thefederalregister.com

Daily Rules, Proposed Rules, and Notices of the Federal Government

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 170

RIN 0991-AB82

Health Information Technology: Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology, 2014 Edition; Revisions to the Permanent Certification Program for Health Information Technology

AGENCY: Office of the National Coordinator for Health Information Technology (ONC), Department of Health and Human Services.
ACTION: Final rule.
SUMMARY: With this final rule, the Secretary of Health and Human Services adopts certification criteria that establish the technical capabilities and specify the related standards and implementation specifications that Certified Electronic Health Record (EHR) Technology will need to include to, at a minimum, support the achievement of meaningful use by eligible professionals, eligible hospitals, and critical access hospitals under the Medicare and Medicaid EHR Incentive Programs beginning with the EHR reporting periods in fiscal year and calendar year 2014. This final rule also makes changes to the permanent certification program for health information technology, including changing the program's name to the ONC HIT Certification Program.
DATES: These regulations are effective October 4, 2012. The incorporation by reference of certain publications listed in the rule is approved by the Director of theFederal Registeras of October 4, 2012.
FOR FURTHER INFORMATION CONTACT: Steven Posnack, Director, Federal Policy Division, Office of Policy and Planning, Office of the National Coordinator for Health Information Technology, 202-690-7151.
SUPPLEMENTARY INFORMATION:

This final rule is issued under section 3004 of the Public Health Service Act.

Commonly Used Acronyms CAHCritical Access Hospital CDAClinical Document Architecture CDCCenters for Disease Control and Prevention CDSClinical Decision Support CEHRTCertified EHR Technology CFRCode of Federal Regulations CHPLCertified HIT Products List CMSCenters for Medicare & Medicaid Services CQMClinical Quality Measure CYCalendar Year EHEligible Hospital EHRElectronic Health Record EPEligible Professional FYFiscal Year HHSDepartment of Health and Human Services HIPAAHealth Insurance Portability and Accountability Act of 1996 HITHealth Information Technology HITECHHealth Information Technology for Economic and Clinical Health HITPCHIT Policy Committee HITSCHIT Standards Committee HL7Health Level Seven ICD-9-CMInternational Classification of Diseases, 9th Revision, Clinical Modification ICD-10International Classification of Diseases, 10th Revision ICD-10-CMInternational Classification of Diseases, 10th Revision, Clinical Modification ICD-10-PCSInternational Classification of Diseases, 10th Revision, Procedure Coding System IHEIntegrating the Healthcare Enterprise® LOINC®Logical Observation Identifiers Names and Codes MUMeaningful Use ONCOffice of the National Coordinator of Health Information Technology NCPDPNational Council for Prescription Drug Programs NISTNational Institute of Standards and Technology PHSAPublic Health Service Act SNOMED CT®Systematized Nomenclature of Medicine Clinical Terms I. Executive Summary A. Purpose of Regulatory Action B. Summary of Major Provisions 1. Overview of the 2014 Edition EHR Certification Criteria 2. Certified EHR Technology 3. ONC HIT Certification Program

C. Costs and Benefits

II. Background A. Statutory Basis 1. Standards, Implementation Specifications, and Certification Criteria 2. HIT Certification Programs B. Regulatory History 1. Standards, Implementation Specifications, and Certification Criteria Rules 2. Medicare and Medicaid EHR Incentive Programs Rules 3. HIT Certification Programs Rules III. Provisions of the Final Rule Affecting Standards, Implementation Specifications and Certification Criteria A. 2014 Edition EHR Certification Criteria 1. Certification Criteria Relationship to MU 2. Applicability 3. Scope of a Certification Criterion for Certification

4. Explanation and Revision of Terms Used in Certification Criteria

5. Consensus-Based Standards 6. Adopting Versions of Standards 7. Display of Vocabulary Standards 8. Common Data Elements in Certification Criteria 9. New Certification Criteria a. Ambulatory and Inpatient Setting b. Ambulatory Setting c. Inpatient Setting 10. Revised Certification Criteria a. Ambulatory and Inpatient Setting b. Ambulatory Setting c. Inpatient Setting 11. Unchanged Certification Criteria a. Refinements to Unchanged Certification Criteria b. Unchanged Certification Criteria Without Refinements 12. Gap Certification 13. “Disability” Status B. Redefining Certified EHR Technology and Related Terms 1. Certified EHR Technology (CEHRT) Definition 2. Base EHR Definition 3. Complete EHR Definition 4. Certifications Issued for Complete EHRs and EHR Modules 5. Adaptations of Certified Complete EHRs or Certified EHR Modules IV. Provisions of the Final Rule Affecting the Permanent Certification Program for HIT (“ONC HIT Certification Program”) A. Program Name Change B. “Minimum Standards” Code Sets C. Revisions to EHR Module Certification Requirements 1. Privacy and Security Certification 2. Certification to Certain New Certification Criteria D. ONC-ACB Reporting Requirements E. Continuation and Representation of Certified Status 1. 2011 or 2014 Edition EHR Certification Criteria Compliant 2. Updating a Certification 3. Representation of Meeting the Base EHR Definition F. EHR Technology Price Transparency G. Certification and Certification Criteria for Other Health Care Settings V. Collection of Information Requirements VI. Regulatory Impact Statement A. Statement of Need B. Overall Impact 1. Comment and Response 2. Executive Orders 12866 and 13563—Regulatory Planning and Review Analysis a. Costs i. Development and Preparation Costs for 2014 Edition EHR Certification Criteria ii. Overall Development and Preparation Estimated Costs Over a 3-Year Period iii. Costs for Reporting Test Results Hyperlinks b. Benefits 3. Regulatory Flexibility Act Analysis 4. Executive Order 13132—Federalism 5. Unfunded Mandates Reform Act of 1995 Regulation Text
I. Executive Summary A. Purpose of Regulatory Action

