narrow the scope of 
EHR Module testing and certification to one of the capabilities or 
functions (subparagraphs) of a criterion. The commenter stated that 
this solution would necessitate that the ONC-ATCB provide modules that 
only perform such discrete functions with a ``conditional 
certification'' that carries the caveat that the module must be used in 
conjunction with other certified modules to offer full and complete 
functionality for the applicable criterion.
    Response. We agree with the first commenter that, as proposed, EHR 
Modules should be tested and certified to the first paragraph level of 
a certification criterion, as described in the example above. We 
believe that this is the most appropriate level for testing and 
certification of EHR Modules because, in most cases, this level of a 
criterion most fully represents the capabilities that are needed to 
perform the associated meaningful use objectives.
    We believe that the specific concerns raised by the commenter 
related to the ``drug-drug, drug-allergy, drug-formulary checks'' 
criterion and the ``incorporate clinical lab-test results into EHR as 
structured data'' criterion are more appropriately suited for 
discussion and resolution in the forthcoming final rule to finalize the 
certification criteria adopted in the HIT Standards and Certification 
Criteria interim final rule.
    We are finalizing paragraph (a) of Sec.  170.450 without 
modification, but we are modifying Sec.  170.450 to remove paragraph 
(b) because it is repetitive of the requirements set forth in paragraph 
(a).
b. Privacy and Security Testing and Certification
    With respect to EHR Modules, we discussed in the Proposed Rule when 
ONC-ATCBs would be required to test and certify EHR modules to the 
privacy and security certification criteria adopted by the Secretary. 
We proposed that EHR Modules must be tested and certified to all 
privacy and security certification criteria adopted by the Secretary 
unless the EHR Module(s) is/are presented for testing and certification 
in one of the following manners:
     The EHR Module(s) are presented for testing and 
certification as a pre-coordinated, integrated ``bundle'' of EHR 
Modules, which could otherwise constitute a Complete EHR. In such 
instances, the EHR Module(s) shall be tested and certified in the same 
manner as a Complete EHR. Pre-coordinated bundles of EHR Module(s) 
which include EHR Module(s) that would not be part of a local system 
and under the end user's direct control are excluded from this 
exception. The constituent EHR Modules of such an integrated bundle 
must be separately tested and certified to all privacy and security 
certification criteria;
     An EHR Module is presented for testing and certification, 
and the presenter can demonstrate to the ONC-ATCB that it would be 
technically infeasible for the EHR Module to be tested and certified in 
accordance with some or all of the privacy and security certification 
criteria; or
     An EHR Module is presented for testing and certification, 
and the presenter can demonstrate to the ONC-ATCB that the EHR Module 
is designed to perform a specific privacy and security capability. In 
such instances,

[[Page 36177]]

the EHR Module may only be tested and certified in accordance with the 
applicable privacy and security certification criterion/criteria.
    Comments. A number of commenters supported our proposed approach 
and agreed that EHR Modules should be tested and certified to all 
adopted privacy and security certification criteria unless there were 
justifiable reasons for which they should not. Other commenters 
suggested changes to one or more of the stated exceptions and posed 
questions for our consideration. Some commenters recommended that we 
deem certification criteria ``addressable'' similar to the Health 
Insurance Portability and Accountability Act (HIPAA) Security Rule's 
application of the word ``addressable'' to certain implementation 
specifications (in the HIPAA context) within a security standard (in 
the HIPAA context). Other commenters noted that with respect to the 
second exception, involving the demonstration that it would be 
technically infeasible for an EHR Module to be tested and certified to 
some or all privacy and security certification criteria, that the term 
``inapplicable'' should be added as a condition in addition to 
``technically infeasible.'' Another commenter stated that we should 
remove the third exception, involving the demonstration that an EHR 
Module is designed to perform a specific privacy and security 
capability, because, depending on how the privacy and security EHR 
Module is developed, it may also need to include certain capabilities, 
such as an audit log.
    Response. We appreciate commenters' support for our proposed 
approach and the thoughtfulness of the responses. While we understand 
and appreciate the similarities some commenters saw with respect to the 
HIPAA Security Rule and leveraging the ``addressable'' concept, we do 
not believe that making each privacy and security certification 
criterion ``addressable'' in the way it is implemented under the HIPAA 
Security Rule is an appropriate approach for the purposes of testing 
and certifying EHR Modules.
    In the context of the HIPAA Security Rule, HIPAA covered entities 
must assess whether each addressable implementation specification (in 
the HIPAA Security Rule) is a reasonable and appropriate safeguard in 
its environment. If a HIPAA covered entity determines that an 
addressable implementation specification is reasonable and appropriate, 
then the covered entity is required to implement it. If a HIPAA covered 
entity determines that an addressable implementation specification is 
not reasonable and appropriate, the covered entity is required to: (1) 
document why it would not be reasonable and appropriate to implement 
the addressable implementation specification; and (2) implement an 
equivalent alternative measure if reasonable and appropriate. While 
this is a sensible approach for HIPAA covered entities, we do not 
believe that it translates well into the testing and certification of 
EHR Modules.
    All HIPAA covered entities are required to comply with the HIPAA 
Security Rule with respect to their electronic protected health 
information, regardless of their size and resources. Accordingly, the 
HIPAA Security Rule provides for a flexible approach, allowing a HIPAA 
covered entity to implement safeguards that are reasonable and 
appropriate for its unique environment. We do not believe that this 
approach is appropriate for testing and certifying EHR Modules because 
one purpose of certification is to assure eligible professionals and 
eligible hospitals that an EHR Module includes a specified capability 
or set of capabilities. For these reasons, we believe that the proposed 
standard of ``technically infeasible'' is more appropriate than the 
HIPAA Security Rule's ``addressable'' concept for the purposes of 
testing and certifying EHR Modules. Thus, an EHR Module developer must 
satisfy each privacy and security criterion where it is technically 
feasible.
    To complement our ``technically infeasible'' standard, we agree 
with those commenters that recommended the addition of the word 
``inapplicable'' to the second proposed exception. We believe that in 
some cases a privacy and security certification criterion may be 
inapplicable to an EHR Module while technically feasible to implement, 
and in other cases a privacy and security certification criterion may 
be applicable but technically infeasible to implement. For example, it 
may be technically feasible to implement an automatic log-off or 
emergency access capability for several types of EHR Modules, but such 
capabilities may be inapplicable given the EHR Module's anticipated 
function and/or point of integration.
    We require that an EHR Module developer provide sufficient 
documentation to support a claim that a particular privacy and security 
certification criterion is inapplicable or that satisfying the 
certification criterion is technically infeasible. Based on this 
documentation, the ONC-ATCB should independently assess and make a 
reasonable determination as to whether the EHR Module should be exempt 
from having to include a particular privacy or security capability.
    We also agree with the commenter that stated that we should remove 
the third exception and simply require all modules, if not included in 
a pre-coordinated integrated bundle, to follow the same approach. As a 
result, only the first and second exception will be included in the 
final rule. We recognize that, with respect to an EHR Module that is 
focused exclusively on providing one or more privacy and security 
capabilities, the remaining privacy and security certification criteria 
may be inapplicable or compliance with them may be technically 
infeasible. However, we do not believe it is prudent to presume that 
this will always be the case.
    Comments. Several commenters asked for clarification on the 
circumstances under which the first exception we proposed applied in 
relation to a pre-coordinated, integrated ``bundle'' of EHR Modules, 
the carve out to this exception related to EHR Modules that were ``not 
be part of a local system,'' and our use of the term ``end user.''
    Response. Overall, the premise behind the first exception is to 
release the general requirement that each individual EHR Module be 
tested and certified to all adopted privacy and security criteria. We 
believe that it would be pragmatic to release this requirement in 
situations where several EHR Module developers (e.g., different 
vendors) or a single EHR Module developer presents a collection of EHR 
Modules as a pre-coordinated, integrated bundle to an ONC-ATCB for 
testing and certification. In these circumstances, the integrated 
bundle of EHR Modules would otherwise constitute a Complete EHR. 
Therefore, we clarify that in the circumstances where an integrated 
bundle of EHR Modules is presented for testing and certification and 
one or more of the constituent EHR Modules is/are demonstrably 
responsible for providing all of the privacy and security capabilities 
for the entire bundle of EHR Modules, that those other EHR Modules 
would be exempt from being tested and certified to adopted privacy and 
security certification criteria. To illustrate, four EHR Module 
developers each develop one EHR Module (EHR Modules A, B, C, and D) and 
form an affiliation. The EHR Module developers present their EHR 
Modules for testing and certification as an integrated bundle and 
identify that EHR Module ``C'' is responsible for providing the privacy 
and security capabilities for the rest of the entire bundle (EHR 
Modules A, B, and D). In this scenario, EHR Modules A, B, and D

[[Page 36178]]

would be exempt from also being tested and certified to the adopted 
privacy and security certification criteria.
    With respect to the proposed carve out to this exception related to 
EHR Modules that were ``not be part of a local system,'' we sought to 
limit those circumstances where a group of EHR Module developers could 
claim that a collection of EHR Modules was an ``integrated bundle,'' 
yet it would be technically infeasible for one or all of the EHR 
Modules in the collection to be demonstrably responsible for providing 
all of the privacy and security capabilities for the rest of the EHR 
Modules. We believe this would occur in situations where a presented 
``integrated bundle'' of EHR Modules includes one or more services 
offered by different EHR Module developers that have been implemented 
on different technical architectures or hosted over the Internet on one 
or multiple different servers. In this situation we do not believe that 
it would be possible for one or more of the EHR Modules to be 
demonstrably responsible for providing all of the privacy and security 
capabilities for the rest of the EHR Modules. For example, we do not 
believe that it is possible, at the present time, for a web-based EHR 
Module to offer authentication for another EHR Module that may be 
installed on an eligible professional's laptop, nor do we believe that 
one or more web-based services could provide an audit log for actions 
that took place outside of that service.
    We believe that with this additional clarity the explicit mention 
of the first exception's carve out is no longer necessary and have 
revised the first exception accordingly to include the clarifying 
concepts we discuss above. This revision has also resulted in the 
removal of the term ``end user,'' which commenters requested we 
clarify. The entire provision, including the changes from both our 
responses above, will read:
    EHR Modules shall be tested and certified to all privacy and 
security certification criteria adopted by the Secretary unless the EHR 
Module(s) is/are presented for testing and certification in one of the 
following manners:
    (1) The EHR Module(s) is/are presented for testing and 
certification as a pre-coordinated, integrated bundle of EHR Modules, 
which would otherwise meet the definition of and constitute a Complete 
EHR (as defined in 45 CFR 170.102), and one or more of the constituent 
EHR Modules is/are demonstrably responsible for providing all of the 
privacy and security capabilities for the entire bundle of EHR 
Module(s); or
    (2) An EHR Module is presented for testing and certification, and 
the presenter can demonstrate to the ONC-ATCB that a privacy and 
security certification criterion is inapplicable or that it would be 
technically infeasible for the EHR Module to be tested and certified in 
accordance with such certification criterion.
    We would like to clarify two points related to integrated bundles 
of EHR Modules. First, an integrated bundle of EHR Modules will only 
qualify for this special treatment if, and only if, the integrated 
bundle would otherwise constitute a Complete EHR. In other words, three 
EHR Modules that have been integrated and ``bundled'' but do not meet 
the definition of Complete EHR, would not qualify for this specific 
certification. In those cases, we would view such a bundle as an EHR 
Module that provides multiple capabilities. Second, because an 
integrated bundle of EHR Modules would otherwise constitute a Complete 
EHR, we would treat it as a Complete EHR and when listing it as part of 
our master certified HIT products list, we would provide a designation, 
noting that it was an integrated bundle of EHR Modules.
    Comments. A few commenters requested that we clarify whether there 
could be specific privacy and security-focused EHR Modules. That is, in 
the context of the definition of EHR Module, whether we intended to 
permit EHR Modules to exist that only addressed one or more adopted 
privacy and security certification criteria. One commenter asked for 
clarification as to whether a specific privacy and security-focused EHR 
Module would meet a certification criterion if its purpose was to call 
or assign the actual capability required by a certification criterion 
to another function or service.
    Response. Yes, we believe that there could be specific privacy and 
security-focused EHR Modules and do not preclude such EHR Modules from 
being presented for certification. However, with respect to the second 
comment and request for clarification, we believe that an EHR Module, 
itself, must be capable of performing a capability required by an 
adopted privacy and security certification criterion and that 
delegating the responsibility to another service or function would not 
be acceptable. In those cases there would be no proof that the EHR 
Module could actually perform the specific capability, only that it 
could tell something else to do it.
c. Identification of Certified Status
    We proposed in section 170.450(d) to require ONC-ATCBs authorized 
to test and certify EHR Modules to clearly indicate the certification 
criterion or criteria to which an EHR Module has been tested and 
certified in the EHR Module's certification documentation.
    Comments. We received two comments requesting that we standardize 
the certification documentation requirements or at least provide clear 
guidelines for certificate design. The commenters were concerned that 
if left to the discretion of ONC-ATCBs, the resulting certification 
certificates could look quite different and result in marketplace 
confusion. One commenter recommended that the certification 
certificate, which will figure prominently in EHR software vendor 
marketing, should be uniform in appearance and depict HHS authority and 
assurance.
    Response. We agree with the commenters that certificate 
documentation should be designed in a way that does not lead to market 
confusion. Therefore, we are establishing a new Principle of Proper 
Conduct for ONC-ATCBs regarding the proper identification of Complete 
EHRs and EHR Modules. We further discuss the basis for this new 
Principle of Proper Conduct under the heading titled ``O. Validity of 
Complete EHR and EHR Module Certification and Expiration of Certified 
Status'' later in this section. Consistent with this decision, we are 
modifying proposed Sec.  170.450 to remove paragraph (d). This 
modification will eliminate any potential redundancy with the new 
Principle of Proper Conduct on the proper identification of Complete 
EHRs and EHR Modules.

H. The Testing and Certification of ``Minimum Standards''

    In the Proposed Rule, we summarized the approach set forth in the 
HIT Standards and Certification Criteria interim final rule (75 FR 
2014) to treat certain vocabulary code set standards as ``minimum 
standards.'' We noted that the establishment of ``minimum standards'' 
for specific adopted code sets would, in certain circumstances, allow a 
Complete EHR and/or EHR Module to be tested and certified to a 
permitted newer version of an adopted code set without the need for 
additional rulemaking. Additionally, we noted that this approach would 
enable Certified EHR Technology to be upgraded to a permitted newer 
version of a code set without adversely affecting its certified status.

[[Page 36179]]

    At the end of this summary, we reiterated a previously identified 
limitation of the ``minimum standards'' approach with respect to 
significant revisions to adopted code sets. We stated that a newer 
version of an adopted ``minimum standard'' code set would be permitted 
for use in testing and certification unless it was a significant 
revision to a code set that represented a ``modification, rather than 
maintenance or a minor update of the code set.'' In those cases, we 
reiterated that the Secretary would likely proceed with notice and 
comment rulemaking to adopt a significantly revised code set standard.
    We proposed two methods through which the Secretary could identify 
new versions of adopted ``minimum standard'' code sets. The first 
method would allow any member of the general public to notify the 
National Coordinator about a new version. Under the second method, the 
Secretary would proactively identify newly published versions. After a 
new version has been identified, a determination would be issued as to 
whether the new version constitutes maintenance efforts or minor 
updates of the adopted code set and consequently would be permitted for 
use in testing and certification. We further proposed that once the 
Secretary has accepted a new version of an adopted ``minimum standard'' 
code set that:
    (1) Any ONC-ATCB may test and certify Complete EHRs and/or EHR 
Modules according to the new version;
    (2) Certified EHR Technology may be upgraded to comply with the new 
version of an adopted minimum standard accepted by the Secretary 
without adversely affecting the certification status of the Certified 
EHR Technology; and
    (3) ONC-ATCBs would not be required to test and certify Complete 
EHRs and/or EHR Modules according to the new version until we updated 
the incorporation by reference of the adopted version to a newer 
version.
    Finally, we stated that for either method, we would regularly 
publish on a quarterly basis, either by presenting to the HIT Standards 
Committee or by posting a notification on our Web site, any Secretarial 
determinations that have been made with respect to ``minimum standard'' 
code sets. We requested public comment on the frequency of publication, 
any other approaches we should consider to identify newer versions of 
adopted code set standards, and whether both methods described above 
should be used.
    Comments. Many commenters supported our proposed approaches. These 
commenters also encouraged us to pursue both of the proposed approaches 
(notification of the National Coordinator by the general public and 
proactive identification by the Secretary). Some commenters recommended 
that we establish open lines of communication with the organizations 
responsible for maintaining identified ``minimum standard'' code sets 
in order to facilitate the process of identifying newer versions.
    Response. We appreciate the commenters' support for our proposals. 
Based on this feedback, we have decided to adopt both of the approaches 
we have proposed. In addition, we expect to work, as appropriate, with 
the maintenance organizations for the ``minimum standard'' code sets, 
as well as the HIT Standards Committee, to identify new versions when 
they become available.
    Comments. A few commenters recommended that ONC-ATCBs not be 
required to use an accepted newer version of a ``minimum standard'' 
code set for certification. Along those lines, a few other commenters 
recommended that there be a delay period between the Secretary's 
acceptance of a new version and when it would be required for testing 
and certification. One commenter noted that supporting multiple 
versions of standards should be avoided and that there would be 
differences in what was certified versus what was implemented, while 
another noted that even permitting the use of a minor update could 
affect interoperability. Some commenters specifically requested 
clarification regarding the timeline associated with the Secretary's 
acceptance of a newer version and its publication and what requirement 
there would be for its inclusion in testing and certification.
    Response. We believe that some commenters misunderstood the 
implications of the Secretary's acceptance of a newer version of a 
``minimum standard'' code set. We therefore clarify that if the 
Secretary accepts a newer version of a ``minimum standard'' code set, 
nothing is required of ONC-ATCBs, Complete EHR or EHR Module 
developers, or the eligible professionals and eligible hospitals who 
have implemented Certified EHR Technology. In the Proposed Rule, we 
used a three-pronged approach in order to provide greater flexibility 
and accommodate industry practice with respect to code sets that must 
be maintained and frequently updated. The first prong would permit, but 
not require, ONC-ATCBs to use an accepted newer version of a ``minimum 
standard'' code set to test and certify Complete EHRs and/or EHR 
Modules if the accepted newer version has been incorporated into a 
product by a Complete EHR or EHR Module developer. In these instances, 
we believe this approach benefits Complete EHR or EHR Module developers 
because they would be able to adopt a newer version of a code set 
voluntarily and have their Complete EHR or EHR Module certified 
according to it, rather than having to use an older version for 
certification. The second prong would permit, but not require, eligible 
professionals and eligible hospitals who are already using Certified 
EHR Technology to receive an upgrade from their Complete EHR or EHR 
Module developer or voluntarily upgrade themselves to an accepted newer 
version of a ``minimum standard'' code set without adversely affecting 
the certification status of their Certified EHR Technology. Again, we 
believe this is a benefit to eligible professionals and eligible 
hospitals and provides greater flexibility. The third prong explicitly 
states that an ONC-ATCB would not be required to use any other version 
of a ``minimum standard'' code set beyond the one adopted at 45 CFR 
part 170 subpart B until the Secretary incorporates by reference a 
newer version of that code set.
    We recognize that a few different versions of adopted ``minimum 
standards'' could all be implemented at the same time and before a 
subsequent rulemaking potentially changes what constitutes the 
``minimum.'' We also understand the point raised by the commenter who 
expressed concerns about this approach because it could potentially 
create a situation where there could be differences in what was 
certified versus what was implemented. Along those lines, we also 
appreciate the point made by the commenter that a minor update could 
affect interoperability. We acknowledge these concerns and considered 
them as part of our analysis in determining whether to adopt minimum 
standards and to permit such standards to be exceeded when newer 
versions had been made available for use. However, we would like to 
make clear that we provide this flexibility on a voluntary basis and 
believe that the benefit of accepting newer versions of a ``minimum 
standard'' (namely, enabling the HIT industry to keep pace with new 
code sets) outweighs any potential or temporary risk to 
interoperability.
    In light of the discussion above, we do not believe it is necessary 
to change any of our proposals, and we hope the additional 
clarification above addresses

[[Page 36180]]

the concerns and questions raised by commenters.
    Comments. Some commenters requested that we clarify the process the 
Secretary would follow before accepting a newer version of an adopted 
``minimum standard'' code set.
    Response. We expect that after a new version of an adopted 
``minimum standard'' code set has been identified (either through the 
general public's notification of the National Coordinator or the 
Secretary proactively identifying its availability), the National 
Coordinator would ask the HIT Standards Committee to assess and solicit 
public comment on the new version. We expect that the HIT Standards 
Committee would subsequently issue a recommendation to the National 
Coordinator which would identify whether the Secretary's acceptance of 
the newer version for voluntary implementation and testing and 
certification would burden the HIT industry, negatively affect 
interoperability, or cause some other type of unintended consequence. 
After considering the recommendation of the HIT Standards Committee, 
the National Coordinator would determine whether or not to seek the 
Secretary's acceptance of the new version of the adopted ``minimum 
standard'' code set. If the Secretary approves the National 
Coordinator's request, we would issue guidance on an appropriate but 
timely basis indicating that the new version of the adopted ``minimum 
standard'' code set has been accepted by the Secretary.

I. Authorized Testing and Certification Methods

    We proposed in section 170.457 that, as a primary method, an ONC-
ATCB would be required to be capable of testing and certifying Complete 
EHRs and/or EHR Modules at its facility. We also proposed that an ONC-
ATCB would be required to have the capacity to test and certify 
Complete EHRs and/or EHR Modules through one of the following secondary 
methods: at the site where the Complete EHR or EHR Module has been 
developed; or at the site where the Complete EHR or EHR Module resides; 
or remotely (i.e., through other means, such as through secure 
electronic transmissions and automated web-based tools, or at a 
location other than the ONC-ATCB's facilities).
    Comments. We received many comments on our proposal. We received 
varying recommendations and proposals, but the majority of commenters 
did not agree with testing and certification at an ONC-ATCB's facility 
as the primary method. Commenters noted that to require eligible 
professionals or eligible hospitals with self-developed Complete EHRs 
to physically move their Complete EHRs to another location for testing 
and certification would not only be burdensome but in many cases 
impossible. Instead, many commenters recommended that we require ONC-
ATCBs to have the capacity to certify products through all of the 
secondary methods we proposed. Some commenters supported secondary 
methods without preference, while many commenters recommended that we 
require ONC-ATCBs to offer remote testing as the primary method because 
of its efficiency and low cost to Complete EHR and EHR Module 
developers. Commenters also noted that ONC-ATCBs could offer other 
methods, including performing testing and certification at an ONC-
ATCB's facility. One commenter recommended that, as the primary method, 
ONC-ATCBs should be required to support testing and certification at 
the Complete EHR or EHR Module developer's site, which could include a 
development or deployment site. Another commenter stated that each 
method should be considered equal because different methods may be 
appropriate for different developers. Some commenters recommended that 
we clarify whether we expected Complete EHRs and EHR Modules to be 
``live'' at customer sites before they can be tested and certified. The 
commenters asserted that such a prerequisite will significantly delay 
the roll out of customer upgrades.
    Response. We appreciate the many options and preferences expressed 
by the commenters. We believe that in order to adequately and 
appropriately address the commenters' concerns, an ONC-ATCB must have 
the capacity to provide remote testing and certification for both 
development and deployment sites. A development site is the physical 
location where a Complete EHR or EHR Module was developed. A deployment 
site is the physical location where a Complete EHR or EHR Module 
resides or is being or has been implemented. As discussed in the 
Proposed Rule, remote testing and certification would include the use 
of methods that do not require the ONC-ATCB to be physically present at 
the development or deployment site. This could include the use of web-
based tools or secured electronic transmissions. In addition to remote 
testing and certification, an ONC-ATCB may also offer testing and 
certification at its facility or at the physical location of a 
development or deployment site, but we are not requiring that an ONC-
ATCB offer such testing and certification. As indicated by commenters 
and our own additional research, the market currently utilizes 
predominantly remote methods for the testing and certification of HIT. 
On-site testing and certification was cited as costly and inefficient. 
Therefore, we are not requiring ONC-ATCBs to offer such testing and 
certification, but anticipate that some ONC-ATCBs will offer on-site 
testing and certification if there is a market demand. In response to 
those commenters who requested clarification, we also want to make 
clear that we do not believe that a Complete EHR or EHR Module must be 
``live at a customer's site'' in order to qualify for testing and 
certification by an ONC-ATCB. As stated above, a Complete EHR or EHR 
Module could be tested and certified at a Complete EHR and/or EHR 
Module developer's development site. Consistent with this discussion, 
we have revised Sec.  170.457 to require an ONC-ATCB to provide remote 
testing and certification for both development and deployment sites and 
have included the definitions of ``development site,'' ``deployment 
site,'' and ``remote testing and certification'' in Sec.  170.402.

