Privacy & Security ‘Tiger Team’ Seeks Comments on Provider-Entity Authentication: Due Oct 29

Privacy & Security “Tiger Team” Seeks Comments on Provider-Entity Authentication
Please comment by October 29, 2010

Tuesday, October 19th, 2010 | Posted by: Deven McGraw and Paul Egerman and reposted here by e-Healthcare Marketing.

The Privacy & Security Tiger Team is currently considering policy recommendations to ensure that authentication “trust” rules are in place for information exchange between provider-entities (or organizations).  We are currently evaluating these trust rules at the organizational level, and as such, our scope here does not include authentication of individual users of electronic health record (EHR) systems.  For purposes of this discussion, authentication is the verification that a provider entity (such as a hospital or physician practice) seeking access to electronic protected health information is the one claimed, and the level of assurance is the degree of confidence in the results of an authentication attempt. 

We hope that we can have a robust discussion on this blog that provides valuable input on this topic.  All comments are welcome, but we particularly encourage you to consider the following questions:

  1. What strength of provider-entity authentication (level of assurance) might be recommended to ensure trust in health information exchange (regardless of what technology may be used to meet the strength requirement)?
  2. Which provider-entities can receive digital credentials, and what are the requirements to receive those credentials?
  3. What is the process for issuing digital credentials (e.g., certificates), including evaluating whether initial conditions are met and re-evaluation on a periodic basis?
  4. Who has the authority to issue digital credentials?
  5. Should ONC select an established technology standard for digital credentials and should EHR certification include criteria that tests capabilities to communicate using that standard for entity-level credentials?
  6. What type of transactions must be authenticated, and is it expected that all transactions will have a common level of assurance?

Please comment by October 29, 2010, and identify which question(s) you are responding to.

Thank you,
Deven McGraw and Paul Egerman
Privacy & Security Tiger Team Co-Chairs

Please comment directly on ONC Health IT Buzz blog by clicking on this link.

Blumenthal Letter #20: Health IT Vendor Help Sought on Disparities in EHR Adoption

A Letter to the Vendor Community: Health IT and Disparities

Dr. David Blumenthal
Dr. David Blumenthal

A Message from Dr. David Blumenthal
National Coordinator for
Health Information Technology
October 18, 2010
Excerpted from ONC site on Oct 21, 2010

These are historic times.  The HITECH Act is bringing the power of electronic health records to our health care system.  We are writing to solicit your assistance in making sure that we are not creating a new form of “digital divide” and want to make sure that health IT vendors include providers who serve minority communities in their sales and marketing efforts.

Both the Office of the National Coordinator for Health Information Technology (ONC) and the Office of Minority Health (OMH) appreciate the significant benefits that the use of health information technology (HIT) and electronic health records (EHR) provide to both healthcare providers and patients in delivering and managing health.  Some of these benefits include improved personal decision-making and increased patient safety (resulting in a decrease of medical errors) – both of which lead to improved quality and a more efficient delivery of care, that may result in the prospect of cost savings. 

It is absolutely necessary that the leading EHR vendors work together, continuing to provide EHR adoption opportunities for physicians and other healthcare providers working within underserved communities of color.  Despite our best efforts, data from the National Ambulatory Medical Care Survey indicates that EHR adoption rates remain lower among providers serving Hispanic or Latino patients who are uninsured or relied upon Medicaid.  Moreover, this data also identifies that EHR adoption rates among providers of uninsured non-Hispanic Black patients are lower than for providers of privately insured non-Hispanic White patients.    

Racial and ethnic minorities remain disproportionately affected by chronic illness(es), a contributing factor to intolerably high mortality and morbidity rates.  Electronic health records possess the ability to help improve both the quality and efficiency of medical care accessible by minorities, so that perhaps rates of chronic illness, mortality and morbidity decrease within these communities.  It is critical that this administration, Regional Extension Centers and EHR vendors work together and focus substantial efforts on these priority populations.

To discuss outreach opportunities further, please contact Dr. Sachin H. Jain, Sachin.jain@hhs.gov at ONC and Commander David Dietz, David.Dietz@hhs.gov at OMH.

Sincerely,
David Blumenthal, MD, MPP
National Coordinator for Health Information Technology

Garth N. Graham, MD, MPH
Director of the Office of Minority Health

The Office of the National Coordinator for Health Information Technology (ONC) encourages you to share this information as we work together to enhance the quality, safety and value of care and the health of all Americans through the use of electronic health records and health information technology.

For more information and to receive regular updates from the Office of the National Coordinator for Health Information Technology, please subscribe to ONC’s Health IT News list.

ONC Certified Health IT List (CHPL) of EHRs–Alpha Ordered

ONC Certified HIT List (CHPL) Published at Last
NOTE: The EHR and EHR module list below has been reordered alphabetically according to vendor name by e-Healthcare Marketing and taken from the ONC list officially dated October 5, 2010. ONC’s official list can be found at http://onc-chpl.force.com/ehrcert

The Office of the National Coordinator (ONC) for Health IT at last published its official list of tested and certified EHRs and EHR modules on October 8, 2010. Possible delays of only a few days between CCHIT sending ONC its list of tested and certified products and having the list validated by ONC, and ONC’s using a new platform from its HITRC (Health IT Research Center) and Partners, led to those in Health IT being baffled for a few days as to the status of the official list of ONC-ATCB’s (Authorized Testing and Certification bodies) certified, approved and ONC-validated EHRs. The waiting of those watching too closely is over.

Excerpted from ONC on October 8, 2010:
The ONC Certified HIT Product List (CHPL) provides a comprehensive listing of Complete EHRs and EHR Modules that have been tested and certified under the Temporary Certification Program.

Each Complete EHR and EHR Module listed below has been tested and certified by an ONC-Authorized Testing and Certification Body (ATCB). The ONC-ATCB has reported certain required information about the Complete EHR or EHR Module to ONC and we have validated these reports. Certified EHR technologies are identified with the name of the certifying ATCB, the ONC certification number, vendor information, product information, and product version number.

Please note: The CHPL lists only those EHR technologies that have been tested, certified, and reported to ONC by an ONC-ATCB, with reports validated by ONC. Only those EHR technologies appearing on the ONC-Certified Health IT Product List may be granted the reporting number that will be accepted by CMS for purposes of attestation under the EHR (“meaningful use”) incentives programs.

Using the CHPL

The Products Overview table references two types of EHR product certification classifications, one for Complete EHRs and one for EHR Modules.

EHR technology classified as Complete EHRs are certified to meet all applicable certification criteria adopted by the Secretary in the Standards and Certification Criteria Final Rule (45 CFR Part 170 subpart C). In the Standards and Certification Criteria Final Rule, the Accounting for Disclosures certification criterion (§170.302(w)) is optional for EHR technologies and may not appear.

EHR Modules are those EHR technologies that have been tested and certified to at least one of the certification criteria adopted by the Secretary in the Standards and Certification Criteria Final Rule. Due to the regulatory requirement that EHR Modules be tested and certified to the security criteria, as elaborated in the Temporary Certification Program Final Rule, EHR Modules will typically be tested and certified to more than one of the adopted certification criteria.

The CHPL provides a snapshot of the current listing of certified EHR technologies, and is updated as newly certified EHR technologies are reported by ONC-ATCBs to ONC and validated.

To determine which criterion an EHR technology is certified to meet, select “Certification Status” below for a listed product. The link will take you to the Product Certification Matrix indicating which of the Certification Criteria the product has been tested, certified, and reported to meet.

Please note: This is Version 1.0 of the Certified Health IT Product List (CHPL). Version 2.0 is under development and is expected to provide additional information, such as a list of the Clinical Quality Measures to which a given product was tested; and additional functionality, such as different ways to query and sort the data for viewing. The later version will also provide the above-mentioned reporting number that will be accepted by CMS for purposes of attestation under the EHR (“meaningful use”) incentives programs. Please send suggestions and comments regarding the Certified Health IT Product List (CHPL) to ONC.certification@hhs.gov, with “CHPL” in the subject line.