The HIT Standards Committee (HITSC) issued recommendations for standards, implementation specifications, and certification criteria to the National Coordinator for Health Information Technology (the National Coordinator) on September 28, 2011 andOctober 21, 2011. In fulfilling his duties under sections 3001(c)(1)(A) and (B) of the Public Health Service Act (PHSA), the National Coordinator reviewed the recommendations made by the HITSC, endorsed certain standards, implementation specifications, and certification criteria, and reported his determinations to the Secretary for consideration. On March 7, 2012, the Secretary published a proposed rule (77 FR 13832) with her determinations regarding the standards, implementation specifications, and certification criteria endorsed by the National Coordinator, as required by section 3004(a)(3) of the PHSA. The proposed rule solicited public comment on the standards, implementation specifications, and certification criteria the Secretary proposed for adoption.

This final rule addresses comments received on the proposed rule and specifies the adoption by the Secretary, under sections 3004(a)(3) and 3004(b)(3) of the PHSA, of the standards, implementation specifications, and certification criteria that will establish the technical capabilities that electronic health record (EHR) technology must include to be certified. EHR technology certified to these standards, implementation specifications, and certification criteria makes it possible for eligible professionals (EPs), eligible hospitals (EHs), and critical access hospitals (CAHs) to adopt Certified EHR Technology (CEHRT) and subsequently attempt to demonstrate its meaningful use (MU) under the Medicare and Medicaid EHR Incentive Programs (the “EHR Incentive Programs”).

Consistent with Executive Order 13563, we have undertaken a retrospective review of our regulations. The final rule establishes multiple means for reducing regulatory burden and increasing regulatory flexibility for stakeholders, including changes to current regulatory requirements and approaches.

B. Summary of Major Provisions 1. Overview of the 2014 Edition EHR Certification Criteria

We have adopted certification criteria that will support the changes to the EHR Incentive Programs, including the new and revised objectives and measures for Stages 1 and 2 of MU finalized by CMS. The adopted certification criteria also enhance care coordination, patient engagement, and the security, safety, and efficacy of EHR technology. We refer to the adopted certification criteria as the 2014 Edition EHR certification criteria and the certification criteria previously adopted through rulemaking (75 FR 2014, 75 FR 44590) as the 2011 Edition EHR certification criteria. To permit efficient certification methods and reduce regulatory burden, we have identified those certification criteria that we have adopted as part of the 2014 Edition EHR certification criteria that include unchanged capabilities that were also included in the 2011 Edition EHR certification criteria. For EHR technology previously certified to the 2011 Edition EHR certification criteria, this will permit, where applicable, the use of prior test results for certification to the 2014 Edition EHR certification criteria (see the discussion of “gap certification” in section III.A.12 of this preamble).

2. Certified EHR Technology

Since the publication of the Standards and Certification Criteria final rule in July 2010, 75 FR 44590 (July 28, 2010) (the “S&CC July 2010 final rule”), HHS received significant feedback from stakeholders which suggested that we change our CEHRT policy (and definition) to one that would provide EPs, EHs, and CAHs the flexibility to have only the EHR technology they need to demonstrate MU. Consistent with stakeholder feedback and recommendations received from the HITSC, we proposed to revise the CEHRT definition to offer the requested flexibility. Based on comments received, we have finalized a CEHRT definition that provides even more flexibility for EPs, EHs, and CAHs than we originally proposed. In order to have EHR technology that meets the CEHRT definition for FY and CY 2014 and subsequent years, EPs, EHs, and CAHs must have EHR technology certified to the 2014 Edition EHR certification criteria that meets the Base EHR definition (EHR technology that includes fundamental capabilities all providers would need to have) as well as the additional EHR technology certified to the 2014 Edition EHR certification criteria necessary to meet the MU objectives and measures for the stage of MU that they seek to meet and to capture, calculate, and electronically submit clinical quality measures. In addition, this final rule permits EPs, EHs, and CAHs to adopt EHR technology that meets the FY/CY 2014 CEHRT definition and use it in their attempts to achieve MU prior to FY/CY 2014. We further discuss the new dynamic CEHRT definition, including the Base EHR definition in section III.B (“Redefining Certified EHR Technology and Related Terms”).

We note that we continue to permit only two types of EHR technology, Complete EHRs and EHR Modules, to be certified to meet these definitions under the “ONC HIT Certification Program.” A Complete EHR requires EHR technology to meet, at a minimum, all the mandatory certification criteria for either the ambulatory or inpatient setting, while an EHR Module can be any EHR technology certified to one less than all the mandatory certification criteria for either the ambulatory or inpatient setting (as noted, it would be a Complete EHR if it was certified to all the mandatory certification criteria for a setting). A Complete EHR, by definition, would meet the Base EHR definition and could be used to meet the CEHRT definition, but we note that an EP may need EHR technology certified to the optional “cancer registries” certification criteria to support their attempt to achieve MU. A single EHR Module could also be developed to meet the Base EHR definition and CEHRT definition for an EP, EH, or CAH. Additionally, an EP, EH, or CAH could use multiple certified EHR Modules or a certified EHR Module(s) in conjunction with a certified Complete EHR to meet the Base EHR definition and CEHRT definition.

3. ONC HIT Certification Program

This final rule revises the permanent certification program in ways that increase regulatory clarity and transparency, reduce regulatory burden, and add flexibility for the health information technology (HIT) community. One of these revisions includes changing the permanent certification program title to the “ONC HIT Certification Program,” which provides clearer attribution to the agency responsible for the program and an appropriate description of the program's scope, covering both current and potential future activities. The final rule also revises the process for permitting the use of newer versions of “minimum standard” code sets. The new approach is expected to reduce regulatory complexity and burden by providing the industry with the flexibility to utilize newer versions of adopted “minimum standard” code sets in a timelier manner.

