[Federal Register Volume 75, Number 46 (Wednesday, March 10, 2010)]
[Proposed Rules]
[Pages 11328-11373]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-4991]
[[Page 11327]]
-----------------------------------------------------------------------
Part III
Department of Health and Human Services
-----------------------------------------------------------------------
45 CFR Part 170
Proposed Establishment of Certification Programs for Health Information
Technology; Proposed Rule
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 /
Proposed Rules
[[Page 11328]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Secretary
45 CFR Part 170
RIN 0991-AB59
Proposed Establishment of Certification Programs for Health
Information Technology
AGENCY: Office of the National Coordinator for Health Information
Technology, Department of Health and Human Services.
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: Under the authority granted to the National Coordinator for
Health Information Technology (the National Coordinator) by section
3001(c)(5) of the Public Health Service Act (PHSA) as added by the
Health Information Technology for Economic and Clinical Health (HITECH)
Act, this rule proposes the establishment of two certification programs
for purposes of testing and certifying health information technology.
While two certification programs are described in this proposed rule,
we anticipate issuing separate final rules for each of the programs.
The first proposal would establish a temporary certification program
whereby the National Coordinator would authorize organizations to test
and certify Complete EHRs and/or EHR Modules, thereby assuring the
availability of Certified EHR Technology prior to the date on which
health care providers seeking the incentive payments available under
the Medicare and Medicaid EHR Incentives Program may begin
demonstrating meaningful use of Certified EHR Technology. The second
proposal would establish a permanent certification program to replace
the temporary certification program. The permanent certification
program would separate the responsibilities for performing testing and
certification, introduce accreditation requirements, establish
requirements for certification bodies authorized by the National
Coordinator related to the surveillance of Certified EHR Technology,
and would include the potential for certification bodies authorized by
the National Coordinator to certify other types of health information
technology besides Complete EHRs and EHR Modules.
DATES: To be assured consideration, written or electronic comments on
the proposals for the temporary certification program must be received
at one of the addresses provided below, no later than 5 p.m. on April
9, 2010. To be assured consideration, written or electronic comments on
the proposals for the permanent certification program must be received
at one of the addresses provided below, no later than 5 p.m. on May 10,
2010.
ADDRESSES: Because of staff and resource limitations, we cannot accept
comments by facsimile (FAX) transmission. You may submit comments,
identified by RIN 0991-AB59, by any of the following methods (please do
not submit duplicate comments).
Federal eRulemaking Portal: Follow the instructions for
submitting comments. Attachments should be in Microsoft Word,
WordPerfect, or Excel; however, we prefer Microsoft Word. http://www.regulations.gov.
Regular, Express, or Overnight Mail: Department of Health
and Human Services, Office of the National Coordinator for Health
Information Technology, Attention: Certification Programs Proposed
Rule, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave.,
SW., Washington, DC 20201. Please submit one original and two copies.
Hand Delivery or Courier: Office of the National
Coordinator for Health Information Technology, Attention: Certification
Programs Proposed Rule, Hubert H. Humphrey Building, Suite 729D, 200
Independence Ave., SW., Washington, DC 20201. Please submit one
original and two copies. (Because access to the interior of the Hubert
H. Humphrey Building is not readily available to persons without
Federal government identification, commenters are encouraged to leave
their comments in the mail drop slots located in the main lobby of the
building.)
Inspection of Public Comments: All comments received before the
close of the applicable comment period will be available for public
inspection, including any personally identifiable or confidential
business information that is included in a comment. Please do not
include anything in your comment submission that you do not wish to
share with the general public. Such information includes, but is not
limited to: a person's social security number; date of birth; driver's
license number; State identification number or foreign country
equivalent; passport number; financial account number; credit or debit
card number; any personal health information; or any business
information that could be considered to be proprietary. We will post
all comments received before the close of the applicable comment period
at http://www.regulations.gov.
Docket: For access to the docket to read background documents or
comments received, go to http://www.regulations.gov or U.S. Department
of Health and Human Services, Office of the National Coordinator for
Health Information Technology, Hubert H. Humphrey Building, Suite 729D,
200 Independence Ave., SW., Washington, DC 20201 (call ahead to the
contact listed below to arrange for inspection).
FOR FURTHER INFORMATION CONTACT: Steven Posnack, Policy Analyst, 202-
690-7151.
SUPPLEMENTARY INFORMATION:
Acronyms
CAH Critical Access Hospital
CCHIT Certification Commission for Health Information Technology
CGD Certification Guidance Document
CMS Centers for Medicare & Medicaid Services
EHR Electronic Health Record
FACA Federal Advisory Committee Act
FFS Fee for Service (Medicare Program)
HHS Department of Health and Human Services
HIT Health Information Technology
HITECH Health Information Technology for Economic and Clinical
Health
LOINC Logical Observation Identifiers Names and Codes
MA Medicare Advantage
NIST National Institute of Standards and Technology
NVLAP National Voluntary Laboratory Accreditation Program
OIG Office of Inspector General
OMB Office of Management and Budget
ONC Office of the National Coordinator for Health Information
Technology
ONC-AA ONC-Approved Accreditor
ONC-ACB ONC-Authorized Certification Body
ONC-ATCB ONC-Authorized Testing and Certification Body
OPM Office of Personnel Management
PHSA Public Health Service Act
RFA Regulatory Flexibility Act
RIA Regulatory Impact Analysis
SSA Social Security Act
Table of Contents
I. Background
A. Previously Defined Terminology
B. Legislative and Regulatory History
1. Legislative History
a. Standards, Implementation Specifications, and Certification
Criteria
b. Medicare and Medicaid EHR Incentive Programs
i. Medicare EHR Incentive Program
ii. Medicaid EHR Incentive Program
c. HIT Certification Programs
2. Regulatory History and Related Guidance
a. Initial Set of Standards, Implementation Specifications, and
Certification Criteria
b. Medicare and Medicaid EHR Incentive Programs Proposed Rule
c. HIT Certification Programs Proposed Rule
d. Physician Self-Referral Prohibition and Anti-Kickback EHR
Exception and Safe Harbor Final Rules and ONC Interim
[[Page 11329]]
Guidance Regarding the Recognition of Certification Bodies
C. Overview of Temporary Certification Program
D. Overview of Permanent Certification Program
E. Factors Influencing the Proposal of Both Temporary and
Permanent Certification Programs
1. HIT Policy Committee Recommendations
2. Coordination With the HIT Standards and Certification
Criteria Interim Final Rule and the Medicare and Medicaid EHR
Incentive Programs Proposed Rule
3. Timeliness Related to the Beginning of the Medicare and
Medicaid EHR Incentive Programs
i. Public Comment Period
ii. Urgency of Establishing the Temporary Certification Program
4. Consultations With NIST
F. Additional Context for Comparing the Temporary and Permanent
Certification Programs
1. The Distinction Between Testing and Certification
2. Accreditation
3. Surveillance
II. Provisions of the Temporary Certification Program
A. Applicability
B. Definitions
1. Definition of Applicant
2. Definition of Day or Days
3. Definition of ONC-ATCB
C. Correspondence With the National Coordinator
D. Temporary Certification Program Application Process for ONC-
ATCB Status
1. Application for ONC-ATCB Status
a. Types of Applicants
b. Types of ONC-ATCB Authorization
c. Application Part One
d. Application Part Two
2. Application Review
a. Satisfactory Application
b. Deficient Application Returned and Opportunity To Revise
3. ONC-ATCB Application Reconsideration Requests
4. ONC-ATCB Status
a. Acknowledgement and Representation
b. Expiration of Status Under the Temporary Certification
Program
E. ONC-ATCB Performance of Testing and Certification and
Maintaining Good Standing as an ONC-ATCB
1. Authorization To Test and Certify Complete EHRs
2. Authorization To Test and Certify EHR Modules
a. Certification Criterion Scope
b. When Privacy and Security Certification Criteria Apply to EHR
Modules
3. Authorized Testing and Certification Methods
4. The Testing and Certification of ``Minimum Standards''
5. Maintaining Good Standing as an ONC-ATCB; Violations That
Could Lead to the Revocation of ONC-ATCB Status; Revocation of ONC-
ATCB Status
a. Type-1 Violations
b. Type-2 Violations
c. Proposed Revocation
i. Opportunity To Respond to a Proposed Revocation Notice
ii. Revocation of an ONC-ATCB's Status
d. Extent and Duration of Revocation Under the Temporary
Certification Program
e. Alternative Considered
6. Validity of Complete EHR and EHR Module Certification
F. Sunset
III. Provisions of Permanent Certification Program
A. Applicability
B. Definitions
1. Definition of Applicant
2. Definition of ONC-Approved Accreditor
3. Definition of Day or Days
4. Definition of ONC-ACB
C. Correspondence With the National Coordinator
D. Permanent Certification Program Application Process for ONC-
ACB Status
1. Application for ONC-ACB Status
a. Types of Applicants
b. Types of ONC-ACB Authorization
c. Application for ONC-ACB Status
d. Proficiency Examination
2. Application Review
3. ONC-ACB Application Reconsideration Requests
4. ONC-ACB Status
a. Acknowledgement and Representation
b. Expiration of Status Under the Permanent Certification
Program
E. ONC-ACB Performance of Certification and Maintaining Good
Standing as ONC-ACB
1. Authorization To Certify Complete EHRs
2. Authorization To Certify EHR Modules
3. Authorization To Certify Other HIT
4. Authorized Certification Methods
5. The Certification of ``Minimum Standards''
6. Maintaining Good Standing as an ONC-ACB; Violations That
Could Lead to Revocation of ONC-ACB Status; Revocation of ONC-ACB
Status
7. Validity of Complete EHR and EHR Module Certification
8. Differential Certification
F. ONC-Approved Accreditor
1. Requirements for Becoming an ONC-AA
2. ONC-AA Ongoing Responsibilities
3. Number of ONC-AAs and Length of Approval
G. Promoting Participation in the Permanent Certification
Program
IV. Response to Comments
V. Collection of Information Requirements
A. Collection of Information 1: Application for ONC-
ATCB Status Under the Proposed Temporary Certification Program
B. Collection of Information 2: Application for ONC-ACB
Status Under the Proposed Permanent Certification Program
C. Collection of Information 3: ONC-ATCB and ONC-ACB
Collection and Reporting of Information Related to Complete EHR and/
or EHR Module Certifications
D. Collection of Information 4: Required Documentation
for Requesting ONC-Approved Accreditor Status
VI. Regulatory Impact Analysis
A. Introduction
B. Why This Rule Is Needed?
C. Executive Order 12866--Regulatory Planning and Review
Analyses for the Proposed Temporary and Permanent Certification
Programs
1. Temporary Certification Program Estimated Costs
a. Application Process for ONC-ATCB status
i. Applicant Costs
ii. Costs to the Federal Government
b. Temporary Certification Program: Testing and Certification of
Complete EHRs and EHR Modules
2. Permanent Certification Program Estimated Costs
a. Request for ONC-AA Status
i. Cost of Submission for Requesting ONC-AA Status
ii. Cost to the Federal Government
b. Application Process for ONC-ACB Status and Renewal
i. Applicant Costs and ONC-ACB Renewal Costs
ii. Costs to the Federal Government
c. Permanent Certification Program: Testing and Certification of
Complete EHRs and EHR Modules
3. Costs for Collecting, Storing, and Reporting Certification
Results Under the Temporary and Permanent Certification Programs
a. Costs to ONC-ATCBs and ONC-ACBs
b. Costs to the Federal Government
4. Temporary and Permanent Certification Program Benefits
D. Regulatory Flexibility Act
E. Executive Order 13132--Federalism
F. Unfunded Mandates Reform Act of 1995
I. Background
[If you choose to comment on the background section, please include
at the beginning of your comment the caption ``Background'' and any
additional information to clearly identify the information about which
you are commenting.]
A. Previously Defined Terminology
This proposed rule is directly related to the recently published
(January 13, 2010) health information technology (HIT) Standards and
Certification Criteria interim final rule (75 FR 2014). Consequently,
in addition to new terms and definitions discussed later in this
proposed rule, the following terms have the same meaning as provided at
45 CFR 170.102.
Certification criteria means criteria: (1) To establish
that health information technology meets applicable standards and
implementation specifications adopted by the Secretary; or (2) that are
used to test and certify that health information technology includes
required capabilities.
Certified EHR Technology means a Complete EHR or a
combination of EHR Modules, each of which: (1) Meets the
[[Page 11330]]
requirements included in the definition of a Qualified EHR; and (2) has
been tested and certified in accordance with the certification program
established by the National Coordinator as having met all applicable
certification criteria adopted by the Secretary.
Complete EHR means EHR technology that has been developed
to meet all applicable certification criteria adopted by the Secretary.
Disclosure means the release, transfer, provision of
access to, or divulging in any other manner of information outside the
entity holding the information.
EHR Module means any service, component, or combination
thereof that can meet the requirements of at least one certification
criterion adopted by the Secretary.
Implementation specification means specific requirements
or instructions for implementing a standard.
Qualified EHR means an electronic record of health-related
information on an individual that: (1) Includes patient demographic and
clinical health information, such as medical history and problem lists;
and (2) has the capacity: (i) To provide clinical decision support;
(ii) to support physician order entry; (iii) to capture and query
information relevant to health care quality; and (iv) to exchange
electronic health information with, and integrate such information from
other sources.
Standard means a technical, functional, or performance-
based rule, condition, requirement, or specification that stipulates
instructions, fields, codes, data, materials, characteristics, or
actions.
B. Legislative and Regulatory History
1. Legislative History
The Health Information Technology for Economic and Clinical Health
(HITECH) Act, Title XIII of Division A and Title IV of Division B of
the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-
5), was enacted on February 17, 2009. The HITECH Act amended the Public
Health Service Act (PHSA) and created ``Title XXX--Health Information
Technology and Quality'' (Title XXX) to improve health care quality,
safety, and efficiency through the promotion of health information
technology (HIT) and electronic health information exchange. Section
3001 of the PHSA establishes by statute the Office of the National
Coordinator for Health Information Technology (ONC). Title XXX of the
PHSA provides the National Coordinator and the Secretary of the
Department of Health and Human Services (the Secretary) with new
responsibilities and authorities related to HIT. The HITECH Act also
amended several sections of the Social Security Act (SSA) and in doing
so established the availability of incentive payments to eligible
professionals and eligible hospitals to promote the adoption and
meaningful use of interoperable HIT.
a. Standards, Implementation Specifications, and Certification Criteria
With the passage of the HITECH Act, two new Federal advisory
committees were established, the HIT Policy Committee and the HIT
Standards Committee (sections 3002 and 3003 of the PHSA, respectively).
Each is responsible for advising the National Coordinator on different
aspects of standards, implementation specifications, and certification
criteria. The HIT Policy Committee is responsible for, among other
duties, recommending priorities for the development, harmonization, and
recognition of standards, implementation specifications, and
certification criteria while the HIT Standards Committee is responsible
for recommending standards, implementation specifications, and
certification criteria for adoption by the Secretary under section 3004
of the PHSA consistent with the ONC-Coordinated Federal Health IT
Strategic Plan (the ``strategic plan'').
Section 3004 of the PHSA defines how the Secretary adopts
standards, implementation specifications, and certification criteria.
Section 3004(a) of the PHSA defines a process whereby an obligation is
imposed on the Secretary to review standards, implementation
specifications, and certification criteria and identifies the
procedures for the Secretary to follow to determine whether to adopt
any grouping of standards, implementation specifications, or
certification criteria included among National Coordinator-endorsed
recommendations.
b. Medicare and Medicaid EHR Incentive Programs
Title IV, Division B of the HITECH Act establishes incentive
payments under the Medicare and Medicaid programs for eligible
professionals and eligible hospitals that meaningfully use Certified
EHR Technology. The Centers for Medicare & Medicaid Services (CMS) is
charged with developing the Medicare and Medicaid EHR incentive
programs.
i. Medicare EHR Incentive Program
Section 4101 of the HITECH Act added new subsections to section
1848 of the SSA to establish incentive payments for the meaningful use
of Certified EHR Technology by eligible professionals participating in
the Medicare Fee-for-Service (FFS) program beginning in calendar year
(CY) 2011 and beginning in CY 2015, downward payment adjustments for
covered professional services provided by eligible professionals who
are not meaningful users of Certified EHR Technology. Section 4101(c)
of the HITECH Act added a new subsection to section 1853 of the SSA
that provides incentive payments to Medicare Advantage (MA)
organizations for their affiliated eligible professionals who
meaningfully use Certified EHR Technology beginning in CY2011 and
beginning in 2015, downward payment adjustments to MA organizations to
account for certain affiliated eligible professionals who are not
meaningful users of Certified EHR Technology.
Section 4102 of the HITECH Act added new subsections to section
1886 of the SSA that establish incentive payments for the meaningful
use of Certified EHR Technology by subsection (d) hospitals (defined
under section 1886(d)(1)(B) of the SSA) that participate in the
Medicare FFS program beginning in Federal fiscal year (FY) 2011 and
beginning in FY 2015, downward payment adjustments to the market basket
updates for inpatient hospital services provided by such hospitals that
are not meaningful users of Certified EHR Technology. Section 4102(b)
of the HITECH Act amends section 1814 of the SSA to provide an
incentive payment to critical access hospitals that meaningfully use
Certified EHR Technology based on the hospitals' reasonable costs
beginning in FY 2011 and downward payment adjustments for inpatient
hospital services provided by such hospitals that are not meaningful
users of Certified EHR Technology for cost reporting periods beginning
in FY 2015. Section 4102(c) of the HITECH Act adds a new subsection to
section 1853 of the SSA to provide incentive payments to MA
organizations for certain affiliated eligible hospitals that
meaningfully use Certified EHR Technology and beginning in FY 2015,
downward payment adjustments to MA organizations for those affiliated
hospitals that are not meaningful users of Certified EHR Technology.
[[Page 11331]]
ii. Medicaid EHR Incentive Program
Section 4201 of the HITECH Act amends section 1903 of the SSA to
provide 100 percent Federal financial participation (FFP) to States for
incentive payments to certain eligible health care providers
participating in the Medicaid program to purchase, implement, and
meaningfully use (including support services and training for staff)
Certified EHR Technology and 90 percent FFP for State administrative
expenses related to the incentive program.
c. HIT Certification Programs
Section 3001(c)(5) of the PHSA provides the National Coordinator
with the authority to establish a certification program or programs for
the voluntary certification of HIT. Specifically, section 3001(c)(5)(A)
specifies that the ``National Coordinator, in consultation with the
Director of the National Institute of Standards and Technology, shall
keep or recognize a program or programs for the voluntary certification
of health information technology as being in compliance with applicable
certification criteria adopted under this subtitle'' (i.e.,
certification criteria adopted by the Secretary under section 3004 of
the PHSA). The certification program(s) must also ``include, as
appropriate, testing of the technology in accordance with section
13201(b) of the [HITECH] Act.''
Section 13201(b) of the HITECH Act requires that with respect to
the development of standards and implementation specifications, the
Director of the National Institute of Standards and Technology (NIST),
in coordination with the HIT Standards Committee, ``shall support the
establishment of a conformance testing infrastructure, including the
development of technical test beds.'' The United States Congress also
indicated that ``[t]he development of this conformance testing
infrastructure may include a program to accredit independent, non-
Federal laboratories to perform testing.''
2. Regulatory History and Related Guidance
a. Initial Set of Standards, Implementation Specifications, and
Certification Criteria
In accordance with section 3004(b)(1) of the PHSA, the Secretary
published an interim final rule with request for comments entitled
``Health Information Technology: Initial Set of Standards,
Implementation Specifications, and Certification Criteria for
Electronic Health Record Technology'' (HIT Standards and Certification
Criteria interim final rule) (75 FR 2014), which adopted an initial set
of standards, implementation specifications, and certification
criteria. The standards, implementation specifications, and
certification criteria adopted by the Secretary establish the
capabilities that Certified EHR Technology must include in order to, at
a minimum, support the achievement of what has been proposed for
meaningful use Stage 1 by eligible professionals and eligible hospitals
under the Medicare and Medicaid EHR Incentive Programs proposed rule
(see 75 FR 1844 for more information about meaningful use and the
proposed Stage 1 requirements).
b. Medicare and Medicaid EHR Incentive Programs Proposed Rule
On January 13, 2010, CMS published in the Federal Register (75 FR
1844) the Medicare and Medicaid EHR Incentive Program proposed rule.
The rule proposes a definition for meaningful use Stage 1 and
regulations associated with the incentive payments made available under
Division B, Title IV of the HITECH Act. CMS has proposed that
meaningful use Stage 1 would begin in 2011 and has proposed that Stage
1 would focus on ``electronically capturing health information in a
coded format; using that information to track key clinical conditions
and communicating that information for care coordination purposes
(whether that information is structured or unstructured), but in
structured format whenever feasible; consistent with other provisions
of Medicare and Medicaid law, implementing clinical decision support
tools to facilitate disease and medication management; and reporting
clinical quality measures and public health information.''
c. HIT Certification Programs Proposed Rule
Section 3001(c)(5) of the PHSA, specifies that the National
Coordinator ``shall keep or recognize a program or programs for the
voluntary certification of health information technology as being in
compliance with applicable certification criteria adopted [by the
Secretary] under this subtitle.'' We are using this authority to
propose both temporary and permanent certification programs for HIT.
These certification programs are necessary in order to assure that
eligible professionals and eligible hospitals are able to adopt and
implement Certified EHR Technology in an effort to qualify for
meaningful use incentive payments.
Although the initial and primary purpose of our proposed temporary
and permanent certification programs would be to test and certify
Complete EHRs and EHR Modules, we believe that Congress did not intend
to limit the National Coordinator's authority solely to this purpose.
The National Coordinator is expressly authorized to establish a
voluntary certification program or programs for ``health information
technology,'' not simply EHRs. As a result, we expect that our
permanent certification program could also include the testing and
certification of other types and aspects of HIT. Examples of other
types of HIT that could be tested and certified under the permanent
certification program include personal health records (PHRs) and
networks designed for the electronic exchange of health information. We
invite public comment on the need for additional HIT certifications,
the types of HIT that would be appropriate for certification, and on
any of the potential benefits or challenges associated with certifying
other types of HIT.
d. Physician Self-Referral Prohibition and Anti-Kickback EHR Exception
and Safe Harbor Final Rules and ONC Interim Guidance Regarding the
Recognition of Certification Bodies
In August 2006, HHS published two final rules in which CMS and the
Office of Inspector General (OIG) promulgated an exception to the
physician self-referral prohibition and a safe harbor under the anti-
kickback statute, respectively, for certain arrangements involving the
donation of interoperable EHR software to physicians and other health
care practitioners or entities (71 FR 45140 and 71 FR 45110,
respectively). The exception and safe harbor provide that EHR software
will be ``deemed to be interoperable if a certifying body recognized by
the Secretary has certified the software no more than 12 months prior
to the date it is provided to the [physician/recipient].'' ONC
published separately a Certification Guidance Document (CGD) (71 FR
44296) to explain the factors ONC would use to determine whether to
recommend to the Secretary a body for ``recognized certification body''
status. The CGD serves as a guide for ONC to evaluate applications for
``recognized certification body'' status and provides the information a
body would need to apply for and obtain such status. To date, the
Certification Commission for Health Information Technology (CCHIT) has
been the only organization that has both applied for and been granted
``recognized certification body'' status under the CGD.
In section VI of the CGD, ONC notified the public, including
potential
[[Page 11332]]
applicants, that the recognition process explained in the CGD would be
formalized through notice and comment rulemaking and that when a final
rule has been promulgated to govern the process by which a ``recognized
certification body'' is determined, certification bodies recognized
under the CGD would be required to complete new applications and
successfully demonstrate compliance with all requirements of the final
rule.
This proposed rule marks the beginning of the formal notice and
comment rulemaking described in the CGD. As a result, the processes we
propose for the temporary certification program and permanent
certification program, once finalized, would supersede the CGD, and the
authorization process would constitute the new established method for
``recognizing'' certification bodies, as referenced in the physician
self-referral prohibition and anti-kickback EHR exception and safe
harbor final rules. Consequently, certifications issued by a
certification body ``authorized'' by the National Coordinator would
enable Complete EHRs and EHR Modules to meet the definition of
Certified EHR Technology, and it would constitute certification by ``a
certifying body recognized by the Secretary'' in the context of the
physician self-referral EHR exception and anti-kickback EHR safe
harbor.
We request comment on whether we should construe the proposed new
``authorization'' process as the Secretary's method for ``recognizing''
certification bodies in the context of the physician self-referral EHR
exception and anti-kickback EHR safe harbor.
C. Overview of Temporary Certification Program
We are proposing a temporary certification program to describe the
process by which an organization would become an ONC-Authorized Testing
and Certification Body (ONC-ATCB) and authorized under the temporary
certification program to perform the testing and certification of
Complete EHRs and/or EHR Modules. Under the temporary certification
program, the National Coordinator would assume many of the
responsibilities that we have proposed that other organizations would
otherwise fulfill under the permanent certification program.
In order to become an ONC-ATCB, an organization (or organizations)
would need to submit an application to the National Coordinator to
demonstrate its competency and ability to test and certify Complete
EHRs and/or EHR Modules. We propose under the temporary certification
program that in order to become an ONC-ATCB, an applicant must be able
to both test and certify Complete EHRs and/or EHR Modules. We
anticipate that only a few organizations would qualify and become ONC-
ATCBs under the temporary certification program. We also propose
conditions and requirements applicable to the testing and certification
of Complete EHRs and EHR Modules. Under the temporary program, the
National Coordinator would accept applications for ONC-ATCB status at
any time. The temporary program would sunset once the permanent
certification program is established and at least one certification
body has been authorized by the National Coordinator.
D. Overview of Permanent Certification Program
For the permanent certification program, we are proposing that
several of the responsibilities assumed by the National Coordinator
under the temporary certification program would be fulfilled by others.
The National Coordinator would, where appropriate, seek to move as many
of the temporary certification program's processes as possible to
organizations in the private sector. We are proposing a process in the
permanent certification program by which an organization would become
an ONC-Authorized Certification Body (ONC-ACB). Please note, that an
``ONC-ACB'' in the permanent certification program is different than an
``ONC-ATCB'' in the temporary certification program. Under the
permanent certification program, we are proposing that the National
Coordinator's authorization would be valid solely for certification. We
are also proposing that an applicant for ONC-ACB status must be
accredited prior to submitting an application to the National
Coordinator. An applicant's accreditation would be a critical factor in
the National Coordinator's decision to grant it ONC-ACB status. We
discuss in section III.F the process by which the National Coordinator
would approve an accreditor (an ``ONC-Approved Accreditor'' (ONC-AA))
for certification bodies who intend to apply for ONC-ACB status.
Accreditation would also play an important role with respect to
testing. As we discuss, the National Coordinator's authorization in the
permanent certification program would no longer be valid for the
purposes of testing Complete EHRs and EHR Modules. Instead, we propose
that NIST through the National Voluntary Laboratory Accreditation
Program (NVLAP) (and in accordance with section 13201(b) of the HITECH
Act) would be responsible for accrediting testing laboratories and
determining their competency. In this role, NIST would be solely
responsible for overseeing activities related to testing laboratories.
We further propose that ONC-ACBs would only be permitted to accept test
results from NVLAP-accredited testing laboratories when evaluating a
Complete EHR or EHR Module for certification. We also propose for the
permanent certification program, similar to the temporary certification
program, conditions and requirements that would apply to the
certification of Complete EHRs and EHR Modules. Finally, unlike the
temporary certification program, we propose that an ONC-ACB would be
required to renew its status every two years under the permanent
certification program.
E. Factors Influencing the Proposal of both Temporary and Permanent
Certification Programs
A number of factors played a role in our decision to propose a
temporary certification program that could be implemented quickly, and
a permanent certification program that would be established for the
long term. These factors include the recommendations of the HIT Policy
Committee; the interrelationships of this proposed rule with the HIT
Standards and Certification Criteria interim final rule (75 FR 2014)
and the Medicare and Medicaid EHR Incentive Programs proposed rule (75
FR 1844); the need for eligible professionals and eligible hospitals to
have Certified EHR Technology available in a timely manner; and our
consultations with NIST.
1. HIT Policy Committee Recommendations
As noted above, section 3002(b) requires the HIT Policy Committee
to make recommendations to the National Coordinator related to the
implementation of a nationwide health information technology
infrastructure. As part of this responsibility, the HIT Policy
Committee made five recommendations to the National Coordinator on
August 14, 2009, which support the approach proposed in this rule. The
recommendations addressed the scope of the certification process in
general and the approach the National Coordinator should take to
establish certification programs. The HIT Policy Committee recommended
``that in defining the certification process[hellip]the following
objectives are pursued:
(1) Focus certification on Meaningful Use.
[[Page 11333]]
(2) Leverage the certification process to improve progress on
privacy, security, and interoperability.
(3) Improve the objectivity and transparency of the certification
process.
(4) Expand certification to include a range of software sources,
e.g., open source, self-developed, etc.
(5) Develop a short-term certification transition plan.''
The National Coordinator reviewed and considered the
recommendations made by the HIT Policy Committee and concluded that
they should be used to provide direction for the proposals included in
this rule. We believe that the proposals in this rule reflect the
overall intent of the HIT Policy Committee's recommendations.
We interpret the HIT Policy Committee's use of the word ``self-
developed'' and use it throughout the preamble to mean a Complete EHR
or EHR Module that has been designed, modified, or created by, or under
contract for, a person or entity that will assume the total costs for
its testing and certification and will be a primary user of the
Complete EHR or EHR Module. Self-developed Complete EHRs and EHR
Modules could include brand new Complete EHRs or EHR Modules developed
by a health care provider or their contractor. It could also include a
previously purchased Complete EHR or EHR Module which is subsequently
modified by the health care provider or their contractor and where such
modifications are made to capabilities addressed by certification
criteria adopted by the Secretary. We limit the scope of
``modification'' to only those capabilities for which the Secretary has
adopted certification criteria because other capabilities (e.g., a
different graphical user interface (GUI)) would not affect the
underlying capabilities a Complete EHR or EHR Module would need to
include in order to be tested and certified.
Accordingly, we would only refer to the Complete EHR or EHR Module
as ``self-developed'' if the health care provider paid the total costs
to have the Complete EHR or EHR Module tested and certified. For
example, if hospital A self-develops a Complete EHR, pays for the
Complete EHR to be tested and certified, and then goes on to sell or
make it freely available to additional hospitals, we would not refer to
the Complete EHRs used by those hospitals (other than hospital A) as
being self-developed.