Product Certification Overview — Alpha Ordered by Vendor

Vendor Product Product Class- ification Module Product Version # Certification Status Certifying ATCB ONC Certification #
ABEL Medical Software Inc. ABELMed EHR – EMR / PM Complete EHR N/A 11 View Criteria CCHIT CC-1112-621996-1
Allscripts Allscripts PeakPractice Modular N/A 5.5 View Criteria CCHIT CC-1112-216363-1
Allscripts Allscripts Professional EHR Complete EHR N/A 9.2 View Criteria CCHIT CC-1112-395691-1
Allscripts Allscripts ED Modular N/A 6.3 Servic View Criteria CCHIT CC-1112-814405-1
Aprima Medical Software, Inc Aprima Complete EHR N/A 2011 View Criteria CCHIT CC-1112-607751-1
athenahealth, Inc athenaClinicals Complete EHR N/A 10.1 View Criteria CCHIT CC-1112-360400-1
Cerner Corporation Cerner Millennium Powerchart, Cerner Millennium FirstNet, Cerner Millennium ProF Modular N/A Version 20 View Criteria CCHIT CC-1112-657723-1
ChartLogic, Inc. ChartLogic EMR Complete Ambulatory NA 7 View Criteria Drummond Group Inc. 09232010-1945-1
Compulink Advantage/EHR Complete EHR N/A 10 View Criteria CCHIT CC-1112-380800-1
CureMD Corporation CureMD EHR Complete EHR N/A Version 10 View Criteria CCHIT CC-1112-789570-1
eClinicalWorks LLC eClinicalWorks Complete EHR N/A 8.0.48 View Criteria CCHIT CC-1112-955447-1
Epic Systems Corporation EpicCare Ambulatory – Core EMR Complete EHR N/A Spring 200 View Criteria CCHIT CC-1112-574355-2
Epic Systems Corporation EpicCare Inpatient – Core EMR Complete EHR N/A Spring 200 View Criteria CCHIT CC-1112-574355-1
GE Healthcare Centricity Advance Complete EHR N/A 10.1 View Criteria CCHIT CC-1112-470465-1
gloStream, Inc. gloEMR Complete EHR N/A 6 View Criteria CCHIT CC-1112-501340-1
Health Care Systems, Inc. HCS eMR Modular N/A 4 View Criteria CCHIT CC-1112-107740-1
ifa united i-tech Inc. ifa EMR Modular Ambulatory 6 View Criteria Drummond Group Inc. 09222010-2627-1
Intivia, Inc. InSync Complete Ambulatory N/A 5.4 View Criteria Drummond Group Inc. 09292010-2301-1
Intuitive Medical Software UroChartEHR Complete EHR N/A 4 View Criteria CCHIT CC-1112-115970-1
MCS – Medical Communication Systems, Inc. iPatientCare Complete EHR N/A 10.8 View Criteria CCHIT CC-1112-607019-1
Medical Informatics Engineering WebChart EHR Complete EHR N/A Version 5. View Criteria CCHIT CC-1112-844134-1
Meditab Software, Inc. IMS Complete EHR N/A v. 14.0 View Criteria CCHIT CC-1112-372910-1
NeoDeck Software NeoMed EHR Complete EHR N/A 3 View Criteria CCHIT CC-1112-879100-1
NexTech Systems Inc. NexTech Practice 2011 Modular N/A 9.7 View Criteria CCHIT CC-1112-998990-1
nextEMR, LLC nextEMR, LLC Modular N/A 1.5 View Criteria CCHIT CC-1112-300090-1
NextGen Healthcare NextGen Ambulatory EHR Complete EHR N/A 5.6 SP1 View Criteria CCHIT CC-1112-345777-1
Nortec Software Inc Nortec EHR Complete EHR N/A 7 View Criteria CCHIT CC-1112-837410-1
PeriGen PeriBirth Modular N/A 4.3.51 View Criteria CCHIT CC-1112-586750-1
Prognosis Health Information Systems ChartAccess Complete EHR N/A 4 View Criteria CCHIT CC-1112-216590-1
Pulse Systems 2011 Pulse Complete EHR Complete EHR N/A 2011 View Criteria CCHIT CC-1112-946110-1
QRS, Inc. PARADIGM Modular Ambulatory 8.3 View Criteria Drummond Group Inc. 09202010-8775-1
Sammy Systems SammyEHR Modular N/A 5.1.1 View Criteria CCHIT CC-1112-789800-1
SuccessEHS SuccessEHS Complete EHR N/A 6 View Criteria CCHIT CC-1112-909422-1
The DocPatientNetwork.com Doctations Complete EHR N/A 2 View Criteria CCHIT CC-1112-371480-1
T-System Technologies, Ltd. T SystemEV Modular N/A 2.7 View Criteria CCHIT CC-1112-239140-2
T-System Technologies, Ltd. T SystemEV Modular N/A 2.7 View Criteria CCHIT CC-1112-239140-1
Universal EMR Solutions Physician’s Solution Modular N/A 5 View Criteria CCHIT CC-1112-681600-1
Vision Infonet Inc., MDCare EMR Modular N/A 4.2 View Criteria CCHIT CC-1112-516500-1
WellCentive WellCentive Patient Registry Modular N/A Version 2. View Criteria CCHIT CC-1112-946650-1
Wellsoft Corporation Wellsoft EDIS Modular N/A v11 View Criteria CCHIT CC-1112-527400-1

Blumenthal Blogs on Health IT-based Patient Safety and Commissioned IOM report

Returning to the Source to Help Achieve Patient Safety Goals
Thursday, October 7th, 2010 | Posted by: Dr. David Blumenthal originally on ONC’s Health IT Buzz Blog and republished here by e-Healthcare Marketing blog.

Two landmark reports by the Institute of Medicine (IOM) changed Americans’ perception of their health care system and launched today’s drive to improve the quality and safety of medical care in America. The reports were To Err Is Human, published in 1999, and Crossing the Quality Chasm, released in 2001. 

Both these reports highlighted the important potential role that health information technology (HIT) could play in improving health care quality and reducing medical errors. In fact, Recommendation #9 in Crossing the Quality Chasm called for “renewed national commitment to building an information infrastructure” and said: “This commitment should lead to the elimination of most handwritten clinical data by the end of the decade.”

The end of that decade is now just three months away, and not to mince words, we’re behind the ambitious schedule that the IOM report envisioned. Nonetheless, we have at last made the substantial commitment that was called for in the report.  

Last year in the HITECH Act, Congress and the President authorized $27 billion in Medicare and Medicaid incentive payments for providers who adopt and make meaningful use of certified electronic health records (EHRs). At the same time, the Act created $2 billion in new programs to support the transition to HIT-assisted care. And this summer, the regulatory framework was completed for Stage 1 of the Meaningful Use path toward an EHR-based future in health care.

With the engines of change now in place, it is time to bring closer focus to other key issues for achieving the full potential benefits of HIT. One of these is the issue of improving patient safety. 

We know, both in theory and practice, that HIT-assisted care can reduce errors and improve patient safety. In particular:  

  • Reliable access to complete personal health information is the foundation of safe and effective care. EHRs are inherently superior to paper in delivering such access.    
  • Even more uniquely, EHRs can use their computing power to automatically cross-check personal information and other sources. With such backup, clinicians can be automatically alerted when drugs or other treatments may be contraindicated because of allergies, potential drug interactions, or other factors.

At the same time, however, it would be naïve to suppose that HIT-assisted care can deliver its full patient safety benefits in a single stroke – or that HIT will not present its own safety issues. Clinicians need to become familiar with new EHR systems, which will take time. EHR systems themselves need to evolve and improve. We need to ensure that the “decision support” information they provide is accurate and personalized. Their interfaces need to grow in user-friendliness. Even safety alerts need to find the right medium and avoid producing “alert fatigue.”

These challenges can be met – and indeed, the very “fix-ability” of HIT-based care can be one of its primary safety benefits. HIT systems tend to record and expose patient safety problems when they occur, while paper-based care too often hides them. And EHRs are amendable to rapid, systemic correction of problems – while corrections in a non-systemic, paper-based clinic can take years to accomplish, even when they are identified.