The final rule modifies the certification processes ONC-Authorized Certification Bodies (ONC-ACBs) will need to follow for certifying EHR Modules in a manner that provides clear implementation direction and compliance with the new certification criteria. It also reduces regulatory burden by eliminating the certification requirement that every EHR Module be certified to the “privacy and security” certification criteria. Instead, the privacy and security capabilities areincluded in the Base EHR definition that every EP, EH, and CAH must meet as part of meeting the CEHRT definition.

To increase clarity for purchasers in the HIT market, we have established methods for representing certified Complete EHRs and certified EHR Modules, including when Complete EHRs and EHR Modules meet the Base EHR definition. We also require that test results used for EHR technology certification be made publicly available in an effort to increase transparency and provide EPs, EHs, and CAHs a potential starting point from which to assess any implementation issues associated with certified Complete EHRs and certified EHR Modules. Finally, as another means of increasing transparency and mitigating any potential confusion in the market, we require that ONC-ACBs ensure that EHR technology developers include in their marketing materials and communications notification to potential purchasers any additional types of costs that an EP, EH, or CAH would pay to implement their certified Complete EHR or certified EHR Module in order to attempt to meet MU objectives and measures.

C. Costs and Benefits

We determined that this final rule is not an economically significant rule as its overall costs will be less than $100 million in any one year. We have, however, estimated the costs and benefits of the final rule. The final rule does not account for the estimated costs that EPs, EHs, and CAHs will incur in adopting and implementing certified Complete EHRs and certified EHR Modules. Those costs are estimated in the CMS Medicare and Medicaid EHR Incentive Programs Stage 2 final rule (Stage 2 final rule) published elsewhere in this issue of theFederal Register.The estimated costs expected to be incurred by EHR technology developers to develop and prepare EHR technology (i.e., Complete EHRs and EHR Modules) to be tested and certified in accordance with the 2014 Edition EHR certification criteria are represented in monetary terms in Table 1 below. We believe that there will be market pressures to have certified Complete EHRs and certified EHR Modules ready and available prior to when EPs, EHs, and CAHs must meet the revised CEHRT definition for FY/CY 2014, particularly with the option provided by this final rule for EPs, EHs, and CAHs to adopt EHR technology that meets the FY/CY 2014 CEHRT definition and use it in their attempts to achieve MU in FY/CY 2013. Due to these market pressures, we believe that most of the estimated costs for developing EHR technology to meet the 2014 Edition EHR certification criteria will be incurred during the remainder of 2012 and throughout 2013, rather than in 2014. As a result, as represented in Table 1, the estimated costs attributable to this final rule are distributed as follows: 45% for 2012, 45% for 2013, and 10% for 2014. The dollar amounts expressed in Table 1 are expressed in 2012 dollars.

There are multiple potential benefits that stem from the 2014 Edition EHR certification criteria. Foremost, the 2014 Edition EHR certification criteria promote enhanced interoperability, functionality, utility, and security of EHR technology through the capabilities they include and the standards they require EHR technology to meet for certification. EHR technology certified to the 2014 Edition EHR certification criteria also will be capable of supporting EPs, EHs, and CAHs' attempts to demonstrate MU under the EHR Incentive Programs. The revised CEHRT definition, the availability of gap certification, and the revisions to the ONC HIT Certification Program, will, as noted, increase regulatory clarity, improve transparency, and add flexibility, while also reducing the regulatory burden on the HIT industry. Last, the provisions of this final rule are supportive of other initiatives, such as the Partnership for Patients, Medicare Shared Savings Program, and other quality measure programs administered by CMS.

Table 1—Estimated Costs of the Final Rule: Distributed Total Development and Preparation Costs for Complete EHR and EHR Module Developers (3-year period)—Totals Rounded Year Ratio
  • (percent)
  • Total low cost estimate ($M) Total high cost estimate ($M) Primary mid-point total cost estimate ($M)
    2012 45 45.85 130.02 87.93 2013 45 45.85 130.02 87.93 2014 10 10.20 28.90 19.56 3-Year Totals 101.90 288.94 195.42
    II. Background A. Statutory Basis

    The Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (the Recovery Act) (Pub. L. 111-5), was enacted on February 17, 2009. The HITECH Act amended the PHSA and created “Title XXX—Health Information Technology and Quality” (Title XXX) to improve health care quality, safety, and efficiency through the promotion of HIT and electronic health information exchange.

    1. Standards, Implementation Specifications, and Certification Criteria

    With the passage of the HITECH Act, two new Federal advisory committees were established, the HIT Policy Committee (HITPC) and the HIT Standards Committee (HITSC) (sections 3002 and 3003 of the PHSA, respectively). Each is responsible for advising the National Coordinator on different aspects of standards, implementation specifications, and certification criteria. The HITPC is responsible for, among other duties, recommending priorities for the development, harmonization, and recognition of standards, implementation specifications, and certification criteria. The HITPC also considers and provides recommendations to ONC and CMS on meaningful use (MU) policy under the EHR Incentive Programs. The HITSC is responsible for recommending standards, implementation specifications, and certification criteria for adoption by the Secretary under section 3004 of the PHSA consistent with the ONC-coordinated Federal Health IT Strategic Plan.

