2024-02519. Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing; Correction

AGENCY:

Office of the National Coordinator for Health Information Technology (ONC), Department of Health and Human Services (HHS).

ACTION:

Final rule; correction.

SUMMARY:

This document corrects technical and typographical errors in the final rule entitled, “Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing” that was published in the Federal Register on January 9, 2024, and has a stated effective of February 8, 2024.

DATES:

As of February 8, 2024 the effective date of the final rule published on January 9, 2024 (89 FR 1192, FR 2023–28857), is corrected to March 11, 2024. The corrections in this document are effective on March 11, 2024.

FOR FURTHER INFORMATION CONTACT:

Kate Tipping, Office of Policy, National Coordinator for Health Information Technology, 202–690–7151.

SUPPLEMENTARY INFORMATION:

I. Background

In Federal Register document 2023–28857 (89 FR 1192) final rule entitled “Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing” (HTI–1) (hereinafter referred to as the HTI–1 Final Rule), we identified certain technical and typographical errors following publication in the Federal Register on January 9, 2024. We summarize and correct these errors in the “Summary of Errors” and “Corrections of Errors” sections below.

II. Summary of Errors

A. Preamble Errors—DATES Section—Effective Dates of the Rule

On page 1192, first column, bottom of the page, we erroneously included an effective date of 30 days after publication of the final rule in the Federal Register , when it should have been 60 days after publication of the final rule in the Federal Register . The Congressional Review Act (CRA) requires a 60-day delay in the effective date of a major rule from the date of publication in the Federal Register or receipt of the rule by Congress, whichever is later (5 U.S.C. 801(a)(3)(A)). The rule was published in the Federal Register on January 9, 2024, and it has a stated effective date of February 8, 2024 (89 FR 1192). The Congressional Record reflects that House and Senate received the HTI–1 Final Rule on January 10, 2024 ( See 170 Cong. Rec. H105 (Jan. 11, 2024). Accordingly, we are correcting the effective date to March 11, 2024.

Also on page 1192, first column, bottom of page, the incorporation by reference approval date should be the effective date of the final rule. The HTI–1 Final Rule stated that the incorporation by reference approval date was February 8, 2024 (89 FR 1192). Because we inadvertently included an erroneous effective date, the incorporation by reference approval date must also be corrected to March 11, 2024.

B. Preamble Errors—Part 171

1. Infeasibility Exception—Third Party Seeking Modification Use

On page 1376, third column, middle of the page, we transposed the numbers and added an extra zero in a reference to the Code of Federal Regulations (CFR). We inadvertently added 54 CFR part 1600. We included the correct cross-reference to the regulatory text in a parenthetical. However, the reference to 54 CFR part 1600 should read “45 CFR part 160.”

C. Regulation Text Errors—Part 170—Health Information Technology Standards, Implementation Specifications, and Certification Criteria and Certification Programs for Health Information Technology

1. ONC Certification Criteria for Health IT

On page 1429, third column, top of page, we inadvertently omitted amendatory text for § 170.315. Within amendatory instruction 9 for § 170.315, sub-instructions c. and f., we neglected to specify “introductory text” for three references. Within sub-instruction c., paragraph (b)(2)(iii)(D) should read “(b)(2)(iii)(D) introductory text” and the reference to paragraph (b)(3) should read “(b)(3)(ii)(A) introductory text.” Within sub-instruction f., paragraphs (e)(1)(i)(B)( 1) and (2) should read “(e)(1)(i)(B)( 1) and ( 2) introductory text.” Also on page 1429, third column, top of page, we inadvertently included an incorrect reference and omitted an italicization in sub-instruction h. The reference to paragraphs (g)(10)(v)(A)( 1)(i) and ( ii), (g)(10)(v)(A)( 1)(B), (g)(10)(v)(A)( 2)( i) and ( ii) should read “(g)(10)(v)(A)( 1)( i) and ( ii), (g)(10)(v)(A)( 2)( i) and ( ii), (g)(10)(v)(A)(B)”.

a. Transitions of Care

On page 1430, middle column, top half of the page, we inadvertently referenced §  170.207(n)(2) in § 170.315(b)(1)(iii)(G)(3), Sex constraint. In the HTI–1 Proposed Rule (88 FR 23766), we proposed to remove the requirement in § 170.315(a)(5)(i)(C) and § 170.315(b)(1)(iii)(G)( 3) to code Sex according to the adopted value sets of HL7 Version 3 Value Sets for AdministrativeGender and NullFlavor as referenced in the value sets in § 170.207(n)(1). We proposed instead to permit coding according to either the adopted value sets of HL7 Version 3 Value Sets for AdministrativeGender and NullFlavor as referenced in the value sets in § 170.207(n)(1) until December 31, 2025, or in accordance with the standard in proposed § 170.207(n)(2) (89 FR 1220).