J. Good Standing as an ONC-ATCB, Revocation of ONC-ATCB Status, and 
Effect of Revocation on Certifications Issued by a Former ONC-ATCB

    We proposed in the Proposed Rule requirements that ONC-ATCBs would 
need to meet in order to maintain good standing under the temporary 
certification program, the processes for revoking an ONC-ATCB's status 
for failure to remain in good standing, the effects that revocation 
would have on a former ONC-ATCB, and the potential effects that 
revocation could have on certifications issued by the former ONC-ATCB.
1. Good Standing as an ONC-ATCB
    We proposed in section 170.460 that, in order to maintain good 
standing, an ONC-ATCB would be required to adhere to the Principles of 
Proper Conduct for ONC-ATCBs and refrain from engaging in other types 
of inappropriate behavior, such as misrepresenting the scope of its 
authorization or testing and certifying Complete EHRs and/or EHR 
Modules for which it was not given authorization. In order to maintain 
good standing, we also proposed that an ONC-ATCB would be expected to 
follow all applicable Federal and state laws.
    Comments. Commenters expressed opinions that ONC-ATCBs should be 
expected to meet high standards for ethics and compliance, and 
therefore

[[Page 36181]]

were appreciative of our proposed standards of conduct for ONC-ATCBs. 
One commenter encouraged us to evaluate ONC-ATCBs' compliance with the 
Principles of Proper Conduct on an ongoing basis and at the time for 
re-authorization, particularly if either a Type-1 or Type-2 violation 
had occurred.
    Response. We believe that our proposed Principles of Proper Conduct 
for ONC-ATCBs are essential to maintaining the integrity of the 
temporary certification program, as well as ensuring public confidence 
in the program and the Complete EHRs and EHR Modules that are tested 
and certified under the program. We intend to monitor compliance with 
the Principles of Proper Conduct for ONC-ATCBs on an ongoing basis by, 
among other means, following up on concerns expressed by Complete EHR 
and EHR Module developers and the general public. It is also expected 
that ONC-ATCBs will maintain relevant documentation of their compliance 
with the Principles of Proper Conduct for ONC-ATCBs because such 
documentation would be necessary, for instance, to rebut a notice of 
noncompliance with the Principles of Proper Conduct issued by the 
National Coordinator. We continue to believe that a violation of the 
Principles of Proper Conduct for ONC-ATCBs, a violation of law, or 
other inappropriate behavior must be promptly and appropriately 
addressed to maintain the program's integrity and the public's 
confidence in the program and the products that are certified. If a 
violation or other inappropriate behavior were to occur, it would be 
addressed in accordance with section 170.465. With consideration of the 
public comments received, we are finalizing section 170.460 without 
modification.
2. Revocation of ONC-ATCB Status
    We proposed in section 170.465 that the National Coordinator could 
revoke an ONC-ATCB's status if it committed a Type-1 violation or if it 
failed to timely or adequately correct a Type-2 violation. We defined 
Type-1 violations to include violations of law or temporary 
certification program policies that threaten or significantly undermine 
the integrity of the temporary certification program. These violations 
include, but are not limited to: false, fraudulent, or abusive 
activities that affect the temporary certification program, a program 
administered by HHS or any program administered by the Federal 
government.
    We defined Type-2 violations as noncompliance with Sec.  170.460, 
which would include without limitation, failure to adhere to the 
Principles of Proper Conduct for ONC-ATCBs and engaging in other 
inappropriate behavior. We proposed that if the National Coordinator 
were to obtain reliable evidence that an ONC-ATCB may no longer be in 
compliance with Sec.  170.460, the National Coordinator would issue a 
noncompliance notification. We proposed that an ONC-ATCB would have an 
opportunity to respond and demonstrate that no violation occurred or 
that the alleged violation had been corrected. We further proposed that 
the National Coordinator would review the response and determine 
whether a violation had occurred and whether it had been adequately 
corrected.
    We proposed that the National Coordinator could propose to revoke 
an ONC-ATCB's status if the National Coordinator has evidence that the 
ONC-ATCB committed a Type-1 violation. We proposed that the National 
Coordinator could propose to revoke an ONC-ATCB's status if the ONC-
ATCB failed to rebut an alleged Type-2 violation with sufficient 
evidence showing that the violation did not occur or that the violation 
had been corrected, or if the ONC-ATCB did not submit a written 
response to a Type-2 noncompliance notification within the specified 
timeframe. We proposed that an ONC-ATCB would be able to continue its 
operations under the temporary certification program during the time 
periods provided for the ONC-ATCB to respond to a proposed revocation 
notice and the National Coordinator to review the response.
    We proposed that the National Coordinator could revoke an ONC-
ATCB's status if it is determined that revocation is appropriate after 
considering the ONC-ATCB's response to the proposed revocation notice 
or if the ONC-ATCB does not respond to a proposed revocation notice 
within the specified timeframe. We further proposed that a decision to 
revoke an ONC-ATCB's status would be final and not subject to further 
review unless the National Coordinator chose to reconsider the 
revocation.
    We proposed that a revocation would be effective as soon as the 
ONC-ATCB received the revocation notice. We proposed that a testing and 
certification body that had its ONC-ATCB status revoked would be 
prohibited from accepting new requests for testing and certification 
and would be required to cease its current testing and certification 
operations under the temporary certification program. We further 
proposed that if a testing and certification body had its ONC-ATCB 
status revoked for a Type-1 violation, it would be prohibited from 
reapplying for ONC-ATCB status under the temporary certification 
program for one year. If the temporary certification program sunset 
during this time, the testing and certification body would be 
prohibited from applying for ONC-ACB status under the permanent 
certification program for the remainder of the one year prohibition 
period.
    We proposed that failure to promptly refund any and all fees for 
uncompleted tests and/or certifications of Complete EHRs and EHR 
Modules after the revocation of ONC-ATCB status would be considered a 
violation of the Principles of Proper Conduct for ONC-ATCBs. We 
proposed that the National Coordinator would consider such violations 
in the event that a testing and certification body reapplied for ONC-
ATCB status under the temporary certification program or applied for 
ONC-ACB status under the permanent certification program.
    In association with these proposals, we specifically requested that 
the public comment on two additional proposals. First, we requested 
that the public comment on whether the National Coordinator should 
consider proposing the revocation of an ONC-ATCB's status for 
repeatedly committing Type-2 violations even if the ONC-ATCB adequately 
corrected the violations each time. In conjunction with this request, 
we asked how many corrected Type-2 violations would be sufficient for 
proposing revocation of an ONC-ATCB and to what extent the frequency of 
these violations should be a consideration. Second, we requested that 
the public comment on whether the National Coordinator should also 
include a process to suspend an ONC-ATCB's status.
    Comments. We received general support for our proposed revocation 
process with commenters encouraging us to take a stringent position 
regarding Type-1 and Type-2 violations out of fear that a lack of 
confidence in the qualifications or integrity of an ONC-ATCB could 
seriously undermine the temporary certification program's objectives. 
Commenters requested that vendors, self-developers and providers be 
notified if an ONC-ATCB is suspended, the National Coordinator proposes 
to revoke an ONC-ATCB's status, and/or an ONC-ATCB's status is revoked. 
One commenter recommended that there not be a ``broad'' categorical 
Type-1 violation bar on reapplying for ONC-ATCBs that had their status 
revoked, while other commenters suggested that we extend the timeframe

[[Page 36182]]

for barring ONC-ATCBs that have committed Type-1 violations from 
reapplying to at least three years and to require that a ``re-
authorized'' former ONC-ATCB serve a probationary period.
    We received a few comments on whether we should revoke an ONC-
ATCB's status under the temporary certification program for committing 
multiple Type-2 violations even if the violations were corrected. A 
couple of commenters suggested that an ONC-ATCB should have its status 
revoked for committing multiple violations. One commenter reasoned that 
if an ONC-ATCB committed three or more violations in the short time of 
the anticipated existence of the temporary certification program then 
it deserved to have its status revoked. Another commenter recommended 
that the National Coordinator retain the discretion to review and judge 
each situation as opposed to setting a certain threshold for automatic 
revocation.
    We received multiple comments on our proposed alternative of a 
suspension process with all of the commenters suggesting that there 
could be value in a suspension process. One commenter stated that our 
goal should be first and foremost to protect the needs of product 
purchasers and patients. Commenters stated that suspension could be 
warranted in lieu of proposing revocation and/or during the period 
between a proposed revocation and a final decision on revocation. Some 
commenters recommended that an ONC-ATCB be allowed to continue 
operations during a suspension or be provided ``due process'' rights 
before being suspended, while others suggested that allowing an ONC-
ATCB to continue during instances where an investigation is ongoing and 
violations are being resolved could jeopardize the industry's 
confidence level in the certification process. One commenter suggested 
that an ONC-ATCB be allowed to continue operations unless the alleged 
violation would or could adversely impact patient safety and/or quality 
of care.
    Response. We do not believe that it is appropriate to initiate 
revocation proceedings against an ONC-ATCB for any amount of corrected 
Type-2 violations under the temporary certification program. We did not 
originally propose to initiate revocation proceedings for multiple 
corrected Type-2 violations, but requested public comment on the 
possibility. Commenters appeared to agree that initiating revocation 
proceedings against an ONC-ATCB for committing multiple Type-2 
violations, even if corrected, was an acceptable proposition under 
certain conditions. While we agree that committing multiple Type-2 
violations, even if corrected, is cause for concern, it would be 
difficult to establish a sufficiently objective and equitable standard 
for initiating revocation proceedings on that basis against an ONC-
ATCB. As evidenced by the comments, it is difficult to determine the 
appropriate number of corrected Type-2 violations that would lead to 
revocation proceedings. An ONC-ATCB could commit and correct two Type-2 
violations involving a missed training or a timely update to ONC on a 
key personnel change. In such a situation, we do not believe that 
automatically initiating revocation proceedings would be warranted. We 
also do not believe it would be appropriate to adopt the one 
commenter's recommendation to allow the National Coordinator to use 
discretion to address such instances. This would not give an ONC-ATCB 
sufficient notice of what Type-2 violation, even if corrected, could 
lead to revocation proceedings nor an indication of the amount or 
frequency of the violations that could lead to revocation proceedings. 
Therefore, we believe that an ONC-ATCB should remain in good standing 
if it sufficiently corrects a Type-2 violation, no matter how many 
times an ONC-ATCB commits a Type-2 violation. Such violations will be a 
matter of public record that may influence Complete EHR and EHR Module 
developers' decisions on which ONC-ATCB to select for the testing and 
certification of their Complete EHRs and/or EHR Modules.
    We believe that Type-1 violations as described are not too 
``broad'' in that they must also ``threaten or significantly undermine 
the integrity of the temporary certification program.'' In such cases, 
we believe that barring a former ONC-ATCB from reapplying for ONC-ATCB 
status for one year is an appropriate remedy under the temporary 
certification program, which we do not anticipate lasting beyond 
December 31, 2011. As noted in the Proposed Rule, a Type-1 violation 
could significantly undermine the public's faith in our temporary 
certification program. Therefore, removing the ONC-ATCB from the 
program is an appropriate remedy. The 1-year bar on reapplying will 
allow the former ONC-ATCB sufficient time to address the reasons for 
the Type-1 violation before reapplying. We will, however, reconsider 
the appropriate length of a bar on reapplying for ONC-ACB status and 
whether a probationary period would be appropriate for the permanent 
certification program when we finalize the permanent certification 
program.
    We agree with the commenters that suspension could be an effective 
way to protect purchasers of certified products and ensure patient 
health and safety. As a result, we agree with the commenter and believe 
that the National Coordinator should have the ability to suspend an 
ONC-ATCB's operations under the temporary certification program when 
there is reliable evidence indicating that the ONC-ATCB committed a 
Type-1 or Type-2 violation and that the continued testing and 
certification of Complete EHRs and/or EHR Modules could have an adverse 
impact on patient health or safety. As mentioned in the Proposed Rule, 
the National Coordinator's process for obtaining reliable evidence 
would involve one or more of the following methods: Fact-gathering; 
requesting information from an ONC-ATCB; contacting an ONC-ATCB's 
customers; witnessing an ONC-ATCB perform testing or certification; 
and/or reviewing substantiated complaints.
    Due to the disruption a suspension may cause for an ONC-ATCB, and 
more so for the market, we believe that suspension is appropriate in 
only the limited circumstances described above and have revised Sec.  
170.465 to provide the National Coordinator with the discretion to 
suspend an ONC-ATCB's operations accordingly. An ONC-ATCB would first 
be issued a notice of proposed suspension. Upon receipt of a notice of 
proposed suspension, an ONC-ATCB will be permitted up to 3 days to 
submit a written response to the National Coordinator explaining why 
its operations should not be suspended. The National Coordinator will 
be permitted up to 5 days to review the ONC-ATCB's response and issue a 
determination. In the determination, the National Coordinator will 
either rescind the proposed suspension, suspend the ONC-ATCB's 
operations until it has adequately corrected a Type-2 violation, or 
propose revocation in accordance with Sec.  170.465(c) and suspend the 
ONC-ATCB's operations for the duration of the revocation process. The 
National Coordinator may also make any one of the above determinations 
if an ONC-ATCB fails to submit a timely response to a notice of 
proposed suspension. A suspension will become effective upon an ONC-
ATCB's receipt of a notice of suspension. We believe that this process 
addresses the commenters' concerns regarding due process and 
maintaining the industry's confidence in the temporary certification 
program by not allowing an

[[Page 36183]]

ONC-ATCB to continue operations while an investigation is ongoing and/
or violations are being resolved related to the patient health or 
safety.
    As discussed in a previous section of this preamble, we have 
revised Sec.  170.423(j) to clarify that an ONC-ATCB would have to 
refund any fees paid by a Complete EHR or EHR Module developer that 
seeks to withdraw a request for testing and certification while an ONC-
ATCB is suspended.
    We intend to provide public notification via our Web site and list 
serve if an ONC-ATCB is suspended, issued a notice proposing its 
revocation, and/or has its status revoked. We also note that we revised 
Sec.  170.465(c)(1) to state that ``[t]he National Coordinator may 
propose to revoke an ONC-ATCB's status if the National Coordinator has 
reliable evidence that the ONC-ATCB committed a Type-1 violation.'' The 
term ``reliable'' was inadvertently left out of the Proposed Rule.
3. Effect of Revocation on Certifications Issued by a Former ONC-ATCB
    We proposed in section 170.470 to allow the certified status of 
Complete EHRs and/or EHR Modules certified by an ONC-ATCB that 
subsequently had its status revoked to remain intact unless a Type-1 
violation was committed that called into question the legitimacy of the 
certifications issued by the former ONC-ATCB. In such circumstances, we 
proposed that the National Coordinator would review the facts 
surrounding the revocation of the ONC-ATCB's status and publish a 
notice on ONC's Web site if the National Coordinator believed that 
Complete EHRs and/or EHR Modules were fraudulently certified by a 
former ONC-ATCB and the certification process itself failed to comply 
with regulatory requirements. We further proposed that if the National 
Coordinator determined that Complete EHRs and/or EHR Modules were 
improperly certified, the ``certified status'' of affected Complete 
EHRs and/or EHR Modules would remain intact for 120 days after the 
National Coordinator published the notice. We specifically requested 
that the public comment on our proposed approach and the timeframe for 
re-certification.
    Comments. Multiple commenters expressed agreement and understanding 
with the need to protect the integrity of the temporary certification 
program by ensuring the legitimacy of certifications issued by a former 
ONC-ATCB and requiring recertification of Complete EHRs and/or EHR 
Modules where it is found that they were improperly certified. Many 
commenters stated, however, that we should determine whether an 
improperly certified product negatively and substantially affected the 
performance of a Complete EHR or EHR Module in achieving a meaningful 
use objective before requiring recertification. Other commenters stated 
that ``good faith'' eligible professionals and eligible hospitals who 
can demonstrate meaningful use with a previously certified Complete EHR 
or EHR Module should continue to qualify for payments under the 
Medicare and Medicaid EHR Incentive Programs. Commenters further stated 
that providers should be allowed to replace the previously certified 
product when new certification criteria have been finalized for the 
affected meaningful use criteria, or when their own strategic and 
technical requirements necessitate an upgrade, whichever comes first. 
Commenters contended that the only overriding factor that should 
require recertification is if there is a demonstrable risk to patient 
safety from the use of improperly certified Complete EHRs and/or EHR 
Modules.
    A few commenters expressed concerns about the potential negative 
financial impact recertification would have on Complete EHR and EHR 
Module developers, eligible professionals and eligible hospitals as 
well as the potential for legal liability related to eligible 
professionals and eligible hospitals making attestations to federal and 
state agencies that they are using Certified EHR Technology.
    Some commenters agreed with our 120-day proposal, while many 
commenters recommended 6, 9, 12, and 18-month ``grace periods'' for 
improperly certified Complete EHRs and/or EHR Modules. One commenter 
recommended an extension of the 120-day grace period if there were less 
than 3 ONC-ATCBs at the time of decertification. One commenter noted 
that the revocation process through potential decertification of 
Complete EHRs and/or EHR Modules could take longer than the life of the 
temporary certification program and likely overlap with the issuance of 
new standards and certification criteria, which itself will require 
``recertification'' under the permanent certification program.
    Response. In instances where the National Coordinator determines 
that Complete EHRs and/or EHR Modules were improperly certified, we 
believe that recertification is necessary to maintain the integrity of 
the temporary certification program and to ensure the efficacy and 
safety of certified Complete EHRs and EHR Modules. By requiring 
recertification, eligible professionals and eligible hospitals as well 
as Complete EHR and EHR Module developers can have confidence in the 
temporary certification program and, more importantly, in the Complete 
EHRs and EHR Modules that are certified under the program. As we stated 
in the Proposed Rule, we believe it would be an extremely rare 
occurrence for an ONC-ATCB to have its status revoked and for the 
National Coordinator to determine that Complete EHRs and/or EHR Modules 
were improperly certified. If such events were to occur, the regulatory 
provisions enable the National Coordinator to focus recertification on 
specific Complete EHRs and/or EHR Modules that were improperly 
certified in lieu of requiring recertification of all Complete EHRs and 
EHR Modules tested and certified by the former ONC-ATCB.
    In this regard, the National Coordinator has a statutory 
responsibility to ensure that Complete EHRs and EHR Modules certified 
under the temporary certification program are in compliance with the 
applicable certification criteria adopted by the Secretary. We do not 
believe that the alternatives suggested by the commenters, such as 
whether a ``good faith'' eligible professional or eligible hospital can 
demonstrate meaningful use with a previously certified Complete EHR or 
EHR Module, would enable the National Coordinator to fulfill this 
statutory responsibility. Consequently, if the National Coordinator 
determines that a Complete EHR or EHR Module was improperly certified, 
then retesting and recertification by an ONC-ATCB are the only means by 
which to ensure that the Complete EHR or EHR Module satisfies the 
certification criteria. Moreover, an attestation by a Complete EHR or 
EHR Module developer and/or user of a Complete EHR or EHR Module would 
not be an acceptable alternative to retesting and recertification 
because the National Coordinator could not sufficiently confirm that 
all applicable certification criteria are met.
    We appreciate the concerns expressed by commenters related to the 
potential financial burden of recertification, the potential legal 
liability for providers attesting to the use of Certified EHR 
Technology, and the perceived insufficient amount of time to have a 
Complete EHR and/or EHR Modules recertified. We believe, however, that 
some of these concerns may be unfounded. Any decertification of a 
Complete EHR or EHR Module will be made widely known to the public by 
ONC through publication on our Web site and list serve, which we 
believe will help eligible professionals or eligible hospitals identify 
whether the

[[Page 36184]]

certified status of their Certified EHR Technology is still valid. We 
also believe that programmatic steps, such as identifying ONC-ATCB(s) 
that could be used for retesting and recertification, could be taken to 
assist Complete EHR and/or EHR Module developers with achieving timely 
and cost effective recertifications. Most importantly, in the rare 
circumstance that recertification is required, we believe that the need 
to protect the public from potentially unsafe Complete EHRs and/or EHR 
Modules outweighs the concerns expressed by the commenters. 
Accordingly, we are finalizing this provision without modification.