    Section 3004 of the PHSA identifies a process for the adoption of health IT standards, implementation specifications, and certification criteria and authorizes the Secretary to adopt such standards, implementationspecifications, and certification criteria. As specified in section 3004(a)(1), the Secretary is required, in consultation with representatives of other relevant Federal agencies, to jointly review standards, implementation specifications, and certification criteria endorsed by the National Coordinator under section 3001(c) and subsequently determine whether to propose the adoption of any grouping of such standards, implementation specifications, or certification criteria. The Secretary is required to publish all determinations in theFederal Register.

    Section 3004(b)(3) of the PHSA titled “Subsequent Standards Activity” provides that the “Secretary shall adopt additional standards, implementation specifications, and certification criteria as necessary and consistent” with the schedule published by the HITSC. We consider this provision in the broader context of the HITECH Act to grant the Secretary the authority and discretion to adopt standards, implementation specifications, and certification criteria that have been recommended by the HITSC and endorsed by the National Coordinator, as well as other appropriate and necessary HIT standards, implementation specifications, and certification criteria. Throughout this process, the Secretary intends to continue to seek the insights and recommendations of the HITSC.

    2. HIT Certification Programs

    Section 3001(c)(5) of the PHSA provides the National Coordinator with the authority to establish a certification program or programs for the voluntary certification of HIT. Specifically, section 3001(c)(5)(A) specifies that the “National Coordinator, in consultation with the Director of the National Institute of Standards and Technology, shall keep or recognize a program or programs for the voluntary certification of health information technology as being in compliance with applicable certification criteria adopted under this subtitle” (i.e., certification criteria adopted by the Secretary under section 3004 of the PHSA). The certification program(s) must also “include, as appropriate, testing of the technology in accordance with section 13201(b) of the [HITECH] Act.”

    Section 13201(b) of the HITECH Act requires that with respect to the development of standards and implementation specifications, the Director of the National Institute of Standards and Technology (NIST), in coordination with the HITSC, “shall support the establishment of a conformance testing infrastructure, including the development of technical test beds.” The HITECH Act also indicates that “[t]he development of this conformance testing infrastructure may include a program to accredit independent, non-Federal laboratories to perform testing.”

    B. Regulatory History 1. Standards, Implementation Specifications, and Certification Criteria Rules

    The Secretary issued an interim final rule with request for comments titled “Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology” (75 FR 2014, Jan. 13, 2010) (the “S&CC January 2010 interim final rule”), which adopted an initial set of standards, implementation specifications, and certification criteria. After consideration of the public comments received on the S&CC January 2010 interim final rule, a final rule was issued to complete the adoption of the initial set of standards, implementation specifications, and certification criteria and realign them with the final objectives and measures established for MU Stage 1. Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology; Final Rule, 75 FR 44590 (July 28, 2010). On October 13, 2010, an interim final rule with a request for comment was issued to remove certain implementation specifications related to public health surveillance that had been previously adopted in the S&CC July 2010 final rule (75 FR 62686).

    The standards, implementation specifications, and certification criteria adopted by the Secretary in the S&CC July 2010 final rule established the capabilities that CEHRT must include in order to, at a minimum, support the achievement of MU Stage 1 by EPs, EHs, and CAHs under the Medicare and Medicaid EHR Incentive Programs Stage 1 final rule (the “Stage 1 final rule”) (see 75 FR 44314 for more information about MU and the Stage 1 requirements).

    On March 7, 2012, ONC published a proposed rule (“the Proposed Rule”) (77 FR 13832) in theFederal Registerthat proposed new and revised certification criteria that would support the achievement of MU beginning with the EHR reporting periods in FY/CY 2014. These certification criteria are referred to as the 2014 Edition EHR certification criteria. The rule also proposed revisions to the CEHRT definition.

    2. Medicare and Medicaid EHR Incentive Programs Rules

    On January 13, 2010, CMS published the EHR Incentive Programs Stage 1 proposed rule (75 FR 1844). The rule proposed a definition for Stage 1 MU of CEHRT and regulations associated with the incentive payments made available under Division B, Title IV of the HITECH Act. Subsequently, CMS published a final rule (75 FR 44314) for the EHR Incentive Programs on July 28, 2010, simultaneously with the publication of the S&CC July 2010 final rule. The Stage 1 final rule established the objectives, associated measures, and other requirements that EPs, EHs, and CAHs must satisfy to demonstrate MU during Stage 1.

    On March 7, 2012, CMS published a proposed rule (77 FR 13698) in theFederal Registerfor MU Stage 2 that included proposed revisions to MU Stage 1 beginning with the EHR reporting periods in FY/CY 2013 (Stage 2 proposed rule).

    3. HIT Certification Programs Rules

    On March 10, 2010, ONC published a proposed rule (75 FR 11328) titled “Proposed Establishment of Certification Programs for Health Information Technology” (the “Certification Programs proposed rule”). The rule proposed both a temporary and permanent certification program for the purposes of testing and certifying HIT. It also specified the processes the National Coordinator would follow to authorize organizations to perform the certification of HIT. A final rule establishing the temporary certification program was published on June 24, 2010 (75 FR 36158) (the “Temporary Certification Program final rule”) and a final rule establishing the permanent certification program was published on January 7, 2011 (76 FR 1262) (“the Permanent Certification Program final rule”).

    In the Proposed Rule mentioned above, ONC also proposed revisions to the permanent certification program, including changing the program's name to the ONC HIT Certification Program.

    III. Provisions of the Final Rule Affecting Standards, Implementation Specifications, and Certification Criteria

    To make a clear distinction between previously adopted certification criteria and the ones proposed for adoption in the Proposed Rule, we stated we would refer to and define the certification criteria adopted in the S&CC July 2010 final rule and included in §§ 170.302, 170.304, and 170.306 collectively as the“2011 Edition EHR certification criteria.” We proposed to revise § 170.102 to add this definition.