2. Coordination With the HIT Standards and Certification Criteria
Interim Final Rule and the Medicare and Medicaid EHR Incentive Programs
Proposed Rule
This proposed rule is the third and final element of HHS's
coordinated rulemakings to define the meaningful use of Certified EHR
Technology and support the achievement of meaningful use.
As required by the HITECH Act, eligible professionals and eligible
hospitals must demonstrate meaningful use of Certified EHR Technology
in order to receive incentive payments under the Medicare and Medicaid
EHR Incentive Programs. This proposed rule would create the
certification programs under which Complete EHRs and EHR Modules could
be tested and certified and subsequently used as Certified EHR
Technology by eligible professionals and eligible hospitals. Once
authorized by the National Coordinator, ONC-ATCBs under the temporary
certification program and ONC-ACBs under the permanent certification
program would be obligated to use the certification criteria adopted by
the Secretary and identified at 45 CFR 170.302, 45 CFR 170.304, and 45
CFR 170.306. The Secretary intends to adopt subsequent certification
criteria to support the requirements for future meaningful use stages
once promulgated in regulation by CMS and may, where appropriate, adopt
certification criteria for other types of HIT.
3. Timeliness Related to the Beginning of the Medicare and Medicaid EHR
Incentive Programs
i. Public Comment Period
Congress established specific timeframes in the HITECH Act for the
beginning of the Medicare EHR incentive program. The first payment year
for eligible professionals was defined as calendar year 2011 (i.e., the
year beginning January 1, 2011) and the first payment year for eligible
hospitals was defined as fiscal year 2011 (i.e., the year beginning
October 1, 2010). Congress specified in section 1903(t)(6)(C)(i)(I) of
the SSA that ``for the first year of payment to a Medicaid provider
under this subsection, the Medicaid provider [must] demonstrate that it
is engaged in efforts to adopt, implement, or upgrade certified EHR
technology.'' Although there is no specified date for States to begin
implementing the Medicaid EHR incentives program, Congress did set a
cutoff for when first payments would no longer be permitted to Medicaid
providers (``for any year beginning after 2016''). While the Medicare
and Medicaid EHR Incentive Programs proposed rule provides more detail
for this statutory provision, it is important to note that Medicaid
providers will not be able to receive an incentive payment for
``adopting, implementing, or upgrading Certified EHR Technology'' until
a certification program is established to allow for the testing and
certification of Complete EHRs and EHR Modules.
To meet the previously mentioned timeframes, Certified EHR
Technology must be available before the fall of 2010. Accomplishing
this goal will require many simultaneous actions:
Complete EHRs and EHR Modules may need to be reprogrammed
or redesigned in order to meet the certification criteria adopted by
the Secretary;
A certification program must be established to allow for
testing and certification of Complete EHRs and EHR Modules; and
A collection of Complete EHRs and EHR Modules will need to
be tested and certified under the established temporary certification
program.
For these reasons, among others discussed below, we have chosen to
propose the establishment of a temporary certification program that
could be established and become quickly operational in order to assure
the availability of Certified EHR Technology prior to the beginning of
meaningful use Stage 1.
With these timing constraints in mind, we have provided for a 30-
day public comment period on our proposals for the temporary
certification program and a 60-day comment period on our proposals for
the permanent certification program. Section 6(a)(1) of Executive Order
12866 on Regulatory Planning and Review (September 30, 1993, as further
amended) states that ``each agency should afford the public a
meaningful opportunity to comment on any proposed regulation, which in
most cases should include a comment period of not less than 60 days.''
We believe that it is appropriate to follow this guidance in soliciting
public comment on our proposed permanent certification program because
the permanent certification program's final rule will be issued some
months after the final rule for the temporary certification program.
However, as discussed throughout the preamble, the circumstances and
time constraints under which the temporary certification program must
be established are different. As a result, we believe that a 30-day
comment period provides a meaningful opportunity for the public to
comment on our proposals for the temporary certification program
[[Page 11334]]
and that it will allow ONC to thoughtfully consider comments before
issuing a timely final rule to implement the temporary certification
program. In light of the common proposals we have made for certain
parts of the temporary and permanent certification programs, we
anticipate considering all comments made on this proposed rule when we
finalize the permanent certification program's final rule.
We have proposed a temporary certification program based on our
estimates that it would take too long to establish some of the elements
included in our proposed permanent certification program. For example,
these elements include approximately 6-9 months for the establishment
of the accreditation processes for both testing laboratories by NVLAP
and certification bodies by an ONC-AA as well as the time following for
organizations to gain their accreditation and then subsequently apply
to the National Coordinator for ONC-ACB status. Given our goal to
assure availability of Certified EHR Technology prior to the beginning
of meaningful use Stage 1, we believe that the establishment of a
temporary certification program is a pragmatic and prudent approach to
take. Additionally, we believe that a temporary certification program
is necessary because even assuming the National Coordinator receives
applications from organizations seeking to become ONC-ATCBs under the
temporary certification program on the first possible day they can
apply, we efficiently process the applications, and ultimately
authorize one or more organizations, it is likely that ONC-ATCBs will
not exist until May or June 2010. It will also take ONC-ATCBs time to
process requests for testing and certification under the temporary
certification program.
ii. Urgency of Establishing the Temporary Certification Program
As we have discussed, the HITECH Act provides that eligible
professionals and eligible hospitals must demonstrate meaningful use of
Certified EHR Technology in order to receive incentive payments under
the Medicare and Medicaid EHR Incentive Programs.
This rule proposes the creation of a temporary certification
program, in addition to a permanent certification program, under which
Complete EHRs and EHR Modules could be tested and certified, and
subsequently adopted and implemented by eligible professionals and
eligible hospitals in order to attempt to qualify for incentive
payments under meaningful use Stage 1. Establishing the temporary
certification program in a timely fashion is critical to begin enabling
eligible professionals and eligible hospitals to achieve meaningful use
within the required timeframes. For this goal to be accomplished both
the HIT industry and the Department will have to achieve several
milestones before Complete EHRs and EHR Modules can be tested and
certified. After the close of the public comment period for the
proposed temporary certification program, ONC will review and consider
timely submitted public comments and then draft and publish the
temporary certification program's final rule. The HIT industry will
then need to respond. Organizations seeking to apply for ONC-ATCB
status will submit their applications, the National Coordinator will
then review and assess them, and if necessary, seek additional
information through the established process. Once the National
Coordinator has authorized the first ONC-ATCB, the testing and
certification of Complete EHRs and EHR Modules will need to take place
in accordance with the temporary certification program provisions.
To facilitate an immediate launch of the ONC-ATCB application
review process under the temporary certification program, we are also
proposing that the National Coordinator accept and hold all
applications for ONC-ATCB status received prior to the final rule
effective date. Under the Administrative Procedure Act (5 U.S.C.
553(d)), publication of a substantive final rule must occur not less
than 30 days before its effective date, absent certain statutory
exceptions. In other words, a substantive rule cannot become effective
until 30 days after its publication, unless an exception applies. We
are consequently proposing that the National Coordinator simply accept
and hold all applications for ONC-ATCB status that are received prior
to the temporary certification program's final rule's effective date,
so that immediately upon the final rule becoming effective, the
National Coordinator could begin reviewing received applications
without further delay. We request public comment on this proposal and
the urgency of establishing the temporary certification program,
including how this provision might affect the ability of eligible
professionals and eligible hospitals to timely achieve meaningful use
Stage 1.
4. Consultations With NIST
Section 3001(c)(5) of the PHSA directs the National Coordinator to
consult with the Director of the NIST in the development of a
certification program or programs. Consistent with this statutory
provision, we have developed our proposed certification programs with
the guidance and cooperation of NIST subject matter experts in testing
and certification. Based on NIST recommendations, we believe it is
appropriate to use the International Organization for Standardization
(ISO) and the International Electrotechnical Commission (IEC) ISO/IEC
Guide 65, ISO/IEC 17025, and ISO/IEC 17011 to structure how testing,
certification, and accreditation are conducted under our proposed
certification programs. The ISO Committee on conformity assessment
(CASCO) prepared ISO/IEC Guide 65, ISO/IEC 17025, and ISO/IEC 17011 and
we believe the use of the ISO/IEC guide and standards will help ensure
that the proposed certification programs operate in a manner consistent
with national and international practices for testing and
certification.
Under the temporary certification program we propose that
applicants for ONC-ATCB status will need to demonstrate to the National
Coordinator their conformance to both ISO/IEC Guide 65:1996 (Guide 65)
and ISO/IEC 17025:2005 (ISO 17025). Under the permanent certification
program applicants for ONC-ACB status would be required to be
accredited by an ONC-AA for certification which would require a
demonstration of conformance to Guide 65. Guide 65 specifies the
``general requirements for bodies operating product certification
systems.'' The certification of products (including processes and
services) to this standard provides assurance that the products comply
with specified technical and business requirements. ISO 17025 is an
international standard that specifies the ``general requirements for
competence of testing and calibration laboratories.'' This standard
addresses how testing should be performed using standard methods, non-
standard methods, and laboratory-developed methods. We believe Guide 65
and ISO 17025 are necessary and appropriate for ONC-ATCBs to follow
under the temporary certification program because they provide standard
procedures and requirements for testing and certification widely
accepted by the information technology industry and would ensure
consistency and efficiency in the testing and certification procedures
ONC-ATCBs would perform.
Under the permanent certification program we believe and have
proposed that an ONC-AA for certification would have to conform to ISO/
IEC 17011:2004 (ISO 17011). ISO 17011 is an international standard that
specifies the ``general requirements for accreditation bodies
accrediting conformity
[[Page 11335]]
assessment bodies,'' such as certification bodies.
The ISO/IEC documents use certain terminology that differs from the
terminology used in this proposed rule. We recognize that this proposed
rule has been drafted to ensure consistency with existing regulatory
and/or statutory terms, whereas the ISO/IEC documents were drafted for
a different purpose and have a broader application to a variety of
industries. Nevertheless, we intend certain terms in Guide 65, ISO
17025, and ISO 17011 to have the same meaning as related terms in this
proposed rule. To ensure a consistent application of the ISO/IEC
documents in the context of this proposed rule, we are therefore
proposing the following crosswalk. The indicated terms in the documents
specified below would have the meanings attributed to the related terms
used in this proposed rule, as provided in the following table.
------------------------------------------------------------------------
Terms used in Guide 65, ISO 17025, and ISO Terms used in this Proposed
17011 Rule
------------------------------------------------------------------------
Bodies operating product ONC-ATCB.
certification systems.
ONC-ACB.
Certification body............... Testing and
certification body.
Conformity assessment bodies..... Certification body.
Testing and calibration Testing laboratory.
laboratories.
Accreditation body............... Accreditation
organization.
ONC-AA.
Products......................... Complete EHRs.
EHR Modules.
HIT.
------------------------------------------------------------------------
F. Additional Context for Comparing the Temporary and Permanent
Certification Programs
Rather than proposing the temporary and permanent certification
programs in two separate proposed rules, we have proposed them together
in this notice of proposed rulemaking because we believe this approach
provides the public with a broader context for each of the programs and
a better opportunity to make informed comments. In an effort to prevent
confusion, though, we first discuss our complete set of proposals for
the temporary certification program (section II) and then our complete
set of proposals for the permanent certification program (section III).
As a result, some of the proposals discussed below for both proposed
certification programs are very similar, if not the same, and are
included twice--in the discussions of the temporary certification
program and the permanent certification program. In other cases, there
are significant differences between our proposals underlying the
temporary and permanent certification programs. Before discussing our
complete set of proposals for the temporary certification program and
to provide additional context for the temporary program, we summarize
some of the more significant differences between the temporary and
permanent certification programs.
1. The Distinction Between Testing and Certification
We believe that there is a distinct difference between the
``testing'' and ``certification'' of a Complete EHR and/or EHR Module.
In this proposed rule, ``testing'' is meant to describe the process
used to determine the degree to which a Complete EHR or EHR Module can
meet specific, predefined, measurable, quantitative requirements. These
results would be able to be compared to and evaluated in accordance
with predefined measures. In contrast, ``certification'' is meant to
describe the assessment (and subsequent assertion) made by an
organization, once it has analyzed the quantitative results rendered
from testing along with other qualitative factors, that a Complete EHR
or EHR Module has met all of the applicable certification criteria
adopted by the Secretary. Qualitative factors could include whether a
Complete EHR or EHR Module developer has a quality management system in
place, or whether the Complete EHR or EHR Module developer has agreed
to the policies and conditions associated with being certified (e.g.,
proper logo usage). Above and beyond testing, the act of certification
typically promotes confidence in the quality of a product (and the
vendor that produced it), offers assurance that the product will
perform as described, and helps to make it easier for consumers to
differentiate which products have met specific criteria from others
that have not.
A fundamental difference between testing and certification is that
testing is intended to result in objective, unanalyzed data. In
contrast, certification is expected to result in an overall assessment
of the test results, consideration of their significance, and
consideration of other factors to determine whether the prerequisites
for certification have been achieved. The following is a simple example
to illustrate an important difference between testing and
certification.
An e-prescribing EHR Module developer that seeks to have its EHR
Module certified would first submit the EHR Module to be tested. To
successfully pass the established testing requirements, the e-
prescribing EHR Module would, among other functions, need to transmit
an electronic prescription using mock patient data according to the
standards adopted by the Secretary. Provided that the e-prescribing EHR
Module successfully passed this test it would next be evaluated for
certification. Certification could require that the EHR Module
developer agree to a number of provisions, including, for example,
displaying the EHR Module's version and revision number so potential
purchasers could compare when the EHR Module was last updated or
certified. If the EHR Module developer agreed to all of the applicable
certification requirements and the EHR Module achieved a passing test
result, the e-prescribing EHR Module would be certified. In these
situations, both the EHR Module passing the technical requirements
tests and the EHR Module vendor meeting the other certification
requirements would be required for the EHR Module to achieve
certification.
2. Accreditation
We have proposed, in the interest of expediency and to facilitate
timely certification of Complete EHRs and EHR Modules, that ONC-ATCBs
under temporary certification program would be authorized (and
required) to perform both the testing and certification of Complete
EHRs and/or EHR Modules. Under the temporary certification program, the
National Coordinator would serve in a role similar to an accreditor and
would assess an ONC-ATCB applicant's competency to perform both testing
and certification before granting the applicant ONC-ATCB status.
However, we do not believe that this would be an optimal or practical
approach for the long-term because specialized accreditors in the
private sector are better equipped to react effectively and efficiently
to changes in the HIT market and to more rigorously oversee the
certification bodies they accredit. Moreover, we have observed in other
industries, such as the manufacturing of water-conserving products,
that testing and certification processes are typically handled
independently and separately.\1\ Consequently, under the permanent
certification program, we have proposed to shift the accreditation
responsibilities for testing laboratories and certification bodies from
the National Coordinator to other organizations. As previously
[[Page 11336]]
mentioned, we understand that it may take several months to establish
separate accreditation programs for testing laboratories and
certification bodies and this factor weighed heavily in our decision to
propose a temporary certification program. We consequently believe that
the additional time the temporary certification program would afford
the Department and HIT industry to develop a HIT-oriented accreditation
program would greatly assist the HIT industry's transition to the
accreditation process we have proposed under the permanent
certification program.
---------------------------------------------------------------------------
\1\ See http://www.epa.gov/watersense/partners/certification.html.
---------------------------------------------------------------------------
Under the permanent certification program, we propose the use of
accreditation as a mechanism to ensure that organizations that test and
certify Complete EHRs and/or EHR Modules possess the requisite
competencies to perform such actions with a high degree of precision.
We believe that the proposed accreditation process will also introduce
rigor, transparency, trust, and objectivity to the permanent
certification program. Additionally, accreditation provides an
oversight mechanism to ensure that testing laboratories and
certification bodies are properly performing their respective duties.
Consequently, in order for an applicant under the permanent
certification program to become an ONC-ACB, we would require that it be
accredited by an ``ONC-Approved Accreditor'' (ONC-AA) for certification
in addition to meeting our other proposed application requirements.
Along these lines, we propose a process by which accreditation
organizations can request the National Coordinator's approval to become
an ONC-AA. We believe this process is necessary because we propose
several responsibilities for an ONC-AA to fulfill in order to ensure
our programmatic objectives for the permanent certification program are
met. Additionally, an approval process for an ONC-AA is necessary in
order for potential applicants for ONC-ACB status to know from whom
they can request accreditation.
As we mention above, under the permanent certification program, the
National Coordinator would only authorize organizations to engage in
certification. We emphasize that this is not meant to preclude, limit,
or in any way prevent an organization from also performing the testing
of Complete EHRs and/or EHR Modules. However, in order for a single
organization (which may comprise subsidiaries or components) to perform
both testing and certification under the permanent certification
program it would need to be: (1) Accredited by an ONC-AA and
subsequently become an ONC-ACB; and (2) accredited by the NVLAP. We
request public comment on whether we should give organizations who are
``dual accredited'' and also become an ONC-ACB a special designation to
indicate to the public that such an organization would be capable of
performing both testing and certification under the permanent
certification program.
The NVLAP, established by the NIST, develops specific laboratory
accreditation programs (LAPs) for testing and calibration laboratories
in response to legislative or administrative actions, requests from
government agencies or, in special circumstances, from private sector
entities.\2\ The National Coordinator would make a final determination
about whether to issue a request to NVLAP to develop a LAP for testing
laboratories after considering public comments on our proposals for the
permanent certification program. To ensure that ONC-ACBs review test
results from legitimate and competent testing laboratories, we propose
that ONC-ACBs would only be permitted to certify Complete EHRs and/or
EHR Modules that have been tested by a NVLAP-accredited testing
laboratory.
---------------------------------------------------------------------------
\2\ ``What is the NVLAP'' http://ts.nist.gov/Standards/upload/What-is-the-NVLAP.pdf.
---------------------------------------------------------------------------
3. Surveillance
Under the permanent certification program we propose requirements
for ONC-ACBs related to the surveillance of certified Complete EHRs and
certified EHR Modules. We also propose certain requirements relating to
surveillance for ONC-ATCBs under the temporary certification program.
However, we anticipate that the temporary certification program would
end close to the time an appropriate sample size of implemented
certified Complete EHRs and certified EHR Modules would be available
for ONC-ATCBs to perform ongoing surveillance. As a result of this
limitation, we have proposed affording less weight to surveillance
requirement compliance as well as less stringent requirements for ONC-
ATCBs related to surveillance in the temporary certification program
than we have proposed for ONC-ACBs under the permanent certification
program.
We previously mentioned that we would require applicants for ONC-
ACB status to be accredited by an ONC-AA. We propose that an ONC-AA in
performing accreditation verify a certification body's conformance, at
a minimum, to Guide 65. As a result, we expect that ONC-ACBs will
perform surveillance in accordance at a minimum with Guide 65, which in
section 13, among other provisions, provides that the ``certification
body [or `ONC-ACB'] shall periodically evaluate the marked [or
`certified'] products to confirm that they continue to conform to the
[adopted] standards.'' ONC-ACBs consequently would be required to
evaluate and reevaluate previously certified Complete EHRs and/or EHR
Modules to determine whether the Complete EHRs and/or EHR Modules they
had certified in a controlled environment also perform in an
acceptable, if not the same, manner in the field as they had performed
when they were being certified. We discuss our proposals related to
surveillance in the permanent certification program at section
III.D.1.c.iii.
II. Provisions of the Temporary Certification Program
[If you choose to comment on the provisions of the temporary
certification program, please include at the beginning of your comment
the specific section title and any additional information to clearly
identify the proposal about which you are commenting. For example,
``Definitions'' or ``Sunset.'']
A. Applicability
This subpart would establish the processes that applicants for ONC-
ATCB status must follow to be granted ONC-ATCB status by the National
Coordinator, the processes the National Coordinator would follow when
assessing applicants and granting ONC-ATCB status, and the requirements
of ONC-ATCBs for testing and certifying Complete EHRs and/or EHR
Modules in accordance with the applicable certification criteria
adopted by the Secretary in subpart C.
B. Definitions
1. Definition of Applicant
We propose that the term applicant mean a single organization or a
consortium of organizations that seeks to become an ONC-ATCB by
requesting and subsequently submitting an application for ONC-ATCB
status to the National Coordinator.
2. Definition of Day or Days
We propose that unless otherwise explicitly specified, the term day
or days shall mean a calendar day or calendar days.
3. Definition of ONC-ATCB
We propose ONC-ATCB to mean an organization or a consortium of
organizations that has applied to and been authorized by the National
Coordinator pursuant to the sections
[[Page 11337]]
below to perform the testing and certification of Complete EHRs and/or
EHR Modules under the temporary certification program.
C. Correspondence With the National Coordinator
Throughout the following sections, we have proposed numerous
instances where applicants for ONC-ATCB status and ONC-ATCBs would have
to correspond with the National Coordinator and vice versa. These
instances are almost always associated with specific timeframes (e.g.,
the amount of days an applicant has to respond to a deficient
application notice, etc.). Additionally, because such timeframes either
trigger the beginning of a review process or the close of a response
period it is important for there to be clear, unambiguous beginnings
and endings for when such events must occur (e.g., receipt of an
application).
Moreover, it is the National Coordinator's preference to use e-mail
whenever possible to communicate with an applicant for ONC-ATCB status
or an ONC-ATCB. Therefore, we generally propose that any communication
by the National Coordinator would be via e-mail and, where applicable,
that we would consider the official date of receipt of any e-mail
between the National Coordinator and an applicant for ONC-ATCB status
or an ONC-ATCB to be the day the e-mail was sent, as indicated by the
e-mail time-stamp. Where it is necessary for correspondence to take
place via regular or express mail, we propose to use ``delivery
confirmation'' documentation to establish the official date of receipt.
D. Temporary Certification Program Application Process for ONC-ATCB
Status
1. Application for ONC-ATCB Status
In order to be considered for ONC-ATCB status, we propose that an
applicant must submit an application to the National Coordinator. The
application would be comprised of two parts. In order to receive an
application, an applicant would have to request one in writing from the
National Coordinator (requests would be made to the following e-mail
address: [email protected]).
a. Types of Applicants
We propose that single organizations and consortia would be
eligible to apply for ONC-ATCB status under the temporary certification
program. We expect a consortium, for example, would be comprised of one
organization that would serve as a testing laboratory and a separate
organization that would serve as a certification body. When viewed as a
single applicant, this applicant would be able to perform all of the
required responsibilities of an ONC-ATCB under the temporary
certification program. We support this approach and believe that the
combined expertise of two or more organizations could also result in a
qualified applicant.
b. Types of ONC-ATCB Authorization
In order to properly categorize the application provided to an
applicant, we would require applicants to indicate the type of testing
and certification they seek authorization to perform under the
temporary certification program. We propose that applicants must
request authorization to perform the testing and certification of
Complete EHRs or solely EHR Modules. We would treat a request for
authorization to perform the testing and certification of Complete EHRs
to encompass a request for authorization to perform the testing and
certification of EHR Modules because, by default, an ONC-ATCB
authorized to test and certify Complete EHRs would be able to test and
certify all of the certification criteria adopted by the Secretary at
45 CFR part 170, subpart C. Therefore, we believe, from a technical
perspective, that if an ONC-ATCB can test and certify a Complete EHR it
would also be capable of testing and certifying EHR Modules. With
respect to EHR Modules, this does not mean that an ONC-ATCB would be
expected to determine whether one certified EHR Module would be able to
seamlessly integrate with another EHR Module. Again, as discussed in
the HIT Standards and Certification Criteria interim final rule, if an
eligible professional or eligible hospital chooses to use a combination
of certified EHR Modules to customize their HIT to meet the definition
of Certified EHR Technology, they have the responsibility to ensure
that the certified EHR Modules can properly work together. Please note,
though, that some EHR Modules may be subject to certain additional
Federal requirements.
We request public comment on whether ONC-ATCBs should also be
required to test and certify that any EHR Module presented by one EHR
Module developer for testing and certification would properly work
(i.e., integrate) with another EHR Module presented by a different EHR
Module developer (this request for public comment would also apply to
ONC-ACBs under the permanent certification program).
Additionally, we request public comment on whether the National
Coordinator should permit applicants to seek authorization to test and
certify only Complete EHRs designed for an ambulatory setting or,
alternatively, Complete EHRs designed for an inpatient setting. Under
our current proposal, an applicant seeking authorization to perform
Complete EHR testing and certification would be required to test and
certify Complete EHRs designed for both ambulatory and inpatient
settings. However, if we were to separately authorize Complete EHR
testing and certification, we see certain benefits for the temporary
certification program as well as some negative effects. Among the
benefits, this approach could create the potential that more
organizations would apply for ONC-ATCB status because fewer resources
may be needed and could be focused on one type of testing and
certification. Among the negative effects, this approach could result
in a situation in which no ONC-ATCB exists to certify one or another
type of Complete EHR. This would prevent the testing and certification
of Complete EHRs designed for either an ambulatory or inpatient setting
from being able to be tested and certified.
With respect to EHR Modules, we would require applicants to
identify the type(s) of EHR Module(s) they seek authorization to test
and certify and would restrict any authorization granted to only those
types of EHR Module(s). For example, if an applicant requests
authorization to test and certify electronic prescribing EHR Modules,
and is subsequently authorized to do so, it would not also be
authorized to test and certify other EHR Modules, such as those related
to clinical decision support.
c. Application Part One
We propose that an applicant must address the following four
sections in part one of its application:
i. Under section one, the applicant would be required to provide
the following general information to, among other reasons, ensure that
we have proper contact information:
The name, address, city, State, ZIP code, and Web site of
the applicant;
The name, title, phone number, and e-mail of the person
who will serve as the point of contact for the applicant. This person
must be legally authorized to execute and submit an application on
behalf of the applicant (we refer to this person as an ``authorized
representative'').
ii. Under section two, the applicant would be required to provide
the following information in an effort to demonstrate conformance to
Guide 65
[[Page 11338]]
(which specifies the standards for operating a certification program):
The results of a completed self-audit to all sections of
Guide 65. We expect that applicants would complete this self-audit to
the best of their ability. Because the temporary certification program
will only be in existence for a relatively short period of time, we
recognize that certain limitations exist with respect to specific
sections of Guide 65. In particular, while we expect an applicant to
address Guide 65 section 13 (surveillance), we anticipate putting
relatively little weight on the specific responsibilities for ONC-ATCBs
related to surveillance in the temporary certification program;
A description of the applicant's management structure
according to section 4.2 of Guide 65 (Section 4.2 requires an applicant
to provide a description of its organization including, but not limited
to, legal or ownership status, decision making processes, assurance of
objectivity and impartiality in order to justify its ability to
appropriately operate a certification program);
A copy of the applicant's quality manual that has been
developed according to section 4.5.3 of Guide 65 (Section 4.5.3
requires a quality manual documenting the organization's quality
system, including, but not limited to, quality objectives and
commitment to quality, and associated policies and procedures to ensure
quality);
The applicant's policies and approach to confidentiality
according to section 4.10 of Guide 65 (Section 4.10 requires
documentation of arrangements for safeguarding confidentiality of
information, consistent with applicable laws);
The qualifications of each of the applicant's personnel
who oversee or perform certification according to section 5.2 of Guide
65 (Section 5.2 requires information on the relevant qualifications,
training, and expertise of each staff member involved in the
certification process to be retained and kept up-to-date);
A copy of the applicant's evaluation reporting procedures
according to section 11 of Guide 65 (Section 11 requires a description
of evaluation reporting procedures for conformity or nonconformity of
products with all certification requirements, including any remedial
actions necessary for conformity); and
A copy of the applicant's policies for use and display of
certificates (e.g., logos) according to section 14 of Guide 65 (Section
14 requires evidence of policies and procedures for use and display of
certificates, as appropriate).
iii. Under section three, the applicant would be required to
provide the following information in an effort to demonstrate
conformance to ISO 17025 (which specifies the standards for operating a
testing program):
The results of a completed self-audit to all sections of
ISO 17025;
A copy of the applicant's quality system document
according to section 4.2.2 of ISO 17025 (Section 4.2.2 requires a
quality system document to describe the management system policies
related to quality, including a quality policy statement covering such
items as purpose, objectives, and commitment to appropriate standards
and best professional practices);
A copy of the applicant's policies and procedures for
handling testing nonconformities according to section 4.9.1 of ISO
17025 (Section 4.9.1 requires a description of policies and procedures
used to identify, evaluate, and correct any nonconformity to testing
procedures or other requirements); and
The qualifications of each of the applicant's personnel
who oversee or perform testing according to section 5.2 of ISO 17025
(Section 5.2 requires personnel competency records on the relevant
qualifications, training, and expertise of each staff member involved
in performing testing to be retained and kept up-to-date).
iv. Under section four, the applicant would be required to submit a
properly executed agreement that it will adhere to the ``Principles of
Proper Conduct for ONC-ATCBs.'' The Principles of Proper Conduct for
ONC-ATCBs would require an ONC-ATCB to:
Operate its certification program in accordance with Guide
65 and its testing program in accordance with ISO 17025.
Maintain an effective quality management system which
addresses all requirements of ISO 17025.
Attend all mandatory ONC training and program update
sessions.
Maintain a training program that includes documented
procedures and training requirements to ensure its personnel are
competent to test and certify Complete EHRs and/or EHR Modules.
Use testing tools and procedures published by NIST (e.g.,
published on its Web site or through a notice in the Federal Register)
or functionally equivalent testing tools and procedures published by
another entity for the purposes of assessing Complete EHRs and/or EHR
Modules compliance with the certification criteria adopted by the
Secretary.
Report to ONC within 15 days any changes that materially
affect its:
[cir] Legal, commercial, organizational, or ownership status;
[cir] Organization and management, including key testing and
certification personnel;
[cir] Policies or procedures;
[cir] Location;
[cir] Facilities, working environment or other resources;
[cir] ONC authorized representative (point of contact); or
[cir] Other such matters that may otherwise materially affect its
ability to test and certify Complete EHRs and/or EHR Modules.
Allow ONC, or its authorized agents(s), to periodically
observe on site (unannounced or scheduled) during normal business
hours, any testing and/or certification performed to demonstrate
compliance with the requirements of the temporary certification
program.
Provide ONC, no less frequently than weekly, a current
list of Complete EHRs and/or EHR Modules that have been tested and
certified which includes, at a minimum, the vendor name (if
applicable), the date certified, product version, the unique
certification number or other specific product identification, and
where applicable, the certification criterion or certification criteria
to which each EHR Module has been tested and certified.
Retain all records related to the testing and
certification of Complete EHRs and/or EHR Modules for the duration of
the temporary certification program and provide copies of all testing
and certification records to ONC at the sunset of the temporary
certification program.
Promptly refund any and all fees received for tests and
certifications that will not be completed.