K. Sunset of the Temporary Certification Program

    We proposed in section 170.490 that the temporary certification 
program would sunset on the date when the National Coordinator 
authorized at least one ONC-ACB under the permanent certification 
program. We further proposed that on the date the sunset occurred, ONC-
ATCBs under the temporary certification program would be prohibited 
from accepting new requests to certify Complete EHRs or EHR Modules. 
ONC-ATCBs would, however, be able to complete the processing of 
Complete EHRs and EHR Modules that were being tested and certified at 
the time the sunset occurred. We clarified that ONC-ATCBs would be able 
to review any pending applications that they had received prior to the 
termination date of the temporary certification program and complete 
the certification process for those Complete EHRs and EHR Modules.
    We requested that the public comment on whether we should establish 
a set date for the temporary certification program to sunset, such as 
12/31/2011, instead of a date that depends on a particular action--the 
authorization of at least one ONC-ACB. We noted that a set date would 
provide certainty and create a clear termination point for the 
temporary certification program by indicating to any ONC-ATCBs and 
other certification bodies that in order to be authorized to certify 
Complete EHRs and/or EHR Modules after 12/31/2011, they would need to 
be accredited and reapply to become ONC-ACBs. We further noted that one 
potential downside to a set date would be the possibility that it would 
temporarily prevent certifications from being issued during the time 
period it takes potential ONC-ACB applicants to get accredited and 
receive their authorizations from the National Coordinator.
    Comments. Commenters recommended various methods and means for 
ending the temporary certification program. The predominant suggestion 
from commenters was to devise a method for ending the temporary 
certification program that would limit the amount of uncertainty for 
vendors, self-developers, and providers. In this regard, multiple 
commenters recommended a date certain with 12/31/2011 being the only 
date specified by commenters. Commenters reasoned that a set date would 
give the industry and market a target for planning purposes. Many 
commenters, however, stated that a set date was only viable if there 
were at least one ONC-ACB. Some commenters recommended that there be 
two ONC-ACBs and some also requested that we ensure that there are one 
or two accredited testing labs before we sunset the temporary 
certification program. Commenters contended that having more than one 
ONC-ACB would help prevent a backlog and potential monopolies.
    Multiple commenters recommended that we tie the certification 
programs with the meaningful use stages (i.e., use the temporary 
certification program for Stage 1 and the permanent certification 
program for Stage 2 and beyond) and allow the temporary certification 
program to continue to certify for Stage 1 until it was no longer 
needed. One commenter recommended that the temporary certification 
program should be phased out only after it has been determined that a 
significant percentage of the industry is ready to move to Stage 2 of 
the Medicare and Medicaid EHR Incentive Programs.
    One commenter proposed that there be a period of overlap of up to a 
year between the temporary certification program and the permanent 
certification program to enable ONC-ATCBs to complete the testing and 
certification of products that were presented prior to the beginning of 
the permanent certification program. As part of the proposal, the 
commenter stated that products not completely tested and certified by 
an ONC-ATCB by the end date would need to be resubmitted under the 
permanent certification program.
    Another commenter recommended that the rules for the transition 
period must be flexible enough to accommodate an ONC-ATCB to apply to 
become a testing lab and/or an ONC-ACB under the permanent 
certification program.
    Response. The commenters' recommendation to link the certification 
programs to the proposed stages of meaningful use illustrates a 
misunderstanding of the purpose of the certification programs. 
Consistent with statutory instruction, the primary purpose of the 
certification programs is to ensure that Complete EHRs, EHR Modules, 
and possibly other HIT, meet the standards, implementation 
specifications, and certification criteria adopted by the Secretary. We 
have proposed a temporary certification program in order to ensure that 
Certified EHR Technology will be available for the start of the 
Medicare and Medicaid EHR Incentive Programs and to allow sufficient 
time for the development of a more rigorous permanent certification 
program. Linking the temporary certification program to a proposed 
stage of meaningful use could cause the program to last longer than is 
necessary, which would be inconsistent with the purpose of the program.
    We agree with the majority of commenters that we should strive to 
achieve as much certainty as possible for the market while also 
ensuring the existence of a sufficient supply of authorized testing 
and/or certification bodies so as to enable eligible hospitals and 
eligible providers to achieve meaningful use. Therefore, we have 
modified our proposed timeframe such that the temporary certification 
program will sunset on December 31, 2011, or if the permanent 
certification program is not fully constituted at that time, then upon 
a subsequent date that is determined to be appropriate by the National 
Coordinator. On and after the temporary certification program sunset 
date, ONC-ATCBs will be prohibited from accepting new requests to test 
and certify Complete EHRs or EHR Modules. ONC-ATCBs will, however, be 
permitted up to six months after the sunset date to complete all 
testing and certification activities associated with requests for 
testing and certification of Complete EHRs and/or EHR Modules received 
prior to the sunset date.
    We believe that our proposal provides the appropriate balance 
between market certainty and ensuring that there remains a body 
authorized to test and certify Complete EHRs and EHR Modules. We 
believe that many applicants will seek to become ONC-ACBs and that 
there is sufficient flexibility in the transition to the permanent 
certification program for ONC-ATCBs either to apply to become ONC-ACBs 
or to become accredited testing labs. We further believe that 
applicants will be motivated by business dynamics, such as capturing an 
increased market share, to become authorized as soon as possible under 
the permanent certification program.

[[Page 36185]]

Therefore, we believe that there will be multiple ONC-ACBs by December 
31, 2011.
    In the event that the National Coordinator is unable to begin the 
permanent certification program on January 1, 2012, we believe it is 
appropriate for the temporary certification program to remain 
operational until the National Coordinator determines that the 
permanent certification program is fully constituted. As stated above, 
keeping the temporary certification program operational will help 
ensure that a body authorized to test and certify Complete EHRs and EHR 
Modules remains available. This flexibility provided to the National 
Coordinator will help to alleviate the ``consumer'' concerns expressed 
by commenters related to the potential existence of backlogs or 
monopolies at the start of the permanent certification program. In 
determining whether the proposed permanent certification program is 
fully constituted, the National Coordinator will consider whether there 
are a sufficient number of ONC-ACBs and accredited testing laboratories 
to address the current market demand. For example, if multiple ONC-
ATCBs exist, but only one ONC-ACB has been authorized and no testing 
laboratories are accredited (or alternatively one or more testing 
laboratories exist, but no ONC-ACBs), and the Secretary will soon issue 
newly adopted standards, implementation specifications and 
certification criteria, then it is unlikely that the permanent 
certification program would be considered fully constituted. We believe 
this approach sufficiently addresses the concerns expressed by various 
commenters and provides the most assurance to the market, particularly 
for Complete EHR and EHR Module developers that seek testing and 
certification of Complete EHRs and/or EHR Modules.
    Consistent with our original proposal, we are allowing ONC-ATCBs to 
complete the processing of all requests for the testing and 
certification of Complete EHRs and/or EHR Modules received prior to the 
sunset date. By completing the processing of a request, we expect that 
all testing and certification activities would be completed including 
the issuance of a certification, if appropriate. We are limiting the 
time to complete the processing of requests to a period of six months 
after the sunset date of the temporary certification program. We agree 
with the commenter that a limitation is necessary to bring finality to 
the temporary certification program. We believe that six months is a 
more appropriate period than ``up to a year'' because, as previously 
stated, we anticipate the next set of standards, implementation 
specifications, and certification criteria to be published in late 
summer of 2012. Therefore, market confusion can be avoided by ending 
all vestiges of the temporary certification program before the start of 
testing and certification to newly adopted standards, implementation 
specifications, and certification criteria. If the testing and 
certification of a Complete EHR or EHR Module is not completed prior to 
the end of the 6-month period, the Complete EHR or EHR Module would 
have to be resubmitted for testing and certification under the 
permanent certification program.

L. Recognized Certification Bodies as Related to the Physician Self-
Referral Prohibition and Anti-Kickback EHR Exception and Safe Harbor 
Final Rules

    The physician self-referral prohibition exception and anti-kickback 
statute safe harbor for donations of EHR software (42 CFR 411.357(w) 
and 42 CFR 1001.952(y), respectively) include among their conditions a 
provision that donated software must be interoperable and that, for 
purposes of the exception and safe harbor, software is deemed to be 
interoperable ``if a certifying body recognized by the Secretary has 
certified the software within no more than 12 months prior to the date 
it is provided to the [recipient].'' This final rule addresses the 
process in which the Secretary recognizes a certifying body. As to the 
process, we requested comment in the Proposed Rule on whether we should 
construe the proposed ``authorization'' process for ONC-ATCBs and ONC-
ACBs as the Secretary's method for ``recognizing'' certification 
bodies.
    Comments. The vast majority of commenters supported replacing the 
Secretary's current method for ``recognizing'' certification bodies 
with the proposed ``authorization'' process for ONC-ATCBs and ONC-ACBs. 
The commenters reasoned that our proposal offered consistency and 
efficiency for all stakeholders involved. Only one commenter 
recommended that the current process for ``recognizing'' certification 
bodies not be superseded by the proposed ``authorization'' process, but 
that commenter did so based on a concern expressed by multiple 
commenters. The concern was over whether the proposed ``authorization'' 
process would negatively affect donations of ``certified EHRs'' 
currently in progress, including the invalidation of existing 
investments and the disruption of pending and executed contracts as 
well as ongoing EHR installations. To address these concerns, some 
commenters recommended that EHRs certified by a ``recognized 
certification body'' continue to be permitted for donation under the 
exception and safe harbor if they still satisfied the parameters set by 
the physician self-referral prohibition exception and anti-kickback 
statute safe harbor final rules. The commenters also recommended that 
the subsequent ``rollout'' of EHR installations to physician offices 
should be deemed to qualify for the exception and safe harbor based on 
certification status as of the original purchase date, regardless of 
the date of actual installation in physician offices.
    Some commenters recommended that the term of recognition for 
certified EHR technology under the exception and safe harbor should be 
equal to the ``certification time period of two (2) years, and not 12 
months as currently specified.'' Another commenter recommended that any 
EHR certified by the Certification Commission for Health Information 
Technology (CCHIT) should continue to qualify for the exception and 
safe harbor at least through the end of Stage 1 of the Medicare and 
Medicaid EHR Incentive Programs.
    One commenter noted that the physician self-referral prohibition 
exception and anti-kickback statute safe harbor final rules define 
``interoperability'' and that an EHR's ability to be interoperable is a 
factor in its ability to be donated under those rules. The commenter 
requested that the National Coordinator clarify and provide guidance on 
the standards and interoperability requirements to which ONC-ATCBs and 
ONC-ACBs would test and certify EHRs for purposes of the exception and 
safe harbor.
    A commenter recommended that we clarify that Complete EHRs and EHR 
Modules that are certified under the temporary or permanent 
certification programs may be deemed interoperable and may qualify for 
the physician self-referral prohibition exception or the anti-kickback 
statute safe harbor for EHR donations. The commenter also recommended 
that we state that Complete EHRs and EHR Modules will also be required 
to meet other regulatory provisions outlined in 42 CFR 411.351 et seq. 
or 1001.952 in order to qualify for the exception or safe harbor (e.g., 
an EHR must be used for any patient without regard to payer status). 
The commenter proposed that we include a new requirement that a 
certifying body cannot certify EHRs or EHR Modules if they 
unnecessarily limit or restrict their

[[Page 36186]]

use or compatibility with other HIT (e.g., if an entity binds 
physicians to a particular entity to receive the EHR or the EHR Module, 
or uses a combination of certified EHR Modules that do not work 
together).
    Response. We appreciate the commenters' support for our proposal to 
incorporate the current ``recognition'' of certification bodies into 
the ONC-ATCB and ONC-ACB ``authorization'' processes. We agree with 
commenters that folding the ``recognition'' process into the ONC-ATCB 
and ONC-ACB ``authorization'' processes will lead to greater clarity 
and consistency for all stakeholders. Accordingly, the ONC-ATCB and 
ONC-ACB ``authorization'' processes will constitute the Secretary's 
``recognition'' of a certification body.
    This final rule only addresses the issue of how the Secretary 
recognizes a certifying body. It does not address issues related to the 
application of the exception or safe harbor, as those issues are beyond 
the scope of this final rule and are better directed to CMS and OIG, 
respectively. As noted in the Proposed Rule, CCHIT is the only 
organization that has both applied for and been granted ``recognized 
certification body'' status under ONC's Certification Guidance Document 
(CGD). As implied in the Proposed Rule and the CGD, all ``recognized 
certification bodies'' will lose their status upon the effective date 
of this final rule. As a result, they will need to reapply to become an 
ONC-ATCB (and in the future an ONC-ACB) in order to be a ``recognized 
certification body'' after the effective date of this final rule. Loss 
of ``recognized'' status under the CGD upon the effective date of this 
final rule does not impact the fact that certifications made by CCHIT 
while recognized under the CGD were made by a ``recognized 
certification body.''
    With respect to the request for clarification regarding the 
standards and interoperability requirements to which ONC-ATCBs and ONC-
ACBs would test and certify Complete EHRs and EHR Modules, we clarify 
that we will not adopt different or additional certification criteria 
to which Complete EHRs or EHR Modules must be tested and certified in 
order to meet the deeming provision, and we do not expect ONC-ATCBs and 
ONC-ACBs to use different certification criteria to test and certify 
Complete EHRs and EHR Modules. We believe that the certification 
criteria adopted by the Secretary specify several important 
interoperability requirements and build the foundation for more 
advanced interoperability in the future. It is also important to note 
that regardless of whether EHRs certified in 2009 or 2010 by a 
``recognized certification body'' qualify for donation under the EHR 
exception and safe harbor, these EHRs will not meet the definition of 
Certified EHR Technology and therefore must be recertified by an ONC-
ATCB in order to be used by an eligible professional or eligible 
hospital to demonstrate meaningful use.
    All other issues raised by commenters are outside the scope of this 
rulemaking and in many cases would require notice and comment 
rulemaking in order to be appropriately addressed.

M. Grandfathering

    Grandfathering would essentially involve a determination by the 
National Coordinator that existing EHR systems developed by vendors and 
self-developers, as well as those systems being used by providers in a 
possible modified state, are equivalent to the definition of Certified 
EHR Technology and thus are capable of being used to achieve meaningful 
use. Although we did not propose or discuss the concept of 
grandfathering in the Proposed Rule, several commenters made 
recommendations on the subject.
    Comments. On all three recent meaningful use related rulemakings 
(the HIT Standards and Certification Criteria interim final rule, the 
Medicare and Medicaid EHR Incentive Programs proposed rule, and the HIT 
Certification Programs proposed rule), HHS received comments related to 
the concept of ``grandfathering'' existing EHRs in some form or 
another. Some comments requested that we deem all CCHIT-certified EHRs 
from 2008 onward to be Certified EHR Technology. Others requested that 
we deem all existing EHRs regardless of whether these EHRs had been 
certified by CCHIT. In both cases, these commenters argued that this 
would enable eligible professionals and eligible hospitals who were 
early adopters to possess HIT that met the definition of Certified EHR 
Technology right away. One commenter offered a variant to this 
suggestion by adding a qualification that we should only deem EHRs if 
the EHR currently in the possession of an eligible professional or 
eligible hospital could enable them to meet some (at least 5) number of 
meaningful use objectives. While other commenters using this same line 
of reasoning believed that an EHR should qualify for grandfathering if 
it could enable an eligible professional or eligible hospital to meet 
all applicable objectives and measures, but that such certification 
would only be valid until the temporary certification program was 
operational. One commenter specifically recommended that ONC establish 
a petition process whereby an individual eligible professional or 
eligible hospital could apply directly to ONC for a waiver to use a 
non-certified EHR to qualify for meaningful use.
    Response. We believe that this final rule is the most appropriate 
rulemaking to address comments on grandfathering. The definition of 
Certified EHR Technology specified by Congress at section 3000 of the 
PHSA set forth clear parameters that dictate when HIT will be 
considered Certified EHR Technology. To be Certified EHR Technology, 
HIT must first meet the definition of a Qualified EHR, which in turn 
must be certified pursuant to the certification program(s) established 
under section 3001(c)(5) by the National Coordinator as meeting 
standards adopted under section 3004 by the Secretary. Certification is 
used to provide consumers with assurance and confidence that the 
product or service they seek to purchase and use will work as expected 
and will include the capabilities for which it was purchased.
    While grandfathering may appear convenient in that it would allow 
eligible professionals and eligible hospitals to use the HIT they 
already have in place, we believe that in this context grandfathering 
is inappropriate and would be inconsistent with the statutory 
requirements for Certified EHR Technology specified in the PHSA. 
Grandfathering provides neither assurance nor confidence for eligible 
professionals and eligible hospitals that their existing HIT will have 
the capacity to support their attempts to meet meaningful use Stage 1 
objectives and measures. In this regard, we do not believe that the 
variations to ``grandfathering'' some commenters suggested (that an EHR 
should be grandfathered if it could enable an eligible professional or 
eligible hospital to meet some or all applicable meaningful use 
objectives and measures) are valid approaches. Conversely, we believe 
those approaches are risky from a programmatic perspective with respect 
to the potential for fraud, and from an eligible professional or 
eligible hospital's perspective in that they would have no demonstrable 
proof that their EHR possessed the capabilities necessary to meet the 
certification criteria adopted by the Secretary. More importantly, if 
we were to permit grandfathering according to the logic expressed by 
these commenters, the only way we, and the commenters, would be able to 
tell if an EHR should legitimately be deemed grandfathered would be if 
the eligible professional or eligible hospital had successfully

[[Page 36187]]

achieved meaningful use. We question whether commenters would be 
willing to take the risk of attempting meaningful use without the 
certainty of knowing that their EHR provided the capabilities they 
would need to attempt to achieve it.
    Furthermore, while a deeming of this sort may address a very short 
term need of existing HIT users, we believe it would significantly 
undercut our long-term policy goals and objectives, as well as provide 
eligible professionals and eligible professionals with a false sense of 
security. Without the assurances provided by the testing and 
certification process, grandfathering would require HHS to permit 
eligible professionals and eligible hospitals to use HIT that may be 
incapable from the start of supporting their achievement of meaningful 
use Stage 1. Along those lines, we do not believe that the petition and 
waiver process a commenter suggested is a feasible option because HHS 
would incur the risk that eligible professionals and eligible hospitals 
would fail to achieve meaningful use Stage 1 because their existing HIT 
is incapable of meeting the applicable objectives and measures even 
though we had deemed it ``certified.''

N. Concept of ``Self-Developed''

    We stated in the Proposed Rule that we interpreted the HIT Policy 
Committee's use of the word ``self-developed'' to mean a Complete EHR 
or EHR Module that has been designed, modified, or created by, or under 
contract for, a person or entity that will assume the total costs for 
its testing and certification and will be a primary user of the 
Complete EHR or EHR Module. We noted that self-developed Complete EHRs 
and EHR Modules could include brand new Complete EHRs or EHR Modules 
developed by a health care provider or their contractor. We further 
noted that it could also include a previously purchased Complete EHR or 
EHR Module which is subsequently modified by the health care provider 
or their contractor and where such modifications are made to 
capabilities addressed by certification criteria adopted by the 
Secretary. We specifically stated that we would limit the scope of 
``modification'' to only those capabilities for which the Secretary has 
adopted certification criteria because other capabilities (e.g., a 
different graphical user interface (GUI)) would not affect the 
underlying capabilities a Complete EHR or EHR Module would need to 
include in order to be tested and certified. Accordingly, we stated 
that we would only refer to the Complete EHR or EHR Module as ``self-
developed'' if the health care provider paid the total costs to have 
the Complete EHR or EHR Module tested and certified.
    Comments. Multiple hospitals and hospital associations requested 
that we clarify the definition of ``self-developed'' to include an 
indication of the extent to which modifications can be made to 
previously certified Complete EHRs or EHR Modules without requiring a 
system to be certified as ``self-developed.'' The commenters noted that 
we have clearly stated that eligible professionals and eligible 
hospitals bear full responsibility for making certified EHR Modules 
work together. Therefore, the commenters contended that providers must 
have the ability to make needed modifications to certified EHR Modules 
to achieve that purpose. The commenters stated that often there is a 
need for custom configurations or settings within the parameters of 
certified EHRs, including modifications that may be necessary to ensure 
that the EHR works properly when implemented within an organization's 
entire HIT environment. The commenters further stated that such 
modifications may affect, or even enhance, the capabilities addressed 
by the certification criteria by providing additional and specific 
decision-support functions or allowing for additional quality 
improvement activities. The commenters asserted that as long as the 
system can still perform the function for which it was originally 
certified, these modifications should not trigger the need for a self-
developed certification, even if the changes are made to the 
capabilities addressed by the certification criteria.
    The commenters stated clarity was needed due to the substantial 
resources that will be required for certification of self-developed 
systems. In addition, commenters stated that, for legal compliance 
purposes, clarity will allow providers to confidently submit 
attestations to federal and state agencies about the certification 
status of the Certified EHR Technology they use.
    Response. We understand the unique needs and requirements eligible 
professionals and eligible hospitals have with respect to successfully 
implementing and integrating HIT into operational environments. We 
provided a description of the term ``self-developed'' in the Proposed 
Rule's preamble for two reasons. First, in order to provide greater 
clarity for stakeholders regarding who would be responsible for the 
costs associated with testing and certification and, second, to clearly 
differentiate in our impact analysis those Complete EHRs and EHR 
Modules that would be certified once and most likely sold to many 
eligible professionals and eligible hospitals from those that would be 
certified once and used primarily by the person or entity who paid for 
the certification. We believe that many commenters were not concerned 
about the fact that brand new, built from scratch self-developed 
Complete EHRs and EHR Modules would need to be tested and certified. 
Rather, it appeared that commenters were concerned about whether any 
modification to an already certified Complete EHR or EHR Module, 
including those that would be enhancements or required to integrate 
several EHR Modules, would invalidate a certification or certifications 
and consequently require the eligible professional or eligible hospital 
to seek a new certification because it would be considered self-
developed. We believe this concern stems from the following statement 
we made in the preamble of the Proposed Rule.

    Self-developed Complete EHRs and EHR Modules could include brand 
new Complete EHRs or EHR Modules developed by a health care provider 
or their contractor. It could also include a previously purchased 
Complete EHR or EHR Module which is subsequently modified by the 
health care provider or their contractor and where such 
modifications are made to capabilities addressed by certification 
criteria adopted by the Secretary. We limit the scope of 
``modification'' to only those capabilities for which the Secretary 
has adopted certification criteria because other capabilities (e.g., 
a different graphical user interface (GUI)) would not affect the 
underlying capabilities a Complete EHR or EHR Module would need to 
include in order to be tested and certified.

    In response to these concerns, we would like to further clarify the 
intent of our statements, specifically the statement that a self-
developed Complete EHR or EHR Module ``could also include a previously 
purchased Complete EHR or EHR Module which is subsequently modified by 
the health care provider or their contractor and where such 
modifications are made to capabilities addressed by certification 
criteria adopted by the Secretary.'' We agree with commenters that not 
every modification would or should constitute a modification such that 
a Complete EHR or EHR Module's certified status would become invalid. 
We provided an example in the proposed rule, quoted above, that spoke 
to modifications not related to any of the capabilities addressed by 
certification criteria adopted by the Secretary. We did not, however, 
provide any additional information regarding what we would consider an 
appropriate or inappropriate modification to an already certified 
Complete EHR or EHR Module

[[Page 36188]]

and now take the opportunity to provide that clarification.
    We recognize that a certified Complete EHR or certified EHR Module 
may not automatically work ``out of the box'' once it is implemented in 
an operational environment. We also cautioned eligible professionals 
and eligible hospitals in the HIT Standards and Certification Criteria 
interim final rule that, if they chose to use EHR Modules to meet the 
definition of Certified EHR Technology, they alone would be responsible 
for properly integrating multiple EHR Modules. Given that many of the 
certification criteria adopted by the Secretary express minimum 
capabilities, which may be added to or enhanced by eligible 
professionals and eligible hospitals to meet their health care delivery 
needs (e.g., more than five rules could be added to the clinical 
decision support capability), we believe that it is unrealistic to 
expect that the certified capabilities of a Complete EHR or EHR Module 
will remain 100% unmodified in all cases. As a result, we believe it is 
possible for an eligible professional or eligible hospital to modify a 
Complete EHR or EHR Module's certified capability provided that due 
diligence is taken to prevent such a modification from adversely 
affecting the certified capability or precluding its proper operation. 
While we cannot review every eligible professional and eligible 
hospital's use of Certified EHR Technology and every potential 
modification that may be made to determine whether such modification 
may have invalidated a Complete EHR or EHR Module's certification, we 
strongly urge eligible professionals and eligible hospitals to consider 
the following. Certification is meant to provide assurance that a 
Complete EHR or EHR Modules will perform according to the certification 
criteria to which they were tested and certified. Any modification to a 
Complete EHR or EHR Module after it has been certified has the 
potential to jeopardize the proper operation of the Complete EHR or EHR 
Module and thus the eligible professional or eligible hospital's 
ability to achieve meaningful use. If an eligible professional or 
eligible hospital would like absolute assurance that any modifications 
made did not impact the proper operation of certified capabilities, 
they may find it prudent to seek to have the Complete EHR or EHR 
Module(s) retested and recertified.