    Comments.Commenters expressed support for “editions” of certification criteria, particularly the use of “2011 Edition EHR certification criteria” for collectively referencing §§ 170.302, 170.304, and 170.306.

    Response.We appreciate the expression of support and have revised § 170.102 to include the definition of 2011 Edition EHR certification criteria as proposed.

    A. 2014 Edition EHR Certification Criteria

    In the Proposed Rule, we proposed new, revised, and unchanged certification criteria that would establish the technical capabilities and specify the related standards and implementation specifications that CEHRT would need to include to, at a minimum, support the achievement of MU by EPs, EHs, and CAHs under the EHR Incentive Programs beginning with the EHR reporting periods in FY/CY 2014. We referred to these new, revised, and unchanged certification criteria as the “2014 Edition EHR certification criteria” and proposed to add this term and its definition to § 170.102. Additionally, we proposed to include all of the 2014 Edition EHR certification criteria in § 170.314 to set them apart and make it easier for stakeholders to quickly determine which certification criteria would be required beginning with the EHR reporting periods that start in FY/CY 2014.

    Comments.Commenters expressed support for “editions” of certification criteria, particularly the use of “2014 Edition EHR certification criteria” to reference the certification criteria adopted in § 170.314. One commenter, however, did not agree with our approach to include all of the 2014 Edition EHR certification criteria in § 170.314. The commenter suggested that we should maintain the approach used for the 2011 Edition EHR certification criteria (i.e., to separate general, ambulatory, and inpatient certification criteria into three sections of the Code of Federal Regulations (CFR)).

    Response.We appreciate the expression of support for our “editions” approach and have revised § 170.102 to include the definition of 2014 Edition EHR certification criteria as proposed. Use of “2014 Edition EHR certification criteria” coupled with our use of “2011 Edition EHR certification criteria” should eliminate any ambiguity and provide a clear distinction between the certification criteria that are part of the 2011 Edition EHR certification criteria and those in the 2014 Edition EHR certification criteria.

    We believe by including all the 2014 Edition EHR certification criteria in one section of the CFR is a better approach than our previous approach of separating general, ambulatory, and inpatient certification criteria into three sections of the CFR. As noted in the Proposed Rule, the inclusion of all 2014 Edition EHR certification criteria in one regulatory section will simplify the regulatory framework for stakeholders.

    1. Certification Criteria Relationship to MU

    Many of the certification criteria that we proposed supported the MU objectives and measures proposed by CMS in the Stage 2 proposed rule as well as the reporting of MU objectives and measures and clinical quality measures (CQMs). To the extent CMS has changed (e.g., added, revised, or removed) the MU objectives, measures, or reporting requirements in its final rule, we have made appropriate changes to the associated certification criteria so that they continue to support the MU objectives, measures, and reporting requirements.

    We received many comments on the 2014 Edition EHR certification criteria that were not within this rulemaking's scope. These comments focused on the MU objectives, measures, CQM measures, and reporting requirements. For responses to such comments, we direct readers to the Stage 2 final rule published elsewhere in this issue of theFederal Register.

    We reiterate and emphasize for commenters to remember that certification is a floor not a ceiling. It does not specify an exhaustive set of capabilities that EHR technology must include. Rather, certification assesses a subset of capabilities (generally capabilities that support MU requirements) that may be part of the overall EHR technology that an EP, EH, or CAH adopts. In this regard, certification focuses on providing assurance to EPs, EHs, and CAHs that EHR technology certified to a certification criterion includes the specified capabilities, that those capabilities perform correctly and, where applicable, that those capabilities properly utilize/support adopted standards.

    We discuss the new, revised, and unchanged certification criteria that we are adopting as the 2014 Edition EHR certification criteria in sections A.8 through A.10 below. We include a table at the beginning of the discussion of each certification criterion or criteria that specifies the MU objective that the 2014 Edition EHR certification criterion or criteria support. The objective cited is either a Stage 1 or Stage 2 objective that will be effective for the EHR reporting periods in FY/CY 2014. We provide this frame of reference because beginning in FY/CY 2014 EHR technology will need to be certified to the 2014 Edition EHR certification criteria to meet the CEHRT definition and the tables clearly associate the certification criterion or criteria with the MU objective it supports. The tables also specify the CFR location for each certification criterion adopted in § 170.314.

    2. Applicability

    Section 170.300 establishes the applicability of subpart C—Certification Criteria for Health Information Technology. Section 170.300(a) establishes the applicability of the adopted certification criteria to the testing and certification of Complete EHRs and EHR Modules. Section 170.300(b) specifies that when a certification criterion refers to two or more standards as alternatives, the use of at least one of the alternative standards will be considered compliant. Section 170.300(c) specifies that Complete EHRs and EHR Modules are not required to be compliant with certification criteria that are designated as optional.

    We proposed to revise § 170.300 to reflect our proposed regulatory structure for the 2014 Edition EHR certification criteria. We proposed to revise paragraph (c) to add that Complete EHRs and EHR Modules are also not required to be certified to specific capabilities within a certification criterion that are designated as optional. We also proposed to add a paragraph (d) that would clarify which certification criteria or specific capabilities within a certification criterion included in § 170.314 have general applicability (i.e., apply to both ambulatory and inpatient settings) or apply only to an inpatient setting or an ambulatory setting.

    Comments.Comments asked for clarification on how the optionality provided for capabilities within certification criteria would be clearly identified to purchasers of certified EHR technology.

    Response.We expect that the certifications issued to EHR technology will clearly indicate whether the EHR technology was certified to any optional capability within a certification criterion or, for that matter, any optional certification criterion. The Certified HIT Product List (CHPL) will also indicatewhether a certified Complete EHR or certified EHR Module was certified to an optional certification criterion or an optional specific capability within a certification criterion.