How can we maximize patient safety through HIT-based care? What roles and actions by government, the private sector, and health care providers themselves can help achieve the full potential benefits that were sought in those seminal IOM reports?

As we address these questions, there is no better source of guidance than the IOM itself, building on the same expertise and convening power that produced its initial reports 10 years ago. For that reason, the Office of the National Coordinator for Health Information Technology has contracted with IOM for a follow-up one-year study. In this study, IOM will:  

  • Identify approaches to promote the safety-enhancing features of HIT while protecting patients from any safety problems associated with HIT and preventing HIT-related patient safety problems before they occur;
  • Identify approaches for surveillance and reporting activities to bring about rapid detection and correction of patient safety problems;
  • Address the potential roles of private sector entities such as accrediting and certification bodies as well as patient safety organizations and professional and trade associations; and
  • Examine existing authorities and potential roles for key federal agencies, including the Food and Drug Administration, the Agency for Healthcare Research and Quality, and the Centers for Medicare & Medicaid Services.

As this study is carried out, we will move where appropriate to improve surveillance, reporting, product safety, and clinician performance. But at the same time, we will anticipate a “deep dive” in knowledge synthesizing and a new round of productive recommendations from the IOM.

There is every reason to believe that HIT-assisted care will be transformative for American medicine, but no reason to think the change will be easy or instantaneous. We are returning to the IOM as a key partner in helping to refine the course that it first helped to chart a decade ago.
###
To post comments, please go to ONC’s Health IT Buzz blog.

Blumenthal Blogs on Kaiser Permanente Gift of Translator: CMT–Convergent Medical Terminology

The Gift of Innovation from Within
Thursday, October 7th, 2010 | Posted by: Dr. David Blumenthal originally on ONC’s Health IT Buzz blog and republished here by e-Healthcare Marketing. 

The health information technology (health IT) sector received an important gift on Sept. 29.  In fact, we received two important gifts.  Both these gifts came from Kaiser Permanente.  And both stemmed from Kaiser’s long-time investment and innovation in health IT adoption and use.

At a ceremony at HHS headquarters last week, Kaiser donated its Convergent Medical Terminology (CMT) for open availability to any HIT developer.  The technology enables clinicians to use the terms that are familiar to them in diagnosis and treatment.  CMT acts like a simultaneous translator in several directions.  For clinicians, it translates clinical language they use to communicate with colleagues into the technical terms that electronic health records (EHRs) use to communicate with other records.  For patients, it takes those underlying technical terms and makes them understandable to lay persons.  And, it can translate clinicians’ terminology directly into lay language as well.  It also facilitates the usability of EHRs and the sharing of health information among clinicians and patients.

This will spur adoption and meaningful use of EHRs.  CMT also will reduce current duplicative efforts – by many vendors and health care organizations – to develop and link clinician and patient-friendly terminology to underlying standards. Finally, in support of future innovation, it gives smaller EHR vendors and clinician practices that lack the resources to support vocabulary development access to high-quality clinician- and patient-friendly terminology.

CMT is a product of life in the real-world.  Kaiser recognized the barriers new EHRs represented for clinicians.  So it drew from its own substantial pool of talent to work with experts and develop a translation structure for its EHR.  Kaiser identified a high importance of clinician usability for successful EHR integration and invested in a solution.

This is precisely the kind of private sector innovation that holds the key to unlocking the potential of health IT.

As we move forward toward national and international adoption of health IT, we all each learn valuable lessons that can be shared with others.  This includes vendors and hospitals, but it also includes medical practices and care providers large and small.  I hope sharing will become another important “standard” as we innovate.  We’ll compete on costs, efficiency and quality, and usability.  But we can share important lessons as we go forward.

HHS Secretary Sebelius, White House Chief Technology Officer Aneesh Chopra, IHTSDO Chair Martin Severs, and I, were all on hand to acknowledge the hand-over of CMT.  We at ONC join them in offering our thanks to Kaiser Permanente – for CMT, and even more, for leadership in exemplifying the spirit of innovation!
###
Please post comments directly on the ONC’s Health IT Buzz blog.

InfoGard Laboratories: Third ONC-Authorized Testing and Certification Body

InfoGard Laboratories Approved to Certify EHR: Third ONC-ATCB
Press Release issued on September 20, 2010, San Luis Obispo, California.
InfoGard Laboratories, the nation’s first accredited IT security testing laboratory, is approved by the Health and Human Services, Office of the National Coordinator for Health IT as an ONC-Authorized Testing and Certification Body (ONC-ATCB) for the certification of Complete EHRs and EHR Modules for both ambulatory and inpatient settings. Eligible professionals and hospitals may collect incentive payments through meaningful use of EHR technology capable of meeting the criteria to support meaningful use under the American Recovery and Reinvestment Act (ARRA).

“We are pleased to be among the first IT laboratories to be authorized by ONC to certify EHRs” said Maclynn Brinton, President of InfoGard Laboratories. “Subsequent to accreditation by NIST in 1995 as the nation’s first IT security testing laboratory, InfoGard has developed and participated in numerous government and private sector certification testing programs. We have successfully adapted our processes to support the ONC meaningful use EHR certification requirements for stage one and we will work with both ONC and NIST as requirements are developed for the stage two program. InfoGard will be the source of many healthcare IT compliance services, including HIT certification to current and future regulatory requirements.

Recent polls confirm that preventing healthcare breaches is the number one concern of health IT decision-makers (http://www.healthcareitnews.com/news/survey-data-breach-prevention-top-mind-it-decision-makers). In addition, surveys indicate that providers will not fully embrace e-prescriptions until applications can accommodate controlled substances. Both breach safe harbor and e-prescription of controlled substances require the implementation of NIST privacy and security standards. InfoGard is the only ATCB that is also NIST accredited to assist EHR vendors with achieving compliance with these NIST standards. 

About InfoGard Laboratories 
InfoGard has been instrumental in developing a number of government and private sector test and certification programs, including NIST’s Cryptographic Module Validation Program, programs for postage metering systems in five western countries, and two programs for the payment card industry. InfoGard is also an accredited Common Criteria laboratory. This experienced has provided InfoGard the ability to collaborate successfully with many different organizations in the development of testing and certification programs. InfoGard is independent, self-funded, and employee owned. We offer no hardware, software, or system products and we do not provide contract hardware or software design services.     

In the early 1990s, InfoGard’s founders collaborated with NIST on FIPS 140-1 using a worked example to develop testing requirements. Then, when the USPS was experiencing $350 million per year of postal meter fraud, InfoGard developed validation testing requirements for the first cryptographically secure postage meters. In the late 1990s, InfoGard collaborated with Visa to develop and implement the first testing program for PIN Entry Devices (point-of-sale terminals and ATMs). More recently, InfoGard collaborated with the Payment Card Industry Council (a corporation owned by VISA, MasterCard, American Express, Discover Card, and JCB) to develop and implement a certification process for approving vendors that scan merchant networks for security flaws. 

InfoGard’s consistent success with these programs demonstrates our ability to apply IT security knowledge, project management, and most importantly, collaborative skills. This has enriched our interactions with key constituencies and propagated successful new testing and certification programs.  
#              #                  #

Initial 36 EHRs/EHR Modules Approved Under Temporary Certification Program

ONC Certified Health IT Product List and CCHIT Press Release
Two ambulatory EHR modules and one complete ambulatory EHR were tested and certified by The Drummond Group and were the first officially listed  on Office of the National Coordinator (ONC) for Health IT’s Web site on the  Certified Health IT Product List on Ocotber 1, 2010.

CCHIT issued a press release on October 1, 2010 announcing testiing and certification of 33 EHR modules and complete systems. CCHIT certified 19 complete EHRs including one for a hospital and the rest for ambulatory clinician practices. Among 14 EHR systems certified by CCHIT as modules,  6 were for hospitals and remainder for ambulatory practices. CCHIT noted that many of the certified modules had been submitted as complete EHRs but had not yet been tested for a small number of tests since the federal agency, NIST, had not finalized some of the testing criteria, such as electronic prescribing.  