O. Validity of Complete EHR and EHR Module Certification and Expiration 
of Certified Status

    In the Proposed Rule, we discussed the validity of ``certified 
status'' of Complete EHRs and EHR Modules, as well as the expiration of 
that status as it related to the definition of Certified EHR 
Technology. We stated that certification represented ``a snapshot, a 
fixed point in time, where it has been confirmed that a Complete EHR or 
EHR Module has met all applicable certification criteria adopted by the 
Secretary.'' We went on to say that as the Secretary adopts new or 
modified certification criteria, the previously adopted set of 
certification criteria would no longer constitute all of the applicable 
certification criteria to which a Complete EHR or EHR Module would need 
to be tested and certified. Thus, we clarified that after the Secretary 
has adopted new or modified certification criteria, a previously 
certified Complete EHR or EHR Module's certification would no longer be 
valid for purposes of meeting the definition of Certified EHR 
Technology. In other words, because new or modified certification 
criteria had been adopted, previously issued certifications would no 
longer indicate that a Complete EHR or EHR Module possessed all of the 
capabilities necessary to support an eligible professional's or 
eligible hospital's achievement of meaningful use. Accordingly, we 
noted that Complete EHRs and EHR Modules that had been certified to the 
previous set of adopted certification criteria would no longer 
constitute ``Certified EHR Technology.''
    We also discussed that the planned two-year schedule for updates to 
meaningful use objectives and measures and correlated certification 
criteria created a natural expiration with respect to the validity of a 
previously certified Complete EHR's or EHR Module's certified status 
and its continued ability to be used to meet the definition of 
Certified EHR Technology. We stated that after the Secretary has 
adopted new or modified certification criteria, previously certified 
Complete EHRs and EHR Modules must be retested and recertified in order 
to continue to qualify as Certified EHR Technology.
    We offered further clarification by stating that regardless of the 
year and meaningful use stage at which an eligible professional or 
eligible hospital enters the Medicare or Medicaid EHR Incentive 
Program, the Certified EHR Technology that would need to be used would 
have to include the capabilities necessary to meet the most current 
certification criteria adopted by the Secretary at 45 CFR part 170 
subpart C in order to meet the definition of Certified EHR Technology. 
Finally, we asked for public comment on the best way to assist eligible 
professionals and eligible hospitals who begin meaningful use in 2013 
or 2014 (at Stage 1) in identifying Complete EHRs and/or EHR Modules 
that have been certified to the most current set of adopted 
certification criteria and therefore could be used to meet the 
definition of Certified EHR Technology.
    Comments. Several commenters disagreed with our position. Other 
commenters agreed and contended that Certified EHR Technology should 
always be as up-to-date and as current as possible. Of those commenters 
that disagreed, their concerns focused on two areas: The validity/
expiration of certified status and how eligible professionals and 
eligible hospitals who adopt Certified EHR Technology in the year 
before we anticipate updating adopted standards, implementation 
specifications, and certification criteria for a future stage of 
meaningful use would be affected.
    Commenters asserted that some certification criteria were unlikely 
to change between meaningful use stages and that a Complete EHR or EHR 
Module's certification should remain valid and not expire until the 
Secretary had adopted updated certification criteria. These commenters 
requested that ONC only make changes to certification criteria on a 
cyclical basis and only when necessary for meaningful use or to advance 
interoperability. Finally, within the context of their responses, many 
of these commenters signaled favorable support for our proposal to 
include ``differential certification'' in the permanent certification 
program. In that regard, some commenters noted that we should not 
require Complete EHRs and EHR Modules certified under the purview of 
the temporary certification program to be fully retested and 
recertified once the permanent certification program has been 
initiated.
    A number of commenters expressed concerns about our position and 
contended that it required eligible professionals and eligible 
hospitals who adopt Certified EHR Technology in 2012 (to attempt 
meaningful use Stage 1) to upgrade their Certified EHR Technology twice 
in two years (according to the proposed meaningful use stage 
staggering) in order to continue to be eligible for meaningful use 
incentives during 2013 when they would only still have to meet 
meaningful use Stage 1. Some of these commenters viewed this as a 
penalty and disagreed with our

[[Page 36189]]

position that eligible professionals and eligible hospitals should have 
to use Certified EHR Technology that had been certified to the most 
recently adopted certification criteria. Additionally, these commenters 
conveyed their belief that it is not in the best interest of eligible 
professionals and eligible hospitals to require that they use Certified 
EHR Technology that includes more advanced capabilities than are 
necessary to qualify for the meaningful use stage that they are 
attempting to meet. Finally, one commenter requested that we offer a 
graphical depiction to more clearly convey our position.
    Response. We appreciate commenters' support for our proposal for 
differential certification. Because this concept is solely relevant to 
the policies of the permanent certification program, we do not address 
it in this final rule.
    As previously mentioned in both the HIT Standards and Certification 
Criteria interim final rule and the Medicare and Medicaid EHR Incentive 
Programs proposed rule, ONC and CMS anticipate that the requirements 
for meaningful use will be adjusted every two years. We do not expect 
to adopt certification criteria more frequently than every two years. 
In its proposed rule (75 FR 1854), CMS also indicated that ``[t]he 
stages of criteria of meaningful use and how they are demonstrated are 
described further in this proposed rule and will be updated in 
subsequent proposed rules to reflect advances in HIT products and 
infrastructure. This could include updates to the Stage 1 criteria in 
future rulemaking.'' (Emphasis added.)
    We believe that commenters who expressed concerns and objected to 
our discussion of the expiration/validity of a Complete EHR or EHR 
Module's certified status did not account for the real possibility that 
the requirements for an eligible professional or eligible hospital to 
meet meaningful use Stage 1 in 2013 (or 2014) could be different and 
possibly more demanding than they were for meaningful use Stage 1 in 
2012. Contrary to some commenters' assumptions, it is possible that 
while establishing the objectives and measures for meaningful use Stage 
2 (in a subsequent rulemaking) that CMS could revise what it means to 
meet meaningful use Stage 1 in 2013. Consequently, such revisions could 
include additional requirements, based on advances in HIT, beyond the 
requirements that will be established in the forthcoming final rule 
that specifies what meaningful use Stage 1 will require in 2011 and 
2012. Therefore, the potential remains that an eligible professional or 
eligible hospital who becomes a meaningful user in 2012 would need 
additional, not currently present, capabilities from Certified EHR 
Technology in order to meet meaningful use Stage 1 requirements in 
2013.
    In this regard, and consistent with the caveat many commenters 
articulated, we identified that an eligible professional or eligible 
hospital would no longer be able to assert that a Complete EHR or EHR 
Module's certification was valid for purposes of satisfying the 
definition of Certified EHR Technology in subsequent years for at least 
two reasons: (1) The certification criteria related to particular 
capabilities had been modified; and/or (2) the standard(s) and 
implementation specification(s) associated with a certification 
criterion had been modified (newly adopted or replaced). With respect 
to either of these two reasons, in order for a Complete EHR or EHR 
Module to continue to meet the definition of Certified EHR Technology, 
it would need to be retested and recertified to the new certification 
criteria or newly adopted standards and/or implementation 
specifications for the subsequent years for which they had been 
adopted. Only then would an eligible professional or eligible hospital 
be able to assert that it continues to possess a Complete EHR or EHR 
Module with a valid certification that could be used to meet the 
definition of Certified EHR Technology. For example, a Complete EHR 
would need to be retested and recertified as being compliant with a 
newly adopted standard for the 2013/2014 certification period in order 
for a Complete EHR developer, an eligible professional, or an eligible 
hospital to validly assert that the certification issued for the 
Complete EHR enables it to meet the definition of Certified EHR 
Technology. As we stated in the Proposed Rule, if the previously 
certified Complete EHR were not retested and recertified as being 
compliant with the newly adopted standard, it would not ``lose its 
certification.'' However, the previous certification would no longer 
enable the Complete EHR to meet the definition of Certified EHR 
Technology. Many commenters recognized this fact by indicating that in 
situations where interoperability was a focus, retesting and 
recertification would be needed and justified. With respect to the 
validity of a Complete EHR or EHR Module's certification, we ask 
commenters to consider how they would expect to meet a subsequent stage 
of meaningful use without the technical capabilities necessary to do 
so. A Complete EHR or EHR Module's certification is only as good as the 
capabilities that can be associated with that certification. If the 
Secretary adopts new standards, implementation specifications, or 
certification criteria, a Complete EHR or EHR Module may no longer 
provide a valid set of capabilities to satisfy the definition of 
Certified EHR Technology or support an eligible professional's or 
eligible hospital's attempt to achieve a particular meaningful use 
stage.
    Accordingly, and because the HITECH Act requires eligible 
professionals and eligible hospitals to use Certified EHR Technology in 
order to qualify for incentive payments, we reaffirm our previous 
position. Regardless of the year and meaningful use stage at which an 
eligible professional or eligible hospital enters the Medicare or 
Medicaid EHR Incentive Program, the Certified EHR Technology that they 
would need to use would have to include the capabilities necessary to 
meet the most current certification criteria adopted by the Secretary 
at 45 CFR 170 subpart C. We believe that this position takes into 
account the best interests of eligible professionals and eligible 
hospitals. It will also serve to assure eligible professionals and 
eligible hospitals who implement HIT that meets the definition of 
Certified EHR Technology that they will have the requisite technical 
capabilities to attempt to achieve meaningful use. Just as important, 
this position ensures that all Certified EHR Technology will have been 
tested and certified to the same standards and implementation 
specifications and provide the same level of interoperability, which 
would not be the case if we were to permit different variations of 
Certified EHR Technology to exist.
    To further address concerns raised by the commenters, we clarify 
that if the temporary certification program sunsets on December 31, 
2011 and the permanent certification program is fully constituted at 
the start of 2012, Complete EHRs and EHR Modules that were previously 
certified by ONC-ATCBs to the 2011/2012 certification criteria adopted 
by the Secretary will not need to be retested and recertified as having 
met the certification criteria for those years. In other words, the 
fact that the permanent certification program had replaced the 
temporary certification program would not automatically invalidate 
certifications that were previously issued by ONC-ATCBs pursuant to the 
2011/2012 certification criteria.
    However, we reiterate for commenters what we stated in the Proposed 
Rule (75 FR 11351): ``[S]ince a new certification program would exist, 
which would include different processes, we emphasize that Complete 
EHRs and

[[Page 36190]]

EHR Modules tested and certified under the temporary certification 
program by an ONC-ATCB would need to be tested and certified according 
to the permanent certification program once the Secretary adopts 
certification criteria to replace, amend, or add to previously adopted 
certification criteria.'' Thus, once the permanent certification 
program is fully constituted and after the Secretary has adopted 
additional or revised certification criteria (which we expect will 
occur approximately two years from now), all Complete EHRs and EHR 
Modules that were previously certified under the temporary 
certification program by ONC-ATCBs will need to be tested by an 
accredited testing laboratory and certified by an ONC-ACB. Pursuant to 
our discussion regarding the sunset of the temporary certification 
program combined with the two year cycle on which we expect to adopt 
certification criteria, we anticipate the testing and certification of 
Complete EHRs and EHR Modules to the 2013/2014 certification criteria 
would need to begin by mid-2012 in order for Complete EHRs and EHR 
Modules to be retested and recertified prior to the start of the next 
meaningful use reporting period.
    We provide the following illustration overlaid on CMS's proposed 
staggered payment year/adoption year chart for the Medicare program to 
more clearly convey the discussion above. This illustration would also 
be applicable to the Medicaid program.

----------------------------------------------------------------------------------------------------------------
                                                                   Payment year
       First payment year        -------------------------------------------------------------------------------
                                         2011                2012                2013                2014
----------------------------------------------------------------------------------------------------------------
2011............................  Stage 1...........  Stage 1...........  Stage 2...........  Stage 2.
2012............................  ..................  Stage 1...........  Stage 1...........  Stage 2.
2013............................  ..................  ..................  Stage 1...........  Stage 2.
2014............................  ..................  ..................  ..................  Stage 1.
                                  Complete EHRs and EHR Modules
                                   certified by ONC-ATCBs or ONC-ACBs
                                   \1\ to certification criteria adopted
                                   for 2011 & 2012 meet the definition
                                   of Certified EHR Technology.
                                  Complete EHRs and EHR Modules
                                   certified by ONC-ACBs to
                                   certification criteria adopted for
                                   2013 & 2014 meet the definition of
                                   Certified EHR Technology.
----------------------------------------------------------------------------------------------------------------

    Comments. In response to our question about how to best indicate to 
eligible professionals and eligible hospitals those Complete EHRs and/
or EHR Modules certified to the most current set of adopted 
certification criteria (which could be used to meet the definition of 
Certified EHR Technology), several commenters offered suggestions 
regarding ``labeling'' conventions for Complete EHRs and EHR Modules. 
Overall, commenters indicated that specific ``labeling'' parameters 
would help clarify the ``currency'' of a Complete EHR or EHR Module's 
certification and whether the certification was valid. These commenters 
offered a variety of suggested techniques, including identifying 
Complete EHRs and EHR Modules according to: the applicable meaningful 
use stage they could be used for; the month and year they had been 
tested and certified; and the year associated with the most current set 
of adopted standards, implementation specifications, and certification 
criteria. Additionally, in light of the EHR Module ``bundle'' concept 
we proposed with respect to when EHR Modules need to be tested and 
certified to adopted privacy and security criteria, one commenter 
recommended that we assign specific ``labeling'' constraints to 
certifications issued to pre-coordinated, integrated bundles of EHR 
Modules. Another comment suggested ``labeling'' constraints be assigned 
when a Complete EHR or EHR Module had been tested at an eligible 
professional or eligible hospital's site (e.g., at the hospital where 
the Complete EHR is deployed).
---------------------------------------------------------------------------

    \1\ If the permanent certification program is fully constituted 
and the temporary certification program sunsets on 12/31/2011, all 
new requests made after 12/31/2011 for certification of Complete 
EHRs or EHR Modules to the 2011/2012 certification criteria will be 
processed by an ONC-ACB.
---------------------------------------------------------------------------

    Response. We agree with the commenters who requested more specific 
requirements surrounding how a Complete EHR or EHR Module's certified 
status should be represented and communicated and believe that it will 
provide the most benefit to eligible professionals and eligible 
hospitals who are interested in easily identifying Complete EHRs and 
EHR Modules that have been tested and certified by an ONC-ATCB. In 
fact, Guide 65, Section 14, requires evidence of policies and 
procedures for use and display of certificates (e.g., logos). We 
proposed and, as discussed above, will require applicants for ONC-ATCB 
status to provide the National Coordinator with a copy of their 
policies related to the use and display of certificates. We believe 
that the most effective method to ensure that the certified status of a 
Complete EHR or EHR Module is appropriately represented and 
communicated is through the addition of a new principle to the 
Principles of Proper Conduct for ONC-ATCBs. This new Principle of 
Proper Conduct will also provide additional clarity for applicants in 
terms of the information that the National Coordinator expects to be 
contained in the copy of the policies and procedures associated with 
the use and display of certificates submitted by an applicant as part 
of its application.
    Accordingly, we also believe that this new Principle of Proper 
Conduct for ONC-ATCBs related to how a Complete EHR or EHR Module's 
certification is communicated is a logical extension of our proposals, 
is similar to the requirement we place on ONC-ATCBs with respect to how 
they represent themselves, and provides more specificity and clarity 
around requirements to which ONC-ATCBs would already be subject. The 
new Principle of Proper Conduct requires that:
     All certifications must require that a Complete EHR or EHR 
Module developer conspicuously include the following text on its Web 
site and in all marketing materials, communications statements, and 
other assertions related to the Complete EHR or EHR Module's 
certification:
     [cir] ``This [Complete EHR or EHR Module] is 201[X]/201[X] 
compliant and has been certified by an ONC-ATCB in accordance with the 
applicable certification criteria adopted by the Secretary of Health 
and Human Services. This certification does not represent an 
endorsement by the U.S. Department of Health and Human Services or 
guarantee the receipt of incentive payments.''; and
     [cir] The information an ONC-ATCB is required to report to the 
National Coordinator for the specific Complete EHR or EHR Module at 
issue.
     A certification issued to an integrated bundle of EHR 
Modules shall be treated the same as a certification

[[Page 36191]]

issued to a Complete EHR for the purposes of the above requirement 
except that it must also indicate each EHR Module that comprises the 
bundle.
    With respect to the requirement that includes ``201[X]/20`[X],'' we 
expect ONC-ATCBs to put the years ``2011/2012'' where we have provided 
for variability in the date range and have only provided this 
flexibility in the rare circumstance that the temporary certification 
program does not sunset according to the schedule that we have 
discussed. Given our clarifications about the validity of a Complete 
EHR or EHR Module's certification, we believe that it would be 
inappropriate and misleading to adopt an identification requirement 
solely associated with meaningful use stages. We also believe that it 
would be inappropriate to constrain a particular certification based on 
whether the certification could be attributed to a particular entity at 
a particular location. While unlikely, we do not want to presume that 
such a certified Complete EHR or EHR Module would or could not be 
useful to another eligible professional or eligible hospital.
    We do, however, agree with the commenter who suggested the specific 
constraint for a bundle of EHR Modules. Such bundles, by their very 
nature, would otherwise constitute a Complete EHR and therefore must be 
integrated in such a way in order to even be tested and certified as a 
bundle. In the case of a bundle of EHR Modules, the bundle is greater 
than the sum of each individual EHR Module, and for that reason, we 
would like to clarify that EHR Modules, once certified as part of a 
bundle, would not separately inherit a certification just because they 
were certified as part of a bundle. For example, if EHR Modules A, B, 
C, and D, are certified as an integrated bundle, EHR Module C would not 
on its own be certified, just by virtue of the fact that it was part of 
a certified bundle. If an EHR Module developer wanted to make EHR 
Module C available for uses outside the bundle, then they would have to 
seek to have EHR Module C separately tested and certified.
    Comments. Several commenters requested that we clarify whether 
every single updated version of a Complete EHR or EHR Module would need 
to be retested and recertified in order to have a valid certification 
and whether there would be a mechanism available to accommodate routine 
changes and product maintenance without the need to fully retest and 
recertify each instantiation of a previously certified Complete EHR or 
EHR Module. Some of these commenters stressed that they provide bug-
fixes and other maintenance upgrades to customers on a regular basis 
and that those versions are normally denoted by a new ``dot release'' 
(e.g., version 7.1.1 when 7.1 received certification).
    Response. We understand that Complete EHR and EHR Module developers 
will conduct routine maintenance. We also recognize that at times 
Complete EHR and EHR Module developers will provide new or modified 
capabilities to either make the Complete EHR or EHR Module perform more 
efficiently and/or to improve user experiences related to certain 
functionality (e.g., a new graphical user interface (GUI)). Our main 
concern, as we stated in the preamble, is whether these changes 
adversely affect the capabilities to which a Complete EHR or EHR Module 
has already been tested and certified and whether those changes are 
such that the Complete EHR or EHR Module would no longer support an 
eligible professional or eligible hospital's achievement of meaningful 
use. Accordingly, we clarify that a previously certified Complete EHR 
or EHR Module may be updated for routine maintenance or to include new 
capabilities that both affect capabilities related and unrelated to the 
certification criteria adopted by the Secretary without its 
certification becoming invalid.\2\ However, we do not believe that it 
would be wise to simply permit a Complete EHR or EHR Module developer 
to claim without any verification that the routine maintenance or new/
modified capabilities included in a new version did not adversely 
affect the proper functioning of the previously certified capabilities. 
We believe that an ONC-ATCB should, at a minimum, review an attestation 
submitted by a Complete EHR or EHR Module developer indicating the 
changes that were made, the reasons for those changes, and other such 
information and supporting documentation that would be necessary to 
properly assess the potential effects the new version would have on 
previously certified capabilities.
---------------------------------------------------------------------------

    \2\ We understand that Complete EHR and EHR Module developers 
typically consider a ``minor version release'' to be, for example, a 
version number change from 3.0 to 3.1 and consider a ``major version 
release'' to be, for example, a version number change from 4.0 to 
5.0. In providing for this flexibility, we do not presume the 
version numbering schema that a Complete EHR or EHR Module developer 
may choose to utilize. As a result, we do not preclude a Complete 
EHR or EHR Module developer from submitting an attestation to an 
ONC-ATCB for a Complete EHR or EHR Module whose version number may 
represent a minor or major version change.
---------------------------------------------------------------------------

    As a result, we have added to both Sec.  170.445 and Sec.  170.450 
a requirement that an ONC-ATCB must accept requests for an updated 
version of a previously certified Complete EHR or EHR Module to inherit 
the previously certified Complete EHR or EHR Module's issued 
certification without being retested and recertified. However, the 
Complete EHR or EHR Module developer must submit an attestation as 
described above in the form and format specified by the ONC-ATCB that 
the newer version does not adversely affect the proper functionality of 
previously certified capabilities. Upon receipt of the attestation, an 
ONC-ATCB would be permitted to determine whether the updates and/or 
modifications are such that the new version would adversely affect 
previously certified capabilities and therefore need to be retested and 
recertified, or whether to grant certified status to the new version 
derived from the previously certified Complete EHR or EHR Module.
    If the ONC-ATCB awards a certification to a newer version of a 
previously certified Complete EHR or EHR Module, we expect the ONC-ATCB 
to include this issued certification in its weekly report to the 
National Coordinator. We note that aside from specifying an ONC-ATCB 
must provide this mechanism and review the submitted attestation, we do 
not specify the fees or any other processes an ONC-ATCB may determine 
necessary before granting certified status to a newer version of a 
previously certified Complete EHR or EHR Module based on the submitted 
attestation.

P. General Comments

    We received comments that were not attributable to a specific 
provision or proposal in the Proposed Rule, but were still within the 
scope of the temporary certification program. These comments were on 
such matters as the timing of the temporary certification program, the 
use of elements in the proposed permanent certification program for the 
temporary certification program, the potential for a backlog of 
requests for testing and certification, the costs of testing and 
certification, the use and testing of open source Complete EHRs or EHR 
Modules, and the safety of Complete EHRs and EHR Modules.
    Comments. One commenter suggested that we not implement the 
temporary certification program. Rather, the commenter suggested that 
we proceed straight to implementing the permanent certification 
program. Some other commenters suggested we were moving too fast, while 
still other commenters suggested we were not moving fast enough in 
implementing the temporary certification program. Some commenters

[[Page 36192]]

suggested utilizing elements that we proposed for the permanent 
certification program, such as accreditation and post market 
surveillance in the temporary certification program.
    Response. We discussed in detail the urgency for establishing the 
temporary certification program, particularly the need for making 
Certified EHR Technology available so that eligible professionals and 
eligible hospitals would have the ability to attempt to achieve 
meaningful use Stage 1. In discussing this urgency and the differences 
between the temporary certification program and the permanent 
certification program, we explained how there was not sufficient time 
to implement such elements as accreditation and post market 
surveillance. If we were to attempt to establish an accreditation 
process, Certified EHR Technology would likely not be available in a 
timely manner. Further, the limited time that we anticipate the 
temporary certification program being in existence prevents us from 
establishing a post market surveillance program. By the time we would 
be able to establish and get results from a post market surveillance 
program, the temporary certification program will likely have sunset.
    Comments. Commenters requested that we prevent testing and 
certification monopolies and backlogs of requests for testing and 
certification. Commenters also requested that we mandate pricing for 
testing and certification or at least establish a reasonable fee 
requirement.
    Response. We believe that through the policies we have established 
in this final rule that the temporary certification program is 
inclusive of as many potential applicants for ONC-ATCB status as 
possible and that we have created an environment that is likely to 
result in multiple ONC-ATCBs. Further, we believe that multiple ONC-
ATCBs and market dynamics, particularly competition, will address the 
commenters' concerns about potential monopolies, appropriate costs for 
testing and certification, and the timely and efficient processing of 
requests for the testing and certification of Complete EHRs and EHR 
Modules. Guide 65 also requires ONC-ATCBs to make their services 
accessible to all applicants whose activities fall within its declared 
field of operation (i.e., the temporary certification program), 
including not having any undue financial or other conditions. As noted 
throughout this rule, an ONC-ATCB must be in compliance with Guide 65 
to remain in good standing under the temporary certification program.
    Comments. One commenter requested that we only allow the testing 
and certification of open source Complete EHRs and EHR Modules under 
the temporary certification program and exclude proprietary Complete 
EHRs and EHR Modules. Commenters also inquired as to how we would test 
open source Complete EHRs and EHR Modules.
    Response. We do not agree with the commenter that the temporary 
certification program should be limited to only open source Complete 
EHRs and EHR Modules. Proprietary Complete EHRs and EHR Modules will 
likely be widely purchased and/or utilized by the HIT market and we see 
no valid reason to exclude them from the temporary certification 
program. Open source Complete EHRs and EHR Modules will be tested and 
certified in the same manner as proprietary Complete EHRs and EHR 
Modules under the temporary certification program.
    Comments. A few commenters expressed concern over the potential 
safety risks that could be associated with poorly planned, implemented, 
and used EHR technology and suggested that patient safety should be 
considered in the same context as the speed with which we develop and 
implement the temporary certification program.
    Response. We understand and are acutely aware of the concerns 
expressed by the commenters regarding patient health and safety. We 
believe that the temporary certification program has been sufficiently 
constituted to ensure that ONC-ATCBs will competently test and certify 
Complete EHRs and EHR Modules. Further, we have established a process 
in the temporary certification program that the National Coordinator 
could use to immediately suspend an ONC-ATCB's ability to perform 
testing and certification if there is reliable evidence indicating that 
allowing an ONC-ATCB to continue its testing and certification 
processes would pose an adverse risk to patient health and safety.