    3. Scope of a Certification Criterion for Certification

    In the Proposed Rule, based on our proposal to codify all the 2014 Edition EHR certification criteria in § 170.314, we clarified that certification to the certification criteria at § 170.314 would occur at the second paragraph level of the regulatory section. We noted that the first paragraph level in § 170.314 organizes the certification criteria into categories. These categories include: clinical (§ 170.314(a)); care coordination (§ 170.314(b)); clinical quality measures (§ 170.314(c)); privacy and security (§ 170.314(d)); patient engagement (§ 170.314(e)); public health (§ 170.314(f)); and utilization (§ 170.314(g)). Thus, we stated that a certification criterion in § 170.314 is at the second paragraph level and would encompass all of the specific capabilities in the paragraph levels below with, as noted in our discussion of “applicability,” an indication if the certification criterion or the specific capabilities within the criterion only apply to one setting (ambulatory or inpatient).

    Comments.We received no comments on this clarification.

    Response.Having adopted the 2014 Edition EHR certification criteria in § 170.314 as we proposed, our clarification remains accurate. Additionally, we offer further clarity with an illustration of this principle using the “demographics” certification criterion adopted at § 170.314(a)(3) (second paragraph level). The certification criterion includes two specific capabilities at (3)(i) and (ii) (third paragraph level): “(i)” enable a user to electronically record, change, and access patient demographic data including preferred language, gender, race, ethnicity, and date of birth (in accordance with the specified standards for race, ethnicity, and preferred language (§ 170.314(3)(i)(A) and (B)); and, “(ii)” for the inpatient setting only, enable a user to electronically record, change, and access preliminary cause of death in the event of mortality. Consequently, to meet the demographics certification criterion, for example, EHR technology designed for the inpatient setting would need to meet § 170.314(a)(3)(i)(A) and (B) and (ii), while EHR technology designed for the ambulatory setting would only need to meet (3)(i)(A) and (B) because the capability at (3)(ii) only applies to the inpatient setting.

    4. Explanation and Revision of Terms Used in Certification Criteria

    In the Proposed Rule, we noted that certain terms are repeatedly used in the proposed 2014 Edition EHR certification criteria. We stated that, based on our experience and stakeholder feedback related to how terms in the 2011 Edition EHR certification criteria have been interpreted, it was necessary in certain cases to select different terms. Therefore, we provided the following list of terms that are repeatedly used in the 2014 Edition EHR certification criteria and the intended meaning for each term.

    “User” is used to mean a health care professional or his or her office staff or a software program or service that would interact directly with the CEHRT. This is essentially the same description that we gave to “user” in the S&CC July 2010 final rule (75 FR 44598). We clarified that, unless expressly stated otherwise, “user” does not mean a patient.

    Record” is used to mean the ability to capture and store information in EHR technology. We consider this meaning complementary to and consistent with related terms, namely “change and “access,” and their associated capabilities.

    Change” is used to mean the ability to alter or edit information previously recorded in EHR technology. We proposed to replace the term “modify” used in the 2011 Edition EHR certification criteria with “change.” Although we interpret both terms to have essentially the same meaning, we believe “change” connotes a more plain language meaning as recommended byplainlanguage.gov. 1 In certification criteria in which this term is used, we stated that we do not intend for it to be interpreted to mean that information previously recorded would be able to be changed without the retention of prior value(s). Rather, a change must be retained as an audited event and in a viewable format that identifies the changed information in a patient's record (similar to how one might see changes represented in a word-processing application). How such changes are displayed is a design decision left to EHR technology developers.

    1 http://www.plainlanguage.gov/howto/wordsuggestions/simplewords.cfm#lm

    Access” is used to mean the ability to examine or review information in or through EHR technology. We proposed to replace the term “retrieve” used in the 2011 Edition EHR certification criteria with “access” because we believe it is clearer and more accurately expresses the capability we intend for EHR technology to include. We noted that some stakeholders had interpreted “retrieve” to suggest that the EHR technology also needed to be able to obtain data from external sources. Nevertheless, we stated that we interpret both “access” and “retrieve” to have essentially the same meaning, but note that “access” should not be interpreted to include necessarily the capability of obtaining or transferring the data from an external source.

    Incorporate” is used to mean to electronically import, attribute, associate, or link information in EHR technology. With the exception of import, we previously used these terms to describe the “incorporate” capability included in certification criteria as illustrated by the capability specified at § 170.302(h)(3). We proposed to revise its unique meaning for the 2014 Edition EHR certification criteria and the purposes of certification to account for the ability to electronically import information.

    Create” is used to mean to electronically produce or generate information. We proposed to replace the term “generate” used in the 2011 Edition EHR certification criteria with “create.” We stated that “create” is clearer and is a better word choice than generate from a plain language perspective.

    Transmit” is used to mean to send from one point to another.

    Comments.Commenters expressed general support for our proposed replacement of terms in certification criteria with the proposed terms described above. A few commenters, however, expressed confusion about our description of “incorporate” as we described it and used it in different certification criteria such as the proposed “transitions of care-incorporate summary care record” certification criterion (§ 170.314(b)(1)) and the “incorporate laboratory tests and values/results” certification criterion (§ 170.314(b)(5)).

    Response.We appreciate the support for the proposed term replacements and are replacing the terms as proposed, except for the term “incorporate.” We agree with commenters that our description of incorporate could create confusion based on the context in which we proposed to use it in different certification criteria. In consideration of comments received, we have revised our description of incorporation to reflect the common interpretation commenters stated they assigned to the term. Thus,when the term incorporate is used within a certification criterion it is intended to mean to electronically process structured information from another source such that it is combined (in structured form) with information maintained by EHR technology and is subsequently available for use within the EHR technology by a user. As part of the 2014 Edition EHR certification criteria, the “transitions of care” and “incorporate laboratory tests and values/results” certification criteria at § 170.314(b)(2) and (b)(5), respectively, reference this term in the context of a specific capability that would require EHR technology to be able to incorporate information.