We believe that adherence to these principles is necessary because
they will help protect the integrity of the certification program and
ensure that an applicant is capable of satisfactorily carrying out the
required duties and responsibilities of an ONC-ATCB.
With respect to the third-to-the last principle listed, and in an
effort to make it easier for eligible professionals and eligible
hospitals to cross-validate that they have in fact adopted Certified
EHR Technology, the National Coordinator intends to make a master
``certified HIT products list'' of all Complete EHRs and EHR Modules
tested and certified by ONC-ATCBs available on the ONC Web site. This
Web site would be a public service and would be a single, aggregate
source of all the certified product information ONC-ATCBs provide to
the
[[Page 11339]]
National Coordinator. The master certified HIT products list would also
represent all of the Complete EHRs and EHR Modules that could be used
to meet the definition of Certified EHR Technology. Over time, we
anticipate adding features to this Web site, which could include
interactive functions to enable eligible professionals and eligible
hospitals to use to determine whether a combination of certified EHR
Modules, for instance, constitutes Certified EHR Technology.
With respect to the second to the last listed principle of proper
conduct, because we anticipate that the temporary certification program
will sunset in a relatively short period of time, we have proposed that
all testing and certification records created by ONC-ATCBs must be
retained, at a minimum, for the duration of the temporary certification
program rather than proposing a specific preset length of time for
record retention. Further, we propose that when the temporary
certification program sunsets, all ONC-ATCBs would be required to
provide to the National Coordinator copies of all of their testing and
certification records. We also propose a specific minimum time period
for record retention in the permanent certification program.
d. Application Part Two
In part two of the ONC-ATCB application process, applicants would
be required to complete a proficiency examination. A proficiency
examination would be used to assess whether an applicant can
competently test and certify Complete EHRs and/or EHR Modules. Because
the National Coordinator under the temporary certification program is
performing a role similar to an accreditor, we believe a proficiency
examination is a necessary requirement. We propose to create the
proficiency examination with NIST's assistance and to design it to
evaluate an applicant's knowledge and understanding of HIT
functionality and standards and certification criteria, as well as
their ability to properly test and certify Complete EHRs and/or EHR
Modules. We believe that key personnel directly employed by applicants
should be primarily responsible for completing the proficiency
examination. Due to the topics it will cover, we anticipate that
several key personnel may be required to complete the proposed
proficiency examination. While we have not proposed to prohibit
applicants from consulting with outside experts to complete their
application, applicants would still need to clearly demonstrate in the
material they submit to the National Coordinator that they will be able
to competently operate a testing and certification program. In
reviewing applications, the National Coordinator would take such
assistance into account in order to determine whether an applicant's
purported competency is not artificially inflated by temporarily
retained outside expertise.
We propose to include questions in each proficiency exam from the
following three sections. While a proficiency examination would address
each of the sections below, we plan to generate a pool of questions
from which a random selection would be used for an individual
proficiency examination to ensure that no two proficiency examinations
will be exactly the same. We have provided example questions for each
section, but we do not believe that the specific proficiency exam
questions should be made publicly available. The purpose of a
proficiency examination is for an applicant to prove to the National
Coordinator at the time of application submission that it possesses an
adequate level of knowledge to competently perform the testing and
certification of Complete EHRs and/or EHR Modules. Consequently, our
rationale for posing different questions in each proficiency
examination is the same as our reason for not making the specific
proficiency examination questions available prior to an applicant
submitting a satisfactory application--we seek to prevent an applicant
from preparing answers in advance, which could inaccurately reflect an
applicant's true competency. We are proposing that the applicant also
affirmatively attest that it will not copy, retain, disclose, or in any
way divulge any information from the proficiency examination.
Section 1--Knowledge Quiz
This section would require an applicant to demonstrate a solid
understanding of, and technical expertise in, Complete EHRs and/or EHR
Modules. The applicant would be required to address the following
concepts in a quiz format: Basic health IT knowledge; familiarity with
the standards, implementation specifications, and certification
criteria adopted by the Secretary; familiarity with test methods
associated with the certification criteria adopted by the Secretary;
and ability to determine how a test should be performed for a
particular set of certification criteria.
An example question for section 1 would be: Please indicate the
certification criteria adopted by the Secretary that also require
compliance with specific standards. For each certification criterion,
indicate its purpose and, if applicable, the potential alternative
standard(s) adopted by the Secretary to which a Complete EHR or EHR
Module could be tested and certified.
Section 2--Identification of Test Tools
This section would require an applicant to demonstrate that it can
correctly identify and use test tools published by ONC for Complete
EHRs and EHR Modules. The test tools and functional testing techniques
for the certification criteria adopted by the Secretary have been or
will be developed by NIST. We expect that these test tools will
available prior to, or at the same time as the temporary certification
program's final rule is published.
An example question for section 2 would be: Please describe the
steps you would take to test the capability of a Complete EHR or EHR
Module to generate a patient summary record.
Section 3--Proper Use of Test Tools and Understanding Test
Results
This section would require an applicant to demonstrate that it can
properly use test tools (e.g., a continuity of care document (CCD)
validation tool), can correctly interpret test results generated by
test tools, and further when using test tools that the test results the
applicant produces are consistent.
An example question for section 3 would be: Using the XYZ test tool
with the following sample data sets, please indicate which data sets
passed the test, which data sets failed because of errors, and for
those that data sets that resulted in a failure discuss why such a
failure occurred.
2. Application Review
An applicant would be permitted to submit its application
electronically via e-mail or on paper, or via regular or express mail
(we believe that electronic applications would be the most efficient).
We propose that the National Coordinator be permitted up to 30 days to
review an application once it has been received (the National
Coordinator would notify the applicant's authorized representative to
acknowledge that the application was received). We propose to review
applications for ONC-ATCB status in the order in which they are
received and to review and rule on an application's parts sequentially
(i.e., we will first review part one of an application and if
deficiencies are found we will not review part two). We propose to
notify the applicant if: (1) Its entire application was reviewed and
[[Page 11340]]
found to be satisfactory or; (2) if its application was reviewed and
deficiencies were found in either part one or part two of the
application. In instances where deficiencies have been found, we
propose to return the entire application with the deficiencies
identified in the applicable part of the application.
a. Satisfactory Application
Applicants with satisfactory applications would be notified of
their successful achievement of ONC-ATCB status and upon receipt of
this notification would be permitted to represent themselves as ``ONC-
ATCBs'' and begin testing and certifying Complete EHRs and/or EHR
Modules, as applicable.
b. Deficient Application Returned and Opportunity To Revise
We propose to formally return an application if part one or part
two contains deficiencies. If we discover deficiencies in part one of
an application, we would not review part two until part one is
satisfactory. In the event that a portion of an applicant's response to
its proficiency examination is determined to be deficient, the National
Coordinator may pose an equivalent replacement question for an
applicant to respond to from the appropriate question pool. We propose
that the National Coordinator would have the discretion to have an
element of an application clarified or request that an inadvertent
error or minor omission be corrected. In these cases, before issuing a
formal deficiency notice, we propose that the National Coordinator may
request such information from the applicant's authorized representative
as an addendum to its application. If the applicant fails to provide
such information to the National Coordinator in the timeframe specified
by the National Coordinator, but no less than 5 days, the National
Coordinator could issue a formal deficiency notice. In other
circumstances, the National Coordinator could immediately send a formal
deficiency notice if it is determined that significant deficiencies
exist which cannot be addressed by a clarification or correction of a
minor omission. A formal deficiency notice would be sent to the
applicant's authorized representative and would include all
deficiencies related to a part of an application requiring correction.
If the National Coordinator issues a formal deficiency notice, we
propose to permit an applicant one opportunity per application part to
revise the relevant application part in response and that a revised
application part must be received by the National Coordinator within 15
days of the applicant's receipt of a formal deficiency notice. If an
applicant receives a formal deficiency notice related to part one of
its application, because we have noted that part two would not have
been reviewed, the applicant would be free to revise part two at the
same time it is revising part one and resubmit an entirely updated
application.
We propose that the National Coordinator be permitted up to 15 days
to review a revised application once it has been received. If, upon a
second review of the application, the National Coordinator determines
that the revised application still contains deficiencies, the applicant
will be issued a denial notice stating that it will no longer be
considered for ONC-ATCB status under the temporary certification
program. We propose to permit applicants to request that the National
Coordinator reconsider this decision only when the applicant can
demonstrate that clear, factual errors were made in the review of its
application and that the errors' correction could lead to the applicant
receiving ONC-ATCB status. Requests for reconsideration of revised
applications will be conducted according to the process described in
the next section. We seek public comment on whether there are other
instances in which the National Coordinator should reconsider an
application that has been deemed deficient multiple times.
We also request public comment on whether it would be preferable
for applicants to have their entire application reviewed all at once
and then issued a formal deficiency notice or whether we should, as
proposed, review applications in parts. While the former may seem more
efficient for an applicant, the latter would potentially be more
efficient overall because the National Coordinator would be able to
notify an applicant about deficiencies earlier as well as spend less
time and resources reviewing an application that may need significant
corrections.
3. ONC-ATCB Application Reconsideration Requests
We propose that an applicant for ONC-ATCB status who has had part 1
or part 2 of its application returned twice because of deficiencies and
has subsequently received a denial notice would be able to request that
the National Coordinator reconsider this determination. For applicants,
this would be at most a formal third and final opportunity (per
application part) to continue their pursuit of ONC-ATCB status. While
we believe the following would be highly unlikely, it is possible that
an applicant's request for reconsideration of part 2 of their
application could constitute their sixth formal opportunity (i.e.,
three opportunities for part 1 and two prior opportunities for part 2
before the reconsideration request) to continue their pursuit of ONC-
ATCB status. Again, per our request for public comment above, if we
were to change our approach to reviewing applications for ONC-ATCB
status, the amount of formal opportunities to revise an application
would be reduced.
As previously discussed, we would only permit applicants to request
the National Coordinator to reconsider a deficient application when the
applicant could demonstrate that clear, factual errors were made in the
review of its application and that the errors' correction could lead to
the applicant receiving ONC-ATCB status.
In order to make a reconsideration request, an applicant would be
required to submit to the National Coordinator, within 15 days of
receipt of a denial notice, a written statement (preferably via e-mail)
contesting the decision and explaining what factual errors it believes
can account for the denial. An applicant would be required to include
sufficient documentation to support its explanation. If the applicant
does not file the reconsideration request within the specified
timeframe, the National Coordinator could reject the reconsideration
request.
Upon receipt of the reconsideration request, the National
Coordinator would be permitted up to 15 days to review the information
submitted by the applicant. If, based on the documentation submitted,
the National Coordinator determines that when the application was
reviewed a clear factual error(s) was made and that correction of the
error(s) would lead to the applicant receiving ONC-ATCB status, the
National Coordinator would notify the applicant's authorized
representative that such an error occurred and that its application
would continue to be processed. If the National Coordinator determined
that a clear factual error(s) was made in part 1 of an application and
that correction of the error(s) would lead to a satisfactory submission
for part 1 of an application, the National Coordinator would
subsequently review part 2 of the application. If the National
Coordinator determined that a clear factual error(s) was made in part 2
of an application and that correction of the error(s) would lead to a
completely satisfactory application, the applicant's authorized
representative would be
[[Page 11341]]
notified that the applicant successfully achieved ONC-ATCB status. If,
however, after reviewing an applicant's reconsideration request the
National Coordinator determines that the applicant did not provide
sufficient evidence in its explanation to identify the factual error or
errors that were made during the review of its application, the
National Coordinator could reject the applicant's reconsideration
request.
4. ONC-ATCB Status
a. Acknowledgement and Representation
We propose to make publicly available at http://healthit.hhs.gov
the name of each ONC-ATCB, the date each ONC-ATCB was authorized by the
National Coordinator, and the type(s) of testing and certification each
ONC-ATCB is authorized to perform. Further, to prevent an ONC-ATCB from
misrepresenting the scope of its authorization, we propose that an ONC-
ATCB must prominently and unambiguously identify on its Web site and in
all marketing and communications statements (written and oral) the
scope of its authorization (e.g., the HIT Certification Group is an
ONC-ATCB for e-prescribing EHR Modules).
b. Expiration of Status Under the Temporary Certification Program
As previously mentioned, we expect to publish a final rule for the
permanent certification program within a few months of publishing the
temporary certification program's final rule. When this occurs, we
would immediately begin to implement the permanent certification
program's final provisions with the goal of having ONC-ACBs authorized
under the permanent certification program by or before the beginning of
calendar year 2012 in order to coincide with the certification
activities that would need to take place in the coming months for
meaningful use Stage 2. We believe it will take between 8 to 16 months
to implement the permanent certification program, and therefore, we
expect ONC-ATCBs under the temporary certification program would only
be responsible for testing and certifying Complete EHRs and/or EHR
Modules to the certification criteria adopted by the Secretary that are
applicable to meaningful use Stage 1. Moreover, we will be working to
assure that ONC-ACBs authorized under the permanent certification
program will be in place with sufficient time to certify Complete EHRs
and EHR Modules to the certification criteria adopted by the Secretary
that are applicable to meaningful use Stage 2. However, if the
transition to the permanent certification program occurs prior to the
end of 2011, it is possible that a small percentage of late or new-to-
market Complete EHRs and/or EHR Modules developed to meet the
certification criteria associated with meaningful use Stage 1 may wind
up being tested and certified according to the policies established in
the permanent certification program.
Because the temporary certification program would be operational
only for a short period of time (less than 2 years), we do not believe
that it is necessary to require an ONC-ATCB to renew their ``authorized
status'' under the temporary certification program. As a result, we
have not proposed a renewal requirement for ONC-ATCB status. All ONC-
ATCBs would maintain their status (unless revoked) until the temporary
certification program sunsets (see section II.F). The chart below
illustrates the anticipated operational periods (denoted by quarters
within each calendar year) for the temporary and permanent
certification programs, along with the respective proposed meaningful
use Stage 1 and 2 beginning points for eligible hospitals (Q4) and
eligible professionals (Q1).
[GRAPHIC] [TIFF OMITTED] TP10MR10.036
E. ONC-ATCB Performance of Testing and Certification and Maintaining
Good Standing as an ONC-ATCB
1. Authorization To Test and Certify Complete EHRs
We propose that authorization to test and certify Complete EHRs
under the temporary certification program would require an ONC-ATCB to
be capable of performing ``complete'' testing and certification.
Complete testing and certification would result in the ONC-ATCB testing
and certifying Complete EHRs to all applicable certification criteria
adopted by the Secretary. For example, the certification criteria
applicable to Complete EHRs that eligible professionals would adopt
would need to be tested and certified to all of the certification
criteria at 45 CFR 170.302 and 45 CFR 170.304.
2. Authorization To Test and Certify EHR Modules
We propose that authorization to test and certify EHR Modules under
the temporary certification program would require an ONC-ATCB to do so
in accordance with the applicable certification criterion or
certification criteria adopted by the Secretary. Furthermore, because
an EHR Module, once certified, can be used in combination with other
certified EHR Modules to meet the definition of Certified EHR
Technology, we propose that an ONC-ATCB authorized to test and certify
EHR Modules would be required to clearly indicate the certification
criterion or certification criteria to which an EHR Module has been
tested and certified. We believe this requirement would benefit
potential adopters of certified EHR Modules and make it easier for them
to determine the full capabilities that a combination of certified EHR
Modules includes. To benefit potential adopters of certified EHR
Modules, we would also expect EHR Module developers to clearly indicate
the certification criterion or certification criteria to which an EHR
Module they have developed has been tested and certified.
a. Certification Criterion Scope
As specified at 45 CFR 170.102, the definition of EHR Module means
``any service, component, or combination thereof that can meet the
requirements of at least one certification criterion adopted by the
Secretary.'' In some cases, the certification criteria specified at 45
CFR 170.302, 45 CFR 170.304, and 45 CFR 170.306 simply reference a
criterion at the first paragraph level, for example, 45 CFR 170.302,
paragraph ``(f)'' states, ``Smoking Status. Enable a user to
electronically record, modify, and retrieve the smoking status of a
patient. Smoking status types must
[[Page 11342]]
include: current smoker, former smoker, or never smoked.'' In other
cases, for example, a certification criterion like ``Drug-Drug, Drug-
Allergy, Drug-Formulary Checks'' at 45 CFR 170.302 paragraph ``(a)''
includes a second level ``(1)'' through ``(4)'' which articulate
partial aspects of a single, complete capability. For the purposes of
testing and certifying an EHR Module, we therefore interpret ``one
certification criterion'' in the definition of EHR Module to mean the
entirety of the capabilities encompassed by what is specified at the
first paragraph level.
b. When Privacy and Security Certification Criteria Apply to EHR
Modules
We believe that EHR Modules hold great promise with respect to
innovation. However, we also recognize that the potential innovative
benefits EHR Modules can provide will be significantly compromised if
these same EHR Modules do not include appropriate privacy and security
safeguards to instill trust.
EHR Modules can come in many forms and can provide a large set of
capabilities or a single capability. This variability, which promotes
innovation, also poses several challenges to determining when it is
appropriate to require EHR Modules be tested and certified to the
privacy and security certification criteria adopted by the Secretary
(45 CFR 170.302(o) through (v)). Our goal for determining when this
should occur is two-fold: (1) Assure eligible professionals and
eligible hospitals that EHR Modules will not negatively affect how
Certified EHR Technology in its entirety protects electronic health
information; and (2) appropriately require (or not require) the testing
and certification of EHR Modules to privacy and security certification
criteria.
In the context of EHR Modules and testing and certification, it is
important to keep in mind that we are discussing a point before
``implementation'' in the HIT lifecycle. Accordingly, ONC-ATCBs will
test and certify EHR Modules independent of, and disassociated from,
their potential operating environments. Below, we identify several
challenges to determining when an ONC-ATCB should be required to test
and certify EHR Modules to the privacy and security certification
criteria adopted by the Secretary. After discussing these challenges,
we propose, and request public comment on a potential approach that
establishes when ONC-ATCBs should be required to test and certify EHR
Modules to the privacy and security certification criteria adopted by
the Secretary in addition to the capability or capabilities the EHR
Module may be specifically designed to provide.
One challenge with respect to determining when EHR Modules should
be tested and certified to the privacy and security certification
criteria adopted by the Secretary occurs when EHR Modules operate in an
environment separate from other EHR Modules--when they are so-to-speak
``autonomous.'' For example, an e-prescribing EHR Module or a patient
portal EHR Module provided by an application service provider (ASP)
could be hosted and maintained by the ASP (not by the end-user). In
these cases, an end-user (e.g., eligible professional) may be unable to
control or specify the level or amount of privacy and security
safeguards associated with the health information stored, modified, or
transmitted by the EHR Module. We believe that it would be
irresponsible and potentially dangerous to permit such EHR Modules to
be tested and certified solely to their specific capability, and not to
the privacy and security certification criteria adopted by the
Secretary.
On the flipside, a second challenge relates to EHR Modules that, by
design, may provide specific capabilities which make it technically
infeasible to require that they separately meet the privacy and
security certification criteria adopted by the Secretary. One example
could be a medication reconciliation EHR Module which, from a technical
perspective, would be designed to function ``behind the scenes'' as
part of the internal workings of Certified EHR Technology. In all
likelihood, it would therefore depend on another EHR Module's or EHR
Modules' privacy and security capabilities. In this example, we believe
that it would be technically infeasible for the medication
reconciliation EHR Module to have its own authentication capability
because, in all likelihood, an end-user would have had to have been
authenticated prior to gaining access to the medication reconciliation
EHR Module. Conversely, while it is unlikely that the medication
reconciliation EHR Module would retain or store health information,
other EHR Modules might, and it may be appropriate to require such EHR
Modules to be tested and certified to some or all of the privacy and
security certification criteria adopted by the Secretary.
Because of the context specific nature of EHR Modules, and the fact
that we expect them to provide many different capabilities, it is
difficult to establish with absolute certainty an approach that will
work for all EHR Modules. However, we believe that an appropriate
starting point for such an approach should focus first on protecting
individuals' health information and then on whether there exist
appropriate exceptions to the approach that would exempt EHR Modules
from the requirement to be tested and certified to adopted privacy and
security certification criteria. As a result, we propose that ONC-ATCBs
would be required to test and certify all EHR Modules to the privacy
and security certification criteria adopted by the Secretary unless the
EHR Modules is/are presented for testing and certification in one of
the following manners:
The EHR Module(s) are presented for testing and
certification as a pre-coordinated, integrated ``bundle'' of EHR
Modules, which could otherwise constitute a Complete EHR. In such
instances, the EHR Module(s) would be tested and certified in the same
manner as a Complete EHR. Because the bundle of EHR Modules would
constitute a single, integrated product, we believe that it would be
unnecessary in such cases to require each EHR Module to be tested and
certified independently to privacy and security certification criteria.
We propose one variation to this exception for pre-coordinated bundles
of EHR Modules which include EHR Module(s) that would not be part of an
eligible professional or eligible hospital's local system and under its
direct control (e.g., a patient portal EHR Module that is not hosted
and maintained). In these situations, the constituent EHR Modules of
such an integrated bundle would need to be separately tested and
certified to all privacy and security certification criteria;
An EHR Module is presented for testing and certification,
and the presenter can demonstrate to the ONC-ATCB that it would be
technically infeasible for the EHR Module to be tested and certified in
accordance with some or all of the privacy and security certification
criteria. For example, we believe that it would be technically
infeasible for an EHR Module that does not store even temporarily, or
maintain any health information to be required to include a capability
to encrypt health information at rest or include an audit log.
Alternatively, it would presumably be technically infeasible for an EHR
Module that does not provide a capability for exchange to be required
to include the capabilities to encrypt health information for exchange
or account for treatment, payment, or health care operations
disclosures; or
[[Page 11343]]
An EHR Module is presented for testing and certification,
and the presenter can demonstrate to the ONC-ATCB that the EHR Module
is designed to perform a specific privacy and security capability. In
such instances, we do not believe that it should be tested and
certified to the other privacy and security certification criteria
adopted by the Secretary. For example, an encryption EHR Module would
not be required to be tested and certified as also including the
capability to terminate an electronic session after a predetermined
time of inactivity.
We believe that the approach we have articulated above provides an
appropriate framework for determining when ONC-ATCBs would be required
to test and certify EHR Modules to the privacy and security
certification criteria adopted by the Secretary. We request public
comment on whether there are additional alternatives to the ones
proposed above and other circumstances where an EHR Module should be
tested and certified to none, some, or all of the privacy and security
certification criterion adopted by the Secretary.
3. Authorized Testing and Certification Methods
We propose that in being authorized to test and certify Complete
EHRs and/or EHR Modules, ONC-ATCBs must have the capacity to test and
certify Complete EHRs and/or EHR Modules at their facility. We propose
further that an ONC-ATCB must also have the capacity to test and
certify Complete EHRs and/or EHR Modules through some secondary means
or at a secondary location. Such secondary methods would include
testing and certification: (1) At the site (i.e., physical location)
where a Complete EHR or EHR Module has been developed (e.g., at a
Complete EHR developer's facility); or (2) at the site (i.e., physical
location) where the Complete EHR or EHR Module resides (e.g., at a
hospital where the HIT has been installed); or (3) remotely (i.e.,
through other means, such as through secure electronic transmissions
and automated Web-based tools, or at a location other than the ONC-
ATCB's facilities). We believe that these secondary testing and
certification methods will better accommodate self-developed Complete
EHRs and EHR Modules. For example, a Complete EHR developer may submit
a Complete EHR to an ONC-ATCB to be tested and certified at the ONC-
ATCB's facility. In other cases, it may not be practicable for a
hospital with a self-developed Complete EHR to submit its Complete EHR
to an ONC-ATCB for testing and certification at the ONC-ATCBs facility
and, in these cases, we expect that ONC-ATCBs would either test and
certify the hospital's Complete EHR at the hospital where the Complete
EHR resides or remotely through other means that do not require the
ONC-ATCB to be physically present at the hospital. We expect that the
most common form of remote testing and certification will employ the
use of automated programs that can be accessed by the hospital via the
Internet to demonstrate to the ONC-ATCB that its Complete EHR meets all
applicable certification criteria adopted by the Secretary. Other forms
of remote testing and certification may include an employee of the ONC-
ATCB walking through a particular scripted scenario with predefined
data that the hospital would have to ``plug-in'' to their Complete EHR
and then convey the result (e.g., the hospital would be asked to enter
fabricated information on a group of ``test'' patients into its
Complete EHR and provide responses to specific questions asked by the
ONC-ATCB employee). We request public comment on whether an ONC-ATCB
should be required to perform any of the secondary methods discussed
above in addition to testing and certifying Complete EHRs and/or EHR
Modules at its facility.
Our proposals do not preclude eligible professionals and eligible
hospitals who have already adopted and implemented HIT that they
believe meets the definition of Certified EHR Technology from seeking
to have such HIT tested and certified themselves. Rather than relying
on the vendor(s) that supplied their HIT to them to apply for testing
and certification, eligible professionals and eligible hospitals could
go directly to an ONC-ATCB to get their HIT tested and certified.
However, eligible professionals and eligible hospitals should keep in
mind that they alone would bear the full costs of testing and
certification if they went directly to an ONC-ATCB.
4. The Testing and Certification of ``Minimum Standards''
In the HIT Standards and Certification Criteria interim final rule
(75 FR 2014), we explained how we would approach the testing and
certification of Complete EHRs and EHR Modules for certain vocabulary
code set standards. Our approach included the establishment of these
standards as ``minimum standards.'' Adopting a particular version of
the code set as a ``minimum'' permits a Complete EHR and/or EHR Module
to be tested and certified to a permitted newer version of an adopted
code set without the need for additional rulemaking on the part of the
Secretary. For example, on the day the HIT Standards and Certification
Criteria interim final rule was put on display by the Federal Register
for public inspection a new version (version 2.29) of Logical
Observation Identifiers Names and Codes (LOINC[reg]) was released. In
that regard, we stated the following in the HIT Standards and
Certification Criteria interim final rule:
[W]e understand that certain types of standards, specifically
code sets, must be maintained and frequently updated to serve their
intended purpose effectively * * * To address this need and
accommodate industry practice, we have in this interim final rule
indicated that certain types of standards will be considered a floor
for certification. We have implemented this approach by preceding
references to specific adopted standards with the phrase, ``at a
minimum.'' In those instances, the certification criterion requires
compliance with the version of the code set that has been adopted
through incorporation by reference, or any subsequently released
version of the code set. This approach will permit Complete EHRs and
EHR Modules to be tested and certified, to, ``at a minimum,'' the
version of the standard that has been adopted or a more current or
subsequently released version. This will also enable Certified EHR
Technology to be updated from an older, ``minimum,'' adopted version
of a code set to a more current version without adversely affecting
Certified EHR Technology's ``certified status.'' We intend to
elaborate in the upcoming HIT Certification Programs proposed rule
on how testing and certification would be conducted using standards
we have adopted and designated as ``minimums'' in certain
certification criteria. That being said, we understand that this
approach has certain limitations. In some cases, for instance,
rather than simply maintaining, correcting, or slightly revising a
code set, a code set maintaining organization will modify the
structure or framework of a code set to meet developing industry
needs. We would consider this type of significant revision to a code
set to be a ``modification,'' rather than maintenance or a minor
update of the code set. An example of a code set ``modification''
would be if a hypothetical XYZ code set version 1 were to use 7-
digit numeric codes to represent health information while XYZ code
set version 2 used 9-digit alphanumeric codes to represent health
information. In such cases, interoperability would likely be reduced
among Complete EHRs and EHR Modules that have adopted different
versions of the structurally divergent code sets. If a code set that
we have adopted through incorporation by reference is modified
significantly, we will update the incorporation by reference of the
adopted version with the more recent version of the code set prior
to requiring or permitting certification according to the newer
version.
At the end of this discussion we provided examples of when a
standard would be considered a ``minimum
[[Page 11344]]
standard'' and the limitation to our approach. To address the
identified limitation, we propose to clarify when a newer version of an
adopted ``minimum standard'' code set would be permitted for use in
testing and certification and when it would not. We believe that there
are two prevailing methods the Secretary could use to determine whether
a significant revision to a code set represents a ``modification,
rather than maintenance or a minor update of the code set'' and,
consequently, when a code set version should not be permitted for
testing and certification above the minimum adopted by the Secretary
until additional public comment can be obtained.
The first method would allow for any member of the general public
to notify the National Coordinator about a new version of an identified
``minimum standard'' code set. For this method, we would encourage the
person or entity who submits a notification to the National Coordinator
to include any relevant information the National Coordinator would need
to correctly identify the ``minimum standard'' code set (e.g., name and
version) and any additional information that the National Coordinator
could use to determine whether the new version constitutes general
maintenance or minor updates, or a significant revision or
modification. Upon receipt of these notifications and a determination
by the National Coordinator that the new version of the code set did
not represent a significant revision or modification, the National
Coordinator would request the Secretary to permit the use of the
identified new version for testing and certification purposes.
The second method we considered, and solicit public comment on,
would be for the Secretary to proactively identify newly published
versions of adopted minimum standard code sets and issue determinations
as to whether they reflect maintenance efforts or minor updates of the
adopted code set and would be permitted for testing and certification.
For either method above, we propose that once the Secretary has
granted permission for a new version of an adopted minimum standard
code to be used:
(1) Any ONC-ATCB may test and certify Complete EHRs and/or EHR
Modules according to the new version;
(2) Certified EHR Technology may be upgraded to comply with the new
version of an adopted minimum standard accepted by the Secretary
without adversely affecting the certification status of the Certified
EHR Technology; and
(3) ONC-ATCBs would not be required to test and certify Complete
EHRs and/or EHR Modules according to the new version until we updated
the incorporation by reference of the adopted version to a newer
version.
For either method, we also propose to regularly publish (on
quarterly basis) either by presenting to the HIT Standards Committee or
by posting a notification on our Web site, any Secretarial
determinations that have been made with respect to ``minimum standard''
code sets. We request public comment on whether a quarterly publication
is an appropriate notification interval. We also seek public comment on
other methods we might take to identify acceptable newer versions of
minimum standard code sets in addition to the two methods we have
discussed. Please note that the two methods we have proposed are not
mutually exclusive and we request public comment on whether it would be
advantageous to pursue both methods.
5. Maintaining Good Standing as an ONC-ATCB; Violations That Could Lead
to the Revocation of ONC-ATCB Status; Revocation of ONC-ATCB Status
In order to maintain good standing as an ONC-ATCB, we propose that
an ONC-ATCB would have to abide by the Principles of Proper Conduct for
ONC-ATCBs. In addition, we expect that an ONC-ATCB would follow other
Federal and State laws to which it is subject and refrain from engaging
in other types of inappropriate behavior.