Q. Comments Beyond the Scope of This Final Rule

    In response to the Proposed Rule, some commenters chose to raise 
issues that are beyond the scope of our proposals. We do not summarize 
or respond to those comments in this final rule. However, we will 
review the comments and consider whether other actions may be 
necessary, such as addressing the comments in the permanent 
certification program's rulemaking or clarifying program operating 
procedures, based on the information or suggestions in the comments.

IV. Provisions of the Final Regulation

    For the most part, this final rule incorporates the provisions of 
the Proposed Rule. Those provisions of this final rule that differ from 
the Proposed Rule are as follows:
     In Sec.  170.401, we added ``the requirements that ONC-
ATCBs must follow to remain in good standing'' to properly identify 
that this subpart contains requirements that ONC-ATCBs must follow to 
remain in good standing under the temporary certification program. This 
reference was inadvertently left out of the Proposed Rule.
     In Sec.  170.402, we added the definitions of 
``development site,'' ``deployment site,'' and ``remote testing and 
certification.''
     In Sec.  170.405(b), we added ``or ONC-ATCB'' to clarify 
that either an applicant for ONC-ATCB status or an ONC-ATCB may, when 
necessary, utilize the specified correspondence methods. This reference 
was inadvertently left out of the Proposed Rule.
     In Sec.  170.423, in response to public comments, we added 
a new Principle of Proper Conduct designated as paragraph (k). The new 
Principle of Proper Conduct will require ONC-ATCBs to ensure that all 
Complete EHRs and EHR Modules are properly identified and marketed.
     In Sec.  170.423(e), we modified the language to require 
that ONC-ATCBs ``[u]se test tools and test procedures approved by the 
National Coordinator for the purposes of assessing Complete EHRs and/or 
EHR Modules compliance with the certification criteria adopted by the 
Secretary.''
     In Sec.  170.423(h), we have specified that an ONC-ATCB 
will be additionally required to report the clinical quality measures 
to which a Complete EHR or EHR Module has been tested and certified 
and, where applicable, any additional software a Complete EHR or EHR 
Module relied upon to demonstrate its compliance with a certification 
criterion or criteria adopted by the Secretary.
     In Sec.  170.423(i), in response to comments, we made 
revisions to clarify that an ONC-ATCB must retain all records related 
to tests and certifications according to ISO Guide 65 and ISO 17025 for 
the duration of the temporary certification program and provide copies 
of the final results of all completed tests and certifications to ONC 
at the conclusion of testing and certification activities under the 
temporary certification program.
     In Sec.  170.423(j), we made revisions to clarify that an 
ONC-ATCB will only

[[Page 36193]]

be responsible for issuing refunds in situations where the ONC-ATCB's 
conduct caused testing and certification to be suspended and a request 
for testing and certification is withdrawn, and in instances where the 
ONC-ATCB's conduct caused the testing and certification not to be 
completed or necessitated the recertification of Complete EHRs or EHR 
Modules it had previously certified.
     In Sec.  170.430(a)(2), to provide clarity in response to 
public comments, we have stated that the National Coordinator will 
review each part of the application ``in its entirety.''
     In Sec.  170.430(b)(1), we have removed the terms 
``inadvertent'' and ``minor'' in response to public comment.
     In Sec.  170.430(c), to respond to public comments, we 
have revised paragraph (c)(1) to allow an applicant for ONC-ATCB status 
to request an extension of the 15-day period provided to submit a 
revised application in response to a deficiency notice. We have revised 
paragraph (c)(2) to state that the National Coordinator can grant an 
applicant's request for an extension of the 15-day period based on a 
finding of good cause. We have also revised paragraph (c)(3) to permit 
the National Coordinator to request clarification of statements and the 
correction of errors or omissions in a revised application during the 
15-day period that the National Coordinator has to review a revised 
application.
     In Sec.  170.440(b), to respond to public comments, we 
have revised the paragraph to state, in relevant part, ``Each ONC-ATCB 
must prominently and unambiguously identify the scope of its 
authorization on its Web site, and in all marketing and communications 
statements (written and oral) pertaining to its activities under the 
temporary certification program.''
     In Sec.  170.445(a), we revised the paragraph to state 
that ``An ONC-ATCB must test and certify Complete EHRs to all 
applicable certification criteria adopted by the Secretary at subpart C 
of this part.'' This revision addresses public comments and ensures 
consistent requirements for ONC-ATCBs with regard to testing and 
certification requirements for Complete EHRs and EHR Modules. An ONC-
ATCB must not just be capable of conducting the applicable testing and 
certification, but they are required to perform the appropriate testing 
and certification.
     In Sec.  170.445, we re-designated paragraph (b) as 
paragraph (d). We then added a new provision, designated as paragraph 
(b), which states that an ONC-ATCB must provide the option for a 
Complete EHR to be tested and certified solely to the applicable 
certification criteria adopted by the Secretary at subpart C of this 
part. We also added another new provision, designated as paragraph (c), 
that requires an ONC-ATCB to accept requests for an updated version of 
a previously certified Complete EHR to inherit the previously certified 
Complete EHR issued certification without being retested and 
recertified.
     In Sec.  170.450, we removed proposed paragraphs (b) and 
(d) because they are redundant of other regulatory requirements within 
this subpart. We then added a new provision, designated as paragraph 
(b), which states that an ONC-ATCB must provide the option for an EHR 
Module or a bundle of EHR Modules to be tested and certified solely to 
the applicable certification criteria adopted by the Secretary at 
subpart C of this part. We also added another new provision, designated 
as paragraph (d), that requires an ONC-ATCB to accept requests for an 
updated version of a previously certified EHR Module or bundle of EHR 
Modules to inherit the previously certified EHR Module or bundle of EHR 
Modules issued certification without being retested and recertified.
     In Sec.  170.450(c), we revised the paragraph to state 
that EHR Modules shall be tested and certified to all privacy and 
security certification criteria adopted by the Secretary unless the EHR 
Module(s) is/are presented for testing and certification in one of the 
following manners: (1) The EHR Module(s) is/are presented for testing 
and certification as a pre-coordinated, integrated bundle of EHR 
Modules, which would otherwise meet the definition of and constitute a 
Complete EHR (as defined in 45 CFR 170.102), and one or more of the 
constituent EHR Modules is/are demonstrably responsible for providing 
all of the privacy and security capabilities for the entire bundle of 
EHR Module(s); or (2) An EHR Module is presented for testing and 
certification, and the presenter can demonstrate and provide 
documentation to the ONC-ATCB that a privacy and security certification 
criterion is inapplicable or that it would be technically infeasible 
for the EHR Module to be tested and certified in accordance with such 
certification criterion.
     In Sec.  170.457, we revised the section to require that 
an ONC-ATCB provide remote testing and certification for both 
development and deployment sites.
     In Sec.  170.465, we revised the section to provide the 
National Coordinator with the discretion to suspend an ONC-ATCB's 
operations if there is reliable evidence indicating that the ONC-ATCB 
has committed a Type-1 or Type-2 violation and that the continued 
testing and certification of Complete EHRs and/or EHR Modules by the 
ONC-ATCB could have an adverse impact on patient health or safety. An 
ONC-ATCB will have 3 days to respond to a notice of proposed suspension 
by explaining in writing why its operations should not be suspended. 
The National Coordinator will be permitted up to 5 days to review the 
response and issue a determination to the ONC-ATCB. The National 
Coordinator will make a determination to either rescind the proposed 
suspension, suspend the ONC-ATCB until it has adequately corrected a 
Type-2 violation, or propose revocation in accordance with Sec.  
170.465(c) and suspend the ONC-ATCB's operations for the duration of 
the revocation process. The National Coordinator may also make any one 
of the above determinations if an ONC-ATCB fails to submit a timely 
response to a notice of proposed suspension. A suspension will become 
effective upon an ONC-ATCB's receipt of a notice of suspension.
     In Sec.  170.465(c)(1) we revised the provision to state 
that ``[t]he National Coordinator may propose to revoke an ONC-ATCB's 
status if the National Coordinator has reliable evidence that the ONC-
ATCB committed a Type-1 violation.'' The term ``reliable'' was 
inadvertently left out of the Proposed Rule.
     In Sec.  170.490, we revised the section to state that the 
temporary certification program will sunset on December 31, 2011, or if 
the permanent certification program is not fully constituted at that 
time, then upon a subsequent date that is determined to be appropriate 
by the National Coordinator. We clarified that ONC-ATCBs will be 
prohibited from accepting new requests to test and certify Complete 
EHRs or EHR Modules ``on and after the temporary certification program 
sunset date.'' We also revised the section to state that ONC-ATCBs are 
permitted up to six months after the sunset date to complete all 
testing and certification activities associated with requests for 
testing and certification of Complete EHRs and/or EHR Modules received 
prior to the sunset date.
     We added Sec.  170.499 to incorporate by reference ISO/IEC 
Guide 65:1996 and ISO/IEC 17025:2005.

V. Technical Correction to Sec.  170.100

    We are making a technical correction to Sec.  170.100. We 
inadvertently left out a citation to section 3001(c)(5) of the PHSA, 
which provides the statutory basis for the National Coordinator to 
establish certification program(s) for

[[Page 36194]]

HIT. We have revised Sec.  170.100 to include reference to this 
statutory authority.

VI. Waiver of the 30-Day Delay in the Effective Date

    We ordinarily provide a 30-day delay in the effective date of a 
final rule as required by section 553(d) of the Administrative 
Procedure Act (APA). 5 U.S.C. Sec.  553(d). However, we can waive the 
30-day delay in the effective date if the Secretary finds, for good 
cause, that the delay is impracticable, unnecessary, or contrary to the 
public interest, and includes a statement of the finding and the 
reasons in the rule issued. The Secretary finds that good cause exists 
to waive the 30-day delay in the effective date of this final rule. A 
delayed effective date would be contrary to the public interest because 
it would restrict the ability of eligible professionals and eligible 
hospitals to adopt and implement Certified EHR Technology.
    As previously discussed, the HITECH Act provides incentive payments 
beginning in 2011 under the Medicare and Medicaid programs for eligible 
professionals and eligible hospitals that demonstrate meaningful use of 
Certified EHR Technology. The rules promulgated by ONC and CMS 
establish the regulatory framework through which eligible professionals 
and eligible hospitals may seek to qualify for those incentive 
payments. The Medicare and Medicaid EHR Incentive Programs proposed 
rule would establish meaningful use Stage 1 beginning in 2011. The HIT 
Standards and Certification Criteria interim final rule adopted 
certification criteria that directly support the proposed meaningful 
use Stage 1 objectives. This final rule establishes a temporary 
certification program that will allow Complete EHRs and EHR Modules to 
be tested and certified to the adopted certification criteria.
    As a result, Certified EHR Technology will not be available to 
eligible professionals and eligible hospitals until the temporary 
certification program begins. Eligible professionals and eligible 
hospitals will need time to select, adopt, and implement Certified EHR 
Technology before they attempt to demonstrate meaningful use in 2011. 
In addition, before testing and certification can begin, ONC must 
review and deem satisfactory applications that are submitted by 
organizations that seek ONC-ATCB status. A delayed effective date for 
this final rule would delay the process for making Certified EHR 
Technology available to eligible professionals and eligible hospitals 
prior to the proposed beginning of meaningful use Stage 1 in 2011.
    Several commenters voiced their strong concern that the temporary 
certification program needs to be established immediately so as to 
enable organizations to apply and be authorized to serve as ONC-ATCBs, 
to enable Complete EHR and EHR Module developers to have their Complete 
EHRs and/or EHR Modules certified, and to enable eligible professionals 
and eligible hospitals to obtain and implement Certified EHR Technology 
that will support their achievement of meaningful use. These commenters 
encouraged us to take immediate steps to issue this final rule and to 
permit organizations to apply for ONC-ATCB status. These commenters 
explained that it is necessary to have ONC-ATCBs in place as soon as 
possible in order for them to be positioned and prepared to test and 
certify Complete EHRs and EHR Modules in a timely manner.
    For the reasons stated above, we believe that a delayed effective 
date for this final rule would be contrary to the public interest. 
Therefore, we find there is good cause to waive the 30-day delay in the 
effective date of this final rule.

VII. Collection of Information Requirements

    In accordance with section 3507(j) of the Paperwork Reduction Act 
of 1995 (PRA), 44 U.S.C. 3501 et seq., the information collection 
included in this final rule has been submitted for emergency approval 
to OMB.
    The two information collections specified under sections A and B 
below were previously published in the Federal Register as part of the 
Proposed Rule and HHS invited interested persons to submit comments on 
any aspect of each of the two information collections, including the 
following: (1) Necessity and utility of the information collection; (2) 
the accuracy of the estimate of the burden; (3) ways to enhance the 
quality, utility, and clarity of the information to be collected; and 
(4) ways to minimize the burden of collection without reducing the 
quality of the collected information.
    The final rule contains one new information collection requirement 
pertaining to records retention and disclosure to ONC that was 
inadvertently left out of the Proposed Rule, but included in the 
emergency request to OMB. Please refer to section C below for this new 
information collection.

A. Collection of Information: Application for ONC-ATCB Status Under the 
Temporary Certification Program

    Section 170.420 requires an applicant for ONC-ATCB status to submit 
to the National Coordinator a completed application. The application 
consists of two parts. Part 1 requires an applicant to submit general 
identifying information, complete self audits to Guide 65 and ISO 
17025, and agree to adhere to the Principles of Proper Conduct for ONC-
ATCBs. Part 2 requires an applicant to complete a proficiency 
examination. The proficiency examination is not, however, considered 
``information'' for PRA collection purposes because it falls under the 
exception to the definition of information at 5 CFR 1320.3(h)(7). We 
estimated in the Proposed Rule that there would be no more than 3 
applicants for ONC-ATCB status. We also assumed that these applicants 
would be familiar with the relevant requirements found in Guide 65 and 
ISO 17025 and would have a majority, if not all, of the documentation 
requested in the application already developed and available before 
applying for ONC-ATCB status. Therefore, with the exception of 
completing a proficiency examination, we concluded that an applicant 
would only spend time collecting and assembling already developed 
information to submit with their application. Based on these 
assumptions, we estimated that it would take approximately:
     10 minutes for an applicant to provide the general 
identifying information requested in the application;
     2 hours to complete the Guide 65 self audit and assemble 
associated documentation;
     2 hours to complete the ISO 17025 self audit and assemble 
associated documentation; and
     20 minutes to review and agree to the ``Principles of 
Proper Conduct for ONC-ATCBs.''
    Comments. One commenter expressed a concern that we had 
underestimated the potential burden hours associated with applying for 
the temporary certification program. The commenter cited that while 
they had significant familiarity with testing and certification, their 
organization was not totally conformant to both Guide 65 and ISO 17025. 
The commenter stated that it had taken 120 hours to perform a gap 
analysis and that it would take approximately another several hundred 
more hours to properly conform to our

[[Page 36195]]

proposed requirements in order to be ready to apply for ONC-ATCB 
status.
    Response. We agree with this commenter. As noted, we previously 
assumed and based on that assumption, estimated that applicants for 
ONC-ATCB status would already be conformant with Guide 65 and ISO 17025 
and would have ``in hand'' the documentation we requested copies of as 
part of the ONC-ATCB application (``conformant applicants''). Given 
this commenter's analysis, we believe that it is reasonable to expect 
that one or two potential applicants for ONC-ATCB status (``partially 
conformant applicants'') may need to perform more upfront work than 
other potential applicants. As a result, we have revised our estimates 
below to account for the fact that, at most, two potential applicants 
may need to perform more upfront work to prepare to apply for ONC-ATCB 
status and to account for the fact that we now anticipate that there 
may be up to five applicants for ONC-ATCB status.
    In consultation with NIST, we believe that the 120 hours to perform 
a gap analysis is reasonable and have estimated that the remaining time 
it may take a potential applicant to become conformant with both Guide 
65 and ISO 17025 would be a maximum of 280 hours. Thus, in order to be 
ready to apply for ONC-ATCB status, we believe that it will take 
approximately a maximum of 400 hours for a potential applicant to 
become conformant with Guide 65 and ISO 17025 and have equally 
distributed the burden among these two requirements. Our revised 
analysis is expressed in the table below.

                                        Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
                                                                     Number of
      Type of respondent            Form name        Number of     responses per   Burden hours    Total burden
                                                    respondents     respondent     per response        hours
----------------------------------------------------------------------------------------------------------------
Conformant Applicant..........  ONC-ATCB                       3               1             4.5            13.5
                                 Application.
Partially Conformant Applicant  ONC-ATCB                       2               1           400.5             801
                                 Application.
                                                 ---------------------------------------------------------------
    Total.....................  ................  ..............  ..............  ..............           814.5
----------------------------------------------------------------------------------------------------------------

B. Collection of Information: ONC-ATCB Collection and Reporting of 
Information Related to Complete EHR and/or EHR Module Certifications

    Section 170.423(h) requires an ONC-ATCB to provide ONC, no less 
frequently than weekly, a current list of Complete EHRs and/or EHR 
Modules that have been tested and certified as well as certain minimum 
information about each certified Complete EHR and/or EHR Module.
    We did not receive any comments on this collection of information. 
We have, however, specified in this final rule two additional reporting 
elements that must be submitted by ONC-ATCBs on a weekly basis (i.e., 
clinical quality measures to which a Complete EHR or EHR Module has 
been tested and certified and, where applicable, any additional 
software a Complete EHR or EHR Module relied upon to demonstrate its 
compliance with a certification criterion or criteria adopted by the 
Secretary). ONC-ATCBs will be capturing these additional reporting 
elements in conjunction with the other information we request that they 
report on a weekly basis. Consequently, we do not believe that the 
reporting of these two additional elements will increase the reporting 
burden for ONC-ATCBs.
    Based on our new estimate that there may be up to 5 applicants that 
apply for ONC-ATCB status, we have revised our overall annual burden 
estimate. In doing so, we have maintained our prior assumptions. For 
the purposes of estimating the potential burden, we assume that all of 
the estimated applicants will apply and become ONC-ATCBs. We also 
assume that ONC-ATCBs will report weekly (i.e., respondents will 
respond 52 times per year). Finally, we assume that the information 
collections will be accomplished through electronic data collection and 
storage, which will be part of the normal course of business for ONC-
ATCBs. Therefore, with respect to this proposed collection of 
information, the estimated burden is limited to the actual electronic 
reporting of the information to ONC.

                                        Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
                                                                  Number of     Average  burden
             Type of respondent                  Number of      responses per      hours  per      Total burden
                                                respondents       respondent        response          hours
----------------------------------------------------------------------------------------------------------------
ONC-ATCB Testing and Certification Results..               5               52                1              260
----------------------------------------------------------------------------------------------------------------

C. Collection of Information: ONC-ATCB Retention of Testing and 
Certification Records and the Submission of Copies of Records to ONC

    Section 170.423(i) requires ONC-ATCBs to retain all records related 
to tests and certifications according to Guide 65 and ISO 17025 for the 
duration of the temporary certification program and provide copies of 
the final results of all completed tests and certifications to ONC at 
the conclusion of testing and certification activities under the 
temporary certification program.
    We do not believe that there are any specific recordkeeping burdens 
associated with this requirement. Based on our consultations with NIST, 
we understand that it is standard industry practice to retain records 
related to testing and certification. Therefore, we believe that the 
only burden attributable to our requirement is associated with the 
submission of copies to ONC of the final results of all completed tests 
and certifications.
    For the purposes of estimating the potential burden, we assume that 
all of the estimated number of applicants for the temporary 
certification program (i.e., five) will become ONC-ATCBs. For 
calculation purposes, we also assume that each ONC-ATCB will incur the 
same burden. We assume that on average each ONC-ATCB will test and 
certify an equal amount of ONC's estimate of the maximum amount of

[[Page 36196]]

Complete EHRs and EHR Modules that will be tested and certified under 
the temporary certification program as specified in the regulatory 
impact analysis of this final rule. We estimate the equal amount of 
Complete EHRs and/or EHR Modules that will be tested and certified by 
each of the 5 estimated ONC-ATCBs to be approximately 205. Finally, we 
assume that an ONC-ATCB will submit copies of the final results of all 
completed tests and certifications to ONC by either electronic 
transmission or paper submission. In either instance, we believe that 
an ONC-ATCB will spend a similar amount of time and effort in 
organizing, categorizing and submitting the requested information. We 
estimate that this amount of time will be approximately 8 hours for 
each ONC-ATCB. Our estimates are expressed in the table below.

                                        Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
                                                                  Number of     Average  burden
             Type of respondent                  Number of      responses per      hours per       Total burden
                                                respondents       respondent        response          hours
----------------------------------------------------------------------------------------------------------------
ONC-ATCB Testing and Certification Records..               5                1                8               40
----------------------------------------------------------------------------------------------------------------

VIII. Regulatory Impact Analysis

A. Introduction

    We have examined the impacts of this final rule as required by 
Executive Order 12866 on Regulatory Planning and Review (September 30, 
1993, as further amended), the Regulatory Flexibility Act (RFA) (5 
U.S.C. 601 et seq.), section 202 of the Unfunded Mandates Reform Act of 
1995 (2 U.S.C. 1532), Executive Order 13132 on Federalism (August 4, 
1999), and the Congressional Review Act (5 U.S.C. 804(2)).
    Executive Order 12866 directs agencies to assess all costs and 
benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health and safety 
effects, distributive impacts, and equity). A regulatory impact 
analysis (RIA) must be prepared for major rules with economically 
significant effects ($100 million or more in any one year). Based on 
the analysis of costs and benefits that follows, we have determined 
that this final rule covering the temporary certification program is 
not an economically significant rule because we estimate that the 
overall costs and benefits associated with the temporary certification 
program, including the costs associated with the testing and 
certification of Complete EHRs and EHR Modules, to be less than $100 
million per year. Nevertheless, because of the public interest in this 
final rule, we have prepared an RIA that to the best of our ability 
presents the costs and benefits of the final rule.