InfoGard Laboratories was only authorized by ONC to begin testing on September 24, 2010, while CCHIT and Drummond Group authorization began September 3, 2010. InfoGard is based in San Luis Obisop, CA; while CCHIT is based in Chicago, IL; and Drummond Group, Inc, is based in Austin, TX.

ONC’s Certified Health IT Product List
Accessed and excerpted as of 10/2/2010.
“The Certified HIT Product List (CHPL) provides a comprehensive listing of Complete EHRs and EHR Modules that have been tested and certified under the Temporary Certification Program maintained by the Office of the National Coordinator for Health IT (ONC).

“Each Complete EHR and EHR Module listed below has been certified by an ONC-Authorized Testing and Certification Body (ATCB), and reported to ONC, and approved by ONC after review. Certified products are identified with the name of the certifying ATCB, the ONC certification number, vendor information, product information, and product version number. Please note that only those products and versions included on the CHPL are deemed “certified EHR technology” under the ONC Temporary Certification Program. The CHPL provides a snapshot of the current listing of certified EHR products, and is updated as newly certified products are reported to and approved by ONC.”

Using the CHPL
“The Products Overview table references two types of EHR product certification classifications, one for Complete EHRs and one for EHR Modules.

“EHR products classified as Complete EHR are certified to meet all the mandatory certification criteria as identified in the Standards and Certification Criteria Final Rule (45 CFR Part 170 Part III). In the Final Rule, the certification criterion for Accounting for Disclosures (§170.302(w)) is optional for systems or technologies seeking certification and may not appear.

“EHR Modules are those technologies that are certified to at least one of the certification criteria as defined in the Standards and Certification Criteria Final Rule. Due to the regulatory requirement that EHR Module technologies be certified to the security criteria, as elaborated in the Final Rule, EHR Modules will typically be certified to more than one of the regulatory criteria.”

The data in the CHPL Products Overview table is current as of October 01, 2010.

Products Certification Overview 

Certifying ATCB ONC Cert # Vendor Products Products Class Module Product Ver #
Drummond Group Inc.
————–
09202010-8775-1
————–
QRS, Inc.
————–
PARADIGM
————–
Modular
—————
Ambu-
latory
————-
8.3
————
Drummond Group Inc.
————–
09222010-2627-1
————–
ifa united i-tech Inc.
————–
ifa EMR
————–
Modular
————–
Ambu-
latory
———–
6
————–
Drummond Group Inc. 09232010-1945-1 ChartLogic, Inc. ChartLogic EMR Complete Ambu-latory  NA 7

Additional details will be available next week. 

Commission Announces First ONC-ATCB 2011/2012 Certifications
Press Release Issued by CCHIT on October 1, 2010 produced in full below.

33 Electronic Health Record Products Meeting ARRA Requirements Are Available to Providers 
CHICAGO – Oct. 1, 2010 – The Certification Commission for Health Information Technology (CCHIT®) announced today that it has tested and certified 33 Electronic Health Record (EHR) products under the Commission’s ONC-ATCB program, which certifies that the EHRs are capable of meeting the 2011/2012 criteria supporting Stage 1 meaningful use as approved by the Secretary of Health and Human Services (HHS). Certification is required to qualify eligible providers and hospitals for funding under the American Recovery and Reinvestment Act (ARRA).  The certifications include 19 Complete EHRs, which meet all of the 2011/2012 criteria for either eligible provider or hospital technology, and 14 EHR Modules, which meet one or more – but not all – of the criteria.
CCHIT was among the first organizations to be recognized by the Office of the National Coordinator for Health Information Technology (ONC) as an Authorized Testing and Certification Body (ONC-ATCB). ONC-ATCB certification aligns with Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology published in the Federal Register in July 2010 and strictly adheres to the test procedures published by the National Institute of Standards and Technology (NIST) at the time of testing.  
“We are pleased to have quickly completed the certification process for these EHRs so that companies are now able to offer certified products to providers who wish to purchase and implement EHR technology and achieve meaningful use in time for the 2011-2012 incentives. This is a testament to the Commission’s long history in certifying EHRs and the skills and experience of our trained team who test the products we certify,” said Karen M. Bell, M.D., M.S.S., Chair, CCHIT. “We have ramped up our testing capacity to accommodate the demand for ONC-ATCB certification. Applications and testing dates are available for other EHR developers seeking this certification,” she said.

See the latest list of ONC-ATCB Certified 2011/2012 technology

EHR products that have received the Commission’s ONC-ATCB 2011/2012 certification are:

Complete EHRs
Company
Product
Version
Domain
ABELMed EHR – EMR / PM
11
Eligible Provider
Allscripts Professional EHR
9.2
Eligible Provider
Aprima
2011
Eligible Provider
athenaClinicals
10.10
Eligible Provider
CureMD EHR
10
Eligible Provider
Doctations
2.0
Eligible Provider
EpicCare Inpatient – Core EMR
Spring 2008
Hospital
EpicCare Ambulatory – Core EMR
Spring 2008
Eligible Provider
Centricity Advance
10.1
Eligible Provider
gloEMR
6.0
Eligible Provider
UroChartEHR
4.0
Eligible Provider
iPatientCare
10.8
Eligible Provider
WebChart EHR
5.1
Eligible Provider
IMS
v. 14.0
Eligible Provider
NeoMed EHR
3.0
Eligible Provider
NextGen Ambulatory EHR
5.6
Eligible Provider
Nortec EHR
7.0
Eligible Provider
2011 Pulse Complete EHR
2011
Eligible Provider
SuccessEHS
6.0
Eligible Provider
 
EHR Modules
Many companies offering ONC-ATCB 2011/2012 certified EHR modules applied for certification of their products as certified complete EHRs but testing could not be completed on a small number of criteria (such as electronic prescribing) because planned updates to the test procedures by NIST were not available at the time of testing. These products are certified as EHR Modules in the interim but may return to become certified as complete EHRs in the near future. Providers interested in purchasing these products should follow CCHIT’s regular ONC-ATCB product certification updates available at http://www.cchit.org/ as they occur.  
Company
Product
Version
Domain
Allscripts ED
6.3 Service Release 4
Hospital
Allscripts PeakPractice
5.5
Eligible Provider
eClinicalWorks
8.0.48
Eligible Provider
HCS eMR
4.0
Hospital
NexTech Practice 2011
9.7
Eligible Provider
nextEMR, LLC
1.5.0.0
Eligible Provider
PeriBirth
4.3.50
Hospital
ChartAccess
4
Hospital
SammyEHR
1.1.248
Eligible Provider
T SystemEV
2.7
Hospital
Physician’s Solution
5.0
Eligible Provider
MDCare EMR
4.2
Eligible Provider
WellCentive Registry
Version 2.0
Eligible Provider
Wellsoft EDIS
v11
Hospital
 
The HHS Final Rule, Establishment of the Temporary Certification Program for Health Information Technology, requires EHR developers to provide complete information on the details of their ONC-ATCB 2011/2012 certification, including company and product name and version, date certified, unique product identification number, the criteria for which they are certified, and the clinical quality measures for which they were tested, and  any additional software a complete EHR or EHR module relied upon to demonstrate its compliance with a certification criteria. This information also will be available at http://www.cchit.org  next week for the products certified by CCHIT.
CCHIT and other ONC-ATCBs are required to provide ONC with a current list of Complete EHRs and  EHR Modules that have been tested and certified. That information will be published on ONC’s Certified HIT Products List (CHPL) Web page when it becomes available. 
Many products tested and certified by CCHIT in the ONC-ATCB program are also CCHIT Certified® in the Commission’s independently developed certification program designed for physician practices and hospitals looking for more robust, integrated EHR products to support the unique needs of their clinicians and patients.  Health IT companies certify their EHRs in both programs to provide greater assurance to their customers. Companies with products applying for the CCHIT Certified program may also apply for the ONC-ATCB 2011/2012 program at no additional cost. Detailed information about products with this dual certification is available at http://www.cchit.org.
About CCHIT
The Certification Commission for Health Information Technology (CCHIT®) is an independent, 501(c)3 nonprofit organization with the public mission of accelerating the adoption of robust, interoperable health information technology. The Commission has been certifying electronic health record technology since 2006 and is approved by the Office of the National Coordinator for Health Information Technology (ONC) of the U.S. Department of Health and Human Services (HHS) as an Authorized Testing and Certification Body (ONC-ATCB).  More information on CCHIT, CCHIT Certified® products and ONC-ATCB certified electronic health record technology is available at http://cchit.org.
 