Further, we propose that the National Coordinator would be capable
of revoking an ONC-ATCB's status under the temporary certification
program when either of two types of violations occurs. We describe
these violations and the revocation process below.
a. Type-1 Violations
Type-1 violations would include violations of law or temporary
certification program policies that threaten or significantly undermine
the integrity of the temporary certification program. Type-1 violations
would include, but are not limited to, false, fraudulent, or abusive
activities that affect: The temporary certification program; a program
administered by HHS; or any program administered by the Federal
government. These violations could jeopardize the integrity of the
temporary certification program and would include examples such as, the
ONC-ATCB or a principal employee, owner, or agent of an ONC-ATCB being
convicted of fraud, embezzlement or extortion or of violating a similar
Federal or State securities laws while participating in the temporary
certification program, falsifying or manipulating test results and
certifications, or withholding information that would indicate false or
fraudulent activity had occurred within the temporary certification
program.
We believe that the National Coordinator must ensure that the
certification program is fair and honest and provides users of
Certified EHR Technology with faith in the integrity of the temporary
certification program (e.g., that Complete EHRs and EHR Modules have
been properly tested and certified). Therefore, if the National
Coordinator has evidence that an ONC-ATCB committed one or more of the
above-mentioned violations (false, fraudulent, and abusive activities)
the National Coordinator could issue the ONC-ATCB a notice proposing to
revoke its ONC-ATCB status.
b. Type-2 Violations
``Type-2'' violations would include inappropriate conduct by an
ONC-ATCB under the temporary certification program. A Type-2 violation
would include, but not be limited to, the failure of an ONC-ATCB to
adhere to the Principles of Proper Conduct for ONC-ATCBs and engaging
in other types of inappropriate behavior. Examples of these types of
violations include, but are not limited to: failing to attend mandatory
ONC training programs, failing to meet specified reporting
requirements, misrepresenting the scope of its authorization, and an
ONC-ATCB testing and certifying Complete EHRs and/or EHR Modules for
which it does not have authorization.
If the National Coordinator obtains reliable evidence from fact-
gathering, requesting information from an ONC-ATCB, contacting an ONC-
ATCB's customers, witnessing an ONC-ATCB perform testing or
certification, and/or substantiated complaints that an ONC-ATCB's
conduct may indicate a failure to adhere to the Principles of Proper
Conduct for ONC-ATCBs or exhibited other inappropriate behavior, the
National Coordinator would notify the ONC-ATCB of a possible Type-2
violation. The notification would include all pertinent information
regarding the National Coordinator's assessment.
Unless otherwise specified by the National Coordinator, an ONC-ATCB
would be permitted up to 30 days from the date it is notified about
possible Type-2 violation(s) to submit a written response and any
accompanying documentation that could demonstrate
[[Page 11345]]
no violation(s) occurred or validate that violation(s) occurred and
were corrected. If the ONC-ATCB fails to submit a response to the
National Coordinator within 30 days, the National Coordinator could
issue the ONC-ATCB a notice proposing to revoke its ONC-ATCB status.
If an ONC-ATCB submits a response, the National Coordinator would
be permitted up to 30 days to evaluate the ONC-ATCB's response (and
request additional information, if necessary). If the National
Coordinator determines that the ONC-ATCB did not commit a Type-2
violation, or may have committed a Type-2 violation but satisfactorily
corrected any violation(s) that may have occurred, a memo will be
issued to the ONC-ATCB to confirm this determination. If the National
Coordinator determines that the ONC-ATCB's response is insufficient and
that a Type-2 violation had occurred and had not been adequately
corrected, then the National Coordinator could propose to revoke an
ONC-ATCB's status.
c. Proposed Revocation
We propose that the National Coordinator could propose the
revocation of an ONC-ATCB's status for alleged Type-1 violations and
for failing to respond to, or satisfactorily address, a notification
related to a Type-2 violation.
We request public comment on whether the National Coordinator
should also consider proposing the revocation of an ONC-ATCB's status
for repeatedly committing Type-2 violations even if the ONC-ATCB has
adequately corrected the violations each time. We further request
comment on how many corrected Type-2 violations would be sufficient for
proposing revocation of an ONC-ATCB and to what extent the frequency of
these violations should be a consideration. While we have not repeated
this request for public comment in our discussion of the permanent
certification program, we nevertheless encourage comments regarding
this option for that program as well.
i. Opportunity To Respond to a Proposed Revocation Notice
We propose that an ONC-ATCB could respond to a proposed revocation
notice within 10 days of receipt of the proposed revocation notice in
order to contest the proposed revocation and explain why its status
should not be revoked. We propose that if an ONC-ATCB responds to a
revocation notice, it must include sufficient documentation to support
its explanation. Upon receipt of an ONC-ATCB's response to a proposed
revocation notice, the National Coordinator would be permitted up to 30
days to review the information submitted by the ONC-ATCB.
During the time period provided for an ONC-ATCB to respond to the
proposed revocation notice and the National Coordinator's review
period, we propose to permit the ONC-ATCB to continue its operations
under the temporary certification program. We believe this proposal
affords the ONC-ATCB meaningful due process and would minimally impact
the temporary certification program because we have proposed procedures
for reaching a timely final decision on revocation. We welcome comments
on this proposal and whether it would be more appropriate for the
National Coordinator to immediately suspend an ONC-ATCB's operations
for the time between the issuance of a proposed revocation notice and a
final decision on revocation.
If the National Coordinator determines that an ONC-ATCB's status
should not be revoked, the National Coordinator would notify the ONC-
ATCB's authorized representative in writing to express this
determination.
ii. Revocation of an ONC-ATCB's Status
We propose that the National Coordinator could revoke an ONC-ATCB's
status if it is determined that revocation is appropriate after
considering the information provided by the ONC-ATCB in response to the
proposed revocation notice or if the ONC-ATCB does not respond to a
proposed revocation notice within the specified timeframe.
We propose that a decision to revoke an ONC-ATCB's status would be
final and would not be subject to further review unless the National
Coordinator chooses to reconsider the revocation.
d. Extent and Duration of Revocation Under the Temporary Certification
Program
We propose that the revocation of an ONC-ATCB's status would become
effective as soon as the ONC-ATCB receives the revocation notice. A
testing and certification body whose ONC-ATCB status has been revoked
would be prohibited from accepting new requests for testing and
certification and would be required to cease its current testing and
certification operations related to Complete EHRs and/or EHR Modules
(i.e., the National Coordinator's revocation would not apply to other
testing and certification operations that are not within the scope of
this rule). We would also expect it to issue a complete refund to any
entity whose Complete EHR or EHR Module was being tested and certified
by the ONC-ATCB at the time its status was revoked. If a testing and
certification body were to refuse or fail to issue a complete refund(s)
upon having its ONC-ATCB status revoked, we propose that the refusal or
failure should be a consideration in determining the qualifications of
a testing and certification body if it were to apply at a later date to
be an ONC-ACB under the proposed permanent certification program. We
welcome comments on this proposal, including any potential
alternatives.
Once an ONC-ATCB has had its status revoked, the testing and
certification body would be permitted to reapply for ONC-ATCB status
under the temporary certification program and apply under our proposed
permanent certification program unless it had its status revoked for a
Type-1 violation. Type-1 violations would significantly undermine the
integrity of the temporary certification program and we do not believe
it would be appropriate to allow the same testing and certification
body to reapply for ONC-ATCB right away. Further, we believe that Type-
1 violations could so significantly undermine the public's faith in our
proposed certification programs that we propose to prohibit the testing
and certification body from reapplying for ONC-ATCB status for 1 year
and to count that 1 year prohibition towards the ONC-ACB application
period under the permanent certification program if the temporary
certification program sunsets during this time. We request public
comment on any other alternatives regarding the treatment of ``former
ONC-ATCBs'' that have had their status revoked.
We recognize that in instances where an ONC-ATCB has had its status
revoked, some people may call into question the legitimacy of the
certifications issued by the former ONC-ATCB. To address this matter,
we propose that the ``certified status'' of Complete EHRs and/or EHR
Modules certified by the former ONC-ATCB will remain intact unless a
Type-1 violation was committed that calls into question the legitimacy
of the certifications issued by the former ONC-ATCB. In these
circumstances, which we believe would be extremely rare, we propose
that the National Coordinator would review the facts surrounding the
revocation of the ONC-ATCB's status and publish a notice on ONC's Web
site if the National Coordinator believes that Complete EHRs and/or EHR
Modules were fraudulently certified by a former
[[Page 11346]]
ONC-ATCB and the certification process itself failed to comply with
regulatory requirements. If the National Coordinator determines that
Complete EHRs and/or EHR Modules were improperly certified, we propose
that the ``certified status'' of impacted Complete EHRs and/or EHR
Modules would remain intact for 120 days after the National Coordinator
publishes the notice. We believe that 120 days is a suitable timeframe
for the developers of the impacted Complete EHRs and/or EHR Modules to
get their HIT re-certified by an ONC-ATCB in good standing. We request
public comment on our proposed approach and the timeframe for re-
certification. Although highly unlikely, it is important to note that
if a Complete EHR or EHR Module developer whose product was improperly
certified does not seek to remedy this improper certification in the
timeframe provided that all of the end-users (e.g., eligible
professionals and eligible hospitals) that have adopted the Complete
EHR or EHR Module developer's product would no longer have HIT that
meets the definition of Certified EHR Technology.
e. Alternative Considered
As noted briefly above, another alternative approach to the
revocation process described above (where the National Coordinator
would issue a notice to an ONC-ATCB proposing to revoke its status)
would be a suspension process whereby an ONC-ATCB's status would be
suspended if the ONC-ATCB is reasonably suspected of having committed a
Type-1 violation or if the ONC-ATCB fails to respond in a timely manner
to a possible Type-2 violation or has not appropriately addressed an
admitted Type-2 violation. Such a process would result in the National
Coordinator issuing an ONC-ATCB a suspension notification. Upon receipt
of a suspension notification, an ONC-ATCB would have to temporarily
cease testing and certifying Complete EHRs and/or EHR Modules.
Additionally, during the suspension an ONC-ATCB would also be
prohibited from accepting new requests for testing and certification.
If the National Coordinator issues a suspension notice to an ONC-
ATCB, the ONC-ATCB could respond directly to the National Coordinator
and explain in writing why its status should not have been suspended.
Upon receiving the ONC-ATCB's response, the National Coordinator would
review the information submitted by the ONC-ATCB and reply within 7
days. In the reply, the National Coordinator could extend the
suspension for an additional 14 days to obtain further information,
terminate the suspension, or propose revocation while extending
suspension during the pendency of the revocation process.
We believe that a suspension process is an alternative worth
considering because it could assist the National Coordinator in
preventing further untoward actions by an ONC-ATCB, whereas the process
we discuss above would permit, albeit presumably for a short amount of
time, an ONC-ATCB to continue to test and certify Complete EHRs and/or
EHR Modules while revocation procedures are underway. Therefore, we
request public comment on whether the National Coordinator should also
include a process to suspend an ONC-ATCB's status. We have not repeated
this request for public comment in our discussion of the permanent
certification program, but we encourage commenters to consider this as
an option for that program as well and provide comments.
6. Validity of Complete EHR and EHR Module Certification
In the HIT Standards and Certification Criteria interim final rule,
we defined Certified EHR Technology to mean ``a Complete EHR or a
combination of EHR Modules, each of which: (1) Meets the requirements
included in the definition of a Qualified EHR; and (2) has been tested
and certified in accordance with the certification program established
by the National Coordinator as having met all applicable certification
criteria adopted by the Secretary.''
Part two of the definition of Certified EHR Technology specifies an
important concept--that in order to meet the definition, a tested and
certified Complete EHR or combination of separately tested and
certified EHR Modules must meet all applicable certification criteria
adopted by the Secretary. Certification represents a snapshot, a fixed
point in time, where it has been confirmed that a Complete EHR or EHR
Module has met all applicable certification criteria adopted by the
Secretary. From that point forward, a specific Complete EHR or EHR
Module version which has been certified would be forever labeled
``certified.'' However, as the Department adopts new or modified
certification criteria, previously adopted certification criteria would
no longer constitute all of the applicable certification criteria to
which a Complete EHR or EHR Module would need to be tested and
certified. As a result, Complete EHRs and EHR Modules that had been
certified to a previously adopted set of certification criteria would
no longer be considered ``Certified EHR Technology'' for purposes of
enabling an eligible professional or eligible hospital to attempt to
achieve a future stage of meaningful use.
As previously mentioned in both the HIT Standards and Certification
Criteria interim final rule and the Medicare and Medicaid EHR Incentive
Programs proposed rule, we and CMS stated that we anticipate that the
requirements for meaningful use will be adjusted every two years.
Accordingly, and because the HITECH Act requires eligible professionals
and eligible hospitals to use Certified EHR Technology in order to
qualify for incentive payments, we expect that there will continue to
be a close correlation and connection between certification criteria
adopted by the Secretary and future meaningful use objectives (and
their associated measures).
In that regard, when a set of objectives and measures for a future
stage of meaningful use has been proposed, we anticipate that the
Secretary would also propose to adopt certification criteria to
replace, amend, or add to previously adopted certification criteria.
Presumably, those additional or modified certification criteria would
set a new, higher bar for the capabilities that Certified EHR
Technology would need to include and for which eligible professionals
and eligible hospitals would need in order to attempt to achieve the
next proposed meaningful use stage.
We believe the planned two-year schedule for updates to meaningful
use objectives and measures and correlated certification criteria
creates a natural expiration for the ``certified status'' of Complete
EHRs and EHR Modules. Accordingly, after the Secretary has adopted new
or modified certification criteria, the validity of the certification
associated with previously certified Complete EHRs and EHR Modules will
expire and those Complete EHRs and EHR Modules would need to be re-
certified in order for eligible professionals and eligible hospitals to
continue to possess HIT that meets ``all applicable certification
criteria adopted by the Secretary'' and consequently also meets the
definition of Certified EHR Technology.
Stated another way, regardless of the year and meaningful use stage
at which an eligible professional or eligible hospital enters the
Medicare or Medicaid EHR Incentive Program, the Certified EHR
Technology that would be used would have to include the capabilities
necessary to meet the most current certification criteria adopted by
the Secretary at 45 CFR 170 subpart C
[[Page 11347]]
in order to meet the definition of Certified EHR Technology. For
example, if the Secretary adopts 5 new certification criteria in 2012
which would be applicable to, and in support of, meaningful use Stage
2, an eligible professional who implemented Certified EHR Technology in
2011 would need to ensure that its HIT was upgraded with newly
certified software or a certified EHR Module by 2013 to include the 5
new capabilities the Secretary adopted in the certification criteria in
order to continue to have HIT that meets the definition of Certified
EHR Technology and could provide the capabilities they would need to
continue to attempt to achieve meaningful use.
We also want to point out and clarify an apparent, yet temporary,
inconsistency that would occur in 2013 and 2014 should CMS finalize its
proposed staggered approach for meaningful use stages to provide
flexible entry points for eligible professionals and eligible hospitals
(e.g., an eligible professional whose first payment year is 2013 would
start at meaningful use Stage 1 in 2013, while an eligible professional
whose first payment year was 2011 would be required to meet meaningful
use Stage 2 requirements in 2013). The apparent inconsistency pertains
to the HIT an eligible professional or eligible hospital would need to
have to meet the definition of Certified EHR Technology and the
meaningful use stage the eligible professional or eligible hospital
would need to meet to qualify for incentive payments. As proposed,
eligible professionals and eligible hospitals who seek to have their
first payment year begin in 2013 or 2014 would only need to meet
meaningful use stage 1 requirements; however, the Certified EHR
Technology they would need to use, would need to meet the most recent
certification criteria adopted by the Secretary, which at that time
would be in support of meaningful use stage 2. As a result, should CMS
finalize its proposed staggered approach for meaningful use stages,
these eligible professionals and eligible hospitals would need to use
``meaningful use stage 2 Certified EHR Technology'' even though they
would only have to meet meaningful use stage 1 metrics.
Should CMS finalize its proposed staggered approach for meaningful
use stages, we recognize that some confusion within the HIT industry
may arise during 2013 and 2014 because of this apparent inconsistency
and the divergent use of the term ``meaningful use.'' We would
anticipate, therefore, that ONC-ACBs would clearly indicate the
certification criteria used when certifying Complete EHRs and/or EHR
Modules, and identify certifications according to the calendar year and
month rather than the meaningful use stage to reflect the currency of
the certification criteria against which the Complete EHRs and/or EHR
Modules have been certified. Consequently, if an eligible professional
or eligible hospital were seeking to obtain a certified Complete EHR or
certified EHR Module in 2014, for instance, that eligible professional
or eligible hospital would look for Complete EHRs and EHR Modules
certified in accordance with certification criteria current in 2014,
rather than Complete EHRs and EHR Modules certified as meeting
certification criteria intended to support meaningful use Stage 1,
Stage 2, or Stage 3. We request comments on ways to ensure greater
clarity in the certification of Complete EHRs and EHR Modules.
We believe this proposed approach would benefit eligible
professionals and eligible hospitals whose first payment year is in
2013 because they would already have the Certified EHR Technology they
would need in order to meet meaningful use stage 2, which, as proposed,
would begin for them in the following year (2014). Eligible
professionals and eligible hospitals, whose first payment year is 2014,
would also benefit. They would have adopted more advanced HIT and would
need to be familiar with the additional capabilities it provides,
because, as proposed, they would need to meet meaningful use Stage 3
requirements in the following year (2015). This approach would also
assist other HIT users with whom eligible professionals and eligible
hospitals would exchange information by ensuring improved
interoperability among their respective HIT systems.
We again note that this apparent inconsistency would exist only for
the years 2013 and 2014. By 2015, if as proposed by CMS an eligible
professional or eligible hospital seeks to begin participating in the
Medicare and Medicaid incentive programs, that eligible professional or
eligible hospital would need to implement Complete EHRs or EHR Modules
certified to certification criteria that support meaningful use Stage 3
and would have to meet meaningful use Stage 3 metrics.
F. Sunset
We propose to sunset the temporary certification program and the
rules that govern it when the National Coordinator has authorized at
least one ONC-ACB under the permanent certification program. We further
propose that on the date at which this sunset occurs that ONC-ATCBs
under the temporary certification program will be prohibited from
accepting new requests to certify Complete EHRs and/or EHR Modules.
That means that ONC-ATCBs will be able to review any pending
applications that they will have received prior to the termination date
of the temporary certification program, and complete the certification
process for those Complete EHRs and EHR Modules. We request public
comment on whether we should establish a set date for the temporary
program to sunset, such as 12/31/2011, instead of date that depends on
a particular action--the authorization of at least one ONC-ACB. A set
date would provide certainty and create a clear termination point for
the temporary certification program by indicating to any ONC-ATCBs and
other certification bodies that in order to be authorized to certify
Complete EHRs and/or EHR Modules after 12/31/2011, they would need to
be accredited and reapply to become ONC-ACBs. One potential downside to
a set date would be the possibility that it would temporarily prevent
certifications from being issued during the time period it takes
potential ONC-ACB applicants to get accredited and receive their
authorizations from the National Coordinator.
III. Provisions of Permanent Certification Program
[If you choose to comment on the provisions of the permanent
certification program, please include at the beginning of your comment
the specific section title and any additional information to clearly
identify the proposal about which you are commenting. For example,
``Definitions'' or ``Permanent Certification Program Application
Process.'']
As noted above, we have chosen to propose both the temporary and
permanent certification programs in this notice of proposed rulemaking.
We believe this format offers the public significantly more context for
our proposed policies and expect to receive more informed and detailed
comments on our proposed policies. Similarly, we anticipate that some
comments will be applicable to both certification programs. In that
regard, we believe that this approach also reduces the amount of
redundancy that would have existed had we published two separate
proposed rules.
Along those same lines, we have proposed that certain aspects of
the temporary certification program will be the same as certain
elements of the permanent certification program. In those cases, to
reduce unnecessary, duplicative text in this rule, we simply identify
those proposed elements of
[[Page 11348]]
both programs that are the same. In all other cases, we discuss in
greater detail those proposals that are unique to the permanent
certification program. To remain consistent with the section structure
developed above and to improve readability and comprehension, we have
presented our proposals for the permanent certification program in the
same order as those presented in the temporary certification program.
Additionally, in our proposals for the permanent certification program
that cross-reference proposed provisions of the temporary certification
program, all references to ONC-ATCBs should be substituted with
references to ONC-ACBs, as appropriate.
A. Applicability
This subpart would establish the processes an applicant for ONC-ACB
status must follow to be granted ONC-ACB status by the National
Coordinator, the processes the National Coordinator would follow when
assessing applicants and granting ONC-ACB status, the requirements of
ONC-ACBs for certifying Complete EHRs and/or EHR Modules in accordance
with the applicable certification criteria adopted by the Secretary in
subpart C. It also establishes the processes accreditation
organizations would follow to request approval from the National
Coordinator and that the National Coordinator in turn would follow to
approve an accreditation organization under the permanent certification
program as well as certain ongoing responsibilities for an ONC-AA.
B. Definitions
1. Definition of Applicant
We propose to use the same definition of applicant for the
permanent certification program with the exception of replacing ONC-
ATCB with ONC-ACB.
2. Definition of Day or Days
We propose that day or days would have the same meaning under the
permanent certification program as we have proposed under the temporary
certification program.
3. Definition of ONC-Approved Accreditor
We propose that the term ONC-Approved Accreditor (ONC-AA) means an
accreditation organization that the National Coordinator has approved
to accredit certification bodies under the permanent certification
program.
4. Definition of ONC-ACB
We propose ONC-ACB to mean a single organization or a consortium of
organizations that has applied to and been authorized by the National
Coordinator to perform the certification of, at a minimum, Complete
EHRs and/or EHR Modules using the applicable certification criteria
adopted by the Secretary. We have included the phrase ``at a minimum''
in this definition to take into account the possibility that ONC-ACBs
may be authorized in the future to certify other types of HIT, such as
personal health records (PHRs). Please note, however, that for that to
occur, the Secretary would have to adopt certification criteria
applicable to these types of HIT.
C. Correspondence With the National Coordinator
We propose that when applicants for ONC-ACB status and ONC-ACBs
correspond with the National Coordinator and vice versa, that these
communications must comply with the same rules we have proposed for the
temporary certification program.
D. Permanent Certification Program Application Process for ONC-ACB
Status
Similar to the temporary certification program, we propose under
the permanent certification program to permit applicants for ONC-ACB
status to apply at any time.
1. Application for ONC-ACB Status
Similar to the temporary certification program, we propose that an
applicant for ONC-ACB status must submit an application to the National
Coordinator in the same manner ONC-ATCB applicants must under the
temporary certification program in order to be considered for ONC-ACB
status. However, unlike the temporary certification program, applicants
would no longer need to request an application and would instead be
permitted to submit an application (which we intend to make available
on the ONC Web site) to the following e-mail address:
[email protected].
a. Types of Applicants
Because the National Coordinator's authorization in the permanent
certification program is only valid with respect to certification, we
do not expect that it would be necessary for organizations seeking to
apply for ONC-ACB status to form a partnership or consortium. However,
such an applicant would not be prevented from achieving ONC-ACB status
as long as it could meet all of the requirements of the permanent
certification program.
b. Types of ONC-ACB Authorization
Similar to the temporary certification program, we would require an
applicant for ONC-ACB status to indicate on its application the type of
certification it seeks authorization to perform under the permanent
certification program. If the applicant requested authorization to
certify EHR Modules we would also require it to identify the type(s) of
EHR Modules which it seeks authorization to certify. The proposed
requirement for an applicant to indicate the type of certification it
is seeking would also apply to other types of HIT if the Secretary has
adopted certification criteria for that HIT.
c. Application for ONC-ACB Status
We propose that an applicant must include the following information
in its application:
i. The applicant would be required to submit the same general
identifying information required under the temporary certification
program and section II.D.1.c.i.
ii. The applicant would be required to submit the information
necessary for ONC to confirm the applicant's accreditation by an ONC-
AA.
iii. The applicant would be required to submit a properly executed
agreement that it will adhere to the ``Principles of Proper Conduct for
ONC-ACBs.'' The Principles of Proper Conduct for ONC-ACBs would require
an ONC-ACB to:
Maintain its accreditation.
Attend all mandatory ONC training and program update
sessions.
Maintain a training program that includes documented
procedures and training requirements to ensure its personnel are
competent to certify HIT.
Report to ONC within 15 days any changes that materially
affect its:
[cir] Legal, commercial, organizational, or ownership status;
[cir] Organization and management including key certification
personnel;
[cir] Policies or procedures;
[cir] Location;
[cir] Personnel, facilities, working environment or other
resources;
[cir] ONC authorized representative (point of contact); or
[cir] Other such matters that may otherwise materially affect its
ability to certify HIT.
Allow ONC, or its authorized agents(s), to periodically
observe on site (unannounced or scheduled) any certifications performed
to demonstrate compliance with the requirements of the permanent
certification program.
[[Page 11349]]
Provide ONC, no less frequently than weekly, a current
list of Complete EHRs and/or EHR Modules that have been certified,
which includes, at a minimum, the vendor name (if applicable), the date
certified, the product version, the unique certification number or
other specific product identification, and where applicable, the
certification criterion or certification criteria to which each EHR
Module has been certified.
Retain all records related to the certification of
Complete EHRs and/or EHR Modules for a minimum of 5 years.
Only certify HIT, including Complete EHRs and/or EHR
Modules that have been tested by a NVLAP-accredited testing laboratory.
Submit an annual surveillance plan to the National
Coordinator and annually report to the National Coordinator its
surveillance results.
Promptly refund any and all fees received for
certifications that will not be completed.
The first difference between these Principles of Proper Conduct for
ONC-ACBs and those proposed under the temporary certification program
is that we have removed the principles related to Guide 65 and ISO
17025. The former would be replaced and addressed by the accreditation
principle for ONC-ACBs and the latter, ISO 17025, would no longer be
necessary since the National Coordinator's authorization under the
permanent certification program applies solely to certification.
The second difference is that we have added the principle that ONC-
ACBs would only be permitted to certify Complete EHRs and/or EHR
Modules that have been tested by a NVLAP-accredited testing laboratory.
We believe that NVLAP-accreditation is the best option, because the
NVLAP is an internationally recognized testing laboratory accreditation
program and because it will best serve the public's interests. The
NVLAP will also be able to rely on the significant technical and
scientific staff NIST employs who have specialized expertise in
developing and performing tests for and evaluations of HIT. Moreover,
Congress clearly indicated its intentions both in section 3001(c)(5) of
the PHSA and in section 13201(b) of the HITECH Act by associating NIST
with the testing and certification of HIT. In the latter, the HITECH
Act expressly provides that the Director of NIST, in coordination with
the HIT Standards Committee, ``shall support the establishment of a
conformance testing infrastructure * * *'' and that ``[t]he development
of this conformance testing infrastructure may include a program to
accredit independent, non-Federal laboratories to perform testing.''
The third difference pertains to record retention. For the
permanent certification program, we propose to require that ONC-ACBs
retain their records related to the certification of Complete EHRs and
EHR Modules for a minimum of five years. We understand from our
consultations with NIST that this is standard industry practice for
organizations involved in certification. Given the fact that it will be
possible for ONC-ACBs to be authorized under the permanent
certification program for many years, we believe that this time period
is necessary in the event that the National Coordinator notifies an
ONC-ACB of a proposed Type-2 violation or proposes to revoke an ONC-
ACBs status. These records would be directly relevant to a
determination by the National Coordinator that an ONC-ACB committed a
Type-2 violation and/or to revoke an ONC-ACB's status. Moreover, we
believe that the records will be necessary for ONC-ACBs to conduct
surveillance. Finally, similar to our proposal for the temporary
certification program, if an ONC-ACB loses its status for any reason it
could be required to provide the National Coordinator with copies of
all relevant records related to certification for up to a five year
period.
The fourth and final difference is the requirement that an ONC-ACB
would need to conduct surveillance of Complete EHRs and/or EHR Modules
that the ONC-ACB had previously certified. As noted in section I.F.3
when we introduced the concept of surveillance, we expect that as part
of ONC-ACBs' accreditation to confirm compliance at a minimum with
Guide 65, they will have addressed section 13. Section 13 specifies the
general surveillance requirements that a certification body must meet
in order to become accredited. We propose to require that ONC-ACBs
agree to submit annual surveillance plans to the National Coordinator
and annually report to the National Coordinator their surveillance
results. As discussed below, we also propose a requirement for the ONC-
AA to have processes in place to ensure that the certification bodies
it accredits properly conduct surveillance. We believe that ONC-ACBs
should be given the flexibility to conduct surveillance in accordance
with their accreditation. However, we recognize that it would likely
benefit the HIT industry if certain common elements of surveillance
could be developed and we welcome public comment on what those elements
should be. We anticipate that we would issue annual guidance for ONC-
ACBs before they submit their surveillance plans in order to identify
ONC priorities. In that regard, we also request public comment on
whether there are specific approaches to surveillance that have worked
in other industries and should be replicated for HIT.
We anticipate using the results of ONC-ACB surveillance to make
publicly available information related to the implementation and
performance of Complete EHRs and EHR Modules in the field and as
feedback for the efficient operation of the permanent certification
program. We expect that these surveillance results could also be used
by prospective purchasers of Complete EHRs and/or EHR Modules to
determine whether a Complete EHR or EHR Module they are considering
implementing has been the subject of any unsatisfactory surveillance
reports (and why those unsatisfactory results occurred). We believe
this requirement is important and would provide the National
Coordinator and ONC-ACBs with important feedback regarding the
effectiveness of the permanent certification program and what if any
changes may need to be made to improve how the program operates.
We emphasize that surveillance results obtained by ONC-ACBs and
reported to the National Coordinator would not immediately affect a
Complete EHR or EHR Module's certification. That is, if after an ONC-
ACB reevaluated a Complete EHR it previously certified and reported
that the Complete EHR no longer met a certification criterion or
criteria because, for example, an individual took actions to alter a
capability provided by the Complete EHR such that it no longer
performed according to its original design or improperly installed the
Complete EHR, such a result would not automatically invalidate the
Complete EHR's certification. However, we would expect ONC-ACBs upon
the identification of a pattern of poorly performing previously
certified Complete EHRs and/or EHR Modules to determine whether they
properly certified the Complete EHR or EHR Module in the past. We
believe that the publication of surveillance results and market forces
will sufficiently motivate developers of Complete EHRs and/or EHR
Modules to continue to improve their products and address any
shortcoming identified by the ONC-ACB surveillance process. We request
public comment on whether the National Coordinator should consider
proactively stepping-in to protect purchasers of Complete EHRs and/or
EHRs Modules by taking action such as ``de-certifying'' Complete EHRs
and/or
[[Page 11350]]
EHR Modules if a pattern of unsatisfactory surveillance results emerges
and the ONC-ACB has not taken any measures to evaluate the poor
performance.
d. Proficiency Examination
We no longer propose the use of a proficiency exam in the permanent
certification program because it would no longer serve a useful
purpose. Moreover, the accreditation process for ONC-ACB applicants
encompasses this requirement and we do not believe that any additional
redundancy is necessary.