B. Why is this rule needed?

    As stated in earlier sections of this final rule, section 
3001(c)(5) of the PHSA provides the National Coordinator with the 
authority to establish a certification program or programs for the 
voluntary certification of HIT. This final rule is needed to outline 
the processes by which the National Coordinator would exercise this 
authority to authorize certain organizations to test and certify 
Complete EHRs and/or EHR Modules. Once certified, Complete EHRs and EHR 
Modules will be able to be used by eligible professionals and eligible 
hospitals as, or be combined to create, Certified EHR Technology. 
Eligible professionals and eligible hospitals who seek to qualify for 
incentive payments under the Medicare and Medicaid EHR Incentive 
Programs are required by statute to use Certified EHR Technology.

C. Executive Order 12866--Regulatory Planning and Review Analysis

1. Comment and Response
    Comments. A few commenters expressed concerns that the costs we 
attributed in the Proposed Rule related to the testing and 
certification of Complete EHRs and EHR Modules were too high, 
unrealistic, and unreliable. One commenter requested that we remove our 
cost estimates because they believed they were based on a monopolistic 
pricing structure. Other commenters indicated that we should regulate 
the pricing related to testing and certification in order to ensure 
that prices were not exorbitant and did not preclude smaller Complete 
EHR and EHR Module developers from being able to attain certification 
for their product.
    Response. We understand the commenters' concerns; however, we have 
a responsibility to put forth a good faith effort to estimate the 
potential costs associated with this final rule. Part of that effort 
includes using the best available data to inform our assumptions and 
estimates. While we were open to revising our cost estimates in 
response to public comment, in no instance did a commenter provide 
alternative estimates or reference additional information from which we 
could base revisions. Conversely, we believe that commenters who 
expressed concerns about the potential costs, largely did so from the 
perspective of stating a request that we ensure the costs for testing 
and certification were not prohibitively high.
    While we understand these commenters' perspectives, we do not 
believe that it is appropriate to dictate the minimum or maximum amount 
an ONC-ATCB should be able to charge for testing and certifying a 
Complete EHR or EHR Module. However, as evidenced by the increase in 
our estimate of the number of ONC-ATCB applicants under the temporary 
certification program, it is our hope that multiple ONC-ATCBs will be 
authorized and will compete for market share. As a result of expected 
increased competition among ONC-ATCBs, we believe there could also be 
increased downward pressure on the costs associated with testing and 
certification. If that cost pressure occurs, we believe that the upper 
ranges of the cost estimates we provide in this final rule could be 
overestimates.
    Comments. Some commenters questioned our estimates related to the 
number of EHR Modules we expected to be tested and certified. One 
commenter suggested that the number of self-developed EHR Modules 
should be much higher than we estimated. Other commenters expressed 
that this rule needed to account for other costs associated with 
testing and certification (e.g., reprogramming a Complete EHR or EHR 
Module) and not just the costs associated with the application process 
and for Complete EHRs and EHR Modules to be tested and certified.
    Response. This final rule is one of three coordinated rulemakings. 
Each of these rulemakings accounts for its specific effects. In the HIT 
Standards and Certification Criteria interim final rule (75 FR 2038), 
we summarized these effects as follows:


[[Page 36197]]


    While there is no bright line that divides the effects of this 
interim final rule and the other two noted above, we believe that 
each analysis properly focuses on the direct effects of the 
provisions it creates. This interim final rule estimates the costs 
commercial vendors, open source developers, and relevant Federal 
agencies will incur to prepare Complete EHRs and EHR Modules to be 
tested and certified to adopted standards, implementation 
specifications, and certification criteria. The Medicare and 
Medicaid EHR Incentive Programs proposed rule estimates the impacts 
related to the actions taken by eligible professionals or eligible 
hospitals to become meaningful users, including purchasing or self-
developing Complete EHRs or EHR Modules. The HIT Certification 
Programs proposed rule estimates the testing and certification costs 
for Complete EHRs and EHR Modules.

    As result, we estimate in this final rule, as we had before, the 
effects of the application process for ONC-ATCB status and the costs 
for Complete EHRs and EHR Modules to be tested and certified by ONC-
ATCBs. With respect to EHR Modules, especially self-developed EHR 
Modules, we agree with those commenters regarding our estimates and 
have provided revised estimates that factor in a potential larger 
number of self-developed EHR Modules. While neither commenter who 
offered this concern related to EHR Modules provided any data to 
substantiate their claims, we determined that this revision was 
necessary because we had previously grouped self-developed Complete 
EHRs and EHR Modules together. Upon further review and other comments 
addressed above regarding EHR Modules, we believe that in order to 
provide a more accurate estimate, self-developed Complete EHRs and EHR 
Modules should be separately accounted for. We believe our prior 
estimates related to self-developed Complete EHRs and EHR Modules are 
more appropriately attributable to the number of self-developed 
Complete EHRs. Accordingly, we have developed new estimates (captured 
in the discussion and tables below) for the number of self-developed 
EHR Modules that we believe will be presented for testing and 
certification.
2. Executive Order 12866 Final Analysis
    As required by Executive Order 12866, we have examined the economic 
implications of this rule as it relates to the temporary certification 
program. Executive Order 12866 directs agencies to assess all costs and 
benefits of available regulatory alternatives and, when regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health and safety, 
and other advantages; distributive impacts; and equity). Executive 
Order 12866 classifies a regulation as significant if it meets any one 
of a number of specified conditions, including having an annual effect 
on the economy of $100 million, or in a material way adversely 
affecting the economy, a sector of the economy, competition, or jobs. 
While this rule is therefore not ``economically significant,'' as 
defined by Executive Order 12866, OMB has determined that this rule 
constitutes a ``significant regulatory action'' as defined by Executive 
Order 12866 because it raises novel legal and policy issues.
a. Temporary Certification Program Estimated Costs
i . Application Process for ONC-ATCB Status
Applicant Costs
    As discussed under the collection of information section, we have 
increased our estimate of the number of applicants we expect will apply 
for ONC-ATCB status. In the Proposed Rule, we stated that we 
anticipated that there would be no more than 3 applicants for ONC-ATCB 
status. Based on the comments received, we now believe that there may 
be up to 5 applicants for ONC-ATCB status. In addition, we believe that 
up to 2 of these applicants will not have the level of preparedness 
that we originally estimated for all potential applicants for ONC-ATCB 
status.
    As part of the temporary certification program, an applicant will 
be required to submit an application and complete a proficiency exam. 
We do not believe that there will be an appreciable difference in the 
time commitment an applicant for ONC-ATCB status will have to make 
based on the type of authorization it seeks (i.e., we believe the 
application process and time commitment will be the same for applicants 
seeking authorization to conduct the testing and certification of 
either Complete EHRs or EHR Modules). We do, however, believe that 
there will be a distinction between applicants based on their level of 
preparedness. For the purposes of estimating applicant costs, we have 
divided applicants into two categories, ``conformant applicants'' and 
``partially conformant applicants.'' We still believe, after reviewing 
comments, that there will be three ``conformant applicants'' and that 
these applicants will have reviewed the relevant requirements found in 
the ISO/IEC standards and will have a majority, if not all, of the 
documentation requested in the application already developed and 
available before applying for ONC-ATCB status. Therefore, with the 
exception of completing a proficiency examination, we believe 
``conformant applicants'' will only spend time collecting and 
assembling already developed information to submit with their 
application. Conversely, we believe that there will be up to two 
``partially conformant applicants'' and that these applicants will 
spend significantly more time establishing their compliance with Guide 
65 and ISO 17025. Based on our assumptions, review of comments, and 
consultations with NIST, we anticipate that it will take a ``conformant 
applicant'' approximately 28.5 hours and a ``partially conformant 
applicant'' approximately 424.5 hours to complete the application and 
submit the requested documentation. Our estimates include the time 
discussed above in our collection of information section and 
approximately up to 24 hours for all applicants to complete the 
proficiency examination--8 hours (1 full work day) to complete section 
1 (demonstration of technical expertise related to Complete EHRs and/or 
EHR Modules); 6 hours to complete section 2 (demonstration of test tool 
identification); and 10 hours to complete section 3 (demonstration of 
proper use of test tools and understanding of test results). Moreover, 
after consulting with NIST we assume that:
     An employee equivalent to the Federal Salary 
Classification of GS-9 Step 1 could provide the general information 
requested in the application and accomplish the paperwork duties 
associated with the application;
     An employee equivalent to the Federal Salary 
Classification of GS-15 Step 1 would be responsible for conducting the 
self audits and agreeing to the ``Principles of Proper Conduct for ONC-
ATCBs''; and
     An employee or employees equivalent to the Federal Salary 
Classification of GS-15 Step 1 would be responsible for completing the 
proficiency examination.
    We have taken these employee assumptions and utilized the 
corresponding employee hourly rates for the locality pay area of 
Washington, D.C. as published by the U.S. Office of Personnel 
Management (OPM), to calculate our cost estimates. We have also 
calculated the costs of an employee's benefits while completing the 
application. We have calculated these costs by assuming that an 
applicant expends thirty-six percent (36%) of an employee's hourly wage 
on benefits for the employee. We have concluded that a 36% expenditure 
on benefits is an appropriate estimate

[[Page 36198]]

because it is the routine percentage used by HHS for contract cost 
estimates. Our calculations are expressed in Tables 1 and 2 below.

                               Table 1--Temporary Certification Program: Cost to Applicants to Apply to Become an ONC-ATCB
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                   Burden hours                                                 Cost per applicant
                                                         --------------------------------    Employee         Cost of    -------------------------------
      Application requirement        Employee equivalent                     Partially      hourly wage      employee                        Partially
                                                            Conformant      conformant         rate        benefits  per    Conformant      conformant
                                                             applicant       applicant                         hour          applicant       applicant
--------------------------------------------------------------------------------------------------------------------------------------------------------
General Identifying Information...  GS-9 Step 1.........           10/60           10/60          $22.39           $8.06           $5.07           $5.07
Self Audits and Documentation.....  GS-15 Step 1........               4             400           59.30           21.35          322.60       32,260.00
Principles of Proper Conduct......  GS-15 Step 1........           20/60           20/60           59.30           21.35           26.89           26.89
Proficiency Examination...........  GS-15 Step 1........              24              24           59.30           21.35        1,935.60        1,935.60
                                                         -----------------------------------------------------------------------------------------------
    Total Cost Per Application....  ....................  ..............  ..............  ..............  ..............       $2,290.16      $34,227.56
--------------------------------------------------------------------------------------------------------------------------------------------------------


                         Table 2--Temporary Certification Program: Total Applicant Cost
----------------------------------------------------------------------------------------------------------------
                                                                                      Cost of
                                                                    Anticipated     application     Total cost
                        Type of applicant                            number of     per applicant   estimate ($)
                                                                    applicants          ($)
----------------------------------------------------------------------------------------------------------------
Conformant Applicant............................................               3       $2,290.16       $6,870.48
Partially Conformant Applicant..................................               2       34,227.56       68,455.12
                                                                 -----------------------------------------------
    Total Cost of Application Process...........................  ..............  ..............       75,325.60
----------------------------------------------------------------------------------------------------------------

    We based our cost estimates on the amount of applicants that we 
believe will apply over the life of the temporary certification 
program. We assume that all applicants will apply during the first year 
of the program and thus all application costs should be attributed to 
the first year of the program. However, based on our projection that 
the temporary certification program will last approximately two years 
and that one or two applicants may choose to apply in the second year, 
the annualized cost of the application process will be $37,663.
Costs to the Federal Government
    We have estimated the cost to develop the ONC-ATCB application, 
including the development and administration of the proficiency 
examination to be $34,618 based on the 495 hours we believe it will 
take to develop the application, prepare standard operating procedures 
as well as create the requisite pools of questions for the proficiency 
examinations. More specifically, we believe it will take 360 hours of 
work of a Federal Salary Classification GS-14 Step 1 employee located 
in Washington, DC to develop the proficiency examination, 80 hours of 
work by the same employee to develop the standard operation procedures 
and the actual application, and 55 hours to score all the exams and 
handle related administrative tasks.
    We also anticipate that there will be costs associated with 
reviewing applications under the temporary certification program. We 
expect that a GS-15 Step 1 employee will review the applications and 
the National Coordinator (or designated representative) will issue 
final decisions on all applications. We anticipate that it will take 
approximately 40 hours to review and reach a final decision on each 
application. This estimate assumes a satisfactory application (i.e., no 
formal deficiency notifications) and includes the time necessary to 
verify the information in each application, assess the results of the 
proficiency examination, and prepare a briefing for the National 
Coordinator. We estimate the cost for the application review process, 
which we anticipate will include the review of 5 applications, to be 
$16,900.
    As a result, we estimate the Federal government's overall cost of 
administering the entire application process, for the length of the 
temporary certification program, at approximately $51,518. Based on our 
projection that the temporary certification program will last 
approximately two years and that one or two applicants may choose to 
apply in the second year, the annualized cost to the Federal government 
for administering the entire application process will be $25,759.
    As previously noted, we will also post the names of applicants 
granted ONC-ATCB status on our Web site. We believe that there will be 
minimal cost associated with this action and have calculated the 
potential cost to be approximately $260 on an annual basis for posting 
and maintaining the information on our Web site (a maximum of 5 hours 
of work for a Federal Salary Classification GS-12 Step 1 employee 
located in Washington, DC).
ii. Testing and Certification of Complete EHRs and EHR Modules
    Section 3001(c)(5)(A) of the PHSA indicates that certification is a 
voluntary act; however, due to the fact that the Medicare and Medicaid 
EHR Incentive Programs require eligible professionals and eligible 
hospitals to use Certified EHR Technology in order to qualify for 
incentive payments, we anticipate that a significant portion of 
Complete EHR and EHR Module developers will seek to have their HIT 
tested and certified.
    In Tables 3 through 8 below, we estimate the costs for Complete 
EHRs and EHR Modules to be tested and certified under the temporary 
certification program. As discussed in the HIT Standards and 
Certification Criteria interim final rule, and to remain consistent 
with our previous estimates (75 FR 2039), we believe that

[[Page 36199]]

approximately 93 commercial/open source Complete EHRs and 50 EHR 
Modules will be tested and certified under our proposed temporary 
certification program. In addition to these costs, we also take into 
account what we believe will be the costs incurred by a percentage of 
eligible professionals and eligible hospitals who themselves will incur 
the costs associated with the testing and certification of their self-
developed Complete EHR or EHR Module(s).
    With respect to the potential for eligible professionals to seek 
testing and certification for a self-developed Complete EHR, DesRoches 
found that only 5% of physicians are in large practices of over 50 
doctors.\3\ Of these large practices, 17% use an ``advanced EHR 
system'' that could potentially be tested and certified if it were 
self-developed (we assume that smaller physician practices do not have 
the resources to self-develop a Complete EHR). We are unaware of any 
reliable data on the number of large practices who may have a self-
developed Complete EHR for which they would seek to be tested and 
certified. As a result, we offer the following estimate based on 
currently available data. We believe that the total number of eligible 
professionals in large practices who both possess an IT staff with the 
resources to develop and support a Complete EHR and would seek to have 
such a self-developed Complete EHR tested and certified will be low--no 
more than 10%. By taking CMS's estimate in its proposed rule of 
approximately 450,000 eligible professionals (75 FR 1960) we multiply 
through by the numbers above (450,000 x .05 x .17 x .10) and then 
divide by a practice size of at least 50 which yields approximately 8 
self-developed Complete EHRs designed for an ambulatory setting that 
could be submitted for testing and certification. Additionally, we 
believe that a reasonable estimate for the number of large practices 
with the IT staff and resources to self-develop an EHR Module and that 
would seek to have such an EHR Module tested and certified can also be 
derived from the calculation above but with a few differences. We start 
with the total number of large practices from the calculation above 
(~77). We then assume an average number (1.1) of self-developed EHR 
Modules for this group of large practices and further refine this 
estimate by providing low and high probability assumptions (10% and 
70%, respectively) to represent the likelihood that any one of these 
large practices possess a self-developed EHR Module that they would 
seek to have tested and certified. Given that no commenter provided 
data to further support this estimate, we believe that our maximum 
number of self-developed EHR Modules estimate is generous. While we do 
not dispute that practice sizes smaller than 50 could also possess 
self-developed EHR Modules, we believe those smaller practices will be 
the exception, not the rule, and that separately calculating a total 
for these smaller practices would produce a negligible amount of EHR 
Modules to add to our overall range.
---------------------------------------------------------------------------

    \3\ DesRoches, CM et al. Electronic Health Records in Ambulatory 
Care--A National Survey of Physicians, New England Journal of 
Medicine July 2008; 359:50-60.
---------------------------------------------------------------------------

    With respect to eligible hospitals, similar to eligible 
professionals, we believe that only large eligible hospitals would have 
the IT staff and resources available to possess a self-developed 
Complete EHR that they would seek to have tested and certified. Again, 
we are unaware of any reliable data on the number of eligible hospitals 
who may have a self-developed Complete EHR for which they would seek to 
be tested and certified. Further, we believe that with respect to EHR 
Modules the probability varies across different types of eligible 
hospitals regarding their IT staff resources and ability to self-
develop an EHR Module and seek to have it tested and certified. As a 
result, we offer the following estimates based on currently available 
data. We have based our calculations on the Medicare eligible hospital 
table CMS provided in its proposed rule (Table 38) (75 FR 1980) which 
conveys hospital IT capabilities according to three levels of adoption 
by hospital size according to the 2007 AHA annual survey. These three 
levels included: (1) Hospitals which had already implemented relatively 
advanced systems that included CPOE systems for medications; (2) 
hospitals which had implemented more basic systems through which lab 
results could be shared, but not CPOE for medications; and (3) 
hospitals starting from a base level either CPOE or lab reporting. CMS 
indicated that CPOE for medication standard was chosen because expert 
input indicated that the CPOE standard in the proposed meaningful use 
definition will be the hardest one for hospitals to meet.
    As stated above, we believe that only large hospitals (defined in 
Table 38 as those with 400+ beds) would have the IT staff and resources 
to develop, support, and seek the testing and certification of a self-
developed Complete EHR. CMS indicated that 331 large hospitals had met 
either ``level 1'' or ``level 2.'' As a result, we estimate that 
approximately 10% of these large eligible hospitals have a self-
developed Complete EHR and would seek to have it tested and certified. 
We believe that this estimate is generous and that a good portion of 
the eligible professionals and eligible hospitals who would likely seek 
to qualify for incentive payments with self-developed Complete EHRs 
would only do so for meaningful use Stage 1. After meaningful use Stage 
1 we anticipate that the number of eligible professionals and eligible 
hospitals who would incur the costs of testing and certification 
themselves will go down because the effort involved to maintain a 
Complete EHR may be time and cost prohibitive as the Secretary 
continues to adopt additional certification criteria to support future 
stages of meaningful use.
    With respect to self-developed EHR Modules, we believe the 
probability varies across different types of eligible hospitals (CAHs, 
Small/Medium, and Large) regarding their IT staff resources and ability 
to self-develop EHR Modules. For each hospital type (identified in 
Table 38) we provide an estimate of the average number of self-
developed EHR Modules we believe each type of eligible hospital would 
seek to have tested and certified. Again, we believe that our high 
average number of self-developed EHR Modules is generous.
    Due to the fact that an ONC-ATCB will be responsible for testing 
and certifying Complete EHRs and/or EHR Modules, we have combined the 
costs for testing and certification because we believe they would be 
difficult to independently estimate. Our cost range for the testing and 
certification of Complete EHRs and EHR Modules includes consideration 
of how the testing and certification will be conducted (i.e., by remote 
testing and certification, on-site testing and certification, or at the 
ONC-ATCB and for the complexity of an EHR Module).
    On July 14, 2009, CCHIT testified in front of the HIT Policy 
Committee on the topic of EHR certification, including the 
certification of EHR Modules. CCHIT estimated that ``EHR-
comprehensive'' according to CCHIT certification criteria would have 
testing and certification costs that would range from approximately 
$30,000 to $50,000. CCHIT also estimated that the testing and 
certification of EHR Modules would range from approximately $5,000 to 
$35,000 depending on the scope of the testing and certification. We 
believe that these estimates provide a reasonable foundation and have 
used them for our cost estimates. However, we assume that competition 
in the testing and

[[Page 36200]]

certification market will reduce the costs of testing and certification 
as estimated by CCHIT but we are unable to provide a reliable estimate 
at this time of what the potential reduction in costs might be. The 
following tables represent our cost estimates for the preceding 
discussion and include:
     Commercial/Open Source Complete EHRs and EHR Modules--
Table 3;
     Self-developed Complete EHRs--Table 4;
     Number of Self-developed EHR Modules by eligible 
professionals in large practices--Table 5;
     Number of Self-developed EHR Modules by type of eligible 
hospital--Table 6; and
     Total costs associated with self-developed EHR Modules--
Table 7.

      Table 3--Temporary Certification Program: Estimated Costs for Testing & Certification of Commercial/Open Source Complete EHRs and EHR Modules
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                          Cost per complete EHR/EHR module  ($M)   Total cost for all complete EHRs/EHR
                                                               Number   -----------------------------------------     modules over 3-year period ($M)
                           Type                              tested and                                          ---------------------------------------
                                                             certified        Low          High       Mid-point       Low          High       Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Complete EHR..............................................           93        $0.03         $0.05         $0.04        $2.79        $4.65         $3.72
EHR Module................................................           50         0.005         0.035         0.02         0.25         1.75          1.0
                                                           ---------------------------------------------------------------------------------------------
    Total.................................................          143  ............  ............  ...........         3.04          6.4          4.72
--------------------------------------------------------------------------------------------------------------------------------------------------------


                  Table 4--Temporary Certification Program: Estimated Costs for Testing & Certification of Self-Developed Complete EHRs
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                               Cost per complete EHR  ($M)       Total cost for all complete EHRs over 3-
                                                                Number   ---------------------------------------             year period ($M)
                            Type                              tested and                                        ----------------------------------------
                                                              certified       Low          High      Mid-point        Low          High       Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Self Developed Complete EHRs Ambulatory Setting............            8        $0.03        $0.05        $0.04         $0.24         $0.4         $0.32
Self-Developed Complete EHRs Inpatient Setting.............           30         0.03         0.05         0.04          0.9           1.5          1.2
                                                            --------------------------------------------------------------------------------------------
    Total..................................................           38  ...........  ...........  ...........          1.14          1.9          1.52
--------------------------------------------------------------------------------------------------------------------------------------------------------

    In Table 5 below, we provide our estimate for the number of 
potential self-developed EHR Modules large practices of eligible 
professionals could seek to have tested and certified.

    Table 5--Temporary Certification Program: Estimated Number of Self-Developed EHR Modules Designed for an
                         Ambulatory Setting by Eligible Professionals in Large Practices
----------------------------------------------------------------------------------------------------------------
                                                                           Average
    Eligible professional       Number of    % with EHR    % with EHR     number of    Min number    Max number
        practice type             large     module (low)     module     EHR modules,     of EHR     EHR  modules
                                practices                    (high)        if any        modules
----------------------------------------------------------------------------------------------------------------
Large.......................           77            10            70          1.25            10            67
----------------------------------------------------------------------------------------------------------------

    In Table 6 below, we provide our estimate for the number of 
potential self-developed EHR Modules varied by hospital type that 
eligible hospitals could seek to have tested and certified.