In the HTI–1 Proposed Rule, we also proposed to update § 170.315(c)(4)(iii)(G) introductory text and (b)(1)(iii)(G)( 3) to reference § 170.207(n)(2) (89 FR 1225). In the HTI–1 Final Rule, we noted that, in the HTI–1 Proposed Rule regulation text in § 170.315(b)(1)(iii)(G)( 3), we inadvertently included a reference to § 170.213 (88 FR 23909) instead of including § 170.207(n)(2) as discussed in our proposal (88 FR 23821). We finalized § 170.315(b)(1)(iii)(G)( 3) without the proposed reference to § 170.213. We stated that we finalized § 170.315(b)(1)(iii)(G)( 3) to include a reference to § 170.207(n)(2) to correct this error and to reference the most recent version of SNOMED CT U.S. Edition available at the time of this rule (89 FR 1225). In the HTI–1 Final Rule, we also finalized our proposal that the adoption of the code sets referenced in §  170.207(n)(1) will expire on January 1, 2026, and that health IT developers can continue to use the specific codes in the current terminology standard through December 31, 2025, in order to provide adequate time for Health IT Modules certified to particular certification criteria to transition to the updated terminology standards (89 FR 1198). In the HTI–1 Final Rule, we finalized the timelines for the respective standards updates as proposed and stated our intent to allow the use of the standards for the criterion consistent with those dates (89 FR 1225). We further stated that developers of certified health IT with Health IT Modules certified to criteria that reference §  170.207(n)(1) would be required to update those Health IT Modules to §  170.207(n)(2) and provide them to customers by January 1, 2026 (89 FR 1298). Therefore, in this final rule correction we have added a reference to § 170.207(n)(1) up to and including December 31, 2025, in § 170.315(b)(1)(iii)(G)( 3). Referencing § 170.207(n)(1) in this manner is consistent with the rationale that Sex be coded according to the adopted value sets in § 170.207(n)(1) until January 1, 2026; or coded according to the adopted standards in § 170.207(n)(2), and consistent with what we proposed (88 FR 23766) and intended to finalize.

b. Electronic Prescribing

On page 1430, third column, top of page, in § 170.315(b)(3) we also inadvertently omitted five asterisks after paragraph (b)(3)(ii)(A). The text in (b)(3) should remain unchanged except for the revisions in (b)(3)(ii)(A).

2. Real World Testing

On page 1434, first column, middle of page, in amendatory instruction 12 for § 170.405, we neglected to specify “introductory text” after paragraph (b)(2)(ii). The correct reference should say “(b)(2)(ii) introductory text.”

3. Discontinuation of Year Themed Editions

In the HTI–1 Final Rule, we finalized the discontinuation of year themed editions for ONC Certification Criteria for Health IT and renamed all certification criteria within the Program simply as “ONC Certification Criteria for Health IT” (89 FR 1206). In the HTI–1 Proposed Rule (88 FR 23912, 23914), we proposed to remove and replace references to the 2015 Edition in §§ 170.406(a)(5) and 170.550(h)(1). In the HTI–1 Final Rule, we finalized the removal of year themed Editions as proposed and stated that we “replaced references to the `2015 Edition' in §§  170.102, 170.405, 170.406, 170.523, 170.524, and 170.550 (89 FR 1207). However, when removing the references to the 2015 Edition in the regulation text, we neglected to remove and replace the reference to the 2015 Edition in §§ 170.406(a)(5) and 170.550(h)(1). Because year themed editions have been discontinued, including the 2015 Edition, and because we proposed to remove and replace these references and stated that we finalized as proposed, in this final rule correction we have corrected §§ 170.406(a)(5) and 170.550(h)(1) to replace the references to the 2015 Edition with references to ONC Certification Criteria for Health IT.

III. Waiver of Proposed Rulemaking, Comment Period, and Delay in Effective Date

Under 5 U.S.C. 553(b) of the Administrative Procedure Act (APA), the agency is required to publish a notice of the proposed rulemaking in the Federal Register before the provisions of a rule take effect. In addition, section 553(d) of the APA mandates a 30-day delay in effective date after issuance or publication of a rule. Sections 553(b)(B) and 553(d)(3) of the APA provide for exceptions from the notice and comment and delay in effective date requirements. Section 553(b)(B) of the APA authorizes an agency to dispense with normal rulemaking requirements for good cause if the agency makes a finding that the notice and comment process are impracticable, unnecessary, or contrary to the public interest. In addition, section 553(d)(3) of the APA allows the agency to avoid the 30-day delay in effective date where such delay is contrary to the public interest and an agency includes a statement of support.