    Comments.Commenters expressed confusion about how to interpret our use of the phrase “included in one or any combination of the following” in certification criteria.

    Response.To eliminate any potential confusion, we have revised the certification criteria containing this phrase to read “each one and at least one combination of the following data.” We use this phrase to mean that the capability for which certification is required must be able to individually address each of the data specified in the certification criterion and at least one combination of those data. “One combination” means a combination of two or more of the data listed in the certification criterion. For example, in the clinical decision support (CDS) certification criterion six categories of data are listed in paragraphs § 170.314 (a)(8)(i)(A) through (F). The certification criterion states “enable a limited set of identified users to select (i.e., activate) one or more electronic clinical decision support interventions … based on each one and at least one combination of the following data.” Thus, to meet this certification criterion EHR technology must be able to enable the selection of CDS interventions that would be separately applicable to the data listed in (A) through (F) and at least one combination of the data listed in (A) through (F), such as (A) and (D) (problems and demographics).

    To provide further clarity for the 2014 Edition EHR certification criteria, we have revised a number of certification criteria to now begin with “EHR technology must be able to * * *” rather than “Enable a user to * * *.” We believe this approach more clearly communicates that theEHR technologymust demonstrate the capability to be certified to the certification criterion. As one last point of clarification, we replaced “data element” references in certification criteria, where appropriate, with simply “data.” We believe this clarifies when we intend to mean data that includes types and elements. We also believe this will prevent confusion when the reference point is solely a “data element.”

    Comments.Commenters asked how terms used in MU objectives and measures are defined for the purposes of the 2014 Edition EHR certification criteria, such as “electronic notes,” “images,” “care plan,” and “care team.”

    Response.We incorporate in our certification criteria the terms used in MU objectives and measures as they are defined or described in the Stage 2 final rule.

    5. Consensus-Based Standards

    Comments.Commenters stated that for interoperability to be successful, it was essential that standards be created through collaborative, consensus-based processes that take into consideration the needs and concerns of all interested stakeholders.Response.Federal agencies are required under the National Technology Transfer and Advancement Act of 1995 (NTTAA) (15 U.S.C. § 3701 et seq.) and OMB Circular A-1192 to use, wherever practical, technical standards that are developed or adopted by voluntary consensus standards bodies to carry out policy objectives or activities, with certain exceptions. Both the NTTAA and OMB Circular A-119 provide for certain exceptions to selecting only standards developed or adopted by voluntary consensus standards bodies, namely when doing so would be inconsistent with applicable law or otherwise impractical. In this final rule, we have adopted or refer to voluntary consensus standards, except for the following government-unique standards: the Office of Management and Budget Standards for Maintaining, Collecting, and Presenting Federal Data on Race and Ethnicity; the three transport standards adopted in § 170.202; the standard that identifies the data elements referenced by clinical quality measures (adopted at § 170.204(c)); and certain standards related to the protection of electronic health information adopted in § 170.210. We are aware of no voluntary consensus standards that would serve as alternatives to these standards for the purposes that we have identified.

    2 http://www.whitehouse.gov/omb/circulars_a119.

    Comments.A commenter suggested that we incorporate the HL7 EHR System Functional Model (ISO/HL7 10781 standard) into certification. The commenter noted that is a long-standing international consensus standard for EHR System functionality and that Release 2 of this standard is currently in ballot by the International Standards Organization Technical Committee 215 on Health Informatics (ISO TC215), the Committee for European Normalization Technical Committee 251 (CEN TC251), the International Health Terminology Standards Development Organisation (IHTSDO), the Clinical Data Interchange Standards Consortium (CDISC) and Health Level Seven (HL7). The commenter suggested that “linking” the function and conformance criteria of the internationally-recognized ISO/HL7 10781 standard to the 2014 Edition EHR certification criteria for the purposes of certification would make EHR technology certified under the ONC HIT Certification Program more competitive in international markets.

    Response.It is our understanding that the HL7 EHR System Functional Model provides a comprehensive set of EHRsystemfunctional requirements that in many cases goes beyond the scope of the capabilities required by the 2014 Edition EHR certification criteria. As such, this comment is outside the scope of this current rulemaking. However, we strongly support methods that could be used to increase international interoperability and acceptance of EHR technology certified under the ONC HIT Certification Program. Accordingly, we intend to explore and request that the HITPC and HITSC consider the applicability and usefulness of the HL7 EHR System Functional Model as a basis for future recommendations on certification criteria.

    6. Adopting Versions of Standards

    Comments.We received comments recommending that we adopt standards at a higher level of abstraction and that we should not be overly prescriptive about the exact version and release of vocabulary and messaging protocols. That is, that we should not adopt a particular version of a content exchange standard for which certification would be required, (e.g., HL7 2.x, where “x” could be any version within the version 2 family) and accompany the adopted standards with detailed implementation specifications or guidance outside of rulemaking.

    Response.While the commenters' recommendation may provide added flexibility, we are unable to accept the recommendation for multiple reasons. First, it has the potential to create interoperability challenges. Second, there are processes under the Administrative Procedure Act that must be followed for the adoption of substantive requirements. Third, in accordance with Office of the Federal Register regulations related to “incorporation by reference,” 1 CFRpart 51, which we follow for this final rule, the publications we reference are “limited to the edition of the publication that is approved” and do not include “[f]uture amendments or revisions of the publication.” Consequently, we do not include regulatory language that refers, for instance, to “Version 1.X” when “X” remains a variable.