About ONC-ATCB 2011/2012 certification
The ONC-ATCB 2011/2012 certification program tests and certifies that EHR technology is capable of meeting the 2011/2012 criteria approved by the Secretary of Health and Human Services (HHS). The certifications include Complete EHRs, which meet all of the 2011/2012 criteria for either eligible provider or hospital technology and EHR Modules, which meet one or more – but not all – of the criteria. ONC-ATCB certification aligns with Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology published in the Federal Register in July 2010 and strictly adheres to the test procedures published by the National Institute of Standards and Technology (NIST) at the time of testing.   ONC-ATCB 2011/2012 certification conferred by the Certification Commission for Health Information Technology (CCHIT®) does not represent an endorsement of the certified EHR technology by the U.S. Department of Health and Human Services nor does it guarantee the receipt of incentive payments.
 
“CCHIT®” and “CCHIT Certified®” are registered trademarks of the Certification Commission for Health Information Technology.
#                      #                    #

IOM: Study to Improve Health Care Safety with Health IT

Institute of Medicine will study best policies and practices for improving health care safety with health information technology
HHS Press Release on Wednesday, September 29, 2010                         

The Institute of Medicine (IOM) will conduct a 1-year study aimed at ensuring that health information technology (HIT) will achieve its full potential for improving patient safety in health care.  The study will be carried out under a $989,000 contract announced today by the Office of the National Coordinator for Health Information Technology (ONC), which is charged with coordinating federal efforts regarding HIT adoption and meaningful use.

“Since 1999, when the IOM published its ground-breaking study To Err Is Human, the Institute has been a leader in the movement to improve patient safety,” said David Blumenthal, M.D., national coordinator for health information technology.  “This study will draw on IOM’s depth of knowledge in this area to help all of us ensure that HIT reaches the goals we are seeking for patient safety improvement.”

The study will examine a comprehensive range of patient safety-related issues, including prevention of HIT-related errors and rapid reporting of any HIT-related patient safety issues.  It will make recommendations concerning the potential effects of government policies and private sector actions in maximizing patient safety and avoiding medical errors through HIT.  Highlights of the study will include: 

* Summary of existing knowledge of the effects of HIT on patient safety;

* Identifying approaches to promote the safety-enhancing features of HIT while protecting patients from any safety problems associated with HIT;

* Identifying approaches for preventing HIT-related patient safety problems before they occur;

* Identifying approaches for surveillance and reporting activities to bring about rapid detection and correction of patient safety problems;

* Addressing the potential roles of private sector entities such as accrediting and certification bodies as well as patient safety organizations and professional and trade associations; and

* Discussion of existing authorities and potential roles for key federal agencies, including the Food and Drug Administration (FDA), the Agency for Healthcare Research and Quality (AHRQ), and the Centers for Medicare & Medicaid Services (CMS). 

“The IOM is pleased to have the opportunity to add its expertise and convening power in helping to achieve the goals of improved safety through HIT-assisted care,” said IOM President Harvey Fineberg, M.D. 

Donald Berwick, M.D., CMS administrator and a national leader on patient safety, said, “Improving patient safety in health care depends on thoroughness in planning and execution, to find problems systematically and correct them decisively.  We have high expectations for patient safety improvement through HIT, but achieving those goals will require the same careful and vigorous approach that is needed to improve safety in any enterprise.  The IOM can help us identify a productive path to better patient safety with the help of HIT.” 

Substantial funding under the Health Information Technology Economic and Clinical Health Act, part of the American Recovery and Reinvestment Act of 2009, will support the adoption and meaningful use of HIT, especially through incentives for the adoption and meaningful use of certified electronic health records. In July, CMS announced regulations outlining the initial requirements that eligible health care providers must meet to demonstrate meaningful use of certified EHR technology for the Medicare and Medicaid incentive payments program, which CMS will administer.  Also in July, ONC announced regulations completing the adoption of an initial set of standards, implementation specifications and certification criteria to enable the testing and certification of EHR technology for meaningful use Stage 1.  Earlier this month, ONC named initial testing and certifying bodies. 

More information about HIT and support for adoption and meaningful use can be found on the web at www.healthit.hhs.gov.

ONC Regulations FAQs Related to Certification

ONC Regulations FAQs Related to Certification
Posted on ONC site on 9/22/2010.

Download all 20 Questions and Answers [PDF - 79 KB]

1. Question [9-10-001-1]: What certification criteria will ONC-ATCBs use to certify EHR technology for purposes of the “deeming” provision of the Physician Self-Referral Prohibition and Anti-Kickback Electronic Health Record (EHR) Exception and Safe Harbor Final Rules?

Answer:  Both the Physician Self-Referral Prohibition EHR Exception and the Anti-kickback EHR Safe Harbor regulations, at 42 CFR 411.357(w) and 42 CFR 1001.952(y), respectively, provide that software “is deemed to be interoperable if a certifying body recognized by the Secretary has certified the software within no more than 12 months prior to the date it is provided to the recipient.”  The “recognition” of certification bodies process referred to in these regulations, as discussed in the Temporary Certification Program Final Rule (the Final Rule) (75 FR 36185) has been superseded or folded into the ONC-ATCB and ONC-ACB “authorization” processes.  Consequently, the ONC-ATCB and ONC-ACB “authorization” processes will constitute the Secretary’s “recognition” of a certification body.  With that said, as further explained in the Final Rule, ONC-ATCBs are required to test and certify EHR technology to all applicable certification criteria adopted by the Secretary at 45 CFR part 170, subpart C.  We believe that the certification criteria adopted by the Secretary specify essential interoperability requirements and build the foundation for more advanced interoperability in the future.  Any questions regarding compliance with the exception or safe harbor should be directed to the Centers for Medicare & Medicaid Services (CMS) and the HHS Office of Inspector General (OIG), respectively.

2. Question [9-10-002-1]: If my EHR technology is capable of submitting batch files to an immunization registry using the adopted standards (HL7 2.3.1 or 2.5.1 and CVX), is that sufficient for demonstrating compliance with the certification criterion specified at 45 CFR 170.302(k)?

Answer: The certification criterion at 45 CFR 302(k) does not specify, and is not intended to specify, when submissions should be made or the periodicity of the submissions. Consequently, submitting batch files to an immunization registry, provided that they are formatted according to one or both of the adopted standards, is not prohibited by this certification criterion and would be acceptable.

3. Question [9-10-003-1]: In the “Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology” Final Rule published on July 28, 2010, the Secretary adopted the following implementation specifications at 45 CFR 170.205(d)(2) for HL7 2.5.1 – Public Health Information Network HL7 Version 2.5 Message Structure Specification for National Condition Reporting Final Version 1.0 and Errata and Clarifications National Notification Message Structural Specification. We believe that these implementation specifications may have been adopted in error because they only provide direction to public health agencies on how to report to the Centers for Disease Control and Prevention (CDC). Therefore, their adoption does not appear to either provide the appropriate or requisite implementation guidance for the adopted standard, HL7 2.5.1, or more importantly, to enable the user to “electronically record, modify, retrieve, and submit syndrome-based public health surveillance information…,” as required by the adopted certification criterion, 45 CFR 170.302(l). Please clarify whether these implementation specifications are appropriate for the intended capability specified by the public health surveillance certification criterion at 45 CFR 170.302(l)?