2. Application Review
We propose to use the same timeframes and general processes for
application review under the permanent certification program as we
propose for the temporary certification program. The primary difference
between the permanent certification program's application review
process and the temporary certification program's is the reduced number
of opportunities for an applicant to submit revisions in response to
formal deficiency notices (due to the fact that the application is only
one part). The timeframes for review, resubmission, and reconsideration
are the same as those proposed under the temporary certification
program. The only other difference between our two proposals in this
section is our reference to ONC-ACB instead of ONC-ATCB and that the
scope of an ONC-ACBs authorization will only be valid for certification
and not both testing and certification.
3. ONC-ACB Application Reconsideration Requests
We propose to use the same timeframes and processes for ONC-ACB
application reconsideration requests under the permanent certification
program as we propose for the temporary certification program. Again,
we now refer to ONC-ACBs instead of ONC-ATCBs.
4. ONC-ACB Status
a. Acknowledgement and Representation
We propose the same policies for ONC-ACBs related to
acknowledgement and representation as we do for ONC-ATCBs under the
temporary certification program.
b. Expiration of Status Under the Permanent Certification Program
We propose that an ONC-ACB would be required to renew its status
every two years. To renew its status, we propose that an ONC-ACB would
need to submit an updated application to the National Coordinator for
review 60 days prior to the expiration of its status. We request public
comment on any additional information an ONC-ACB should provide the
National Coordinator in order to have its status renewed, such as
documentation of the ONC-ACB's current accreditation status and any
additional information or updates to the original application that
would aid in the National Coordinator's review of the renewal request.
E. ONC-ACB Performance of Certification and Maintaining Good Standing
as ONC-ACB
1. Authorization To Certify Complete EHRs
We propose, similar to the temporary certification program, that
ONC-ACBs who seek authorization under the permanent certification
program to certify Complete EHRs must be capable of certifying Complete
EHRs to all applicable certification criteria adopted by the Secretary.
2. Authorization To Certify EHR Modules
We again propose that ONC-ACBs who seek authorization under the
permanent certification program to certify EHR Modules must be capable
of certifying EHR Modules in accordance with the applicable
certification criteria adopted by the Secretary. We would mirror our
proposals in the temporary certification program related to the scope
of a ``certification criterion'' and when, in this case, an ONC-ACB
would be required to certify EHR Modules to the privacy and security
certification criteria adopted by the Secretary in the permanent
certification program.
3. Authorization To Certify Other HIT
As we mention above in the preamble, section 3001(c)(5) of the PHSA
provides the National Coordinator with broad authority to establish
certification programs for the ``voluntary certification of health
information technology as being in compliance with applicable
certification criteria adopted under this subtitle.'' As a result, we
requested public comment on the other types of HIT that the permanent
certification program could include and ONC-ACBs could certify. As the
statute provides, if the Secretary were to adopt certification criteria
applicable to other types of HIT that the National Coordinator could
subsequently authorize an ONC-ACB to certify such HIT under the
permanent certification program. Therefore, we propose that if the
Secretary adopts certification criteria for HIT beyond Complete EHRs
and EHR Modules, a current ONC-ACB would have to submit an addendum to
its original application to request authorization to certify this other
type of HIT. If a new organization wanted to be authorized to certify
another type of HIT it would need to follow the rules for becoming an
ONC-ACB, including first receiving accreditation from an ONC-AA.
4. Authorized Certification Methods
Similar to the temporary certification program, we propose that
ONC-ACBs must have the capacity to certify Complete EHRs and/or EHR
Modules at their facility and one of the secondary methods we
identified in the temporary certification program.
5. The Certification of ``Minimum Standards''
Based on the same rationale provided in the temporary certification
program discussion above, we propose to adopt the same method or
methods for identifying which minimum standards (i.e., code sets) that
an ONC-ACB will use for certification.
6. Maintaining Good Standing as an ONC-ACB; Violations That Could Lead
to Revocation of ONC-ACB Status; Revocation of ONC-ACB Status
We propose the same policies and procedures for an ONC-ACB to
maintain good standing in the permanent certification program as in the
temporary certification program. We also include the same descriptions
for the types of violations discussed above in the temporary
certification program as well as the same timeframes and processes the
National Coordinator would take to revoke an ONC-ACBs status. Similar
to the temporary certification program, we propose that if an ONC-ACB
has its status revoked due to a Type-1 violation, it would be
prohibited from reapplying for ONC-ACB status for at least 1 year. We
believe this timeframe is justified because we assume that a former
ONC-ACB would need a certain amount of time to reorganize its
management and key personnel after having its status revoked.
Additionally, depending on the type of violation that led to the former
ONC-ACBs status being revoked, it is also possible that it would lose
its accreditation. We request public comment on whether this timeframe
should be shortened or lengthened, and whether alternative sanctions
related to ONC-ACBs or former ONC-ACBs should be considered.
Again, per our discussion above, we maintain our policy proposal
for the re-certification of Complete EHRs and/or EHR Modules if the
National
[[Page 11351]]
Coordinator determines that fraudulent certifications were issued.
7. Validity of Complete EHR and EHR Module Certification
Based on the same rationale provided in the temporary certification
program we do not believe that we need to adopt an explicit expiration
date for the certifications associated with Complete EHRs and EHR
Modules because of the natural expiration that our other regulatory
actions would create. Additionally, since a new certification program
would exist, which would include different processes, we emphasize that
Complete EHRs and EHR Modules tested and certified under the temporary
certification program by an ONC-ATCB would need to be tested and
certified according to the permanent certification program once the
Secretary adopts certification criteria to replace, amend, or add to
previously adopted certification criteria. We anticipate that this
would occur to support meaningful use Stage 2 and, as we discussed in
the temporary certification program section on this matter, the
capabilities eligible professionals and eligible hospitals would need
from their Certified EHR Technology would also change, thereby
affecting the validity and utility of the prior certification.
That being said, with respect to EHR Modules, we can envision
situations, especially in the future, where measures associated with a
meaningful use objective may change, but the capability a certified EHR
Module would need to provide would not change. As a result, it may be
impracticable or unnecessary for the EHR Module to be re-certified. For
example, a hypothetical meaningful use Stage 3 measure for electronic
prescribing could be 90% of all prescriptions compared to the 80%
proposed for meaningful use Stage 1. In this example, it may be
impracticable for a certified EHR Module for electronic prescribing to
be recertified if the only thing that has changed is the meaningful use
measure. Alternatively, if the certification criteria (and standard(s)
associated with those certification criteria) have changed, then it
would be necessary for the EHR Module to be re-certified. Therefore, we
request public comment on whether there should be circumstances where
EHR Modules should not have to be re-certified.
8. Differential Certification
We expect that over time the certification criteria adopted by the
Secretary will increase incrementally, much like the approach CMS has
proposed for meaningful use objectives and measures. As a result, after
Complete EHRs and EHR Modules have been certified to meet the
certification criteria associated with meaningful use Stage 1, it may
benefit both Complete EHR and EHR Module developers as well as eligible
professionals and eligible hospitals if some form of differential
certification were available. Differential certification would comprise
an ONC-ACB certifying Complete EHRs and/or EHR Modules to the
differences between the certification criteria adopted by the Secretary
associated with one stage of meaningful use and a subsequent stage of
meaningful use. For example, if the Secretary were to adopt 5 new
certification criteria to support meaningful use Stage 2 and those were
the only additional capabilities that needed to be certified in order
for a Complete EHR's certification to be valid again (i.e., all other
certification criteria remained the same) for the purposes of
meaningful use Stage 2, then the Complete EHR would only have to be
tested and certified to those 5 criteria rather than the entire set of
certification criteria again. We request public comment on factors that
could be considered to determine when differential certification would
be appropriate and when it would not. Factors we have considered
include, whether the standard(s) associated with a certification
criterion or certification criteria change and whether additional
certification criteria change in such a way that the new capabilities a
Complete EHR or EHR Module would need to provide impact how other
previously certified capabilities would perform.
We believe that differential certification could be a valuable and
pragmatic approach for the future and that it may further reduce costs
for certification and expedite the certification process. We request
public comment on whether we should require ONC-ACBs to offer
differential certification. In considering this request, we also ask
when differential certification should begin. That is, should
differential certification be permitted to begin with Complete EHRs and
EHR Modules certified under the temporary certification program (i.e.,
the differences between 2011 and 2013) or after all Complete EHRs and
EHR Modules have been certified once under the permanent certification
program (i.e., the differences between 2013 and 2015). We ask
commenters to consider this distinction because of the differences in
rigor that we expect Complete EHRs and EHR Modules will go through to
get certified under the permanent certification program.
F. ONC-Approved Accreditor
We propose that prior to submitting an application to the National
Coordinator for ONC-ACB status, an organization would need to be
accredited by an ONC-AA for certification. We propose a specific
accreditation requirement for the permanent certification program in
order to conform to industry best practices. We believe that the
accreditation of applicants for ONC-ACB status is an important
prerequisite for the permanent certification program because it not
only introduces additional rigor and objectivity to the certification
process, but also provides for increased confidence in, and credibility
to, the certifications performed. In that regard, if Complete EHR and/
or EHR Module developers believe that an ONC-ACB is not performing up
to par, they would be able to notify the ONC-AA (in addition to the
National Coordinator, if necessary) in order to expose any potential
ONC-ACB performance problems. The ONC-AA would be able to assess
whether these reports are valid, determine whether the ONC-ACB has
violated any of the terms of its accreditation, and would be able to
determine if any action is necessary including notifying the National
Coordinator.
1. Requirements for Becoming an ONC-AA
In order to become an ONC-AA, we propose that an accreditation
organization must submit a request in writing to the National
Coordinator along with the following information to demonstrate its
ability to serve as an ONC-AA.
A detailed description of the accreditation organization's
conformance to ISO 17011 and experience evaluating the conformance of
certification bodies to Guide 65.
A detailed description of the accreditation organization's
accreditation requirements and how those requirements complement the
Principles of Proper Conduct for ONC-ACBs.
Detailed information on the accreditation organization's
procedures that would be used to monitor ONC-ACBs.
Detailed information, including education and experience,
about the key personnel who review certification bodies for
accreditation.
[[Page 11352]]
Procedures for responding to, and investigating,
complaints against ONC-ACBs.
Once the National Coordinator receives such information, we propose
that the National Coordinator would be permitted up to 30 days to
review and issue a determination as to whether the accreditation
organization has been approved. The National Coordinator would judge
ONC-AA applicants on the information they provide, the completeness of
their descriptions to the elements listed above, and their overall
accreditation experience. The National Coordinator would review
submissions for ONC-AA status on a first come first serve basis and
would ``approve'' the first accreditation organization that
satisfactorily demonstrated its ability to serve as an ONC-AA. We
propose to use the same process for reconsideration of an accreditation
organization's approval request as we do for ONC-ACB applicants under
the permanent certification program.
2. ONC-AA Ongoing Responsibilities
In order to ensure that our programmatic objectives for the
permanent certification program are met, we propose that an ONC-AA
would fulfill, at a minimum, the following ongoing responsibilities:
Maintain conformance with ISO 17011;
In accrediting certification bodies, verify conformance
to, at a minimum, Guide 65;
Verify that ONC-ACBs are performing surveillance in
accordance with their respective annual plans; and
Review ONC-ACB surveillance results to determine if the
results indicate any substantive non-conformance with the terms set by
the ONC-AA when it granted the ONC-ACB accreditation.
We request public comment on these and potentially other ongoing
responsibilities that we should expressly require an ONC-AA to fulfill.
3. Number of ONC-AAs and Length of Approval
We believe that it is important for all applicants for ONC-ACB
status to be accredited by the same ONC-AA. Doing so would provide
stability and consistency for all ONC-ACB applicants and a common point
of trust for Complete EHR and EHR Module developers. Moreover, Complete
EHR and EHR Module developers would obtain a level of assurance that
any ONC-ACBs' certification would be equal to another's because all of
them had been accredited by the same ONC-AA. As a result, we believe
that it is important from a programmatic perspective for there to be
only one ONC-AA at a time and therefore we have proposed to only
approve one ONC-AA at a time. We request public comment on whether it
would be in the best interest of the ONC-ACB applicants and Complete
EHR and EHR Module developers to allow for more than one ONC-AA at a
time.
Finally, we propose that ONC-AA status would expire after 3 years.
Consistent with this proposed expiration of status, we propose to again
accept requests for ONC-AA status 120 days before the then current ONC-
AA's status is set to expire. We believe that 3 years provides an
appropriate balance between precluding other qualified accreditation
organizations from requesting ONC-AA status and providing some level of
consistency between the ONC-AA and ONC-ACB levels. We request public
comment on whether we should extend the length of an ONC-AA's status to
a maximum of 5 years before accepting requests for ONC-AA status or
shortening the length to 2 years or identify a different period of
time.
G. Promoting Participation in the Permanent Certification Program
In the context of the permanent certification program, it is our
hope and expectation that multiple organizations will step forward to
apply for and receive ONC-ACB status and that these organizations will
be able to certify Complete EHRs and EHR Modules in a timely and
satisfactory manner. Moreover, given the proposed Medicare and Medicaid
EHR Incentive Programs, we believe that organizations will be motivated
to become ONC-ACBs to meet the demand for Certified EHR Technology by
eligible professionals and eligible hospitals. We do not believe that
the requirements set forth in this proposed rule create prohibitively
high barriers to market entry for organizations interested in becoming
ONC-ACBs. However, we welcome comments on whether this proposed rule
does in fact create high barriers to market entry and, if so, how we
could revise the proposed requirements to lower those barriers and
encourage participation. We provide cost and burden estimates in
Section V (Collection of Information Requirements) and Section VI
(Regulatory Impact Analysis).
HHS is responsible for the overall implementation and success of
the proposed Medicare and Medicaid EHR Incentive Programs and we are
acutely aware that without a properly operating certification program
the overall success of the EHR incentive programs could be affected. We
are concerned about two low probability, but problematic risks--there
being no ONC-ACBs authorized under the permanent certification program
or only one ONC-ACB that engages in monopolistic behavior. We are
therefore interested in public comment regarding potential approaches
that could be pursued to stimulate market involvement or remediate this
situation if it were to develop, including the possibility for the
National Coordinator to establish a temporary ONC-managed certification
process (``ONC process'') that would include some type of certification
review board. This would not be a preferred option, and would come with
significant limitations. Congress, in section 3001(c)(5) of the PHSA,
did not expressly authorize the National Coordinator or the Secretary
to assess and collect fees related to the certification of HIT and
subsequently retain and use those fees to administer an ONC process if
it were established. We seek public comment on other potential
approaches that could be employed to address the two risks identified
above.
IV. Response to Comments
Because of the large number of public comments normally received in
response to Federal Register documents, we are not able to acknowledge
or respond to them individually. We will consider all comments we
receive by the date and time specified in the DATES section of this
preamble, and, when we proceed with a subsequent document, we will
respond to the comments in the preamble of that document.
V. Collection of Information Requirements
In compliance with the requirement of section 3506(c)(2)(A) of the
Paperwork Reduction Act of 1995 (PRA), the Office of the Secretary
(OS), Department of Health and Human Services, is publishing the
following summary of proposed information collection requests for
public comment. In order to fairly evaluate an information collection,
section 3506(c)(2)(A) of the PRA requires that we solicit comment on
the following issues:
1. Whether the information collection is necessary and useful to
carry out the proper functions of the agency;
2. The accuracy of the agency's estimate of the information
collection burden;
3. The quality, utility, and clarity of the information to be
collected; and
[[Page 11353]]
4. Recommendations to minimize the information collection burden on
the affected public, including automated collection techniques.
Under the PRA, the time, effort, and financial resources necessary
to meet the information collection requirements referenced in this
section are to be considered. We explicitly seek, and will consider,
public comment on our assumptions as they relate to the PRA
requirements summarized in this section. To comment on the collections
of information or to obtain copies of the supporting statements and any
related forms for the proposed paperwork collections referenced in this
section, e-mail your comment or request, including your address and
phone number to [email protected], or call the Reports
Clearance Office on (202) 690-6162. Written comments and
recommendations for the proposed information collections must be
directed to the OS Paperwork Clearance Officer at the above e-mail
address within 30 days.
Abstract
The Health Information Technology for Economic and Clinical Health
(HITECH) Act, Title XIII of Division A and Title IV of Division B of
the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-
5), was enacted on February 17, 2009. The HITECH Act amended the Public
Health Service Act (PHSA) and created ``Title XXX--Health Information
Technology and Quality'' (Title XXX) to improve health care quality,
safety, and efficiency through the promotion of health information
technology (HIT) and electronic health information exchange.
Section 3001(c)(5) of the PHSA requires the National Coordinator,
in consultation with the Director of the National Institute of
Standards and Technology, to ``keep or recognize a program or programs
for the voluntary certification of health information technology as
being in compliance with applicable certification criteria'' adopted by
the Secretary under section 3004. In this notice of proposed rulemaking
implementing section 3001(c)(5), we propose to establish two
certification programs, a temporary certification program and a
permanent certification program. The establishment of these programs
and the proposals therein would require four separate collections of
information.
A. Collection of Information 1: Application for ONC-ATCB
Status Under the Proposed Temporary Certification Program
Under the proposed temporary certification program, an applicant
who voluntarily applies to become an ONC-ATCB would be required to
submit an application to the National Coordinator. Based on prior
experience, we believe that the testing and certification of Complete
EHRs and/or EHR Modules will require expertise that few in the HIT
marketplace possess. As a result, we assume that there will be no more
than 3 applicants for ONC-ATCB status. We believe that there will be no
more than 3 applicants because we have only seen evidence in the press
of one organization that has committed to applying and another that has
expressed its interest in entering the HIT testing and certification
field. The application requirements include the completion of an
application form, submission of additional documentation as specified
in the application form, and completion of a proficiency examination.
However, the proficiency examination is not considered ``information''
for PRA collection purposes because it falls under the exception to the
definition of information at 5 CFR 1320.3(h)(7). We estimate that it
will take approximately:
10 minutes for an applicant to provide the general
identifying information requested in the application (section 1);
2 hours to complete the Guide 65 self audit and assemble
associated documentation (section 2);
2 hours to complete the ISO 17025 self audit and assemble
associated documentation (section 3); and
20 minutes to review and agree to the ``Principles of
Proper Conduct for ONC-ATCBs'' (section 4).
As discussed in more detail in section VI, we base these estimates
on the assumption that qualified applicants for the temporary
certification program will already be familiar with the relevant
requirements found in the ISO/IEC standards and will have a majority,
if not all, of the documentation requested in the application already
developed and available before applying for ONC-ATCB status. Therefore,
with the exception of completing a proficiency examination, we believe
an applicant would only spend time collecting and assembling already
developed information to submit with their application rather than
developing, for example, a ``quality manual'' from scratch.
More specifics about the temporary certification program's proposed
application requirements and the information that would be collected
can be found at Sec. 170.420.
Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
Number of Average burden
Type of respondent (ONC-ATCB applicant) Number of responses per hours per Total burden
respondents respondent response hours
----------------------------------------------------------------------------------------------------------------
ATCB Application Section 1.................... 3 1 10/60 .5
ATCB Application Section 2.................... 3 1 2 6
ATCB Application Section 3.................... 3 1 2 6
ATCB Application Section 4.................... 3 1 20/60 1
-----------------------------------------------------------------
Total..................................... 3 1 4.5 13.5
----------------------------------------------------------------------------------------------------------------
B. Collection of Information 2: Application for ONC-ACB Status
Under the Proposed Permanent Certification Program
Under the proposed permanent certification program, an applicant
who voluntarily applies to become an ONC-ACB would be required to
submit an application to the National Coordinator. We estimate that
there will be no more than 6 applicants for ONC-ACB status under the
permanent certification program. While we believe that the business
case for entering the HIT market to perform the certification of
Complete EHRs and EHR Modules could increase as health IT adoption
rates increase, we believe that it is unlikely (given the expertise
needed to perform the certification of Complete EHRs and EHR Modules)
that the number of applicants would extend into the tens of applicants.
The application requirements include the completion of an
application form and submission of additional
[[Page 11354]]
documentation as specified in the application form. We estimate that it
will take approximately:
10 minutes for an applicant to provide the general
identifying information requested in the application (section 1);
30 minutes to assemble the information necessary to
provide documentation of accreditation by an ONC-AA (section 2); and
20 minutes to review and agree to the ``Principles of
Proper Conduct for ONC-ACBs'' (section 3).
While we anticipate that very few organizations will have the
expertise to test and certify HIT in the temporary certification
program, we have proposed to separate these responsibilities in the
permanent certification program and in doing so, we believe that
several private sector organizations that currently conduct only
testing or only certification will be able to enter the HIT testing and
certification field. Our burden estimates above are based on the
assumption that these existing entities will already be familiar with
many of the requirements proposed in this rule and will, for example,
already have a majority--if not all--of the documentation requested in
the application already developed and available before applying for
ONC-ACB status.
Also, while this rule does impose record keeping requirements, we
believed that the proposed 5-year requirement is in line with common
industry practice and, consequently, would not represent an additional
cost to ONC-ACBs as a result of this rule.
More specifics about the permanent certification program's proposed
application requirements and the information that would be collected
can be found at Sec. 170.502.
Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
Number of Average
Type of respondent (ONC-ACB applicant) Number of responses per burden hours Total burden
respondents respondent per response hours
----------------------------------------------------------------------------------------------------------------
ACB Application Section 1....................... 6 1 10/60 1
ACB Application Section 2....................... 6 1 30/60 3
ACB Application Section 3....................... 6 1 20/60 2
---------------------------------------------------------------
Total....................................... 6 1 1 6
----------------------------------------------------------------------------------------------------------------
C. Collection of Information 3: ONC-ATCB and ONC-ACB
Collection and Reporting of Information Related To Complete EHR and/or
EHR Module Certifications
Under both of the proposed certification programs we propose to
require ONC-ATCBs and ONC-ACBs to provide ONC, no less frequently than
weekly, a current list of Complete EHRs and/or EHR Modules that have
been tested and certified which includes, at a minimum, the vendor name
(if applicable), the date certified, the product version, the unique
certification number or other specific product identification, and
where applicable, the certification criterion or certification criteria
to which each EHR Module has been tested and certified.
These specific proposed requirements for the temporary
certification program and the permanent certification program can be
found at Sec. 170.420 and Sec. 170.520, respectively.
For the purposes of estimating the potential burden, we assume that
all of the estimated applicants in the tables above will apply and
become ONC-ATCBs and ONC-ACBs under the temporary certification program
and permanent certification program, respectively. We also assume, per
our requirement specified in the respective Principles of Proper
Conduct for ONC-ATCBs and ONC-ACBs, that ONC-ATCBs and ONC-ACBs will
report weekly (i.e., respondents will respond 52 times per year).
Finally, we assume that the information collections would be
accomplished through electronic data collection and storage and that
such collection and storage would be part of ONC-ATCBs and ONC-ACBs
normal course of business. Therefore, with respect to this proposed
collection of information, the estimated burden is limited to the
actual electronic reporting of the information to ONC.
Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
Number of Average
Type of respondent Number of responses per burden hours Total burden
respondents respondent per response hours
----------------------------------------------------------------------------------------------------------------
ONC-ATCB Testing and Certification Results...... 3 52 1 156
ONC-ACB Certification Results................... 6 52 1 312
---------------------------------------------------------------
Total....................................... 9 104 2 468
----------------------------------------------------------------------------------------------------------------
D. Collection of Information 4: Required Documentation for
Requesting ONC-Approved Accreditor Status
Under the permanent certification program we propose to require
accreditation organizations who seek to become an ONC-AA to submit
information to the National Coordinator to demonstrate their ability to
accredit certification bodies that would eventually apply for ONC-ACB
status. We assume that there will only be two accreditation
organizations that will prepare and submit the information sought by
the National Coordinator. We believe this will be the case based on our
knowledge of the HIT market and consultations with NIST related to the
existence of potential accreditation organizations that could seek the
National Coordinator's approval.
We have included our estimates of the approximate time commitments
associated with documenting each requirement that must be included in
an accreditation organization's submission:
20 minutes for an accreditation organization to provide a
detailed description of the accreditation
[[Page 11355]]
organization's conformance to ISO 17011 and experience evaluating the
conformance of certification bodies to Guide 65;
20 minutes for an accreditation organization to provide a
detailed description of the accreditation organization's accreditation
requirements and how the requirements complement the Principles of
Proper Conduct for ONC-ACBs;
5 minutes for an accreditation organization to provide a
copy of the procedures that would be used to monitor ONC-ACBs;
10 minutes for an accreditation organization to provide
detailed information, including education and experience, about the key
personnel who review certification bodies for accreditation; and
5 minutes for an accreditation organization to provide a
copy of the procedures for responding to, and investigating, complaints
against ONC-ACBs.
These specific proposed requirements for the permanent certification
program can be found at Sec. 170.503.
Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
Number of Average
Type of respondent (ONC-AA requestor) Number of responses per burden hours Total burden
respondents respondent per response hours
----------------------------------------------------------------------------------------------------------------
Documentation of Conformance to ISO 17011 and 2 1 20/60 .67
Guide 65 Experience............................
Description of Accreditation Requirements and 2 1 20/60 .67
how they Complement the Principles of Proper
Conduct for ONC-ACBs...........................
Documentation of Monitoring Procedures.......... 2 1 5/60 .165
Documentation of Key Personnel.................. 2 1 10/60 .33
Documentation of Procedures for Responding to 2 1 5/60 .165
and Investigating Complaints...................
---------------------------------------------------------------
Total....................................... 2 1 1 2
----------------------------------------------------------------------------------------------------------------
As required by Sec. 3504(h) of the Paperwork Reduction Act, we
have submitted a copy of this document to the Office of Management and
Budget (OMB) for its review of these information collection
requirements.
VI. Regulatory Impact Analysis
A. Introduction
We have examined the impacts of this proposed rule as required by
Executive Order 12866 on Regulatory Planning and Review (September 30,
1993, as further amended), the Regulatory Flexibility Act (RFA) (5
U.S.C. 601 et seq.), section 202 of the Unfunded Mandates Reform Act of
1995 (2 U.S.C. 1532), Executive Order 13132 on Federalism (August 4,
1999), and the Congressional Review Act (5 U.S.C. 804(2)).
Executive Order 12866 directs agencies to assess all costs and
benefits of available regulatory alternatives and, if regulation is
necessary, to select regulatory approaches that maximize net benefits
(including potential economic, environmental, public health and safety
effects, distributive impacts, and equity). A regulatory impact
analysis (RIA) must be prepared for major rules with economically
significant effects ($100 million or more in any one year). Based on
the analysis of costs and benefits that follows, we have determined
that this proposed rule, including both the temporary certification
program and permanent certification program, is not an economically
significant rule because we estimate that the overall costs and
benefits associated with the combination of the temporary and permanent
certification programs as well as the costs associated with the testing
and certification of Complete EHRs and EHR Modules under both
certification programs will be less than $100 million per year.
Nevertheless, because of the public interest in this proposed rule, we
have prepared an RIA that to the best of our ability presents the costs
and benefits of the proposed rule broken down by each proposed
certification program. We request comments on the economic analyses
provided in this proposed rule.
B. Why This Rule is Needed?
As stated in earlier sections of this proposed rule, section
3001(c)(5) of the PHSA provides the National Coordinator with the
authority to establish a certification program or programs for the
voluntary certification of HIT. This proposed rule is needed to outline
the processes by which the National Coordinator would exercise this
authority to authorize certain organizations to test and certify
Complete EHRs and/or EHR Modules. Once certified, Complete EHRs and EHR
Modules would be able to be used by eligible professionals and eligible
hospitals as, or be combined to create, Certified EHR Technology.
Eligible professionals and eligible hospitals who seek to qualify for
incentive payments under the Medicare and Medicaid EHR Incentive
Programs are required by statute to use Certified EHR Technology.
C. Executive Order 12866--Regulatory Planning and Review Analyses for
the Proposed Temporary and Permanent Certification Programs
As required by Executive Order 12866, we have examined the economic
implications of this proposed rule as it relates to our proposed
temporary and permanent certification programs. Executive Order 12866
directs agencies to assess all costs and benefits of available
regulatory alternatives and, when regulation is necessary, to select
regulatory approaches that maximize net benefits (including potential
economic, environmental, public health and safety, and other
advantages; distributive impacts; and equity). Executive Order 12866
classifies a regulation as significant if it meets any one of a number
of specified conditions, including having an annual effect on the
economy of $100 million, or in a material way adversely affecting the
economy, a sector of the economy, competition, or jobs. While this rule
is therefore not ``economically significant,'' as defined by Executive
Order 12866, OMB has determined that this rule constitutes a
``significant regulatory action'' as defined by Executive Order 12866
because it raises novel legal and policy issues.
Throughout the following analyses we identify specific actions or
issues for which we expressly ask for comments. The public, however, is
invited to comment on any and all elements of the analyses and on all
underlying assumptions.
[[Page 11356]]
1. Temporary Certification Program Estimated Costs
a. Application Process for ONC-ATCB Status
i. Applicant Costs
As mentioned above, we believe that the testing and certification
of Complete EHRs and/or EHR Modules will require expertise that not
many in the HIT marketplace currently possess. Therefore, we assume
that there will be no more than 3 applicants for ONC-ATCB status. We
believe that there will be no more than three applicants because we
have only seen evidence in the press of one organization that has
committed to applying and another that has expressed its interest in
entering the HIT testing and certification field.
As part of the temporary certification program, an applicant would
be required to submit an application and complete a proficiency exam.
We do not believe that there will be an appreciable difference in the
time commitment an applicant for ONC-ATCB status will have to make
based on the type of authorization it seeks (i.e., we believe the
application process and time commitment will be the same for applicants
seeking authorization to conduct either the testing and certification
of Complete EHRs or EHR Modules). Further, we assume that qualified
applicants will have reviewed the relevant requirements found in the
ISO/IEC standards and will have a majority, if not all, of the
documentation requested in the application already developed and
available before applying for ONC-ATCB status. Without having such
documentation (including policies and procedures) we believe that it
would be difficult for an applicant to operate a legitimate testing and
certification program. Therefore, with the exception of completing a
proficiency examination, we believe an applicant would only spend time
collecting and assembling already developed information to submit with
their application rather than developing, for example, a ``quality
manual'' from scratch.