    We note, however, that we have taken two steps for certain vocabulary standards designated as minimum standards code sets. First, in this final rule we have adopted updated versions of four vocabulary standards that we proposed for certification in the Proposed Rule. We proposed the use of the January 2012 International Release of SNOMED CT®, but have adopted the July 2012 International Release of SNOMED CT® as well as the March 2012 U.S. Extension to SNOMED CT®. We proposed the use of version 2.38 of LOINC®, but have adopted version 2.40. We proposed the use of the February 2012 monthly version of RxNorm, but have adopted the August 2012 monthly version of RxNorm. We proposed the use of the August 15, 2011 version of CVX code sets, but have adopted the updated through July 11, 2012 version. In all these instances, we have found that the newer versions improve interoperability and EHR technology implementation, support MU, and do not create additional substantive requirements in comparison to the proposed versions of these vocabulary standards. Further, the adoption of these versions establishes the baseline in the CFR with the most recent versions of these vocabulary standards that is possible. Second, we have also established an approach that permits the use of newer versions of these standards than the one adopted in the CFR. We refer readers to section IV.B for a discussion of “minimum standards” code sets and our new more flexible approach for their use in certification and upgrading certified Complete EHRs and certified EHR Modules. Readers should also review § 170.555, which specifies the certification processes for “minimum standards” code sets.

    7. Display of Vocabulary Standards

    Comments.Several commenters asked a similarly themed question with respect to the vocabulary standards we proposed to adopt. The question centered on whether EHR technology was required to display a particular vocabulary to a user (for the certification criteria that require recording certain patient information in a vocabulary standard) in order to be certified. Commenters explained that for the problem list certification criterion that SNOMED CT® codes should not be required for display in EHR technology and that an organization should be able to use whichever code set they prefer to display. Others provided similar rationale and said that health care providers are typically unfamiliar with SNOMED CT®. Commenters raised similar questions regarding the display of race and ethnicity as well as smoking status.

    Response.We agree with commenters and want to make clear that EHR technology does not have to display an adopted vocabulary to a user to be certified to the certification criterion that includes the vocabulary standard. For a more detailed discussion and example of our intent please review our responses to the problem list certification criterion.

    8. Common Data in Certification Criteria

    Comments.Several commenters pointed out that we repeat much of the same data in the “view, download, and transmit to a 3rd party,” “clinical summaries,” and both “transitions of care” certification criteria. These commenters suggested that we specify a single definition that included this common data and then reference that definition in the applicable certification criteria. They added that this would cut down on the repetitiveness of the certification criteria, make the certification criteria smaller and, thus, easier to read, and that this approach would be more efficient overall. Commenters recommended that we define a “Summary Care Record.”

    Response.We agree with commenters' suggestions. Further, we note that the data we reference in these certification criteria mirror those specified by CMS for the objectives and measures to which these certification criteria correlate. Because there is a common set of MU data types/elements for which certification would be required across several certification criteria, we have created the term “Common MU Data Set.” We define this term by only the data that is common to (i.e., included in all five certification criteria) the “view, download, and transmit to a 3rd party,” “clinical summary,” “transitions of care—receive, display, and incorporate transition of care/referral summaries,” “transitions of care—create and transmit transition of care/referral summaries,” and “data portability” certification criteria (see Table 2 below). We decline to create a specific definition for “summary care record” because the Common MU Data Set definition serves multiple certification criteria that reference different “summary” oriented documents. For instance, data referenced in the “clinical summary” shares the data in the Common MU Data Set with the “transitions of care” certification criteria, but also includes unique data that is specific to a clinical summary. The following data are included in the Common MU Data Set definition and where applicable reference the standard that would have otherwise been assigned if the data were individually included within the certification criteria.

    Table 2—Common MU Data Set 1. Patient name 2. Sex. 3. Date of birth 4. Race. 5. Ethnicity 6. Preferred language. 7. Smoking status 8. Problems. 9. Medications 10. Medication allergies. 11. Laboratory test(s) 12. Laboratory value(s)/result(s). 13. Vital signs (height, weight, BP, BMI) 14. Care plan field(s), including goals and instructions. 15. Procedures 16. Care team members.

    We also believe that further clarity for stakeholders can be provided through the use of more specific descriptions for the different types of “data summaries” referenced in certification criteria. These specific descriptions are listed below and are used in the applicable certification criteria and referenced in the preamble discussions of the certification criteria. This revision is intended to make the data referenced in the final rule and the “data summary” to which it is assigned more readily apparent to readers. We note that the use of these specific descriptions in the certification criteria are for regulatory clarity purposes only and do not imply any additional meaning.

    Certification criterion Type of summary Data portability § 170.314(b)(7) Export Summary. Transitions of care—receive, display, and incorporate transition of care/referral summaries § 170.314(b)(1) Transition of care/referral summary. Transitions of care—create and transmit transition of care/referral summaries § 170.314(b)(2) View, download, and transmit to a 3rd party § 170.314(e)(1) Ambulatory Summary.
  • Inpatient Summary.
  • Clinical Summary § 170.314(e)(2) Clinical Summary.
    9. New Certification Criteria

    In the Proposed Rule, we described certification criteria that we considered “new.” We noted the following factors that we would consider when determining whether a certification criterion is “new”:

    • The certification criterion only specifies capabilities that have never been included in previously adopted certification criteria; or

    • The certification criterion was previously adopted as “mandatory” for a particular setting and subsequently adopted as “mandatory” or “optional” for a different setting.

    Comments.We did not receive comments questioning our description of new certification criteria.

    Response.We therefore continue to use this descri