    Table 6--Temporary Certification Program: Estimated Number of Self-Developed EHR Modules Designed for an
                            Inpatient Setting Stratified by Type of Eligible Hospital
----------------------------------------------------------------------------------------------------------------
                                                                             Average
                                                  % with EHR   % with EHR   number of    Min number   Max number
     Type of eligible hospital       Number of      module       module        EHR         of EHR        EHR
                                        EHs         (low)        (high)    modules, if    modules      modules
                                                                               any
----------------------------------------------------------------------------------------------------------------
CAH...............................          518            1           10          1.1            6           57
S/M...............................         1951            5           15          1.5          146          439
Large.............................          331           25           70          2.0          166          463
                                   -----------------------------------------------------------------------------
    Total.........................         2800  ...........  ...........  ...........          318          959
----------------------------------------------------------------------------------------------------------------


[[Page 36201]]

    In Table 7 below, we provide our estimate for the total testing and 
certification costs associated with the minimum and maximum number of 
self-developed EHR Modules from Table 5 and Table 6.

                 Table 7--Temporary Certification Program: Estimated Costs for Testing & Certification of All Self-Developed EHR Modules
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                  Cost per EHR module ($M)        Total cost for all EHR modules over 3-
                                                                 Number   ---------------------------------------            year period ($M)
                 Self-developed EHR modules                    tested and                                        ---------------------------------------
                                                               certified       Low          High      Mid-point       Low          High       Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Min No. of EHR Modules......................................          328       $0.005       $0.035        $0.02        $1.64        $11.5         $6.56
Max No. of EHR Modules......................................         1026        0.005        0.035         0.02         5.13         35.9         20.52
                                                                                                                 ---------------------------------------
    Total...................................................  ...........  ...........  ...........  ...........         6.77         47.4         27.1
--------------------------------------------------------------------------------------------------------------------------------------------------------

    Our estimates cover anticipated testing and certification costs 
under the temporary certification program from 2010 through some 
portion of 2012 as we expect the permanent certification program to be 
operational by 2012. However, because we cannot predict the exact date 
at which ONC-ATCBs will finish any remaining tests and certifications 
in their queue, we believe that it is reasonable to assume the 
possibility that 2012 costs for testing and certification could be 
considered as part of the temporary certification program.
    Consistent with our estimates in the HIT Standards and 
Certification Criteria interim final rule (75 FR 2041) about when 
Complete EHRs and EHR Modules will be prepared for testing and 
certification to the certification criteria adopted by the Secretary 
for meaningful use Stage 1, we anticipate that they will be tested and 
certified in the same proportions. Therefore, we believe that of the 
total number of Complete EHRs and EHR Modules that we have estimated 
(commercial, open source, and self-developed), 45% will be tested and 
certified in 2010, 40% will be tested and certified in 2011, and 15% 
will be tested and certified in 2012. Table 8 below represents this 
proportional distribution of the estimated costs we calculated for the 
testing and certification of Complete EHRs and EHR Modules to the 
certification criteria adopted to support meaningful use Stage 1 under 
the temporary certification program as expressed in Table 3 above.

 Table 8--Distributed Total Costs for the Testing and Certification of Complete EHRs and EHR Modules to Stage 1
                                   MU by Year (3-Year Period)--Totals Rounded
----------------------------------------------------------------------------------------------------------------
                                                                                                        Total
                                                                            Total low    Total high    average
                            Year                                 Ratio         cost         cost         cost
                                                                             estimate     estimate     estimate
                                                                               ($M)         ($M)         ($M)
----------------------------------------------------------------------------------------------------------------
2010........................................................          45%        $4.93       $25.07       $15.00
2011........................................................          40%         4.38        22.28        13.34
2012........................................................          15%         1.64         8.36         5.00
                                                                          --------------------------------------
    3-Year Totals...........................................  ...........        10.95         55.7        33.34
----------------------------------------------------------------------------------------------------------------

iii. Costs for Collecting, Storing, and Reporting Certification Results
Costs to ONC-ATCBs
    Under the temporary certification program, ONC-ATCBs will be 
required to provide ONC, no less frequently than weekly, an up-to-date 
list of Complete EHRs and/or EHR Modules that have been tested and 
certified as well as certain minimum information about each certified 
Complete EHR and/or EHR Module.
    As stated in the collection of information section, we will require 
the reporting of this information on a weekly basis and that it will 
take ONC-ATCBs about an hour to prepare and electronically transmit the 
information to ONC each week (i.e., respondents will respond 52 times 
per year). As also noted in the collection of information section, we 
have specified in this final rule two additional reporting elements 
that must be submitted by ONC-ATCBs on a weekly basis (i.e., clinical 
quality measures to which a Complete EHR or EHR Module has been tested 
and certified and, where applicable, any additional software a Complete 
EHR or EHR Module relied upon to demonstrate its compliance with a 
certification criterion or criteria adopted by the Secretary). ONC-
ATCBs will be capturing these additional reporting elements in 
conjunction with the other information we request that they report on a 
weekly basis. Consequently, we do not believe that the reporting of 
these two additional elements will increase the reporting burden or 
costs for ONC-ATCBs.
    We believe that an employee equivalent to the Federal 
Classification of GS-9 Step 1 could complete the transmissions of the 
requested information to ONC. We have utilized the corresponding 
employee hourly rate for the locality pay area of Washington, D.C., as 
published by OPM, to calculate our cost estimates. We have also 
calculated the costs of the employee's benefits while completing the 
transmissions of the requested information. We have calculated these 
costs by assuming that an ONC-ATCB or ONC-ACB expends thirty-six 
percent (36%) of an employee's hourly wage on benefits for the 
employee. We have concluded that a 36% expenditure on benefits is an 
appropriate estimate because it is the routine percentage used by HHS 
for contract cost estimates. Our cost estimates are expressed in Table 
9 below.

[[Page 36202]]



                                          Table 9--Annual Costs for an ONC-ATCB To Report Certifications to ONC
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                       Annual burden                        Employee
              Program requirement                        Employee equivalent          hours per ONC-   Employee hourly  benefits hourly   Total cost per
                                                                                           ATCB           wage rate           cost           ONC-ATCB
--------------------------------------------------------------------------------------------------------------------------------------------------------
ONC-ATCB Certification Results.................  GS-9 Step 1.......................               52           $22.39            $8.06        $1,583.40
--------------------------------------------------------------------------------------------------------------------------------------------------------

    To estimate the highest possible cost, we assume that all of the 
estimated applicants (i.e., five) that we anticipate will apply under 
the temporary certification program will become ONC-ATCBs. Therefore, 
we estimate the total annual reporting cost under the temporary 
certification program to be $7,917.
    We believe that the requirement for ONC-ATCBs to retain 
certification records for the length of the temporary certification 
program is in line with common industry practices and, consequently, 
does not represent additional costs to ONC-ATCBs as a result of this 
final rule.
Costs to the Federal Government
    As stated previously in this final rule, we will post a 
comprehensive list of all certified Complete EHRs and EHR Modules on 
our Web site. We believe that there will be minimal cost associated 
with this action and have calculated the potential cost, including 
weekly updates, to be $8,969 on an annualized basis. This amount is 
based on 173 hours of yearly work of a Federal Salary Classification 
GS-12 Step 1 employee located in Washington, DC.
iv. Costs for Retaining Records and Providing Copies to ONC
Costs to ONC-ATCBs
    Under the temporary certification program, ONC-ATCBs will be 
required to retain all records related to tests and certifications 
according to Guide 65 and ISO 17025 for the duration of the temporary 
certification program and provide copies of the final results of all 
completed tests and certifications to ONC at the conclusion of testing 
and certification activities under the temporary certification program.
    We do not believe that there are any specific recordkeeping or 
capital costs associated with this requirement. Based on our 
consultations with NIST, we understand that it is standard industry 
practice to retain records related to testing and certification. 
Therefore, we believe that the only costs attributable to our 
requirement are those associated with the submission of copies to ONC 
of the final results of all completed tests and certifications.
    As stated in the collection of information section, we estimate 
that each ONC-ATCB will incur the same burden and, assuming that there 
are 5 ONC-ATCBs, will test and certify, at most, approximately 205 
Complete EHRs and/or EHR Modules under the temporary certification 
program. We also assume that an ONC-ATCB will submit copies of the 
final results of all completed tests and certifications to ONC by 
either electronic transmission or paper submission. In either instance, 
we believe that an ONC-ATCB will spend a similar amount of time and 
effort in organizing, categorizing and submitting the requested 
information. We estimate that this amount of time will be approximately 
8 hours for each ONC-ATCB.
    Based on our own assumptions and consultations with NIST, we 
believe that an employee equivalent to the Federal Classification of 
GS-9 Step 1 could organize, categorize, and submit the final results of 
all completed tests and certifications either by electronic 
transmission or through paper submission of photocopies to ONC. We have 
taken this employee assumption and utilized the corresponding employee 
hourly rate for the locality pay area of Washington, DC, as published 
by the U.S. Office of Personnel Management, to calculate the cost 
estimates. We have also calculated the costs of the employee's benefits 
while organizing, categorizing, and submitting the final results. We 
have calculated these costs by assuming that an ONC-ATCB will expend 
thirty-six percent (36%) of an employee's hourly wage on benefits for 
the employee. We have concluded that a 36% expenditure on benefits is 
an appropriate estimate because it is the routine percentage used by 
HHS for contract cost estimates. Our calculations are expressed in the 
table below.

                                           Table 10--Costs for an ONC-ATCB To Submit Copies of Records to ONC
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                                                            Employee
               Program requirement                        Employee equivalent           Burden hours   Employee hourly  benefits hourly   Total cost per
                                                                                        per ONC-ATCB      wage rate           cost           ONC-ATCB
--------------------------------------------------------------------------------------------------------------------------------------------------------
Submission of Testing and Certification Records.  GS-9 Step 1.......................               8           $22.39            $8.06          $243.60
--------------------------------------------------------------------------------------------------------------------------------------------------------

    To estimate the highest possible cost, we assume that all of the 
estimated applicants (i.e., five) that we anticipate will apply under 
the temporary certification program will become ONC-ATCBs. Therefore, 
we estimate the total cost for submitting the requested records at the 
conclusion of testing and certification activities under the temporary 
certification program to be $1,218.00.
Costs to the Federal Government
    We anticipate that ONC will simply receive copies of the final 
results of all completed tests and certifications. Therefore, we 
believe the Federal government will only incur negligible costs.
b. Temporary Certification Program Benefits
    We believe that several benefits will accrue from the establishment 
of the temporary certification program. The temporary certification 
program will allow for the rapid influx of Complete EHRs and EHR 
Modules to be tested and certified at a sufficient pace for eligible 
professionals and eligible hospitals to adopt and implement Certified 
EHR Technology for meaningful use Stage 1 and thus potentially qualify 
for incentive payments under the CMS Medicare and Medicaid EHR 
Incentive Programs proposed rule. The time between the temporary 
certification program and the permanent certification

[[Page 36203]]

program will permit the HIT industry the time it needs for accredited 
testing laboratories to come forward, for an ONC-authorized accreditor 
to be approved and for additional applicants for ONC-ACB status to come 
forward. We further believe that the temporary certification program 
will meet our overall goals of accelerating health IT adoption and 
increasing levels of interoperability. At this time, we cannot predict 
how fast all of these savings will occur or their precise magnitude as 
they are partly dependent on future final rules for meaningful use and 
the subsequent standards and certification criteria adopted by the 
Secretary.

D. Regulatory Flexibility Act

    The RFA requires agencies to analyze options for regulatory relief 
of small businesses if a rule has a significant impact on a substantial 
number of small entities. For more information on the Small Business 
Administration's (SBA's) size standards, see the SBA's Web site.\4\ For 
purposes of the RFA, small entities include small businesses, nonprofit 
organizations, and small governmental jurisdictions. When conducting a 
RFA we are required to assess the potential effects of our rule on 
small entities and to make every effort to minimize the regulatory 
burden that might be imposed on small entities. We believe that the 
entities that are likely to be directly affected by this final rule are 
applicants for ONC-ATCB status. Furthermore, we believe that these 
entities would either be classified under the North American Industry 
Classification System (NAICS) codes 541380 (Testing Laboratories) or 
541990 (Professional, Scientific and Technical Services).\5\ We believe 
that there will be up to 5 applicants for ONC-ATCB status. According to 
the NAICS codes identified above, this would mean SBA size standards of 
$12 million and $7 million in annual receipts, respectively.\6\ Because 
this segment of the HIT industry is in a nascent stage and is comprised 
of very few entities, we have been unable to find reliable data from 
which to determine what realistic annual receipts would be. However, 
based on our total estimates for Complete EHRs and EHR Modules to be 
tested and certified, we assume that the annual receipts of any one 
ONC-ATCB could be in the low millions of dollars. Moreover, it is 
unclear, whether these entities may be involved in other testing and 
certification programs which would increase their annual receipts and 
potentially place them outside the SBA's size standards.
---------------------------------------------------------------------------

    \4\ http://sba.gov/idc/groups/public/documents/sba_homepage/serv_sstd_tablepdf.pdf.
    \5\ See 13 CFR 121.201
    \6\ The SBA references that annual receipts means ``total 
income'' (or in the case of a sole proprietorship, ``gross income'') 
plus ``cost of goods sold'' as these terms are defined and reported 
on Internal Revenue Service tax return forms. http://www.sba.gov/idc/groups/public/documents/sba_homepage/guide_to_size_standards.pdf.
---------------------------------------------------------------------------

    We believe that we have established the minimum amount of 
requirements necessary to accomplish our policy goals and that no 
appropriate regulatory alternatives could be developed to lessen the 
compliance burden for applicants for ONC-ATCB status as well as ONC-
ATCBs once they have been granted such status by the National 
Coordinator. Moreover, we believe that this final rule will create 
direct positive effects for entities because their attainment of ONC-
ATCB status will permit them to test and certify Complete EHRs and/or 
EHR Modules. Thus, we expect that their annual receipts will increase 
as a result of becoming an ONC-ATCB.
    We did not receive any comments related to our RFA analysis during 
the comment period available for the temporary certification program. 
As a result, we examined the economic implications of this final rule 
and have concluded that it will not have a significant impact on a 
substantial number of small entities. The Secretary certifies that this 
final rule will not have a significant impact on a substantial number 
of small entities.

E. Executive Order 13132--Federalism

    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a rule that imposes substantial 
direct requirement costs on State and local governments, preempts State 
law, or otherwise has federalism implications.
    Nothing in this final rule imposes substantial direct requirement 
costs on State and local governments, preempts State law or otherwise 
has federalism implications. We are not aware of any State laws or 
regulations that conflict with or are impeded by our temporary 
certification program, and we did not receive any comments to the 
contrary in response to the Proposed Rule.

F. Unfunded Mandates Reform Act of 1995

    Title II of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-
4) requires cost-benefit and other analyses before any rulemaking if 
the rule includes a ``Federal mandate that may result in the 
expenditure by State, local, and tribal governments, in the aggregate, 
or by the private sector, of $100,000,000 or more (adjusted annually 
for inflation) in any 1 year.'' The current inflation-adjusted 
statutory threshold is approximately $133 million. We did not receive 
any comments related to the temporary certification program on our 
analysis presented in the Proposed Rule. Therefore, we have determined 
that this final rule will not constitute a significant rule under the 
Unfunded Mandates Reform Act, because it imposes no mandates.
    OMB reviewed this final rule.

List of Subjects in 45 CFR Part 170

    Computer technology, Electronic health record, Electronic 
information system, Electronic transactions, Health, Health care, 
Health information technology, Health insurance, Health records, 
Hospitals, Incorporation by reference, Laboratories, Medicaid, 
Medicare, Privacy, Reporting and recordkeeping requirements, Public 
health, Security.

0
 For the reasons set forth in the preamble, 45 CFR subtitle A, 
subchapter D, part 170, is amended as follows:

PART 170--HEALTH INFORMATION TECHNOLOGY STANDARDS, IMPLEMENTATION 
SPECIFICATIONS, AND CERTIFICATION CRITERIA AND CERTIFICATION 
PROGRAMS FOR HEALTH INFORMATION TECHNOLOGY

0
1. The authority citation for part 170 is revised to read as follows:

    Authority: 42 U.S.C. 300jj-11; 42 U.S.C 300jj-14; 5 U.S.C. 552.


0
2. Revise Sec.  170.100 to read as follows:


Sec.  170.100  [Amended]

    The provisions of this subchapter implement sections 3001(c)(5) and 
3004 of the Public Health Service Act.

0
3. In Sec.  170.102, add in alphabetical order the definition of ``Day 
or Day(s)'' to read as follows:


Sec.  170.102  Definitions.

* * * * *
    Day or Days means a calendar day or calendar days.
* * * * *

0
4. Add a new subpart D to part 170 to read as follows:
Subpart D--Temporary Certification Program for HIT
Sec.
170.400 Basis and scope.
170.401 Applicability.
170.402 Definitions.
170.405 Correspondence.
170.410 Types of testing and certification.
170.415 Application prerequisite.
170.420 Application.
170.423 Principles of proper conduct for ONC-ATCBs.

[[Page 36204]]

170.425 Application submission.
170.430 Review of application.
170.435 ONC-ATCB application reconsideration.
170.440 ONC-ATCB status.
170.445 Complete EHR testing and certification.
170.450 EHR Module testing and certification.
170.455 Testing and certification to newer versions of certain 
standards.
170.457 Authorized testing and certification methods.
170.460 Good standing as an ONC-ATCB.
170.465 Revocation of authorized testing and certification body 
status.
170.470 Effect of revocation on the certifications issued to 
complete EHRs and EHR Modules.
170.490 Sunset of the temporary certification program.
170.499 Incorporation by reference.

Subpart D--Temporary Certification Program for HIT


Sec.  170.400  Basis and scope.

    This subpart implements section 3001(c)(5) of the Public Health 
Service Act, and sets forth the rules and procedures related to the 
temporary certification program for health information technology 
administered by the National Coordinator for Health Information 
Technology.


Sec.  170.401  Applicability.

    This subpart establishes the processes that applicants for ONC-ATCB 
status must follow to be granted ONC-ATCB status by the National 
Coordinator, the processes the National Coordinator will follow when 
assessing applicants and granting ONC-ATCB status, the requirements 
that ONC-ATCBs must follow to remain in good standing, and the 
requirements of ONC-ATCBs for testing and certifying Complete EHRs and/
or EHR Modules in accordance with the applicable certification criteria 
adopted by the Secretary in subpart C of this part.


Sec.  170.402  Definitions.

    For the purposes of this subpart:
    Applicant means a single organization or a consortium of 
organizations that seeks to become an ONC-ATCB by requesting and 
subsequently submitting an application for ONC-ATCB status to the 
National Coordinator.
    Deployment site means the physical location where a Complete EHR or 
EHR Module resides or is being or has been implemented.
    Development site means the physical location where a Complete EHR 
or EHR Module was developed.
    ONC-ATCB or ONC-Authorized Testing and Certification Body means an 
organization or a consortium of organizations that has applied to and 
been authorized by the National Coordinator pursuant to this subpart to 
perform the testing and certification of Complete EHRs and/or EHR 
Modules under the temporary certification program.
    Remote testing and certification means the use of methods, 
including the use of web-based tools or secured electronic 
transmissions, that do not require an ONC-ATCB to be physically present 
at the development or deployment site to conduct testing and 
certification.


Sec.  170.405  Correspondence.

    (a) Correspondence and communication with the National Coordinator 
shall be conducted by e-mail, unless otherwise necessary. The official 
date of receipt of any e-mail between the National Coordinator and an 
applicant for ONC-ATCB status or an ONC-ATCB is the day the e-mail was 
sent.
    (b) In circumstances where it is necessary for an applicant for 
ONC-ATCB status or an ONC-ATCB to correspond or communicate with the 
National Coordinator by regular or express mail, the official date of 
receipt will be the date of the delivery confirmation.


Sec.  170.410  Types of testing and certification.

    Applicants may seek authorization from the National Coordinator to 
perform the following types of testing and certification:
    (a) Complete EHR testing and certification; and/or
    (b) EHR Module testing and certification.


Sec.  170.415  Application prerequisite.

    Applicants must request in writing an application for ONC-ATCB 
status from the National Coordinator. Applicants must indicate:
    (a) The type of authorization sought pursuant to Sec.  170.410; and
    (b) If seeking authorization to perform EHR Module testing and 
certification, the specific type(s) of EHR Module(s) they seek 
authorization to test and certify. If qualified, applicants will only 
be granted authorization to test and certify the types of EHR Modules 
for which they seek authorization.


Sec.  170.420  Application.

    The application for ONC-ATCB status consists of two parts. 
Applicants must complete both parts of the application in their 
entirety and submit them to the National Coordinator for the 
application to be considered complete.
    (a) Part 1. An applicant must provide all of the following:
    (1) General identifying information including:
    (i) Name, address, city, state, zip code, and Web site of 
applicant; and
    (ii) Designation of an authorized representative, including name, 
title, phone number, and e-mail address of the person who will serve as 
the applicant's point of contact.
    (2) Documentation of the completion and results of a self-audit 
against all sections of ISO/IEC Guide 65:1996 (incorporated by 
reference in Sec.  170.499), and the following:
    (i) A description of the applicant's management structure according 
to section 4.2 of ISO/IEC Guide 65:1996;
    (ii) A copy of the applicant's quality manual that has been 
developed according to section 4.5.3 of ISO/IEC Guide 65:1996;
    (iii) A copy of the applicant's policies and approach to 
confidentiality according to section 4.10 of ISO/IEC Guide 65:1996;
    (iv) A copy of the qualifications of each of the applicant's 
personnel who oversee or perform certification according to section 5.2 
of ISO/IEC Guide 65:1996;
    (v) A copy of the applicant's evaluation reporting procedures 
according to section 11 of ISO/IEC Guide 65:1996; and
    (vi) A copy of the applicant's policies for use and display of 
certificates according to section 14 of ISO/IEC Guide 65:1996.
    (3) Documentation of the completion and results of a self-audit 
against all sections of ISO/IEC 17025:2005 (incorporated by reference 
in Sec.  170.499), and the following:
    (i) A copy of the applicant's quality system document according to 
section 4.2.2 of ISO/IEC 17025:2005;
    (ii) A copy of the applicant's policies and procedures for handling 
testing nonconformities according to section 4.9.1 of ISO/IEC 
17025:2005; and
    (iii) The qualifications of each of the applicant's personnel who 
oversee or conduct testing according to section 5.2 of ISO/IEC 
17025:2005.
    (4) An agreement, properly executed by the applicant's authorized 
representative, that it will adhere to the Principles of Proper Conduct 
for ONC-ATCBs.
    (b) Part 2. An applicant must submit a completed proficiency 
examination.


Sec.  170.423  Principles of proper conduct for ONC-ATCBs.