Based on our assumptions and consultations with NIST, we anticipate
that it will take an applicant approximately 28.5 hours to complete the
application and submit the requested documentation. Our estimate
includes the time discussed above in our collection of information
section and approximately up to 24 hours to complete the proficiency
examination--8 hours (1 full work day) to complete section 1
(demonstration of technical expertise related to Complete EHRs and/or
EHR Modules); 6 hours to complete section 2 (demonstration of test tool
identification); and 10 hours to complete section 3 (demonstration of
proper use of test tools and understanding of test results). Moreover,
after consulting with NIST we assume that:
(1) An employee equivalent to the Federal Salary Classification of
GS-9 Step 1 could provide the general information requested in the
application and accomplish the paperwork duties associated with the
application;
(2) An employee equivalent to the Federal Salary Classification of
GS-15 Step 1 would be responsible for conducting the self audits and
agreeing to the ``Principles of Proper Conduct for ONC-ATCBs''; and
(3) An employee or employees equivalent to the Federal Salary
Classification of GS-15 Step 1 would be responsible for completing the
proficiency examination.
We have taken these employee assumptions and utilized the
corresponding employee hourly rates for the locality pay area of
Washington, DC as published by the U.S. Office of Personnel Management
(OPM), to calculate our cost estimates. We have also calculated the
costs of an employee's benefits while completing the application. We
have calculated these costs by assuming that an applicant expends
thirty-six percent (36%) of an employee's hourly wage on benefits for
the employee. We have concluded that a 36% expenditure on benefits is
an appropriate estimate because it is the routine percentage used by
HHS for contract cost estimates. Our calculations are expressed in
Tables 1 and 2 below.
Table 1--Temporary Certification Program: Cost to Applicants To Apply To Become an ONC-ATCB
----------------------------------------------------------------------------------------------------------------
Cost of
Employee Employee employee Cost per
Proposed requirement equivalent Burden hours hourly wage benefits per applicant
rate hour
----------------------------------------------------------------------------------------------------------------
General Identifying GS-9 Step 1..... 10/60 $22.39 $8.06 $5.07
Information.
Self Audits and Documentation. GS-15 Step 1.... 4 59.30 21.35 322.60
Principles of Proper Conduct.. GS-15 Step 1.... 20/60 59.30 21.35 26.89
Proficiency Examination....... GS-15 Step 1.... 24 59.30 21.35 1,935.60
---------------------------------------------------------------------------------
Total Cost Per Application ................ .............. .............. .............. 2,290.16
----------------------------------------------------------------------------------------------------------------
Table 2--Temporary Certification Program: Total Cost of Application Process
----------------------------------------------------------------------------------------------------------------
Cost of application per
Anticipated number of applicants applicant ($) Total cost estimate ($)
----------------------------------------------------------------------------------------------------------------
3........................................................... $2,290.16 $6,870.48
----------------------------------------------------------------------------------------------------------------
We based our cost estimates on the amount of applicants that we
believe will apply over the life of the temporary certification
program. We assume that all applicants will apply during the first year
of the program and thus all application costs should be attributed to
the first year of the program. However, based on our projection that
the temporary certification program will last approximately two years
and that one or two applicants may choose to apply in the second year,
the annualized cost of the application process would be $3,435. We
invite comments on our estimated number of applicants and on the costs
associated with the proposed application process under the temporary
certification program.
ii. Costs to the Federal Government
We have estimated the cost to develop the ONC-ATCB application,
including the development and administration of
[[Page 11357]]
the proficiency examination to be $33,079 based on the 473 hours we
believe it will take to develop the application, prepare standard
operating procedures as well as create the requisite pools of questions
for the proficiency examinations. More specifically, we believe it will
take 360 hours of work of a Federal Salary Classification GS-14 Step 1
employee located in Washington, DC to develop the proficiency
examination, 80 hours of work by the same employee to develop the
standard operation procedures and the actual application, and 33 hours
to score all the exams and handle related administrative tasks.
We also anticipate that there would be costs associated with
reviewing applications under the proposed temporary certification
program. We believe that a GS-15 Step 1 employee would review the
applications and the National Coordinator (or designated
representative) would issue final decisions on all applications. We
anticipate that it would take approximately 40 hours to review and
reach a final decision on each application. This estimate assumes a
satisfactory application (i.e., no formal deficiency notifications) and
includes the time necessary to verify the information in each
application, assess the results of the proficiency examination, and
prepare a briefing for the National Coordinator. We estimate the cost
for the application review process to be $10,140.
As a result, we estimate the Federal government's overall cost of
administering the entire application process, for the length of the
temporary certification program, at approximately $43,219. Based on our
projection that the temporary certification program will last
approximately two years and that one or two applicants may choose to
apply in the second year, the annualized cost to the Federal government
for administering the entire application process would be $21,610.
As previously noted, we will also post the names of applicants
granted ONC-ATCB status on our Web site. We believe that there would be
minimal cost associated with this action and have calculated the
potential cost to be approximately $156 on an annual basis for posting
and maintaining the information on our Web site (a maximum of 3 hours
of work for a Federal Salary Classification GS-12 Step 1 employee
located in Washington, DC).
b. Temporary Certification Program: Testing and Certification of
Complete EHRs and EHR Modules
Section 3001(c)(5)(A) of the PHSA indicates that certification is a
voluntary act; however, due to the fact that the Medicare and Medicaid
EHR Incentive Programs require eligible professionals and eligible
hospitals to use Certified EHR Technology in order to qualify for
incentive payments, we anticipate that a significant portion of
Complete EHR and EHR Module developers will seek to have their HIT
tested and certified.
In table 3 below, we estimate the costs for Complete EHRs and EHR
Modules to be tested and certified under the temporary certification
program. As discussed in the HIT Standards and Certification Criteria
interim final rule, and to remain consistent with our previous
estimates (75 FR 2039), we believe that approximately 93 commercially-
developed and open source Complete EHRs and 50 EHR Modules will be
tested and certified under our proposed temporary certification
program. In addition to these costs, we also take into account what we
believe will be the costs incurred by a small percentage of eligible
professionals and eligible hospitals who themselves will incur the
costs associated with the testing and certification of their self-
developed Complete EHR or EHR Module.
With respect to the potential for eligible professionals to seek
testing and certification for a self-developed Complete EHR or EHR
Module, DesRoches approximates that only 5% of physicians are in large
practices of over 50 doctors.\3\ Of these large practices, 17% use an
``advanced EHR system'' that could potentially be tested and certified
if it were self-developed (we assume that smaller physician practices
do not have the resources to self-develop a Complete EHR or EHR
Module). We are unaware of any reliable data on the number of large
physicians groups who may have a self-developed Complete EHR or EHR
Module for which they would seek to be tested and certified. As a
result, we request public comment on what this percentage may be and
offer the following estimate based on currently available data. We
believe that the total number of eligible professionals in larger
practices who both possess and would seek to have a self-developed
Complete EHR or EHR Module tested and certified will be low--no more
than 10%. By taking CMS's estimate of approximately 450,000 eligible
professionals (75 FR 1960) we multiply through by the numbers above
(450,000 x .05 x .17 x .10) and then divide by a practice size of at
least 50 which yields approximately 8 self-developed Complete EHRs or
EHR Modules designed for an ambulatory setting that could be submitted
for testing and certification.
---------------------------------------------------------------------------
\3\ DesRoches, CM et al. Electronic Health Records in Ambulatory
Care--A National Survey of Physicians New England Journal of
Medicine July 2008; 359:50-60.
---------------------------------------------------------------------------
With respect to eligible hospitals, similar to eligible
professionals, we believe that only large eligible hospitals would be
in a position to have self-developed a Complete EHR or EHR Module and
seek to have it tested and certified. Again, we are unaware of any
reliable data on the number of eligible hospitals who may have a self-
developed Complete EHR or EHR Module for which they would seek to be
tested and certified. As a result, we request public comment on what
this percentage may be and offer the following estimate based on
currently available data. We estimate that 10% of large eligible
hospitals have a self-developed Complete EHR or EHR Module and that all
of theses hospitals would seek to have it tested and certified.
Extrapolating from the AHA survey data on hospital adoption described
by Jha et al. in the New England Journal of Medicine, there would be
only about 300 large hospitals with advanced systems and, as a result,
we believe approximately 30 that would be in a position to seek to have
a self-developed Complete EHR or EHR Module tested and certified.\4\
---------------------------------------------------------------------------
\4\ Jha, AK et al. Use of Electronic Health Records in U.S.
Hospitals. New England Journal of Medicine March 2009; 360:1628-38.
---------------------------------------------------------------------------
We believe that our estimates for eligible professionals and
eligible hospitals are generous and that a good portion of the eligible
professionals and eligible hospitals who would likely seek to qualify
for incentive payments with self-developed Complete EHRs or EHR Modules
would only do so for meaningful use Stage 1. After meaningful use Stage
1 we anticipate that the number of eligible professionals and eligible
hospitals who would incur the costs of testing and certification
themselves will go down because the effort involved to maintain a
Complete EHR or EHR Module may be time and cost prohibitive as the
Secretary continues to adopt additional certification criteria to
support future stages of meaningful use.
Due to the fact that an ONC-ATCB will be responsible for testing
and certifying Complete EHRs and/or EHR Modules, we have combined the
costs
[[Page 11358]]
for testing and certification because we believe they would be
difficult to independently estimate. Our cost range for the testing and
certification of Complete EHRs and EHR Modules includes consideration
of how the testing and certification will be conducted (i.e., by remote
testing and certification, on-site testing and certification, or at the
ONC-ATCB and for the complexity of an EHR Module). To illustrate, we
assume that the on-site testing and certification of a Complete EHR and
the testing and certification of a complex EHR Module would both be at
the high end of their respective cost estimates (i.e., $50,000 and
$35,000).
On July 14, 2009, CCHIT testified in front of the HIT Policy
Committee on the topic of EHR certification, including the
certification of EHR Modules. CCHIT estimated that ``EHR-
comprehensive'' (Complete EHRs) testing and certification would range
from approximately $30,000 to $50,000. CCHIT also estimated that the
testing and certification of EHR Modules would range from approximately
$5,000 to $35,000 depending on the scope of the testing and
certification. We believe that these estimates provide a reasonable
foundation and have used them for our cost estimates. However, we
assume that competition in the testing and certification market will
reduce the costs of testing and certification as estimated by CCHIT but
we are unable to provide a reliable estimate at this time of what the
potential reduction in costs might be. Please also note, that because
we have limited data on the number of self-developed Complete EHRs and
EHR Modules that will be presented for testing and certification, we
cannot accurately separate the costs for the testing and certification
of self-developed Complete EHRs from self-developed EHR Modules. As a
result, we have estimated the lowest possible cost by assuming that all
of the estimated self-developed HIT that will be presented for testing
and certification will be EHR Modules and that they would be tested and
certified at the lowest estimated cost ($5,000 each) and then we
estimated the highest possible cost by assuming that all of the
estimated self-developed HIT that will be presented for testing and
certification will be Complete EHRs and that they would be tested and
certified at the highest estimated cost ($50,000 each). Our cost
estimates are expressed in Table 3 below.
Table 3--Temporary Certification Program: Estimated Costs for Testing and Certification
--------------------------------------------------------------------------------------------------------------------------------------------------------
Cost per complete EHR/EHR module ($M) Total cost for all complete EHRs/EHR
Number ------------------------------------------ modules over 3-year period ($M)
Type tested and --------------------------------------
certified Low High Mid-point Low High Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Commercial/Open Source Complete EHR....................... 93 $0.03 $0.05 $0.04 $2.79 $4.65 $3.72
Commercial/Open Source EHR Module......................... 50 0.005 0.035 0.02 0.25 1.75 1
Self-Developed Complete EHRs and EHR Modules.............. 38 0.005 0.05 0.028 0.19 1.90 1.06
---------------------------------------------------------------------------------------------
Total................................................. 181 ............ ............ ............ 3.23 8.30 5.78
--------------------------------------------------------------------------------------------------------------------------------------------------------
Our estimates cover anticipated testing and certification costs
under the temporary certification program from 2010 through some
portion of 2012 as we expect the permanent certification program to be
operational by 2012. However, because we cannot predict the exact date
at which the temporary certification program will sunset (and the date
at which ONC-ATCBs will finish any remaining tests and certifications
in their queue), we believe that it is appropriate to attribute all
2012 costs for testing and certification to both the temporary
certification program and the permanent certification program to err on
the side of overestimating rather than underestimating the costs of our
proposals. Therefore, we also attribute the 2012 testing and
certification costs associated with certification criteria adopted by
the Secretary to support meaningful use Stage 1 in section C.2 below.
Consistent with our estimates in the HIT Standards and
Certification Criteria interim final rule (75 FR 2041) about when
Complete EHRs and EHR Modules will be prepared for testing and
certification to the certification criteria adopted by the Secretary
for meaningful use Stage 1, we anticipate that they will be tested and
certified in the same proportions. Therefore, we believe that of the
total number of Complete EHRs and EHR Modules that we have estimated
(commercial, open source, and self-developed), 45% will be tested and
certified in 2010, 40% will be tested and certified in 2011, and 15%
will be tested and certified in 2012. Table 4 below represents this
proportional distribution of the estimated costs we calculated for the
testing and certification of Complete EHRs and EHR Modules to the
certification criteria adopted to support meaningful use Stage 1 under
the temporary certification program as expressed in Table 3 above.
Table 4--Distributed Total Costs for the Testing and Certification of Complete EHRs and EHR Modules to Stage 1
MU by Year (3-Year Period)--Totals Rounded
----------------------------------------------------------------------------------------------------------------
Total high Total average
Year Ratio Total low cost cost estimate cost estimate
(percent) estimate ($M) ($M) ($M)
----------------------------------------------------------------------------------------------------------------
2010............................................ 45 $1.45 $3.74 $2.60
2011............................................ 40 1.29 3.32 2.31
2012............................................ 15 0.49 1.24 0.87
---------------------------------------------------------------
3-Year Totals............................... .............. 3.23 8.30 5.78
----------------------------------------------------------------------------------------------------------------
[[Page 11359]]
2. Permanent Certification Program Estimated Costs
a. Request for ONC-AA Status
i. Cost of Submission for Requesting ONC-AA Status
As noted in the collection of information section, we believe that
only two accreditation organizations will prepare and submit the
information sought by the National Coordinator. Additionally, as noted
in the collection of information section, we estimate that it will take
1 hour to prepare and submit a request for ONC-AA status. We believe
that an employee equivalent to the Federal Salary Classification of GS-
15 Step 1 would be responsible for preparing and submitting the
required information.
We have utilized the corresponding employee hourly rate for the
locality pay area of Washington, DC, as published by the OPM, to
calculate our cost estimates. We have also calculated the costs of an
employee's benefits while preparing and submitting the required ONC-AA
documentation. We have calculated these costs by assuming that an
accreditation organization expends thirty-six percent (36%) of an
employee's hourly wage on benefits for the employee. We have concluded
that a 36% expenditure on benefits is an appropriate estimate because
it is the routine percentage used by HHS for contract cost estimates.
Our cost estimates are expressed in the Table 5 below.
Table 5--Permanent Certification Program: Cost to Accreditation Organizations To Submit the Information Required
to Become an ONC-AA
----------------------------------------------------------------------------------------------------------------
Total cost
Proposed requirement Employee Burden hours Hourly wage Cost of employee per
equivalent rate benefits per hour applicant
----------------------------------------------------------------------------------------------------------------
Submission of Request for ONC- GS-15 Step 1...... 1 $59.30 $21.35 $80.65
AA Status.
----------------------------------------------------------------------------------------------------------------
Using our estimates above, we believe that the cost to submit the
information required to become an ONC-AA will be $81 and the total cost
for the two accreditation organizations that we estimate will submit
requests for ONC-AA status will be $161. Based on our estimate of two
accreditation organizations submitting the required documentation to be
considered for ONC-AA status and on our proposal that we would seek to
select an ONC-AA every three years, we estimate the annualized cost of
this process to be $54. We welcome comments on our estimates for the
number of accreditation organizations that will request ONC-AA status
and our cost estimates.
ii. Cost to the Federal Government
We anticipate that there will be costs associated with reviewing
the information provided by accreditation organizations requesting to
become an ONC-AA under the proposed permanent certification program. We
believe that a GS-15 Step 1 employee would review the submissions and
the National Coordinator (or designated representative) would issue
final decisions on all submissions. We anticipate that it would take 10
hours to review and reach a final decision on each submission. This
estimate assumes a satisfactory submission (i.e., no formal deficiency
notifications) and includes the time necessary to verify the
information in each submission and prepare a briefing for the National
Coordinator. We estimate the Federal government's overall cost to
review the submissions and select an ONC-AA to be $1,732. Based on our
estimate of two accreditation organizations submitting the required
documentation to be considered for ONC-AA status and on our proposal
that we would seek to select an ONC-AA every three years, the
annualized cost to the Federal government for reviewing the submissions
for ONC-AA status would be $577. If we notify the public of the
selection of the ONC-AA by posting the information on our Web site or
by issuing a press release, we believe that we would incur negligible
costs from these actions.
b. Application Process for ONC-ACB Status and Renewal
i. Applicant Costs and ONC-ACB Renewal Costs
Similar to the temporary certification program, we propose that an
applicant for ONC-ACB status would be required to submit an
application. However, unlike the temporary certification program, we
have proposed that applicants for ONC-ACB status must be accredited in
order to be a qualified ONC-ACB applicant. We estimate that there will
be 6 applicants for ONC-ACB status under the permanent certification
program and that those 6 applicants will first seek and become
accredited by an ONC-AA. Because accreditation would include a
demonstration of conformance to Guide 65 for all organizations that
seek to be accredited, we do not believe that there will be a
difference in the cost of accreditation for organizations who seek to
become ONC-ACBs for EHR Modules versus ONC-ACBs for Complete EHRs.
Based on our consultations with NIST, we estimate that it would
take approximately 2 to 5 days for an ONC-AA to complete the
accreditation process at a cost of $20,000. This cost includes an
estimated $5,000 administrative fee and an estimated $15,000 fee for
the accreditation assessment. We expect that the accreditation renewal
process will occur once between 2012 and 2016 for each ONC-ACB and
assume that the accreditation renewal process will be less onerous than
the initial accreditation process because the ONC-ACB would presumably
apply to the same ONC-AA and that the ONC-AA would rely on prior
information and not conduct a completely new review of an ONC-ACB. We
believe this is a reasonable assumption because the ONC-AA will likely
already be familiar with the ONC-ACB and have its documentation on file
and we do not expect that the ONC-ACB would make such drastic changes
to its policies or procedures which would necessitate a lengthy
assessment of their competency by an ONC-AA. Accordingly, we estimate
that accreditation renewal would take no more than 3 days and would
cost no more than $10,000. These estimated costs are expressed in Table
7 below.
After becoming accredited by an ONC-AA, an applicant for ONC-ACB
status would incur minimal costs to prepare and submit an application
to the National Coordinator. As noted in the collection of information
section, we believe that it will take 10 minutes to provide the general
information requested in the application, 30 minutes to assemble the
information necessary to provide documentation of accreditation by an
ONC-AA, and 20 minutes to
[[Page 11360]]
review and agree to the ``Principles of Proper Conduct for ONC-ACBs.''
Based on our consultations with NIST, we believe that an employee
equivalent to the Federal Salary Classification of GS-9 Step 1 could
provide the required general identifying information and documentation
of accreditation status. We believe that an employee equivalent to the
Federal Salary Classification of GS-15 Step 1 would be responsible for
reviewing and agreeing to the ``Principles of Proper Conduct for ONC-
ACBs.'' We have taken these employee assumptions and utilized the
corresponding employee hourly rates for the locality pay area of
Washington, DC, as published by the OPM, to calculate our cost
estimates. We have also calculated the costs of an employee's benefits
while completing the application. We have calculated these costs by
assuming that an applicant expends thirty-six percent (36%) of an
employee's hourly wage on benefits for the employee. We have concluded
that a 36% expenditure on benefits is an appropriate estimate because
it is the routine percentage used by HHS for contract cost estimates.
Our cost estimates are expressed in Table 6 below.
Table 6--Permanent Certification Program: Cost To Applicants To Apply to Become ONC-ACBs and Cost for ONC-ACBs
To Apply for Status Renewal
----------------------------------------------------------------------------------------------------------------
Cost of
Burden Employee employee Cost per
Proposed requirement Emloyee equivalent hours hourly wage benefits per applicant
rate hour
----------------------------------------------------------------------------------------------------------------
General Identifying Information... GS-9 Step 1.......... 10/60 $22.39 $8.06 $5.07
Documentation of Accreditation.... GS-9 Step 1.......... 30/60 22.39 8.06 15.23
Principles of Proper Conduct...... GS-15 Step 1......... 20/60 59.30 21.35 26.89
-----------------------------------------------------------------------------
Total Cost Per Applicant...... ..................... ........... ........... .............. 47.19
----------------------------------------------------------------------------------------------------------------
We have estimated the applicant costs and ONC-ACB renewal costs
through 2016, but no further, because we believe that it is premature
to assume how the meaningful use requirements post-Stage 3 will change
after the downward payment adjustments for eligible professionals and
eligible hospitals become effective (e.g., the incentive payment
adjustments specified at section 1848(a)(7) of the SSA for eligible
professionals) and what impact, if any, those potential changes will
have on the permanent certification program. Using our estimates above,
we believe that the average initial cost for an applicant to become
accredited and apply to be an ONC-ACB will be approximately $20,047 and
the total cost for all 6 applicants will be approximately $120,283. We
estimate that between 2012 and 2016 that all applicants will renew
their ONC-ACB status twice and their accreditation once. We assume that
the costs for an ONC-ACB to renew its status with the National
Coordinator will be similar in burden to its initial application.
Furthermore, we believe that the average cost for an ONC-ACB to renew
its accreditation and to apply for renewal of its ONC-ACB status twice
would be approximately $10,094 and the total renewal costs for all ONC-
ACBs will be approximately $60,566. We estimate that the total costs of
the accreditation, application and renewal processes under the proposed
permanent certification program between 2012 and 2016 would be
approximately $30,142 per applicant/ONC-ACB and approximately $180,849
for all applicants/ONC-ACBs. Based on our cost estimate timeframe of 5
years (2012 through 2016), the annualized cost would be $36,170.
Table 7--Permanent Certification Program: Total Costs of Certification Accreditation, Applying for ONC Certification Authorization, and Accreditation
and Authorization Renewal Between 2012 and 2016
--------------------------------------------------------------------------------------------------------------------------------------------------------
Cost to apply Cost to
Cost of for Cost to renew renew ONC- Total cost
Anticipated number of applicants accreditation certification accreditation ACB status estimate per
per applicant authorization per applicant twice applicant/ONC-
per applicant ACB
--------------------------------------------------------------------------------------------------------------------------------------------------------
6.................................................................. $20,000 $47.19 $10,000 $94.38 $30,141.57
------------------------------------------------------------------------------------
Total Cost of Accreditation, Application and Renewal........... ................ ................ ................ ........... 180,849.42
--------------------------------------------------------------------------------------------------------------------------------------------------------
We invite comments on the number of entities that will seek to
become accredited for certification under our proposed permanent
certification program and the costs associated with accreditation,
applying for ONC-ACB status, the renewal costs for both, and the
timeframe we used for estimating costs.
ii. Costs to the Federal Government
We estimate the cost to develop the ONC-ACB application to be $350
based on the 5 hours of work we believe it would take a Federal Salary
Classification GS-14 Step 1 employee located in Washington, DC to
develop the application form. We also anticipate that there would be
costs associated with reviewing applications under the proposed
permanent certification program. We believe that a GS-15 Step 1
employee would review the applications and the National Coordinator (or
designated representative) would issue final decisions on all
applications. We anticipate that it would take approximately 20 hours
to review and reach a final decision on each application. This estimate
assumes a satisfactory application (i.e., no formal deficiency
notifications) and includes the time necessary to verify the
information in each application and prepare a briefing for the National
Coordinator. We estimate the cost for the application review process to
be $10,392. As a result, we estimate the
[[Page 11361]]
Federal government's overall cost of administering the entire
application process at approximately $10,742. Based on our cost
estimate timeframe of 5 years (2012 through 2016), the annualized cost
to the Federal government would be $2,148.
As previously noted, we would also post the names of applicants
granted ONC-ACB status on our Web site. We believe that there would be
minimal cost associated with this action and have calculated the
potential cost to be approximately $312 on an annual basis for posting
and maintaining the information on our Web site (a maximum of 6 hours
of work for a Federal Salary Classification GS-12 Step 1 employee
located in Washington, DC).
c. Permanent Certification Program: Testing and Certification of
Complete EHRs and EHR Modules
As with the temporary certification program, we estimate below the
costs that Complete EHR and EHR Module developers (commercial, open
source, self-developed) will incur to have their HIT tested and
certified between 2012 and 2016. As previously stated in our discussion
of the appropriate timeframe for estimating costs for the ONC-ACB
application process, we estimate costs through 2016, but no further,
because we believe that it is premature to assume how the meaningful
use requirements post-Stage 3 will change after the Medicare downward
payment adjustments become effective. Although CMS has proposed to
promulgate updates to the meaningful use stages every 2 years, we
assume that there could be more time between stages (i.e., greater than
2 years) in years post-meaningful use Stage 3 based evaluations of
earlier meaningful use stages, public feedback, and other factors,
which would affect when Complete EHRs and/or EHR Modules would need to
be recertified. However, we do expect meaningful use requirements
between 2012 and 2016, which would encompass both Stage 2 and Stage 3
requirements to become more demanding and iterate every 2 years.
Therefore, we can safely assume that Complete EHRs and EHR Modules will
need to be tested and certified twice during this time period.
Even though under the permanent certification program the costs for
testing and certification could presumably be attributed to different
entities (i.e., testing costs to a NVLAP-accredited testing laboratory
and certification costs to an ONC-ACB) we have included them together
in an effort to reflect the overall effect of this rulemaking. As
previously mentioned, we cannot predict a specific date for when the
temporary certification program will sunset, and thus when ONC-ATCBs
will finish testing and certifying Complete EHRs and/or EHR Modules in
their queue. Therefore, as similarly calculated for the temporary
certification program costs, we have estimated and attributed to the
permanent certification program's costs the 2012 cost for testing and
certifying 15% of the prior number of Complete EHRs and EHR Modules to
associated meaningful use Stage 1 certification criteria. We have done
this to account for the possibility that the ONC-ACBs could be
authorized as soon as late 2011 and thus all testing and certification
for 2012 would take place solely under the auspices of the permanent
certification program. This 15% 2012 cost for testing and certification
is represented by 15% of the number of each type of Complete EHR and
EHR Module we previously estimated would be tested and certified to
Meaningful Use Stage 1 multiplied by the appropriate estimated costs
for testing and certification. These cost estimates are expressed in
Table 8 below.
Table 8--Permanent Certification Program: Estimated 2012 Costs for Testing & Certification Associated With Meaningful Use Stage 1
--------------------------------------------------------------------------------------------------------------------------------------------------------
Cost per complete EHR/EHR module ($M) Total cost for all complete EHRs/EHR
Number ------------------------------------------ modules over 3-year period ($M)
Type tested and ----------------------------------------
certified Low High Mid-point Low High Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Commercial/Open Source Complete EHR..................... 14 $0.03 $0.05 $0.04 $0.42 $0.70 $0.56
Commercial/Open Source EHR Module....................... 5 0.005 0.035 0.02 0.025 0.18 0.1
Self-Developed Complete EHRs and EHR Modules............ 7 0.005 0.05 0.028 0.035 0.35 0.2
-----------------------------------------------------------------------------------------------
Total............................................... 26 ............ ............ ............ 0.48 1.23 0.86
--------------------------------------------------------------------------------------------------------------------------------------------------------
In creating Tables 9A and 9B below, we make the following
assumptions:
The cost for testing and certification will remain the
same in the permanent certification program as they were in the
temporary certification program even with the additional requirement of
surveillance on the part of ONC-ACBs (which we would expect to be
included in the cost they charge Complete EHR and/or EHR Module
developers). We believe this is a reasonable assumption because of the
low and high ranges we have estimated.
That testing and certification costs will be unevenly
distributed across subsequent years. We assume that there will be an
increase in the year preceding the next stage of meaningful use and a
decline between stages. We base this assumption on the proposal CMS has
made to make the reporting period for meaningful use stages as long as
a full year which would consequently require that eligible
professionals and eligible hospitals have HIT that meets the definition
of Certified EHR Technology prior to the start of their next reporting
period in order to complete a full year reporting period with Certified
EHR Technology. We assumed the ratios discussed in the temporary
certification program because the impetus for an increase to occur is
not same for meaningful use Stage 1 as it will be for later meaningful
use stages. We assumed a curve that was relatively flat for 2010 and
2011 which subsequently tapered down in 2012 because of the flexibility
provided by the proposed reporting period for meaningful use Stage 1 (3
to 6 months). This shorter reporting period makes it possible for an
eligible professional or eligible hospital to adopt Certified EHR
Technology during the first half of their first meaningful use Stage 1
reporting year and still receive an incentive payment if they satisfy
the reporting requirements. With respect to the peak years for when
testing and certification costs would
[[Page 11362]]
most likely occur, we assume that those peak years will be 2012 and
2014, the years preceding meaningful use Stages 2 and 3, respectively.
We assume that an increase would encompass 85% of the Complete EHRs and
EHR Modules to be certified, which would represent most, if not all,
previously certified Complete EHRs and EHR Modules and that the
remaining 15% of testing and certification costs for 2013 would likely
represent new EHR Module entrants to the HIT marketplace and Complete
EHR or EHR Module developers who were late to get certified.
As indicated in the HIT Standards and Certification
Criteria interim final rule, we assume that Complete EHR developers
would continue to consolidate due to mergers and acquisitions and that
this consolidation would occur at a rate of 5% between meaningful use
stages. Therefore, we believe that fewer Complete EHRs will need to be
tested and certified prior to each meaningful use stage.
Conversely, we assume that the number of EHR Modules
developed that would need to be tested and certified to meet associated
meaningful use Stage 2 (2013) certification criteria and beyond will
grow at a rate of 20% between meaningful use stages (i.e., based on our
prior estimate of 50 EHR Modules between 2010 and 2012, there would be
10 new modules developed during 2012 and during meaningful use Stage 2
to meet certification criteria associated with meaningful use Stage 2).
We believe our growth rate is reasonable because the cost barrier for
EHR Modules to enter the market would be much less than a Complete EHR.
Coupled with the ability of small or start-up HIT developers to enter
the market we believe that the potential of EHR Modules would lead to a
constant stream of new entrants year after year.