Answer: We have received numerous requests seeking clarification regarding these adopted implementation specifications. Based on additional discussions with various stakeholders, input from public health agencies, and the CDC, and after further review of the implementation specifications, we have determined that these implementation specifications were adopted in error. As questioners correctly point out, the implementation specifications are not appropriate for the intended capability specified by the adopted certification criterion. They provide guidance to public health agencies on the structure and methodology for using HL7 2.5.1 to report Nationally Notifiable Conditions to CDC and do not provide additional clarity for how EHR technology would need to be designed to implement the adopted standard or enable compliance with the capability identified in the certification criterion adopted at 45 CFR 170.302(l).

Accordingly, we anticipate issuing an interim final rule in the near future to remove the implementation specifications adopted at 45 CFR 170.205(d)(2). We also intend to issue compliance guidance to ONC-Authorized Testing and Certification Bodies to clarify how they may continue to test and certify EHR technology in accordance with the related certification criterion until publication of the interim final rule removing “Public Health Information Network HL7 Version 2.5 Message Structure Specification for National Condition Reporting Final Version 1.0 and Errata and Clarifications National Notification Message Structural Specification.”

4. Question [9-10-004-1]: I currently use EHR version 1.3 which I purchased from EHR technology developer XYZ. EHR technology developer XYZ has informed me that it is not going to seek certification for EHR version 1.3. Can I seek certification for EHR version 1.3 or can I partner with a group of other health care providers that also use version 1.3 to split the cost of certification? Additionally, if EHR version 1.3 becomes certified can anyone else using EHR version 1.3 rely on the certification issued to EHR version 1.3?

Answer:
 In response to your first question, yes, any individual health care provider, group of health care providers, other type of affiliation, or organization is permitted to seek to have EHR technology tested and certified. The Temporary Certification Program regulations do not specify who may ask an ONC-ATCB to test and certify EHR technology. However, we note that any party that seeks testing and certification for the EHR technology would typically assume the associated costs. We would also note that prior to presenting EHR technology for testing and certification, it may be prudent to conduct an analysis of the certification criteria with which, for example, EHR version 1.3 would be compliant (i.e., it may only be capable of meeting some, but not all, adopted certification criteria and could therefore only be certified as an EHR Module). Additionally, if the purchaser and EHR technology developer have entered into an agreement, the purchaser may want to review the terms and conditions of the agreement to see what, if any, restrictions have been placed on either of the parties in seeking certification of the EHR technology.

In response to the follow-up question, yes, regardless of who seeks (and/or incurs the costs) to have the EHR technology tested and certified by an ONC-ATCB, once the EHR technology is certified, the certification associated with that EHR technology is applicable to all identical copies (for example, all identical copies of EHR version 1.3). In addition, the ONC-ATCB would report to ONC that the particular EHR technology had been certified, and we would make this information available on our website through the Certified HIT Products List (CHPL).

5. Question [9-10-005-1]: I am an EHR technology developer. I have sought and achieved certification for the Complete EHR that I sell. The Complete EHR, however, is also designed to be sold in separate components so that I can offer my customers different prices based on the capabilities they seek to implement. Is it possible for me to sell components of my certified Complete EHR separately as certified EHR Modules, or do I need to seek testing and certification for each of the separate components that I plan to sell as certified EHR Modules?

Answer: Stand-alone, separate components of a certified Complete EHR do not derive their own separate certified status based solely on the fact that they were included as part of the Complete EHR when it was tested and certified. The separate component(s) would no longer meet the definition of a Complete EHR, nor would it have independently demonstrated that it can still properly perform capabilities for which certification is required in the absence of the capabilities with which it was previously certified as part of the Complete EHR. Additionally, the separate component(s) would not satisfy the requirements of 45 CFR 170.450(c) related to the privacy and security testing and certification of EHR Modules.

This concept is similar to our treatment of integrated bundles of EHR Modules. We clarified in the Temporary Certification Program final rule (75 FR 36191) that EHR Modules, once certified as part of a bundle, would not each separately inherit a certification just because they were certified as part of a bundle.

Therefore, EHR technology developers must have the separate components of a certified Complete EHR tested and certified as EHR Modules before the components may be sold separately as certified EHR Modules. Because ONC-ATCBs that are authorized to test and certify Complete EHRs are also, by default, authorized to test and certify all types of EHR Modules, such ONC-ATCBs are not precluded from issuing separate certifications for the separate components of a Complete EHR as EHR Modules at the same time the Complete EHR is presented for testing and certification, provided that the ONC-ATCB satisfies its responsibilities under 45 CFR 170.450 as well as other such responsibilities related to EHR Modules (e.g., 45 CFR 170.423 the Principles of Proper Conduct for ONC-ATCBs).

6. Question [9-10-006-1]: I submitted a Complete EHR for certification, but it has not passed a test for one or more of the certification criteria. Can I request that the ONC-ATCB certify the EHR technology that I submitted as an EHR Module instead (i.e., certify only those capabilities that have been tested successfully)?

Answer: Yes, an ONC-ATCB that is authorized to test and certify Complete EHRs has the discretion to change the type of certification it would issue based on an EHR technology developer’s request. Whether the ONC-ATCB would choose to honor a request for a change, as well as any costs associated with a change, would depend upon the arrangement between the EHR technology developer and the ONC-ATCB. Along those lines, if an ONC-ATCB permits a developer or presenter to request a different type of certification for the EHR technology it has submitted, the ONC-ATCB should be cognizant of other responsibilities it may need to satisfy for EHR Modules (e.g., 45 CFR 170.450).

7. Question [9-10-007-1]: My hospital purchased a certified EHR Module that provides approximately 75% of the capabilities we need to meet the definition of Certified EHR Technology. The other 25% are provided by our own self-developed system(s). Can we have our self-developed system tested and certified as an EHR Module and then subsequently use the combination of our self-developed certified EHR Module with the certified EHR Module we purchased to meet the definition of Certified EHR Technology? As a follow up, do we need to have the combination of the purchased certified EHR Module and our self-developed certified EHR Module tested and certified together as a Complete EHR (above and beyond the certifications they have already been issued)?

Answer:
  Yes, you may seek testing and certification for only those systems that have not been certified as an EHR Module (in this case, the self-developed system), and no, you do not need to have the combination of certified EHR Modules certified again as a Complete EHR in order to meet the definition of Certified EHR Technology. In relation to this question, we reiterate paragraph two of the definition of Certified EHR Technology at 45 CFR 170.102. “Certified EHR Technology means: … (2) A combination of EHR Modules in which each constituent EHR Module of the combination has been tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary, and the resultant combination also meets the requirements included in the definition of a Qualified EHR.” As we discussed in the Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology” Final Rule (75 FR 44597), only proper combinations of EHR Modules would meet the definition of Certified EHR Technology. We encourage eligible health care providers who seek to implement certified EHR Modules to consider ahead of time the types of certified EHR Modules that may be needed to ensure that all applicable criteria will be met.

8. Question [9-10-008-1]: If an EHR Module addresses multiple certification criteria (thus providing multiple capabilities), does it need to be tested and certified to the applicable privacy and security certification criteria as a whole or for each capability?

Answer:
 EHR Module means any service, component, or combination thereof that meets at least one certification criterion adopted by the Secretary. An EHR Module could provide a single capability required by one certification criterion or it could provide all capabilities but one required by the certification criteria for a Complete EHR.  In other words, for example, we would call HIT tested and certified to one certification criterion an “EHR Module” and HIT tested and certified to nine certification criteria an “EHR Module,” where ten certification criteria are required for a Complete EHR.

If an EHR Module addresses multiple certification criteria the EHR Module as a whole would be tested and certified to all privacy and security certification criteria unless the EHR Module is presented for testing and certification, and the presenter can demonstrate and provide documentation to the ONC–ATCB that a privacy and security certification criterion is inapplicable or that it would be technically infeasible for the EHR Module to be tested and certified in accordance with such certification criterion (see 45 CFR 170.450(c)(2)).

9. Question [9-10-009-1]: I’m an EHR technology developer and I’ve had my Complete EHR certified. I work with business partners/distributors and permit them to sell my (unmodified) certified Complete EHR under their own brand/name/label. Is this business practice permitted? Is there anything that I should do or be aware of?