    An ONC-ATCB shall:
    (a) Operate its certification program in accordance with ISO/IEC 
Guide 65:1996 (incorporated by reference in Sec.  170.499) and testing 
program in accordance with

[[Page 36205]]

ISO/IEC 17025:2005 (incorporated by reference in Sec.  170.499);
    (b) Maintain an effective quality management system which addresses 
all requirements of ISO/IEC 17025:2005 (incorporated by reference in 
Sec.  170.499);
    (c) Attend all mandatory ONC training and program update sessions;
    (d) Maintain a training program that includes documented procedures 
and training requirements to ensure its personnel are competent to test 
and certify Complete EHRs and/or EHR Modules;
    (e) Use test tools and test procedures approved by the National 
Coordinator for the purposes of assessing Complete EHRs and/or EHR 
Modules compliance with the certification criteria adopted by the 
Secretary;
    (f) Report to ONC within 15 days any changes that materially affect 
its:
    (1) Legal, commercial, organizational, or ownership status;
    (2) Organization and management, including key testing and 
certification personnel;
    (3) Policies or procedures;
    (4) Location;
    (5) Facilities, working environment or other resources;
    (6) ONC authorized representative (point of contact); or
    (7) Other such matters that may otherwise materially affect its 
ability to test and certify Complete EHRs and/or EHR Modules;
    (g) Allow ONC, or its authorized agents(s), to periodically observe 
on site (unannounced or scheduled) during normal business hours, any 
testing and/or certification performed to demonstrate compliance with 
the requirements of the temporary certification program;
    (h) Provide ONC, no less frequently than weekly, a current list of 
Complete EHRs and/or EHR Modules that have been tested and certified 
which includes, at a minimum:
    (1) The vendor name (if applicable);
    (2) The date certified;
    (3) The product version;
    (4) The unique certification number or other specific product 
identification;
    (5) The clinical quality measures to which a Complete EHR or EHR 
Module has been tested and certified;
    (6) Where applicable, any additional software a Complete EHR or EHR 
Module relied upon to demonstrate its compliance with a certification 
criterion or criteria adopted by the Secretary; and
    (7) Where applicable, the certification criterion or criteria to 
which each EHR Module has been tested and certified.
    (i) Retain all records related to tests and certifications 
according to ISO/IEC Guide 65:1996 (incorporated by reference in Sec.  
170.499) and ISO/IEC 17025:2005 (incorporated by reference in Sec.  
170.499) for the duration of the temporary certification program and 
provide copies of the final results of all completed tests and 
certifications to ONC at the conclusion of testing and certification 
activities under the temporary certification program;
    (j) Promptly refund any and all fees received for:
    (1) Requests for testing and certification that are withdrawn while 
its operations are suspended by the National Coordinator;
    (2) Testing and certification that will not be completed as a 
result of its conduct; and
    (3) Previous testing and certification that it performed if its 
conduct necessitates the recertification of Complete EHRs and/or EHR 
Modules;
    (k) Ensure adherence to the following requirements when issuing a 
certification to Complete EHRs and/or EHR Modules:
    (1) All certifications must require that a Complete EHR or EHR 
Module developer conspicuously include the following text on its Web 
site and in all marketing materials, communications statements, and 
other assertions related to the Complete EHR or EHR Module's 
certification:
    (i) ``This [Complete EHR or EHR Module] is 201[X]/201[X] compliant 
and has been certified by an ONC-ATCB in accordance with the applicable 
certification criteria adopted by the Secretary of Health and Human 
Services. This certification does not represent an endorsement by the 
U.S. Department of Health and Human Services or guarantee the receipt 
of incentive payments.''; and
    (ii) The information an ONC-ATCB is required to report to the 
National Coordinator under paragraph (h) of this section for the 
specific Complete EHR or EHR Module at issue;
    (2) A certification issued to an integrated bundle of EHR Modules 
shall be treated the same as a certification issued to a Complete EHR 
for the purposes of paragraph (k)(1) of this section except that it 
must also indicate each EHR Module that comprises the bundle; and
    (3) A certification issued to a Complete EHR or EHR Module based on 
applicable certification criteria adopted by the Secretary at subpart C 
of this part must be separate and distinct from any other 
certification(s) based on other criteria or requirements.


Sec.  170.425  Application submission.

    (a) An applicant for ONC-ATCB status must submit its application 
either electronically via e-mail (or web submission if available), or 
by regular or express mail.
    (b) An application for ONC-ATCB status may be submitted to the 
National Coordinator at any time during the existence of the temporary 
certification program.


Sec.  170.430  Review of application.

    (a) Method of review and review timeframe.
    (1) Applications will be reviewed in the order they are received.
    (2) The National Coordinator will review Part 1 of the application 
in its entirety and determine whether Part 1 of the application is 
complete and satisfactory before proceeding to review Part 2 of the 
application in its entirety.
    (3) The National Coordinator is permitted up to 30 days to review 
an application (submitted for the first time) upon receipt.
    (b) Application deficiencies.
    (1) If the National Coordinator identifies an area in an 
application that requires the applicant to clarify a statement or 
correct an error or omission, the National Coordinator may contact the 
applicant to make such clarification or correction without issuing a 
deficiency notice. If the National Coordinator has not received the 
requested information after five days, the applicant may be issued a 
deficiency notice specifying the error, omission, or deficient 
statement.
    (2) If the National Coordinator determines that deficiencies in 
either part of the application exist, the National Coordinator will 
issue a deficiency notice to the applicant and return the application. 
The deficiency notice will identify the areas of the application that 
require additional information or correction.
    (c) Revised application.
    (1) An applicant is permitted to submit a revised application in 
response to a deficiency notice. An applicant may request an extension 
for good cause from the National Coordinator of the 15-day period 
provided in paragraph (c)(2) of this section to submit a revised 
application.
    (2) In order to continue to be considered for ONC-ATCB status, an 
applicant's revised application must address the specified deficiencies 
and be received by the National Coordinator within 15 days of the 
applicant's receipt of the deficiency notice unless the National 
Coordinator grants an applicant's request for an extension of the 15-
day period based on a finding of good cause. If a good cause extension 
is granted, then the revised application

[[Page 36206]]

must be received by the end of the extension period.
    (3) The National Coordinator is permitted up to 15 days to review a 
revised application once it has been received and may request 
clarification of statements and the correction of errors or omissions 
in a revised application during this time period.
    (4) If the National Coordinator determines that a revised 
application still contains deficiencies, the applicant will be issued a 
denial notice indicating that the applicant will no longer be 
considered for authorization under the temporary certification program. 
An applicant may request reconsideration of a denial in accordance with 
Sec.  170.435.
    (d) Satisfactory application.
    (1) An application will be deemed satisfactory if it meets all 
application requirements, including a passing score on the proficiency 
examination.
    (2) The National Coordinator will notify the applicant's authorized 
representative of its satisfactory application and its successful 
achievement of ONC-ATCB status.
    (3) Once notified by the National Coordinator of its successful 
achievement of ONC-ATCB status, the applicant may represent itself as 
an ONC-ATCB and begin testing and certifying Complete EHRs and/or EHR 
Modules consistent with its authorization.


Sec.  170.435  ONC-ATCB application reconsideration.

    (a) An applicant may request that the National Coordinator 
reconsider a denial notice issued for each part of an application only 
if the applicant can demonstrate that clear, factual errors were made 
in the review of the applicable part of the application and that the 
errors' correction could lead to the applicant obtaining ONC-ATCB 
status.
    (b) Submission requirement. An applicant is required to submit, 
within 15 days of receipt of a denial notice, a written statement to 
the National Coordinator contesting the decision to deny its 
application and explaining with sufficient documentation what factual 
errors it believes can account for the denial. If the National 
Coordinator does not receive the applicant's submission within the 
specified timeframe, its reconsideration request may be rejected.
    (c) Reconsideration request review. If the National Coordinator 
receives a timely reconsideration request, the National Coordinator is 
permitted up to 15 days from the date of receipt to review the 
information submitted by the applicant and issue a decision.
    (d) Decision.
    (1) If the National Coordinator determines that clear, factual 
errors were made during the review of the application and that 
correction of the errors would remove all identified deficiencies, the 
applicant's authorized representative will be notified of the National 
Coordinator's decision to reverse the previous decision(s) not to 
approve part of the applicant's application or the entire application.
    (i) If the National Coordinator's decision to reverse the previous 
decision(s) affected part 1 of an application, the National Coordinator 
will subsequently review part 2 of the application.
    (ii) If the National Coordinator's decision to reverse the previous 
decision(s) affected part 2 of an application, the applicant's 
authorized representative will be notified of the National 
Coordinator's decision as well as the applicant's successful 
achievement of ONC-ATCB status.
    (2) If, after reviewing an applicant's reconsideration request, the 
National Coordinator determines that the applicant did not identify any 
factual errors or that correction of those factual errors would not 
remove all identified deficiencies in the application, the National 
Coordinator may reject the applicant's reconsideration request.
    (3) Final decision. A reconsideration decision issued by the 
National Coordinator is final and not subject to further review.


Sec.  170.440  ONC-ATCB status.

    (a) Acknowledgement and publication. The National Coordinator will 
acknowledge and make publicly available the names of ONC-ATCBs, 
including the date each was authorized and the type(s) of testing and 
certification each has been authorized to perform.
    (b) Representation. Each ONC-ATCB must prominently and 
unambiguously identify the scope of its authorization on its Web site, 
and in all marketing and communications statements (written and oral) 
pertaining to its activities under the temporary certification program.
    (c) Renewal. ONC-ATCB status does not need to be renewed during the 
temporary certification program.
    (d) Expiration. The status of all ONC-ATCBs will expire upon the 
sunset of the temporary certification program in accordance with Sec.  
170.490.


Sec.  170.445  Complete EHR testing and certification.

    (a) An ONC-ATCB must test and certify Complete EHRs to all 
applicable certification criteria adopted by the Secretary at subpart C 
of this part.
    (b) An ONC-ATCB must provide the option for a Complete EHR to be 
tested and certified solely to the applicable certification criteria 
adopted by the Secretary at subpart C of this part.
    (c) Inherited certified status. An ONC-ATCB must accept requests 
for a newer version of a previously certified Complete EHR to inherit 
the previously certified Complete EHR's certified status without 
requiring the newer version to be retested and recertified.
    (1) Before granting certified status to a newer version of a 
previously certified Complete EHR, an ONC-ATCB must review an 
attestation submitted by the developer of the Complete EHR to determine 
whether the newer version has adversely affected any previously 
certified capabilities.
    (2) An ONC-ATCB may grant certified status to a newer version of a 
previously certified Complete EHR if it determines that previously 
certified capabilities have not been adversely affected.
    (d) An ONC-ATCB that has been authorized to test and certify 
Complete EHRs is also authorized to test and certify all EHR Modules 
under the temporary certification program.


Sec.  170.450  EHR module testing and certification.

    (a) When testing and certifying EHR Modules, an ONC-ATCB must test 
and certify in accordance with the applicable certification criterion 
or certification criteria adopted by the Secretary at subpart C of this 
part.
    (b) An ONC-ATCB must provide the option for an EHR Module or a 
bundle of EHR Modules to be tested and certified solely to the 
applicable certification criteria adopted by the Secretary at subpart C 
of this part.
    (c) Privacy and security testing and certification. EHR Modules 
shall be tested and certified to all privacy and security certification 
criteria adopted by the Secretary unless the EHR Module(s) is/are 
presented for testing and certification in one of the following 
manners:
    (1) The EHR Module(s) is/are presented for testing and 
certification as a pre-coordinated, integrated bundle of EHR Modules, 
which would otherwise meet the definition of and constitute a Complete 
EHR (as defined in 45 CFR 170.102), and one or more of the constituent 
EHR Modules is/are demonstrably responsible for providing all of the 
privacy and security

[[Page 36207]]

capabilities for the entire bundle of EHR Module(s); or
    (2) An EHR Module is presented for testing and certification, and 
the presenter can demonstrate and provide documentation to the ONC-ATCB 
that a privacy and security certification criterion is inapplicable or 
that it would be technically infeasible for the EHR Module to be tested 
and certified in accordance with such certification criterion.
    (d) Inherited certified status. An ONC-ATCB must accept requests 
for a newer version of a previously certified EHR Module or bundle of 
EHR Modules to inherit the previously certified EHR Module's or bundle 
of EHR Modules certified status without requiring the newer version to 
be retested and recertified.
    (1) Before granting certified status to a newer version of a 
previously certified EHR Module or bundle of EHR Modules, an ONC-ATCB 
must review an attestation submitted by the developer of the EHR Module 
or presenter of the bundle of EHR Modules to determine whether the 
newer version has adversely affected any previously certified 
capabilities.
    (2) An ONC-ATCB may grant certified status to a newer version of a 
previously certified EHR Module or bundle of EHR Modules if it 
determines that previously certified capabilities have not been 
adversely affected.


Sec.  170.455  Testing and certification to newer versions of certain 
standards.

    (a) ONC-ATCBs may test and certify Complete EHRs and EHR Module to 
a newer version of certain identified minimum standards specified at 
subpart B of this part if the Secretary has accepted a newer version of 
an adopted minimum standard.
    (b) Applicability of an accepted new version of an adopted minimum 
standard.
    (1) ONC-ATCBs are not required to test and certify Complete EHRs 
and/or EHR Modules according to newer versions of an adopted minimum 
standard accepted by the Secretary until the incorporation by reference 
provision of the adopted version is updated in the Federal Register 
with a newer version.
    (2) Certified EHR Technology may be upgraded to comply with newer 
versions of an adopted minimum standard accepted by the Secretary 
without adversely affecting the certification status of the Certified 
EHR Technology.


Sec.  170.457  Authorized testing and certification methods.

    An ONC-ATCB must provide remote testing and certification for both 
development and deployment sites.


Sec.  170.460  Good standing as an ONC-ATCB.

    An ONC-ATCB must maintain good standing by:
    (a) Adhering to the Principles of Proper Conduct for ONC-ATCBs;
    (b) Refraining from engaging in other types of inappropriate 
behavior, including an ONC-ATCB misrepresenting the scope of its 
authorization as well as an ONC-ATCB testing and certifying Complete 
EHRs and/or EHR Modules for which it does not have authorization; and
    (c) Following all other applicable Federal and state laws.


Sec.  170.465  Revocation of authorized testing and certification body 
status.

    (a) Type-1 violations. The National Coordinator may revoke an ONC-
ATCB's status for committing a Type-1 violation. Type-1 violations 
include violations of law or temporary certification program policies 
that threaten or significantly undermine the integrity of the temporary 
certification program. These violations include, but are not limited 
to: False, fraudulent, or abusive activities that affect the temporary 
certification program, a program administered by HHS or any program 
administered by the Federal government.
    (b) Type-2 violations. The National Coordinator may revoke an ONC-
ATCB's status for failing to timely or adequately correct a Type-2 
violation. Type-2 violations constitute noncompliance with Sec.  
170.460.
    (1) Noncompliance notification. If the National Coordinator obtains 
reliable evidence that an ONC-ATCB may no longer be in compliance with 
Sec.  170.460, the National Coordinator will issue a noncompliance 
notification with reasons for the notification to the ONC-ATCB 
requesting that the ONC-ATCB respond to the alleged violation and 
correct the violation, if applicable.
    (2) Opportunity to become compliant. After receipt of a 
noncompliance notification, an ONC-ATCB is permitted up to 30 days to 
submit a written response and accompanying documentation that 
demonstrates that no violation occurred or that the alleged violation 
has been corrected.
    (i) If the ONC-ATCB submits a response, the National Coordinator is 
permitted up to 30 days from the time the response is received to 
evaluate the response and reach a decision. The National Coordinator 
may, if necessary, request additional information from the ONC-ATCB 
during this time period.
    (ii) If the National Coordinator determines that no violation 
occurred or that the violation has been sufficiently corrected, the 
National Coordinator will issue a memo to the ONC-ATCB confirming this 
determination.
    (iii) If the National Coordinator determines that the ONC-ATCB 
failed to demonstrate that no violation occurred or to correct the 
area(s) of non-compliance identified under paragraph (b)(1) of this 
section within 30 days of receipt of the noncompliance notification, 
then the National Coordinator may propose to revoke the ONC-ATCB's 
status.
    (c) Proposed revocation.
    (1) The National Coordinator may propose to revoke an ONC-ATCB's 
status if the National Coordinator has reliable evidence that the ONC-
ATCB committed a Type-1 violation; or
    (2) The National Coordinator may propose to revoke an ONC-ATCB's 
status if, after the ONC-ATCB has been notified of a Type-2 violation, 
the ONC-ATCB fails to:
    (i) To rebut the finding of a violation with sufficient evidence 
showing that the violation did not occur or that the violation has been 
corrected; or
    (ii) Submit to the National Coordinator a written response to the 
noncompliance notification within the specified timeframe under 
paragraph (b)(2).
    (d) Suspension of an ONC-ATCB's operations.
    (1) The National Coordinator may suspend the operations of an ONC-
ATCB under the temporary certification program based on reliable 
evidence indicating that:
    (i) The ONC-ATCB committed a Type-1 or Type-2 violation; and
    (ii) The continued testing and certification of Complete EHRs and/
or EHR Modules by the ONC-ATCB could have an adverse impact on the 
health or safety of patients.
    (2) If the National Coordinator determines that the conditions of 
paragraph (d)(1) have been met, an ONC-ATCB will be issued a notice of 
proposed suspension.
    (3) Upon receipt of a notice of proposed suspension, an ONC-ATCB 
will be permitted up to 3 days to submit a written response to the 
National Coordinator explaining why its operations should not be 
suspended.
    (4) The National Coordinator is permitted up to 5 days from receipt 
of an ONC-ATCB's written response to a notice of proposed suspension to 
review the response and make a determination.

[[Page 36208]]

    (5) The National Coordinator may make one of the following 
determinations in response to the ONC-ATCB's written response or if the 
ONC-ATCB fails to submit a written response within the timeframe 
specified in paragraph (d)(3):
    (i) Rescind the proposed suspension; or
    (ii) Suspend the ONC-ATCB's operations until it has adequately 
corrected a Type-2 violation; or
    (iii) Propose revocation in accordance with Sec.  170.465(c) and 
suspend the ONC-ATCB's operations for the duration of the revocation 
process.
    (6) A suspension will become effective upon an ONC-ATCB's receipt 
of a notice of suspension.
    (e) Opportunity to respond to a proposed revocation notice.
    (1) An ONC-ATCB may respond to a proposed revocation notice, but 
must do so within 10 days of receiving the proposed revocation notice 
and include appropriate documentation explaining in writing why its 
status should not be revoked.
    (2) Upon receipt of an ONC-ATCB's response to a proposed revocation 
notice, the National Coordinator is permitted up to 30 days to review 
the information submitted by the ONC-ATCB and reach a decision.
    (3) Unless suspended, an ONC-ATCB will be permitted to continue its 
operations under the temporary certification program during the time 
period provided for the ONC-ATCB to respond to the proposed revocation 
notice and the National Coordinator to review the response.
    (f) Good standing determination. If the National Coordinator 
determines that an ONC-ATCB's status should not be revoked, the 
National Coordinator will notify the ONC-ATCB's authorized 
representative in writing of this determination.
    (g) Revocation.
    (1) The National Coordinator may revoke an ONC-ATCB's status if:
    (i) A determination is made that revocation is appropriate after 
considering the information provided by the ONC-ATCB in response to the 
proposed revocation notice; or
    (ii) The ONC-ATCB does not respond to a proposed revocation notice 
within the specified timeframe in paragraph (d)(1) of this section.
    (2) A decision to revoke an ONC-ATCB's status is final and not 
subject to further review unless the National Coordinator chooses to 
reconsider the revocation.
    (h) Extent and duration of revocation.
    (1) The revocation of an ONC-ATCB is effective as soon as the ONC-
ATCB receives the revocation notice.
    (2) A testing and certification body that has had its ONC-ATCB 
status revoked is prohibited from accepting new requests for testing 
and certification and must cease its current testing and certification 
operations under the temporary certification program.
    (3) A testing and certification body that has had its ONC-ATCB 
status revoked for a Type-1 violation is prohibited from reapplying for 
ONC-ATCB status under the temporary certification program for one year. 
If the temporary certification program sunsets during this time, the 
testing and certification body is prohibited from applying for ONC-ACB 
status under the permanent certification program for the time that 
remains within the one year prohibition.
    (4) The failure of a testing and certification body that has had 
its ONC-ATCB status revoked, to promptly refund any and all fees for 
tests and/or certifications of Complete EHRs and EHR Modules not 
completed will be considered a violation of the Principles of Proper 
Conduct for ONC-ATCBs and will be taken into account by the National 
Coordinator if the testing and certification body reapplies for ONC-
ATCB status under the temporary certification program or applies for 
ONC-ACB status under the permanent certification program.


Sec.  170.470  Effect of revocation on the certifications issued to 
complete EHRs and EHR Modules.

    (a) The certified status of Complete EHRs and/or EHR Modules 
certified by an ONC-ATCB that had it status revoked will remain intact 
unless a Type-1 violation was committed that calls into question the 
legitimacy of the certifications issued by the former ONC-ATCB.
    (b) If the National Coordinator determines that a Type-1 violation 
occurred that called into question the legitimacy of certifications 
conducted by the former ONC-ATCB, then the National Coordinator would:
    (1) Review the facts surrounding the revocation of the ONC-ATCB's 
status; and
    (2) Publish a notice on ONC's Web site if the National Coordinator 
believes that Complete EHRs and/or EHR Modules were improperly 
certified by the former ONC-ATCB.
    (c) If the National Coordinator determines that Complete EHRs and/
or EHR Modules were improperly certified, the certification status of 
affected Complete EHRs and/or EHR Modules would only remain intact for 
120 days after the National Coordinator publishes the notice. The 
certification status of the Complete EHR and/or EHR Module can only be 
maintained thereafter by being re-certified by an ONC-ATCB in good 
standing.


Sec.  170.490  Sunset of the temporary certification program.

    (a) The temporary certification program will sunset on December 31, 
2011, or if the permanent certification program is not fully 
constituted at that time, then upon a subsequent date that is 
determined to be appropriate by the National Coordinator. On and after 
the temporary certification program sunset date, ONC-ATCBs will be 
prohibited from accepting new requests to test and certify Complete 
EHRs or EHR Modules.
    (b) ONC-ATCBs are permitted up to six months after the sunset date 
to complete all testing and certification activities associated with 
requests for testing and certification of Complete EHRs and/or EHR 
Modules received prior to the sunset date.


Sec.  170.499  Incorporation by reference.

    (a) Certain material is incorporated by reference into this subpart 
with the approval of the Director of the Federal Register under 5 
U.S.C. 552(a) and 1 CFR part 51. To enforce any edition other than that 
specified in this section, the Department of Health and Human Services 
must publish notice of change in the Federal Register and the material 
must be available to the public. All approved material is available for 
inspection at the National Archives and Records Administration (NARA). 
For information on the availability of this material at NARA, call 202-
741-6030 or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html. Also, it is available for 
inspection at U.S. Department of Health and Human Services, Office of 
the National Coordinator for Health Information Technology, Hubert H. 
Humphrey Building, Suite 729D, 200 Independence Ave, SW., Washington, 
DC 20201, call ahead to arrange for inspection at 202-690-7151, and is 
available from the source listed below.
    (b) International Organization for Standardization, Case postale 
56, CH[middot]1211, Geneve 20, Switzerland, telephone +41-22-749-01-11, 
http://www.iso.org.
    (1) ISO/IEC 17025 General Requirements for the Competence of 
Testing and Calibration Laboratories (Second Edition), May 15, 2005, 
IBR approved for Sec.  170.420 and Sec.  170.423.
    (2) ISO/IEC GUIDE 65 General Requirements for Bodies Operating 
Product Certification Systems (First

[[Page 36209]]

Edition), 1996, IBR approved for Sec.  170.420 and Sec.  170.423.
    (3) [Reserved]

    Dated: June 8, 2010.
 Kathleen Sebelius,
Secretary.
[FR Doc. 2010-14999 Filed 6-18-10; 11:15 am]
BILLING CODE 4150-45-P