The number of eligible professionals and eligible
hospitals that incur the testing and certification costs for their
self-developed Complete EHRs and/or EHR Modules for meaningful use
Stage 2 will drop by 50% in 2012 and another 25% in 2014 and level out
after 2014 due to our assumption, that by 2014, and the impending start
of meaningful use Stage 3, that all of the eligible professionals and
eligible hospitals who still have a self-developed Complete EHR or EHR
Module are likely to maintain their HIT rather than switch to a
commercial product.
Table 9A illustrates the overall costs for testing and
certification associated with meaningful use Stage 2. We have factored
in the assumed 5% reduction in the number of Complete EHRs and 20%
increase in EHR Modules presented for testing and certification to meet
the certification criteria associated with meaningful use Stage 2. That
is, we believe there will be approximately 88 unique Complete EHRs and
60 EHR Modules that will be tested and certified. We also separately
factor in the 50% reduction to the number of self-developed Complete
EHRs and EHR Modules that will be tested and certified to meet the
certification criteria associated with meaningful use Stage 2.
Table 9A--Permanent Certification Program: Estimated Overall Costs for Testing & Certification Associated With Meaningful Use Stage 2
--------------------------------------------------------------------------------------------------------------------------------------------------------
Cost per complete EHR/EHR module ($M) Total cost for all complete EHRs/EHR
Number ------------------------------------------ modules over 3-year period ($M)
Type tested and ----------------------------------------
certified Low High Mid-point Low High Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Commercial/Open Source Complete EHR..................... 88 $0.03 $0.05 $0.04 $2.64 $4.40 $3.52
Commercial/Open Source EHR Module....................... 60 0.005 0.035 0.02 0.30 2.10 1.2
Self-Developed Complete EHRs and EHR Modules............ 19 0.005 0.05 0.028 0.095 0.95 0.53
-----------------------------------------------------------------------------------------------
Total............................................... 167 ............ ............ ............ 3.04 7.45 5.25
--------------------------------------------------------------------------------------------------------------------------------------------------------
Table 9B illustrates the overall costs for testing and
certification associated with meaningful use Stage 3. We have again
factored in the assumed 5% reduction in the number of Complete EHRs and
20% increase in EHR Modules presented for testing and certification to
meet the certification criteria associated with meaningful use Stage 3.
That is, we believe there will be approximately 84 unique Complete EHRs
and 72 EHR Modules that will be tested and certified. We also
separately factor in the 25% reduction to the number of self-developed
Complete EHRs and EHR Modules that will be tested and certified to meet
the certification criteria associated with meaningful use Stage 3.
Table 9B--Permanent Certification Program: Estimated Overall Costs for Testing & Certification Associated With Meaningful Use Stage 3
--------------------------------------------------------------------------------------------------------------------------------------------------------
Cost per complete EHR/EHR module ($M) Total cost for all complete EHRs/EHR
Number ------------------------------------------ modules over 3-year period ($M)
Type tested and --------------------------------------
certified Low High Mid-point Low High Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Commercial/Open Source Complete EHR....................... 84 $0.03 $0.05 $0.04 $2.52 $4.20 $3.36
Commercial/Open Source EHR Module......................... 72 0.005 0.035 0.02 0.36 2.52 1.44
Self-Developed Complete EHRs and EHR Modules.............. 14 0.005 0.05 0.028 0.07 0.70 0.39
---------------------------------------------------------------------------------------------
Total................................................. 170 ............ ............ ............ 2.95 7.42 5.19
--------------------------------------------------------------------------------------------------------------------------------------------------------
[[Page 11363]]
Finally, Table 9C illustrates the 85% and 15% testing and
certification cost distributions we estimate would be attributable to
meaningful use Stages 2 and 3 (i.e., between 2012 and 2016) under the
permanent certification program. Additionally, we assume that 100% of
self-developed Complete EHRs and EHR Modules would be certified in year
that precedes the next meaningful use stage (i.e., 2012 and 2014)
because eligible professionals and eligible hospitals who remain self-
developers will be motivated to ensure that their HIT can meet the
definition of Certified EHR Technology prior to the beginning of a new
meaningful use stage in order to avoid missing out on the incentives or
being subject to downward payment adjustments. As a result, the costs
for self-developers to get their Complete EHRs or EHR Modules are only
attributed in Table 9C to the years 2012 and 2014. The totals
multiplied by their respective percentages are derived from Tables 9A
and 9B above.
Table 9C--Permanent Certification Program: Estimated Overall Costs for Testing & Certification Associated With Meaningful Use Stages 2 and 3 Accounting
for Distributed Costs
--------------------------------------------------------------------------------------------------------------------------------------------------------
Meaningful use stage Year(s) Percentage Type Low ($M) High ($M) Mid-point ($M)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Stage 2............................... 2012 85 Complete EHRs/EHR Modules....... $2.50 $5.53 $4.01
-------------------------------------------------------------------------------------------------
100 Self-Developed.................. 0.095 0.95 0.53
-----------------------------------------------------------------------------------------------------------------
2013/2014 15 Complete EHRs/EHR Modules....... 0.44 0.98 0.71
-------------------------------------------------------------------------------------------------
0 Self-Developed.................. 0 0 0
--------------------------------------------------------------------------------------------------------------------------------------------------------
Stage 3............................... 2014 85 Complete EHRs/EHR Modules....... 2.45 5.71 4.08
-------------------------------------------------------------------------------------------------
100 Self-Developed.................. 0.07 0.70 0.39
-----------------------------------------------------------------------------------------------------------------
2015/2016 15 Complete EHRs/EHR Modules....... 0.43 1.01 0.72
-------------------------------------------------------------------------------------------------
0 Self-Developed.................. 0 0 0
--------------------------------------------------------------------------------------------------------------------------------------------------------
3. Costs for Collecting, Storing, and Reporting Certification Results
Under the Temporary and Permanent Certification Programs
a. Costs to ONC-ATCBs and ONC-ACBs
Under both of the proposed certification programs we propose to
require ONC-ATCBs and ONC-ACBs to provide ONC, no less frequently than
weekly, an up-to-date list of Complete EHRs and/or EHR Modules that
have been tested and certified which include, at a minimum, the vendor
name (if applicable), the date certified, the product version, the
unique certification number or other specific product identification,
and where applicable, the certification criterion or certification
criteria to which each EHR Module has been tested and certified.
As stated in the collection of information section, we anticipate
requiring the reporting of this information on a weekly basis and that
it will take ONC-ATCBs and ONC-ACBs about an hour to prepare and
electronically transmit the information to ONC each week (i.e.,
respondents will respond 52 times per year).
We believe that an employee equivalent to the Federal
Classification of GS-9 Step 1 could complete the transmissions of the
requested information to ONC under both proposed certification
programs. We have utilized the corresponding employee hourly rate for
the locality pay area of Washington, DC, as published by OPM, to
calculate our cost estimates. We have also calculated the costs of the
employee's benefits while completing the transmissions of the requested
information. We have calculated these costs by assuming that an ONC-
ATCB or ONC-ACB expends thirty-six percent (36%) of an employee's
hourly wage on benefits for the employee. We have concluded that a 36%
expenditure on benefits is an appropriate estimate because it is the
routine percentage used by HHS for contract cost estimates. Our cost
estimates are expressed in Table 10 below.
Table 10--Annual Costs for ONC-ATCBs and ONC-ACBs To Report Certifications to ONC
----------------------------------------------------------------------------------------------------------------
Annual burden Cost of
Employee hours per ONC- Employee employee Total cost per
Proposed program requirement equivalent ATCBs/ONC-ACBs hourly wage benefits per ONC-ATCB/ONC-
rate hour ACB
----------------------------------------------------------------------------------------------------------------
ONC-ATCB Certification Results.. GS-9 Step 1 52 $22.39 $8.06 $1,583.40
ONC-ACB Certification Results... GS-9 Step 1 52 22.39 8.06 1,583.40
----------------------------------------------------------------------------------------------------------------
To estimate the highest possible burden, we assume that all of the
estimated applicants that we anticipate will apply under our proposed
certification programs will become ONC-ATCBs and ONC-ACBs. Therefore,
we estimate the total annual reporting cost under the temporary
certification program to be $4,750 and the total annual reporting cost
under the permanent certification program to be $9,500.
We believe that the proposed requirements for ONC-ATCBs to retain
certification records for the length of the temporary certification
program and for ONC-ACBs to retain certification records for 5 years
under the permanent certification program are in line with common
industry practices and, consequently, would not represent
[[Page 11364]]
additional costs to ONC-ATCBs and ONC-ACBs as a result of this rule.
b. Costs to the Federal Government
As stated previously in this rule, we propose, under both
certification programs, to post a comprehensive list of all Certified
EHR Technology on our Web site. We believe that there would be minimal
cost associated with this action and have calculated the potential
cost, including weekly updates, to be $5,392 on an annualized basis.
This amount is based on 104 hours of yearly work of a Federal Salary
Classification GS-12 Step 1 employee located in Washington, DC.
4. Temporary and Permanent Certification Program Benefits
We believe that several benefits will accrue from the establishment
of both a temporary certification program and permanent certification
program. The temporary certification program would allow for the rapid
influx of Complete EHRs and EHR Modules to be tested and certified at a
sufficient pace for eligible professionals and eligible hospitals to
adopt and implement Certified EHR Technology for meaningful use Stage 1
and thus potentially qualify for incentive payments under the CMS
Medicare and Medicaid EHR Incentive Programs proposed rule. The time
between the temporary certification program and the permanent
certification program will permit the HIT industry the time it needs
for NLVAP-accredited testing laboratories to come forward, for an ONC-
AA to be approved and for additional applicants for ONC-ACB status to
come forward. We believe that the permanent certification program will
provide more opportunities for private sector entities to participate
in the testing and certification of HIT and instill more confidence in
what it means for HIT to be certified because more rigorous and
objective processes will be in place. We further believe that both
programs will meet our overall goals of accelerating health IT adoption
and increasing levels of interoperability. At this time, we cannot
predict how fast all of these savings will occur or their precise
magnitude as they are partly dependent on future final rules for
meaningful use and the subsequent standards and certification criteria
adopted by the Secretary.
D. Regulatory Flexibility Act
The RFA requires agencies to analyze options for regulatory relief
of small businesses if a rule has a significant impact on a substantial
number of small entities. For more information on the Small Business
Administration's (SBA's) size standards, see the SBA's Web site.\5\ For
purposes of the RFA, small entities include small businesses, nonprofit
organizations, and small governmental jurisdictions. When conducting a
RFA we are required to assess the potential effects of our proposed
rule on small entities and to make every effort to minimize the
regulatory burden that might be imposed on small entities. We believe
that the entities that are likely to be directly affected by this
proposed rule are applicants for ONC-ATCB and ONC-ACB status.
Furthermore, we believe that these entities would either be classified
under the North American Industry Classification System (NAICS) codes
541380 (Testing Laboratories) or 541990 (Professional, Scientific and
Technical Services).\6\ As previously mentioned, we believe that there
will be 3 applicants for ONC-ATCB status and 6 applicants for ONC-ACB
status. According to the NAICS codes identified above, this would mean
SBA size standards of $12 million and $7 million in annual receipts,
respectively.\7\ Because this segment of the HIT industry is in a
nascent stage and is comprised of very few entities, we have been
unable to find reliable data from which to determine what realistic
annual receipts would be. However, based on our total estimates for
Complete EHRs and EHR Modules to be tested and certified, we assume
that the annual receipts of any one ONC-ATCB or ONC-ACB could be in the
low millions of dollars. Moreover, it is unclear, whether these
entities may be involved in other testing and certification programs
which would increase their annual receipts and potentially place them
outside the SBA's size standards.
---------------------------------------------------------------------------
\5\ http://sba.gov/idc/groups/public/documents/sba_homepage/serv_sstd_tablepdf.pdf.
\6\ See 13 CFR 121.201.
\7\ The SBA references that annual receipts means ``total
income'' (or in the case of a sole proprietorship, ``gross income'')
plus ``cost of goods sold'' as these terms are defined and reported
on Internal Revenue Service tax return forms. http://www.sba.gov/idc/groups/public/documents/sba_homepage/guide_to_size_standards.pdf.
---------------------------------------------------------------------------
We believe that we have proposed the minimum amount of requirements
necessary to accomplish our policy goals and that no appropriate
regulatory alternatives could be developed to lessen the compliance
burden for applicants for ONC-ATCB and ONC-ACB status as well as ONC-
ATCBs and ONC-ACBs once they have been granted such status by the
National Coordinator. Moreover, we believe that this proposed rule will
create direct positive effects for entities because their attainment of
ONC-ATCB or ONC-ACB status will permit them to test and certify
Complete EHRs and/or EHR Modules. Thus, we expect that their annual
receipts will increase as a result of becoming an ONC-ATCB or ONC-ACB.
Based on our analysis and discussion above, we have examined the
economic implications of this proposed rule and do not believe that it
will have a significant impact on a substantial number of small
entities. The Secretary certifies that this proposed rule will not have
a significant impact on a substantial number of small entities.
E. Executive Order 13132--Federalism
Executive Order 13132 establishes certain requirements that an
agency must meet when it promulgates a proposed rule (and subsequent
final rule) that imposes substantial direct requirement costs on State
and local governments, preempts State law, or otherwise has federalism
implications.
Nothing in this proposed rule imposes substantial direct
requirement costs on State and local governments, preempts State law or
otherwise has federalism implications. We are not aware of any State
laws or regulations that conflict with or are impeded by either of our
proposed certification programs. This proposed rule affords all States
an opportunity to identify any problems that our temporary or permanent
certification programs would create, and to propose constructive
alternatives. We welcome comments from State and local governments.
F. Unfunded Mandates Reform Act of 1995
Title II of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-
4) requires cost-benefit and other analyses before any rulemaking if
the rule includes a ``Federal mandate that may result in the
expenditure by State, local, and Tribal governments, in the aggregate,
or by the private sector, of $100,000,000 or more (adjusted annually
for inflation) in any 1 year.'' The current inflation-adjusted
statutory threshold is approximately $133 million. We have determined
that this proposed rule which encompasses our proposals for both the
temporary and permanent certification programs would not constitute a
significant rule under the Unfunded Mandates Reform Act, because it
would impose no mandates.
OMB reviewed this proposed rule.
List of Subjects in 45 CFR Part 170
Computer technology, Electronic health record, Electronic
information system, Electronic transactions, Health, Health care,
Health information
[[Page 11365]]
technology, Health insurance, Health records, Hospitals, Incorporation
by reference, Laboratories, Medicaid, Medicare, Privacy, Reporting and
recordkeeping requirements, Public health, Security.
For the reasons set forth in the preamble, the Department proposes
to amend 45 CFR subtitle A, subchapter D, part 170, as follows:
PART 170--HEALTH INFORMATION TECHNOLOGY STANDARDS, IMPLEMENTATION
SPECIFICATIONS, AND CERTIFICATION CRITERIA AND CERTIFICATION
PROGRAMS FOR HEALTH INFORMATION TECHNOLOGY
1. The authority citation for part 170 is revised to read as
follows:
Authority: 42 U.S.C 300jj-11; 42 U.S.C 300jj-14; 5 U.S.C. 552.
2. In Sec. 170.102, add in alphabetical order the definition of
``Day or Day(s)'' to read as follows:
Sec. 170.102 Definitions.
* * * * *
Day or Days means a calendar day or calendar days.
* * * * *
3. Add a new subpart D to part 170 to read as follows:
Subpart D--Temporary Certification Program for HIT
Sec.
170.400 Basis and scope.
170.401 Applicability.
170.402 Definitions.
170.405 Correspondence.
170.410 Types of testing and certification.
170.415 Application prerequisite.
170.420 Application.
170.423 Principles of proper conduct for ONC-ATCBs.
170.425 Application submission.
170.430 Review of application.
170.435 ONC-ATCB application reconsideration.
170.440 ONC-ATCB status.
170.445 Complete EHR testing and certification.
170.450 EHR Module testing and certification.
170.455 Testing and certification to newer versions of certain
standards.
170.457 Authorized testing and certification methods.
170.460 Good standing as an ONC-ATCB.
170.465 Revocation of authorized testing and certification body
status.
170.470 Effect of revocation on the certifications issued to
complete EHRs and EHR Modules.
170.490 Sunset of the temporary certification program.
Subpart D--Temporary Certification Program for HIT
Sec. 170.400 Basis and scope.
This subpart implements section 3001(c)(5) of the Public Health
Service Act, and sets forth the rules and procedures related to the
temporary certification program for health information technology
administered by the National Coordinator for Health Information
Technology.
Sec. 170.401 Applicability.
This subpart establishes the processes that applicants for ONC-ATCB
status must follow to be granted ONC-ATCB status by the National
Coordinator, the processes the National Coordinator will follow when
assessing applicants and granting ONC-ATCB status, and the requirements
of ONC-ATCBs for testing and certifying Complete EHRs and/or EHR
Modules in accordance with the applicable certification criteria
adopted by the Secretary in subpart C of this part.
Sec. 170.402 Definitions.
For the purposes of this subpart:
Applicant means a single organization or a consortium of
organizations that seeks to become an ONC-ATCB by requesting and
subsequently submitting an application for ONC-ATCB status to the
National Coordinator.
ONC-ATCB or ONC-Authorized Testing and Certification Body means an
organization or a consortium of organizations that has applied to and
been authorized by the National Coordinator pursuant to this subpart to
perform the testing and certification of Complete EHRs and/or EHR
Modules under the temporary certification program.
Sec. 170.405 Correspondence.
(a) Correspondence and communication with the National Coordinator
shall be conducted by e-mail, unless otherwise necessary. The official
date of receipt of any e-mail between the National Coordinator and an
applicant for ONC-ATCB status or an ONC-ATCB is the day the e-mail was
sent.
(b) In circumstances where it is necessary for an applicant for
ONC-ATCB status to correspond or communicate with the National
Coordinator by regular or express mail, the official date of receipt
will be the date of the delivery confirmation.
Sec. 170.410 Types of testing and certification.
Applicants may seek authorization from the National Coordinator to
perform the following types of testing and certification:
(a) Complete EHR testing and certification; and/or
(b) EHR Module testing and certification.
Sec. 170.415 Application prerequisite.
Applicants must request in writing an application for ONC-ATCB
status from the National Coordinator. Applicants must indicate:
(a) The type of authorization sought pursuant to Sec. 170.410; and
(b) If seeking authorization to perform EHR Module testing and
certification, the specific type(s) of EHR Module(s) they seek
authorization to test and certify. If qualified, applicants will only
be granted authorization to test and certify the types of EHR Modules
for which they seek authorization.
Sec. 170.420 Application.
The application for ONC-ATCB status consists of two parts.
Applicants must complete both parts of the application in their
entirety and submit them to the National Coordinator for the
application to be considered complete.
(a) Part 1. An applicant must provide all of the following:
(1) General identifying information including:
(i) Name, address, city, State, zip code, and Web site of
applicant; and
(ii) Designation of an authorized representative, including name,
title, phone number, and e-mail address of the person who will serve as
the applicant's point of contact.
(2) Documentation of the completion and results of a self-audit
against all sections of ISO/IEC Guide 65:1996, and the following:
(i) A description of the applicant's management structure according
to section 4.2 of ISO/IEC Guide 65:1996;
(ii) A copy of the applicant's quality manual that has been
developed according to section 4.5.3 of ISO/IEC Guide 65:1996;
(iii) A copy of the applicant's policies and approach to
confidentiality according to section 4.10 of ISO/IEC Guide 65:1996;
(iv) A copy of the qualifications of each of the applicant's
personnel who oversee or perform certification according to section 5.2
of ISO/IEC Guide 65:1996;
(v) A copy of the applicant's evaluation reporting procedures
according to section 11 of ISO/IEC Guide 65:1996; and
(vi) A copy of the applicant's policies for use and display of
certificates according to section 14 of ISO/IEC Guide 65:1996.
[[Page 11366]]
(3) Documentation of the completion and results of a self-audit
against all sections of ISO/IEC 17025:2005, and the following:
(i) A copy of the applicant's quality system document according to
section 4.2.2 of ISO/IEC 17025:2005;
(ii) A copy of the applicant's policies and procedures for handling
testing nonconformities according to section 4.9.1 of ISO/IEC
17025:2005; and
(iii) The qualifications of each of the applicant's personnel who
oversee or conduct testing according to section 5.2 of ISO/IEC
17025:2005.
(4) An agreement, properly executed by the applicant's authorized
representative, that it will adhere to the Principles of Proper Conduct
for ONC-ATCBs.
(b) Part 2. An applicant must submit a completed proficiency
examination.
Sec. 170.423 Principles of proper conduct for ONC-ATCBs.
An ONC-ATCB shall:
(a) Operate its certification program in accordance with ISO/IEC
Guide 65:1996 and testing program in accordance with ISO/IEC
17025:2005;
(b) Maintain an effective quality management system which addresses
all requirements of ISO/IEC 17025:2005;
(c) Attend all mandatory ONC training and program update sessions;
(d) Maintain a training program that includes documented procedures
and training requirements to ensure its personnel are competent to test
and certify Complete EHRs and/or EHR Modules;
(e) Use testing tools and procedures published by NIST or
functionally equivalent testing tools and procedures published by
another entity for the purposes of assessing Complete EHRs and/or EHR
Modules compliance with the certification criteria adopted by the
Secretary;
(f) Report to ONC within 15 days any changes that materially affect
its:
(1) Legal, commercial, organizational, or ownership status;
(2) Organization and management, including key testing and
certification personnel;
(3) Policies or procedures;
(4) Location;
(5) Facilities, working environment or other resources;
(6) ONC authorized representative (point of contact); or
(7) Other such matters that may otherwise materially affect its
ability to test and certify Complete EHRs and/or EHR Modules;
(g) Allow ONC, or its authorized agents(s), to periodically observe
on site (unannounced or scheduled) during normal business hours, any
testing and/or certification performed to demonstrate compliance with
the requirements of the temporary certification program;
(h) Provide ONC, no less frequently than weekly, a current list of
Complete EHRs and/or EHR Modules that have been tested and certified
which includes, at a minimum, the vendor name (if applicable), the date
certified, product version, the unique certification number or other
specific product identification, and where applicable, the
certification criterion or certification criteria to which each EHR
Module has been tested and certified;
(i) Retain all records related to the testing and certification of
Complete EHRs and/or EHR Modules for the duration of the temporary
certification program and provide copies of all testing and
certification records to ONC at the sunset of the temporary
certification program; and
(j) Promptly refund any and all fees received for tests and
certifications that will not be completed.
Sec. 170.425 Application submission.
(a) An applicant for ONC-ATCB status must submit its application
either electronically via e-mail (or Web submission if available), or
by regular or express mail.
(b) An application for ONC-ATCB status may be submitted to the
National Coordinator at any time during the existence of the temporary
certification program.
Sec. 170.430 Review of application.
(a) Method of review and review timeframe.
(1) Applications will be reviewed in the order they are received.
(2) The National Coordinator will review Part 1 of the application
and determine whether Part 1 of the application is complete and
satisfactory before proceeding to review Part 2 of the application.
(3) The National Coordinator is permitted up to 30 days to review
an application (submitted for the first time) upon receipt.
(b) Application deficiencies.
(1) If the National Coordinator identifies an area in an
application that requires the applicant to clarify a statement or
correct an inadvertent error or minor omission, the National
Coordinator may contact the applicant to make such clarification or
correction without issuing a deficiency notice. If the National
Coordinator has not received the requested information after five days,
the applicant may be issued a deficiency notice specifying the error,
omission, or deficient statement.
(2) If the National Coordinator determines that deficiencies in
either part of the application exist, the National Coordinator will
issue a deficiency notice to the applicant and return the application.
The deficiency notice will identify the areas of the application that
require additional information or correction.
(c) Revised application.
(1) An applicant is permitted to submit a revised application in
response to a deficiency notice.
(2) In order to continue to be considered for ONC-ATCB status, an
applicant's revised application must address the specified deficiencies
and be received by the National Coordinator within 15 days of the
applicant's receipt of the deficiency notice.
(3) The National Coordinator is permitted up to 15 days to review a
revised application once it has been received.
(4) If the National Coordinator determines that a revised
application still contains deficiencies, the applicant will be issued a
denial notice indicating that the applicant will no longer be
considered for authorization under the temporary certification program.
An applicant may request reconsideration of this decision in accordance
with Sec. 170.435.
(d) Satisfactory application.
(1) An application will be deemed satisfactory if it meets all
application requirements, including a passing score on the proficiency
examination.
(2) The National Coordinator will notify the applicant's authorized
representative of its satisfactory application and its successful
achievement of ONC-ATCB status.
(3) Once notified by the National Coordinator of its successful
achievement of ONC-ATCB status, the applicant may represent itself as
an ONC-ATCB and begin testing and certifying Complete EHRs and/or EHR
Modules consistent with its authorization.
Sec. 170.435 ONC-ATCB application reconsideration.
(a) An applicant may request that the National Coordinator
reconsider a denial notice issued for each part of an application only
if the applicant can demonstrate that clear, factual errors were made
in the review of the applicable part of the application and that the
errors' correction could lead to the applicant obtaining ONC-ATCB
status.
(b) Submission requirement. An applicant is required to submit,
within 15 days of receipt of a denial notice, a written statement to
the National
[[Page 11367]]
Coordinator contesting the decision to deny its application and
explaining with sufficient documentation what factual errors it
believes can account for the denial. If the National Coordinator does
not receive the applicant's submission within the specified timeframe,
its reconsideration request may be rejected.
(c) Reconsideration request review. If the National Coordinator
receives a timely reconsideration request, the National Coordinator is
permitted up to 15 days from the date of receipt to review the
information submitted by the applicant and issue a decision.
(d) Decision.
(1) If the National Coordinator determines that clear, factual
errors were made during the review of the application and that
correction of the errors would remove all identified deficiencies, the
applicant's authorized representative will be notified of the National
Coordinator's decision to reverse the previous decision(s) not to
approve part of the applicant's application or the entire application.
(i) If the National Coordinator's decision to reverse the previous
decision(s) affected part 1 of an application, the National Coordinator
will subsequently review part 2 of the application.
(ii) If the National Coordinator's decision to reverse the previous
decision(s) affected part 2 of an application, the applicant's
authorized representative will be notified of the National
Coordinator's decision as well as the applicant's successful
achievement of ONC-ATCB status.
(2) If, after reviewing an applicant's reconsideration request, the
National Coordinator determines that the applicant did not identify any
factual errors or that correction of those factual errors would not
remove all identified deficiencies in the application, the National
Coordinator may reject the applicant's reconsideration request.
(3) Final decision. A reconsideration decision issued by the
National Coordinator is final and not subject to further review.
Sec. 170.440 ONC-ATCB status.
(a) Acknowledgement and publication. The National Coordinator will
acknowledge and make publicly available the names of ONC-ATCBs,
including the date each was authorized and the type(s) of testing and
certification each has been authorized to perform.
(b) Representation. Each ONC-ATCB must prominently and
unambiguously identify on its Web site and in all marketing and
communications statements (written and oral) the scope of its
authorization.
(c) Renewal. ONC-ATCB status does not need to be renewed during the
temporary certification program.
(d) Expiration. The status of all ONC-ATCBs will expire upon the
sunset of the temporary certification program in accordance with Sec.
170.490.
Sec. 170.445 Complete EHR testing and certification.
(a) To be authorized to test and certify Complete EHRs under the
temporary certification program, an ONC-ATCB must be capable of testing
and certifying Complete EHRs to all applicable certification criteria
adopted by the Secretary at subpart C of this part.
(b) An ONC-ATCB that has been authorized to test and certify
Complete EHRs is also authorized to test and certify all EHR Modules
under the temporary certification program.
Sec. 170.450 EHR module testing and certification.
(a) When testing and certifying EHR Modules, an ONC-ATCB must test
and certify in accordance with the applicable certification criterion
or certification criteria adopted by the Secretary at subpart C of this
part.
(b) EHR Modules are required to be tested and certified to at least
one certification criterion.
(c) Privacy and security testing and certification. EHR Modules
shall be tested and certified to all privacy and security certification
criteria adopted by the Secretary unless the EHR Module(s) is/are
presented for testing and certification in one of the following
manners:
(1) The EHR Module(s) are presented for testing and certification
as a pre-coordinated, integrated ``bundle'' of EHR Modules, which could
otherwise constitute a Complete EHR. In such instances, the EHR
Module(s) shall be tested and certified in the same manner as a
Complete EHR. Pre-coordinated bundles of EHR Module(s) which include
EHR Module(s) that would not be part of a local system and under the
end user's direct control are excluded from this exception. The
constituent EHR Modules of such an integrated bundle must be separately
tested and certified to all privacy and security certification
criteria;
(2) An EHR Module is presented for testing and certification, and
the presenter can demonstrate to the ONC-ATCB that it would be
technically infeasible for the EHR Module to be tested and certified in
accordance with some or all of the privacy and security certification
criteria; or
(3) An EHR Module is presented for testing and certification, and
the presenter can demonstrate to the ONC-ATCB that the EHR Module is
designed to perform a specific privacy and security capability. In such
instances, the EHR Module may only be tested and certified in
accordance with the applicable privacy and security certification
criterion/criteria.
(d) ONC-ATCBs authorized to test and certify EHR Modules must
clearly indicate the certification criterion or certification criteria
to which an EHR Module has been tested and certified in its
certification documentation.
Sec. 170.455 Testing and certification to newer versions of certain
standards.
(a) ONC-ATCBs may test and certify Complete EHRs and EHR Modules to
a newer version of certain identified minimum standards specified at
subpart B of this part if the Secretary has accepted a newer version of
an adopted minimum standard.
(b) Applicability of an accepted new version of an adopted minimum
standard.
(1) ONC-ATCBs are not required to test and certify Complete EHRs
and/or EHR Modules according to newer versions of an adopted minimum
standard accepted by the Secretary until the incorporation by reference
provision of the adopted version is updated in the Federal Register
with a newer version.
(2) Certified EHR Technology may be upgraded to comply with newer
versions of an adopted minimum standard accepted by the Secretary
without adversely affecting the certification status of the Certified
EHR Technology.
Sec. 170.457 Authorized testing and certification methods.
(a) Primary method. An ONC-ATCB must have the capacity to test and
certify Complete EHRs and/or EHR Modules at its facility.
(b) Secondary methods. An ONC-ATCB must also have the capacity to
test and certify Complete EHRs and/or EHR Modules through one of the
following methods:
(1) At the site where the Complete EHR or EHR Module has been
developed; or
(2) At the site where the Complete EHR or EHR Module resides; or
(3) Remotely (i.e., through other means, such as through secure
electronic transmissions and automated Web-based tools, or at a
location other than the ONC-ATCB's facilities).