Answer: Yes, this business practice is permitted. However, the ONC-ATCB that certified your Complete EHR is required to ensure that you adhere to the terms and conditions of the certification it issues, including communication of the information specified at 45 CFR 170.423(k). Thus, if you permit business partners/distributors to re-brand or rename your certified Complete EHR and represent that it has been certified, the ONC-ATCB that issued the certification for your Complete EHR may require you (consistent with Section 14 of Guide 65) to ensure that your business partners/distributors adhere to the requirements of 170.423(k) that apply to you. We encourage you to make arrangements with your business partners/distributors to ensure that they appropriately convey the information specified at 170.423(k).

Additionally, an ONC-ATCB is responsible for reporting to ONC a current list of the EHR technology it has tested and certified. Only EHR technologies reported by ONC-ATCBs to ONC will appear on ONC’s “Certified HIT Products List (CHPL).” Therefore, if you are an EHR technology developer that expects to work with business partners/distributors that will re-brand or rename your certified Complete EHR and represent that it has been certified, we encourage you to work with your ONC-ATCB to identify (up front, if possible, or on an ongoing basis) the different names under which your certified Complete EHR may be distributed. Otherwise, those re-branded or renamed Complete EHR(s) will not appear on the CHPL.

An ONC-ATCB is permitted to report information to ONC related to re-branded or renamed Complete EHRs that it has certified. We anticipate that we would list the re-branded or renamed Complete EHR(s) on the CHPL using the same unique certification identification that is assigned to your certified Complete EHR.

10. Question [9-10-010-1]: My EHR technology is designed to receive demographic data from a registration system or a practice management system. The data from these other IT systems is then used by my EHR technology to demonstrate compliance with one or more certification criteria. Do these other IT systems that act as data sources to my EHR technology need to be certified?

Answer: No, other IT systems that act as data sources and are not intended to perform required capabilities in accordance with adopted certification criteria do not need to be certified simply because they supply data to a Complete EHR or EHR Module. Obviously, if the other IT systems have not been developed to, and cannot, perform required capabilities in accordance with adopted certification criteria then certification of those other IT systems would not be available.

For the purposes of certification, an EHR technology developer must be able to demonstrate to an ONC-ATCB that its Complete EHR or EHR Module can perform the capabilities specified by all applicable certification criteria. Thus, in circumstances where the Complete EHR or EHR Module is designed to be implemented in multiple ways, including the ability to receive data from a different IT system, the EHR technology developer would need to demonstrate during testing that regardless of the source from which the Complete EHR or EHR Module receives data, it is compliant with all applicable certification criteria for which testing and certification has been sought.

11. Question [9-10-011-1]: I’ve identified that I am using two different EHR technologies to meet a single certification criterion (my document management system receives and displays summary records (45 CFR 306(f)(1)) and my EHR technology from EHR technology developer XYZ transmits summary records (45 CFR 306(f)(2)). Do both EHR technologies need to be certified?

Answer: Yes, in order to possess EHR technology that meets the definition of Certified EHR Technology, both the document management system and the EHR technology from EHR technology developer XYZ together need to meet this certification criterion in its entirety. As a result, (assuming you are not implementing a certified Complete EHR) you could elect to seek testing and certification yourself for these two systems as an EHR Module or implement a certified EHR Module that meets this certification criterion in its entirety.

12. Question [9-10-012-1]: How many clinical quality measures must EHR technology be capable of calculating in order to get certified?

Answer: It depends on whether the EHR technology is designed to be used in an ambulatory setting or in an inpatient setting as we have adopted a specific certification criterion for each setting to correspond to the correlated meaningful use requirements for which eligible professionals and eligible hospitals and critical access hospitals must satisfy (45 CFR 170.304(j) and 45 CFR 170.306(i), respectively).

For EHR technology designed for an ambulatory setting, it must be tested and certified as being compliant with all 6 of the core (3 core and 3 alternate core) clinical quality measures specified by CMS for eligible professionals as well as at a minimum 3 of the additional clinical quality measures CMS has identified for eligible professionals.

For EHR technology designed for an inpatient setting, it must be tested and certified as being compliant with all of the clinical quality measures specified by CMS for eligible hospitals and critical access hospitals.

The HIT Standards and Certification Criteria final rule provides a more detailed discussion of this issue at 75 FR 44610. Additionally, eligible health care providers should be aware that ONC–Authorized Testing and Certification Bodies (ONC-ATCBs) are required to report to the National Coordinator (among other data) the clinical quality measures to which a Complete EHR or EHR Module has been tested and certified, and further, that the Complete EHR or EHR Module developer would need to make sure this information is available and communicated to prospective purchasers as part of the Complete EHR or EHR Module’s certification.

13. Question [9-10-013-1]: I plan on sending/transferring meaningful use quality reporting data from my EHR technology to my “data warehouse” and have the data warehouse submit/report out the data to CMS. Does my data warehouse need to be certified?

Answer: Yes, if you plan to use your data warehouse to submit calculated clinical quality measures to CMS or States for meaningful use, your data warehouse would need to be certified in order for you to meet the definition of Certified EHR Technology. This is so because your data warehouse would be performing a capability for which the Secretary has adopted a certification criterion (45 CFR 170.304(j) or 45 CFR 170.306(i)) and for which you as an eligible health care provider have a correlated meaningful use requirement to satisfy.

14. Question [9-10-014-1]: I’ve selected a certified Complete EHR [or certified EHR Module] from EHR technology developer XYZ. That being said, I prefer the certified CPOE EHR Module designed by EHR technology developer ABC over the CPOE capability included in EHR technology developer XYZ’s Complete EHR. Can I use the certified CPOE EHR Module from EHR technology developer ABC instead of the CPOE capability included in EHR technology developer XYZ’s certified Complete EHR? Alternatively, can I use both of the certified CPOE capabilities included in EHR technology developer XYZ and ABC’s EHR technologies at the same time? In other words, can I use duplicative or overlapping certified capabilities of different certified EHR technologies without jeopardizing my ability to meaningfully use Certified EHR Technology?

Answer:  Meeting the definition of Certified EHR Technology can be achieved in numerous ways; including using EHR technologies that perform duplicative or overlapping capabilities (if that is what an eligible health care provider chooses to do) so long as all of the applicable certification criteria adopted by the Secretary have been met and those EHR technologies are certified. Consequently, an eligible health care provider could use both certified capabilities (e.g., CPOE) at the same time in two different sections/departments of its organization. The eligible health care provider would however be responsible for reconciling the data between those two certified capabilities for purposes of reporting to CMS or the States.

Eligible health care providers who take such an approach should use ONC’s “Certified HIT Products List (CHPL)” webpage to generate a unique certification combination identification in order to accurately attest to CMS or the States the aggregate of certified EHR technologies used during the EHR reporting period.

15. Question [9-10-015-1]: I am an EHR technology developer preparing my EHR technology for certification. I am relying on a 3rd party software program to demonstrate my compliance with a specific certification criterion. Does this 3rd party software program need to be independently certified?Answer: No, the 3rd party software program that your EHR technology relies upon does not need to be independently certified. In principle, when presenting your EHR technology to an ONC-ATCB you must be able to demonstrate that your EHR technology is in compliance with the certification criterion regardless of whether your EHR technology natively performs the specified capability or relies upon a 3rd party software program. Thus, in practice, if you rely upon a 3rd party software program to successfully demonstrate compliance with a certification criterion, the certification you are issued encompasses the 3rd party software program.

In the context of relied upon software, we require ONC-ATCBs:

  1. To include certain information about software that is relied upon when reporting your certification to the National Coordinator, which will result in your EHR technology’s entry on the Certified HIT Products List (45 CFR 170.423(h)(6)); and
  2. To ensure that you convey this information on your website and in all marketing materials, communications statements, and other assertions related to your EHR technology’s certification (45 CFR 170.423(k)(1)(ii)).

16. Question [9-10-016-1]: I’m in the process of implementing EHR technology developer XYZ’s certified Complete EHR [or certified EHR Module] “E-HealthSystem2010.”

Scenario 1: I have determined that E-HealthSystem2010 needs to be reconfigured in order to connect with one of my patient registration systems. Can I reconfigure E-HealthSystem2010 without compromising the certified status of my implementation of E-HeatlhSystem2010?