[[Page 11368]]
Sec. 170.460 Good standing as an ONC-ATCB.
An ONC-ATCB must maintain good standing by:
(a) Adhering to the Principles of Proper Conduct for ONC-ATCBs;
(b) Refraining from engaging in other types of inappropriate
behavior, including an ONC-ATCB misrepresenting the scope of its
authorization as well as an ONC-ATCB testing and certifying Complete
EHRs and/or EHR Modules for which it does not have authorization; and
(c) Following all other applicable Federal and State laws.
Sec. 170.465 Revocation of authorized testing and certification body
status.
(a) Type-1 violations. The National Coordinator may revoke an ONC-
ATCB's status for committing a Type-1 violation. Type-1 violations
include violations of law or temporary certification program policies
that threaten or significantly undermine the integrity of the temporary
certification program. These violations include, but are not limited
to: false, fraudulent, or abusive activities that affect the temporary
certification program, a program administered by HHS or any program
administered by the Federal government.
(b) Type-2 violations. The National Coordinator may revoke an ONC-
ATCB's status for failing to timely or adequately correct a Type-2
violation. Type-2 violations comprise noncompliance with Sec. 170.460.
(1) Noncompliance notification. If the National Coordinator obtains
reliable evidence that an ONC-ATCB may no longer be in compliance with
Sec. 170.460, the National Coordinator will issue a noncompliance
notification with reasons for the notification to the ONC-ATCB
requesting that the ONC-ATCB respond to the alleged violation and
correct the violation, if applicable.
(2) Opportunity to become compliant. After receipt of a
noncompliance notification, an ONC-ATCB is permitted up to 30 days to
submit a written response and accompanying documentation that
demonstrates that no violation occurred or that the alleged violation
has been corrected.
(i) If the ONC-ATCB submits a response, the National Coordinator is
permitted up to 30 days from the time the response is received to
evaluate the response and reach a decision. The National Coordinator
may, if necessary, request additional information from the ONC-ATCB
during this time period.
(ii) If the National Coordinator determines that no violation
occurred or that the violation has been sufficiently corrected, the
National Coordinator will issue a memo to the ONC-ATCB confirming this
determination.
(iii) If the National Coordinator determines that the ONC-ATCB
failed to demonstrate that no violation occurred or to correct the
area(s) of non-compliance identified under paragraph (b)(1) of this
section within 30 days of receipt of the noncompliance notification,
then the National Coordinator may propose to revoke the ONC-ATCB's
status.
(c) Proposed revocation.
(1) The National Coordinator may propose to revoke an ONC-ATCB's
status if the ONC-ATCB has committed a Type-1 violation; or
(2) The National Coordinator may propose to revoke an ONC-ATCB's
status if, after the ONC-ATCB has been notified of a Type-2 violation,
the ONC-ATCB fails to:
(i) To rebut the finding of a violation with sufficient evidence
showing that the violation did not occur or that the violation has been
corrected; or
(ii) Submit to the National Coordinator a written response to the
noncompliance notification within the specified timeframe under
paragraph (b)(2).
(3) ONC-ATCB's operations. An ONC-ATCB may continue its operations
under the temporary certification program during the time periods
provided for an ONC-ATCB to respond to a proposed revocation notice and
the National Coordinator to review an ONC-ATCB's response to a proposed
revocation.
(d) Opportunity to respond to a proposed revocation notice.
(1) An ONC-ATCB may respond to a proposed revocation notice, but
must do so within 10 days of receiving the proposed revocation notice
and include appropriate documentation explaining in writing why its
status should not be revoked.
(2) Upon receipt of an ONC-ATCB's response to a proposed revocation
notice, the National Coordinator is permitted up to 30 days to review
the information submitted by the ONC-ATCB and reach a decision.
(e) Good standing determination. If the National Coordinator
determines that an ONC-ATCB's status should not be revoked, the
National Coordinator will notify the ONC-ATCB's authorized
representative in writing of this determination.
(f) Revocation.
(1) The National Coordinator may revoke an ONC-ATCB's status if:
(i) A determination is made that revocation is appropriate after
considering the information provided by the ONC-ATCB in response to the
proposed revocation notice; or
(ii) The ONC-ATCB does not respond to a proposed revocation notice
within the specified timeframe in paragraph (d)(1) of this section.
(2) A decision to revoke an ONC-ATCB's status is final and not
subject to further review unless the National Coordinator chooses to
reconsider the revocation.
(g) Extent and duration of revocation.
(1) The revocation of an ONC-ATCB is effective as soon as the ONC-
ATCB receives the revocation notice.
(2) A testing and certification body that has had its ONC-ATCB
status revoked is prohibited from accepting new requests for testing
and certification and must cease its current testing and certification
operations under the temporary certification program.
(3) A testing and certification body that has had its ONC-ATCB
status revoked for a Type-1 violation is prohibited from reapplying for
ONC-ATCB status under the temporary certification program for one year.
If the temporary certification program sunsets during this time, the
testing and certification body is prohibited from applying for ONC-ACB
status under the permanent certification program for the time that
remains within the one year prohibition.
(4) The failure of a testing and certification body that has had
its ONC-ATCB status revoked, to promptly refund any and all fees for
tests and/or certifications of Complete EHRs and EHR Modules not
completed will be considered a violation of the Principles of Proper
Conduct for ONC-ATCBs and will be taken into account by the National
Coordinator if the testing and certification body reapplies for ONC-
ATCB status under the temporary certification program or applies for
ONC-ACB status under the permanent certification program.
Sec. 170.470 Effect of revocation on the certifications issued to
complete EHRs and EHR modules.
(a) The certified status of Complete EHRs and/or EHR Modules
certified by an ONC-ATCB that had it status revoked will remain intact
unless a Type-1 violation was committed that calls into question the
legitimacy of the certifications issued by the former ONC-ATCB.
(b) If the National Coordinator determines that a Type-1 violation
occurred that called into question the legitimacy of certifications
conducted by the former ONC-ATCB, then the National Coordinator would:
[[Page 11369]]
(1) Review the facts surrounding the revocation of the ONC-ATCB's
status; and
(2) Publish a notice on ONC's Web site if the National Coordinator
believes that Complete EHRs and/or EHR Modules were improperly
certified by the former ONC-ATCB.
(c) If the National Coordinator determines that Complete EHRs and/
or EHR Modules were improperly certified, the certification status of
affected Complete EHRs and/or EHR Modules would only remain intact for
120 days after the National Coordinator publishes the notice. The
certification status of the Complete EHR and/or EHR Module can only be
maintained thereafter by being re-certified by an ONC-ATCB in good
standing.
Sec. 170.490 Sunset of the temporary certification program.
The temporary certification program will sunset on the date when
the National Coordinator has authorized at least one ONC-ACB under the
permanent certification program. On the date at which this sunset
occurs, ONC-ATCBs under the temporary certification program are
prohibited from accepting new requests to certify Complete EHRs or EHR
Modules. ONC-ATCBs may, however, complete the processing of Complete
EHRs and EHR Modules that are being tested and certified at the time
the sunset occurs.
4. Add a new subpart E to part 170 to read as follows:
Subpart E--Permanent Certification Program for HIT
Sec.
170.500 Basis and scope.
170.501 Applicability.
170.502 Definitions.
170.503 Requests for ONC-AA status and ONC-AA ongoing
responsibilities.
170.504 Reconsideration process for requests for ONC-AA status.
170.505 Correspondence.
170.510 Types of certification.
170.520 Application.
170.523 Principles of proper conduct for ONC-ACBs.
170.525 Application submission.
170.530 Review of application.
170.535 ONC-ACB application reconsideration.
170.540 ONC-ACB status.
170.545 Complete EHR certification.
170.550 EHR module certification.
170.553 Certification for health information technology other than
complete EHRs and EHR modules.
170.555 Certification to newer versions of certain standards.
170.557 Authorized certification methods.
170.560 Good standing as an ONC-ACB.
170.565 Revocation of authorized certification body status.
170.570 Effect of revocation on the certifications issued to
complete EHRs and EHR modules.
Subpart E--Permanent Certification Program for HIT
Sec. 170.500 Basis and scope.
This subpart implements section 3001(c)(5) of the Public Health
Service Act, and sets forth the rules and procedures related to the
permanent certification program for health information technology
administered by the National Coordinator for Health Information
Technology.
Sec. 170.501 Applicability.
This subpart establishes the processes that applicants for ONC-ACB
status must follow to be granted ONC-ACB status by the National
Coordinator, the processes the National Coordinator will follow when
assessing applicants and granting ONC-ACB status, the requirements of
ONC-ACBs for certifying Complete EHRs and/or EHR Modules in accordance
with the applicable certification criteria adopted by the Secretary in
subpart C of this part. It also establishes the processes accreditation
organizations must follow to request approval from the National
Coordinator and that the National Coordinator in turn will follow to
approve an accreditation organization under the permanent certification
program as well as certain ongoing responsibilities for an ONC-AA.
Sec. 170.502 Definitions.
For the purposes of this subpart:
Applicant means a single organization or a consortium of
organizations that seeks to become an ONC-ACB by requesting and
subsequently submitting an application for ONC-ACB status to the
National Coordinator.
ONC-ACB or ONC-Authorized Certification Body means an organization
or a consortium of organizations that has applied to and been
authorized by the National Coordinator pursuant to this subpart to
perform the certification of, at a minimum, Complete EHRs and/or EHR
Modules using the applicable certification criteria adopted by the
Secretary.
ONC-Approved Accreditor or ONC-AA means an accreditation
organization that the National Coordinator has approved to accredit
certification bodies under the permanent certification program.
Sec. 170.503 Requests for ONC-AA status and ONC-AA ongoing
responsibilities.
(a) Only one ONC-Approved Accreditor (ONC-AA) shall be approved by
the National Coordinator at a time.
(b) Submission. In order to become an ONC-AA, an accreditation
organization must submit a request in writing to the National
Coordinator along with the following information to demonstrate its
ability to serve as an ONC-AA:
(1) A detailed description of the accreditation organization's
conformance to ISO/IEC17011:2004 and experience evaluating the
conformance of certification bodies to ISO/IEC Guide 65:1996;
(2) A detailed description of the accreditation organization's
accreditation requirements and how the requirements complement the
Principles of Proper Conduct for ONC-ACBs;
(3) Detailed information on the accreditation organization's
procedures that would be used to monitor ONC-ACBs;
(4) Detailed information, including education and experience, about
the key personnel who review organizations for accreditation; and
(5) Procedures for responding to, and investigating, complaints
against ONC-ACBs.
(c) Approval. The National Coordinator is permitted up to 30 days
to review a request for ONC-AA status from an accreditation
organization upon receipt.
(1) The National Coordinator's determination will be based on the
information provided, the completeness of the accreditation
organizations' descriptions to the elements listed in paragraph (b) of
this section and each accreditation organization's overall
accreditation experience.
(2) The National Coordinator will review requests by accreditation
organizations for ONC-AA status in the order they are received and will
approve the first qualified accreditation organization consistent with
the requirements of paragraph (b).
(d) Reconsideration of a Decision. Any accreditation organization
seeking to become an ONC-AA may appeal a decision to deny its request
in accordance with Sec. 170.504, but only if no other accreditation
organization has been granted ONC-AA status.
(e) ONC-AA Ongoing Responsibilities. An ONC-AA must:
(1) Maintain conformance with ISO/IEC 17011:2004;
(2) In accrediting certification bodies, verify conformance to, at
a minimum, ISO/IEC Guide 65:1996;
[[Page 11370]]
(3) Verify that ONC-ACBs are performing surveillance in accordance
with their respective annual plans; and
(4) Review ONC-ACB surveillance results to determine if the results
indicate any substantive non-conformance with the terms set by the ONC-
AA when it granted the ONC-ACB accreditation.
(f) ONC-AA Status.
(1) An ONC-AA's status will expire not later than 3 years from the
date its status was granted by the National Coordinator.
(2) The National Coordinator will accept requests for ONC-AA status
120 days before the current ONC-AA's status is set to expire.
Sec. 170.504 Reconsideration process for requests for ONC-AA status.
(a) An accreditation organization may ask that the National
Coordinator to reconsider a decision to deny its request for ONC-AA
status only if the accreditation organization can demonstrate that
clear, factual errors were made in the review of its request for ONC-AA
status and that the errors' correction could lead to the accreditation
organization obtaining ONC-AA status.
(b) Submission requirement. An accreditation organization is
required to submit, within 15 days of receipt of a denial notice, a
written statement to the National Coordinator contesting the decision
to deny its request for ONC-AA status and explaining with sufficient
documentation what factual error(s) it believes can account for the
denial. If the National Coordinator does not receive the accreditation
organization's submission within the specified timeframe its request
may be rejected.
(c) Reconsideration request review. If the National Coordinator
receives a timely reconsideration request, the National Coordinator
will be permitted up to 15 days from the date of receipt to review the
information submitted by the accreditation organization and issue a
decision.
(d) Decision.
(1) If the National Coordinator determines that clear, factual
errors were made during the review of the request, that correction of
the errors would remove all identified deficiencies, and that during
this review no other accreditation organization has been granted ONC-AA
status, the accreditation organization will be notified by National
Coordinator that its request for ONC-AA status has been approved.
(2) If, after reviewing an accreditation organization's
reconsideration request, the National Coordinator determines that the
accreditation organization did not identify the factual errors that
were made during the review of its request for ONC-AA status, the
National Coordinator may reject its reconsideration request.
(3) Final Decision. A reconsideration decision issued by the
National Coordinator is final and not subject to further review.
Sec. 170.505 Correspondence.
(a) Correspondence and communication with the National Coordinator
shall be conducted by e-mail, unless otherwise necessary. The official
date of receipt of any e-mail between the National Coordinator and an
applicant for ONC-ACB status or an ONC-ACB is the day the e-mail was
sent.
(b) In circumstances where it is necessary for an applicant for
ONC-ACB status to correspond or communicate with the National
Coordinator by regular or express mail, the official date of receipt
will be the date of the delivery confirmation.
Sec. 170.510 Types of certification.
Applicants may seek authorization from the National Coordinator to
perform the following types of certification:
(a) Complete EHR certification; and/or
(b) EHR Module certification; and/or
(c) Other types of health information technology certification for
which the Secretary has adopted certification criteria under subpart C
of this part.
Sec. 170.520 Application.
Applicants must include the following information in an application
for ONC-ACB status and submit it to the National Coordinator for the
application to be considered complete.
(a) The type of authorization sought pursuant to Sec. 170.510. For
authorization to perform EHR Module certification, applicants must
indicate the specific type(s) of EHR Module(s) they seek authorization
to certify. If qualified, applicants will only be granted authorization
to certify the types of EHR Modules for which they seek authorization.
(b) General identifying information including:
(1) Name, address, city, State, zip code, and Web site of
applicant; and
(2) Designation of an authorized representative, including name,
title, phone number and e-mail address of the person who will serve as
the applicant's point of contact.
(c) Documentation that confirms that the applicant has been
accredited by an ONC-AA.
(d) An agreement, properly executed by the applicant's authorized
representative, that it will adhere to the Principles of Proper Conduct
for ONC-ACBs.
Sec. 170.523 Principles of proper conduct for ONC-ACBs.
An ONC-ACB shall:
(a) Maintain its accreditation;
(b) Attend all mandatory ONC training and program update sessions;
(c) Maintain a training program that includes documented procedures
and training requirements to ensure its personnel are competent to
certify HIT;
(d) Report to ONC within 15 days any changes that materially affect
its:
(1) Legal, commercial, organizational, or ownership status;
(2) Organization and management including key certification
personnel;
(3) Policies or procedures;
(4) Location;
(5) Personnel, facilities, working environment or other resources;
(6) ONC authorized representative (point of contact); or
(7) Other such matters that may otherwise materially affect its
ability to certify HIT.
(e) Allow ONC, or its authorized agents(s), to periodically observe
on site (unannounced or scheduled) any certifications performed to
demonstrate compliance with the requirements of the permanent
certification program;
(f) Provide ONC, no less frequently than weekly, a current list of
Complete EHRs and/or EHR Modules that have been certified, which
includes, at a minimum, the vendor name (if applicable), the date
certified, the product version, the unique certification number or
other specific product identification, and where applicable, the
certification criterion or certification criteria to which each EHR
Module has been certified;
(g) Retain all records related to the certification of Complete
EHRs and/or EHR Modules for a minimum of 5 years;
(h) Only certify HIT, including Complete EHRs and/or EHR Modules,
that have been tested by a NVLAP-accredited testing laboratory;
(i) Submit an annual surveillance plan to the National Coordinator
and annually report to the National Coordinator its surveillance
results; and
(j) Promptly refund any and all fees received for certifications
that will not be completed.
Sec. 170.525 Application submission.
(a) An applicant for ONC-ACB status must submit its application
either electronically, via e-mail (or Web submission if available), or
by regular or express mail.
[[Page 11371]]
(b) An application for ONC-ACB status may be submitted to the
National Coordinator at any time during the existence of the permanent
certification program.
Sec. 170.530 Review of application.
(a) Method of review and review timeframe.
(1) Applications will be reviewed in the order they are received.
(2) The National Coordinator is permitted up to 30 days from
receipt to review an application (submitted for the first time).
(b) Application deficiencies.
(1) If the National Coordinator identifies an area in an
application that requires the applicant to clarify a statement or
correct an inadvertent error or minor omission, the National
Coordinator may contact the applicant to make such clarification or
correction without issuing a deficiency notice. If the National
Coordinator has not received the requested information after five days,
the applicant may be issued a deficiency notice specifying the error,
omission, or deficient statement.
(2) If the National Coordinator determines that deficiencies in
either part of the application exist, the National Coordinator will
issue a deficiency notice to the applicant and return the application.
The deficiency notice will identify the areas of the application that
require additional information or correction.
(c) Revised application.
(1) An applicant is permitted to submit a revised application in
response to a deficiency notice.
(2) In order to continue to be considered for ONC-ACB status, an
applicant's revised application must be received by the National
Coordinator within 15 days of the applicant's receipt of the deficiency
notice.
(3) The National Coordinator is permitted 15 days to review a
revised application once it has been received.
(4) If the National Coordinator determines that a revised
application still contains deficiencies, the applicant will be issued a
denial notice indicating that the applicant will no longer be
considered for authorization under the permanent certification program.
An applicant may request reconsideration of this decision in accordance
with Sec. 170.535.
(d) Satisfactory application.
(1) An application will be deemed satisfactory if it meets all the
application requirements.
(2) The National Coordinator will notify the applicant's authorized
representative of its satisfactory application and its successful
achievement of ONC-ACB status.
(3) Once notified by the National Coordinator of its successful
achievement of ONC-ACB status, the applicant may represent itself as an
ONC-ACB and begin certifying health information technology consistent
with its authorization.
Sec. 170.535 ONC-ACB application reconsideration.
(a) An applicant may request that the National Coordinator
reconsider a denial notice only if the applicant can demonstrate that
clear, factual errors were made in the review of its application and
that the errors' correction could lead to the applicant obtaining ONC-
ACB status.
(b) Submission requirement. An applicant is required to submit,
within 15 days of receipt of a denial notice, a written statement to
the National Coordinator contesting the decision to deny its
application and explaining with sufficient documentation what factual
errors it believes can account for the denial. If the National
Coordinator does not receive the applicant's reconsideration request
within the specified timeframe its reconsideration request may be
rejected.
(c) Reconsideration request review. If the National Coordinator
receives a timely reconsideration request, the National Coordinator is
permitted up to 15 days from the date of receipt to review the
information submitted by the applicant and issue a decision.
(d) Decision.
(1) If the National Coordinator determines that clear, factual
errors were made during the review of the application and that
correction of the errors would remove all identified deficiencies, the
applicant's authorized representative will be notified of the National
Coordinator's determination and the applicant's successful achievement
of ONC-ACB status.
(2) If, after reviewing an applicant's reconsideration request, the
National Coordinator determines that the applicant did not identify any
factual errors or that correction of those factual errors would not
remove all identified deficiencies in the application, the National
Coordinator may reject the applicant's reconsideration request.
(3) Final decision. A reconsideration decision issued by the
National Coordinator is final and not subject to further review.
Sec. 170.540 ONC-ACB Status.
(a) Acknowledgement and publication. The National Coordinator will
acknowledge and make publicly available the names of ONC-ACBs,
including the date each was authorized and the type(s) of certification
each has been authorized to perform.
(b) Representation. Each ONC-ACB must prominently and unambiguously
identify on its Web site and in all marketing and communications
statements (written and oral) the scope of its authorization.
(c) Renewal. An ONC-ACB is required to renew its status every two
years. An ONC-ACB is required to submit a renewal request to the
National Coordinator 60 days prior to the expiration of its status.
(d) Expiration. An ONC-ACB's status will expire two years from the
date it was granted by the National Coordinator unless it is renewed in
accordance with paragraph (c) of this section.
Sec. 170.545 Complete EHR Certification.
(a) To be authorized to certify Complete EHRs under the permanent
certification program, an ONC-ACB must be capable of certifying
Complete EHRs to all applicable certification criteria adopted by the
Secretary at subpart C of this part.
(b) An ONC-ACB that has been authorized to certify Complete EHRs is
also authorized to certify all EHR Modules under the permanent
certification program.
Sec. 170.550 EHR module certification.
(a) When certifying EHR Modules, an ONC-ACB must certify in
accordance with the applicable certification criterion or certification
criteria adopted by the Secretary at subpart C of this part.
(b) EHR Modules are required to be certified to at least one
certification criterion.
(c) Privacy and security certification. EHR Modules shall be
certified to all privacy and security certification criteria adopted by
the Secretary unless the EHR Module(s) is/are presented for
certification in one of the following manners:
(1) The EHR Module(s) are presented for certification as a pre-
coordinated, integrated ``bundle'' of EHR Modules, which could
otherwise constitute a Complete EHR. In such instances, the EHR
Module(s) shall be certified in the same manner as a Complete EHR. Pre-
coordinated bundles of EHR Module(s) which include EHR Module(s) that
would not be part of a local system and under the end user's direct
control are excluded from this exception. The constituent EHR Modules
of such an integrated bundle must be separately certified to all
privacy and security certification criteria.
(2) An EHR Module is presented for certification, and the presenter
can
[[Page 11372]]
demonstrate to the ONC-ACB that it would be technically infeasible for
the EHR Module to be certified in accordance with some or all of the
privacy and security certification criteria; or
(3) An EHR Module is presented for certification, and the presenter
can demonstrate to the ONC-ACB that the EHR Module is designed to
perform a specific privacy and security capability. In such instances,
the EHR Module may only be certified in accordance with the applicable
privacy and security certification criterion/criteria.
(d) ONC-ACBs authorized to certify EHR Modules must clearly
indicate the certification criterion or certification criteria to which
an EHR Module has been certified in its certification documentation.
Sec. 170.553 Certification for health information technology other
than complete EHRs and EHR modules.
An ONC-ACB authorized to certify health information technology
other than Complete EHRs and/or EHR Modules must certify such health
information technology in accordance with the applicable certification
criterion or certification criteria adopted by the Secretary at subpart
C of this part.
Sec. 170.555 Certification to newer versions of certain standards.
(a) ONC-ACBs may test and certify Complete EHRs and EHR Modules to
a newer version of certain identified minimum standards specified at
subpart B of this part if the Secretary has accepted a newer version of
an adopted minimum standard.
(b) Applicability of an accepted new version of an adopted minimum
standard.
(1) ONC-ACBs are not required to test and certify Complete EHRs
and/or EHR Modules according to newer versions of an adopted minimum
standard accepted by the Secretary until the incorporation by reference
provision of the adopted version is updated in the Federal Register
with a newer version.
(2) Certified EHR Technology may be upgraded to comply with newer
versions of an adopted minimum standard accepted by the Secretary
without adversely affecting the certification status of the Certified
EHR Technology.
Sec. 170.557 Authorized certification methods.
(a) Primary method. An ONC-ACB must have the capacity to certify
Complete EHRs and/or EHR Modules at their facility.
(b) Secondary methods. An ONC-ACB must also have the capacity to
certify Complete EHRs and/or EHR Modules through one of the following
methods:
(1) At the site where the Complete EHR or EHR Module has been
developed; or
(2) At the site where the Complete EHR or EHR Module resides; or
(3) Remotely (i.e., through other means, such as through secure
electronic transmissions and automated Web-based tools, or at a
location other than the ONC-ACB's facilities).
Sec. 170.560 Good standing as an ONC-ACB.
An ONC-ACB must maintain good standing by:
(a) Adhering to the Principles of Proper Conduct for ONC-ACBs;
(b) Refraining from engaging in other types of inappropriate
behavior, including an ONC-ACB misrepresenting the scope of its
authorization as well as an ONC-ACB testing and certifying Complete
EHRs and/or EHR Modules for which it does not have authorization; and
(c) Following all other applicable Federal and State laws.
Sec. 170.565 Revocation of authorized certification body status.
(a) Type-1 violations. The National Coordinator may revoke an ONC-
ACB's status for committing a Type-1 violation. Type-1 violations
include violations of law or permanent certification program policies
that threaten or significantly undermine the integrity of the permanent
certification program. These violations include, but are not limited
to: False, fraudulent, or abusive activities that affect the permanent
certification program, a program administered by HHS or any program
administered by the Federal government.
(b) Type-2 violations. The National Coordinator may revoke an ONC-
ACB's status for failing to timely or adequately correct a Type-2
violation. Type-2 violations comprise noncompliance with Sec. 170.560.
(1) Noncompliance notification. If the National Coordinator obtains
reliable evidence that an ONC-ACB may no longer be in compliance with
Sec. 170.560, the National Coordinator will issue a noncompliance
notification with reasons for the notification to the ONC-ACB
requesting that the ONC-ACB respond to the alleged violation and
correct the violation, if applicable.
(2) Opportunity to become compliant. After receipt of a
noncompliance notification, an ONC-ACB is permitted to 30 days to
submit a written response and accompanying documentation that
demonstrates that no violation occurred or that the alleged violation
has been corrected.
(i) If the ONC-ACB submits a response, the National Coordinator is
permitted up to 30 days from the time the response is received to
evaluate the response and reach a decision. The National Coordinator
may, if necessary, request additional information from the ONC-ACB
during this time period.
(ii) If the National Coordinator determines that no violation
occurred or that the violation has been sufficiently corrected, the
National Coordinator will issue a memo to the ONC-ACB confirming this
determination.
(iii) If the National Coordinator determines that the ONC-ACB
failed to demonstrate that no violation occurred or to correct the
area(s) of non-compliance identified under paragraph (b)(1) of this
section within 30 days of receipt of the noncompliance notification,
then the National Coordinator may propose to revoke the ONC-ACB's
status.
(c) Proposed revocation.
(1) The National Coordinator may propose to revoke an ONC-ACB's
status if the ONC-ACB has committed a Type-1 violation; or
(2) The National Coordinator may propose to revoke an ONC-ACB's
status if, after the ONC-ACB has been notified of a Type-2 violation,
the ONC-ACB fails to:
(i) To rebut the finding of a violation with sufficient evidence
showing that the violation did not occur or that the violation has been
corrected; or
(ii) Submit to the National Coordinator a written response to the
noncompliance notification within the specified timeframe under
paragraph (b)(2).
(3) ONC-ACB's operations. An ONC-ACB may continue its operations
under the permanent certification program during the time periods
provided for an ONC-ACB to respond to a proposed revocation notice and
the National Coordinator to review an ONC-ACB's response to a proposed
revocation.
(d) Opportunity to respond to a proposed revocation notice.
(1) An ONC-ACB may respond to a proposed revocation notice, but
must do so within 10 days of receiving the proposed revocation notice
and include appropriate documentation explaining in writing why its
status should not be revoked.
(2) Upon receipt of an ONC-ACB's response to a proposed revocation
notice, the National Coordinator is permitted up to 30 days to review
the information submitted by the ONC-ACB and reach a decision.
[[Page 11373]]
(e) Good standing determination. If the National Coordinator
determines that an ONC-ACB's status should not be revoked, the National
Coordinator will notify the ONC-ACB's authorized representative in
writing of this determination.
(f) Revocation.
(1) The National Coordinator may revoke an ONC-ACB's status if:
(i) A determination is made that revocation is appropriate after
considering the information provided by the ONC-ACB in response to the
proposed revocation notice; or
(ii) The ONC-ACB does not respond to a proposed revocation notice
within the specified timeframe in paragraph (d)(1) of this section.
(2) A decision to revoke an ONC-ACB's status is final and not
subject to further review unless the National Coordinator chooses to
reconsider the revocation.
(g) Extent and duration of revocation.
(1) The revocation of an ONC-ACB is effective as soon as the ONC-
ACB receives the revocation notice.
(2) A certification body that has had its ONC-ACB status revoked is
prohibited from accepting new requests for certification and must cease
its current certification operations under the permanent certification
program.
(3) A certification body that has had its ONC-ACB has its status
revoked for a Type-1 violation, is not permitted to reapply for ONC-ACB
status under the permanent certification program for a period of 1
year.
(4) The failure of a certification body that has had its ONC-ACB
status revoked to promptly refund any and all fees for certifications
of Complete EHRs and EHR Modules not completed will be considered a
violation of the Principles of Proper Conduct for ONC-ACBs and will be
taken into account by the National Coordinator if the certification
body reapplies for ONC-ACB status under the permanent certification
program.
Sec. 170.570 Effect of revocation on the certifications issued to
complete EHRs and EHR modules.
(a) The certified status of Complete EHRs and/or EHR Modules
certified by an ONC-ACB that had it status revoked will remain intact
unless a Type-1 violation was committed that calls into question the
legitimacy of the certifications issued by the former ONC-ACB.
(b) If the National Coordinator determines that a Type-1 violation
occurred that called into question the legitimacy of certifications
conducted by the former ONC-ACB, then the National Coordinator would:
(1) Review the facts surrounding the revocation of the ONC-ACB's
status; and
(2) Publish a notice on ONC's Web site if the National Coordinator
believes that Complete EHRs and/or EHR Modules were improperly
certified by the former ONC-ACB.
(c) If the National Coordinator determines that Complete EHRs and/
or EHR Modules were improperly certified, the certification status of
affected Complete EHRs and/or EHR Modules would only remain intact for
120 days after the National Coordinator publishes the notice. The
certification status of the Complete EHR and/or EHR Module can only be
maintained thereafter by being re-certified by an ONC-ACB in good
standing.
Kathleen Sebelius,
Secretary.
[FR Doc. 2010-4991 Filed 3-4-10; 4:15 pm]
BILLING CODE 4150-45-P