Scenario 2: EHR technology developer XYZ communicated to my organization that they relied upon a 3rd party software program “PatientInfoTracker 2.0” for the purposes of demonstrating compliance with the “generate patient lists” certification criterion specified at 45 CFR 170.302(i) in achieving E-HeatlhSystem2010’s certification. I have already implemented, use, and would like to continue using “SuperListGenerator 7.0.” I have determined that I can reconfigure SuperListGenerator 7.0 to work with E-HeatlhSystem2010. Can I use SuperListGenerator 7.0 in lieu of PatientInfoTracker 2.0 without compromising the certified status of my implementation of E-HeatlhSystem2010?

Answer:  With respect to Scenario 1, yes, you can reconfigure your implementation of E-HealthSystem2010 without compromising its certified status, but you assume the risks associated with modifying a certified capability after it has been certified. You are also responsible for ensuring that these modifications do not adversely affect the performance of E-HealthSystem2010 and, as a result, your ability to demonstrate meaningful use. We encourage eligible providers to use caution when modifying certified Complete EHRs or EHR Modules.

With respect to Scenario 2, no, you cannot use a different 3rd party program to perform a certified capability unless:

  • EHR technology developer XYZ already has a separate certification for E-HealthSystem2010 that identifies SuperListGenerator 7.0 as a relied upon software program; or
  • You seek certification for SuperListGenerator 7.0 as an EHR Module.

17. Question [9-10-017-1]: Under the Medicare and Medicaid EHR Incentive Programs Final Rule, eligible health care providers are permitted to defer certain meaningful use objectives and measures and still receive an EHR incentive payment. However, it is our understanding that in order for us to have our EHR technology certified, we must implement all of the applicable capabilities specified in the adopted certification criteria regardless of whether we intend to use all of those capabilities to qualify for our EHR incentive payment. Is our understanding correct?

Answer: Yes, this understanding is correct.  The flexibility offered as part of the Medicare and Medicaid EHR Incentive Programs Final Rule is not mirrored in the Initial Set of Standards, Implementation Specifications, and Certification Criteria Final Rule because we believe that it is important to accommodate eligible health care providers’ ability to achieve meaningful use. We recognize that in some circumstances an eligible health care provider may not know which meaningful use measures they will seek to defer until they begin implementation and in others an individual provider (even within a specialty) will want to choose different measures to defer based on their local situation and implementation experience. Thus, in order to possess EHR technology that meets the definition of Certified EHR Technology, it must be tested and certified by an ONC-ATCB to all applicable certification criteria adopted by the Secretary.

18. Question [9-10-018-1]: I use or would like to use an “interface” to submit data to a public health agency/registry. Does this interface need to be certified?

Answer:  It depends. We recognize that the term “interface” has several different meanings depending on the context in which it is used, the IT infrastructure of which it is a part, and the capability it performs. Consequently, depending on various factors, an interface may or may not need to be certified.

NO”

  • The answer to your question would be “no,” if the interface provided a user with the ability to directly enter data to the public health agency/registry. In that scenario, the interface would not be providing a capability for which the Secretary has adopted a certification criterion and that Certified EHR Technology must include.
  • Similarly, if the interface would solely be serving as a conduit between your EHR technology and the public health agency/registry and providing the underlying communication protocol to transport data from point A to point B, it would not need to be certified. In this case, the interface would simply be providing the connection between you and the public health agency/registry and the means for the submission to occur. The interface would not be providing the capability specified in the certification criterion adopted by Secretary, which Certified EHR Technology must include.

YES”

  • If, however, the interface were to perform a capability specified in an adopted certification criterion and the interface was intended to satisfy a correlated meaningful use requirement, it would need to be certified. Why? Because you are required to use Certified EHR Technology to qualify for your respective EHR incentive program. As an example, if the interface was intended to provide the capability of electronically recording, modifying, retrieving and submitting immunization information in a standardized format (45 CFR 170.302(k)), it would need to be certified.

19. Question [9-10-019-1]: The “electronic copy of health information” certification criteria (45 CFR 170.304(f) and 45 CFR 170.306(d)) each require that Certified EHR Technology “enable a user to create an electronic copy of a patient’s clinical information… in: (1) Human readable format; and (2) On electronic media or through some other electronic means….” Is there more than one way to demonstrate compliance with these certification criteria?

Answer: Yes, as discussed in the Initial Set of Standards, Implementation Specifications, and Certification Criteria Final Rule, there is more than one way to demonstrate compliance with this certification criterion.  For this certification criterion, Certified EHR Technology must be capable of generating two outputs to produce an electronic copy (i.e., a copy in human readable format and a copy as a CCD or CCR).  If the Certified EHR Technology is capable of generating one copy that could meet both of these requirements, we would also consider that to be a compliant implementation of this capability.

20. Question [9-10-020-1]: The certification criterion at 45 CFR 170.302(n) specifies that “[f]or each meaningful use objective with a percentage-based measure, electronically record the numerator and denominator and generate a report including the numerator, denominator, and resulting percentage associated with each applicable meaningful use measure.” Is it possible for the action of “record” in the certification criterion to be implemented in different ways and still remain in compliance with the certification criterion? For example, could “record” comprise the ability of a centralized analytics EHR Module to accept or retrieve raw data from another EHR Module or EHR Modules, and upon receipt of this raw data, the centralized analytics EHR Module would calculate the numerator, denominator, and the resulting percentage as specified by 45 CFR 170.302(n)?

Answer: Yes, it is possible for the action of “record” in this certification criterion to be implemented in different ways. The example in this question appears to be one possible way to demonstrate compliance with this certification criterion. Other possible methods could include a Complete EHR that accepts or retrieves raw data, analyzes the data, and then generates a report based on the analysis; a Complete EHR that separately tracks each capability with a percentage-based meaningful use measure and later aggregates the numbers and generates a report; or an integrated bundle of EHR Modules in which each of the EHR Modules that is part of the bundle categorizes relevant data, identifies the numerator and denominator and calculates, when requested, the percentage associated with the applicable meaningful use measure. In each of these examples, the action of “record” means to obtain the information necessary to generate the relevant numerator and denominator.

Additional FAQs

CMS Web Site Buttons Link to its EHR Incentive Program Site

Four Buttons Created to Link Web Sites to EHR Incentive Programs
Plus Link to FAQs and Contacts

Centers for Medicare and Medicaid Services (CMS) created four buttons to use on Web sites to link to the official CMS EHR Incentive Program Web site:

Link here for official federal information about the EHR Incentive Programs: http://www.cms.gov/EHRIncentivePrograms/

Round Button

Link here for official federal information about the EHR Incentive Programs: http://www.cms.gov/EHRIncentivePrograms/

Square Button

Link here for official federal information about the EHR Incentive Programs: http://www.cms.gov/EHRIncentivePrograms/

Horizontal Button 1

Link here for official federal information about the EHR Incentive Programs: http://www.cms.gov/EHRIncentivePrograms/

Horizontal Button 2

Round, Square, or Horizontal, you get your choice as to which button to post on your Web site or blog to link directly to the CMS Official Web site for the EHR Incentive Program.

Per CMS Web site “Use these web buttons to post to your web site and have a direct link back to CMS’ EHR Incentive Program web page. We request that alternate text for the web button read: Link here for official federal information about the EHR Incentive Programs: http://www.cms.gov/EHRIncentivePrograms/ . The hyperlink to the EHR Incentive Program web site is: http://www.cms.gov/EHRIncentivePrograms/ ”

To download the buttons for use on Web sites:
EHR Incentive Program Web Button Round [JPG, 23KB]

EHR Incentive Program Web Button Square [JPG, 26KB]

EHR Incentive Program Web Button Horizontal 1 [JPG, 25KB]

EHR Incentive Program Web Button Horizontal 2 [JPG, 34KB]

CMS FAQs And Contacts on EHR Incentive Programs
Health IT Frequently Asked Questions

Contact Information for EHR Incentive Program Inquiries [PDF, 110KB]