We believe this final rule correction does not constitute a rule that would be subject to the APA notice and comment or delayed effective date requirements. This document corrects technical and typographical errors in the preamble and regulation text of the HTI–1 Final Rule, but does not make substantive changes to the policies that were adopted in the HTI–1 Final Rule. As a result, this final rule correction is intended to ensure that the information in the HTI–1 Final Rule accurately reflects the policies adopted in that document.

In addition, even if this were a rule to which the notice and comment procedures and delayed effective date requirements applied, we find that there is good cause to waive such procedures and requirements. Undertaking further notice and comment procedures to incorporate the corrections in this document into the HTI–1 Final Rule would be contrary to the public interest because these corrections ensure the HTI–1 Final Rule complies with the CRA and do not change the policies laid out in the HTI–1 Final Rule. This final rule correction is intended solely to ensure that the HTI–1 Final Rule accurately reflects applicable law and the policies finalized in the HTI–1 Final Rule. Therefore, we believe we have good cause to waive the notice and comment and effective date requirements.

IV. Corrections of Errors

In FR Doc. 2023–28857 appearing on page 1192 in the Federal Register of January 9, 2024, for the reasons stated above, the Office of the Secretary corrects the following:

1. On page 1192, first column, bottom of the page, correct the DATES section to read as follows:

DATES: Effective date: This final rule is effective on March 11, 2024.

Incorporation by reference: The incorporation by reference of certain publications listed in the rule was approved by the Director of the Federal Register as of March 11, 2024.

2. On page 1376, third column, middle of the page, correct the reference to “54 CFR part 1600” to read “ 45 CFR part 160.”

3. On page 1429, in the third column, instructions 9.c, 9.f and 9.h to section § 170.315 are corrected to read as follows:

9. Amend § 170.315 by:

* * * * *

c. Revising paragraphs (a)(12), (b)(1)(iii)(A)( 1) and ( 2); (b)(1)(iii)(B)( 2), (b)(1)(iii)(G) introductory text, (b)(1)(iii)(G)( 3), (b)(2)(i) and (ii), (b)(2)(iii)(D) introductory text, and (b)(2)(iv), (b)(3)(ii)(A) introductory text, (b)(6)(ii)(B)( 2), and (b)(9)(ii);

* * * * *

f. Revising paragraphs (e)(1)(i)(A)( 1) and ( 2), and (e)(1)(i)(B)( 1) and ( 2) introductory text, and adding paragraph (e)(1)(iii);

* * * * *

h. Revising paragraphs (g)(3) introductory text, (g)(6)(i)(A) and (B), (g)(9)(i)(A)( 1) and ( 2), (g)(10)(i)(A) and (B), (g)(10)(ii)(A) and (B), (g)(10)(iv)(A) and (B), (g)(10)(v)(A)( 1)( i) and ( ii), (g)(10)(v)(A)( 2)( i) and ( ii), (g)(10)(v)(B), and (g)(10)(vi) and (vii).

4. On page 1430, starting in the second column, in amendatory instruction 9, in § 170.315 correct paragraphs (b)(1)(iii)(G)( 3), (b)(3)(ii)(A) introductory text, (g)(10)(v)(A)( 1)( i) and ( ii), (g)(10)(v)(A)( 2)( i) and ( ii), and (g)(10)(v)(B) to read as follows:

§ 170.315

[Corrected]

* * * * *

(b) * * *

(1) * * *

(iii) * * *

(G) * * *

( 3) Sex Constraint: Represent sex with the standard adopted in § 170.207(n)(1) up to and including December 31, 2025; or with the standard adopted in § 170.207(n)(2).

* * * * *

(3) * * *

(ii) * * *

(A) Enable a user to perform the following prescription-related electronic transactions in accordance with the standard specified in § 170.205(b)(1) and, at a minimum, the version of the standard specified in § 170.207(d)(1) as follows:

* * * * *

(g) * * *

(10) * * *

(v) * * *

(A) * * *

( 1) * * *

( i) Authentication and authorization must occur during the process of granting access to patient data in accordance with the implementation specification adopted in § 170.215(c) and standard adopted in § 170.215(e).

( ii) A Health IT Module's authorization server must issue a refresh token valid for a period of no less than three months to applications using the “confidential app” profile according to an implementation specification adopted in § 170.215(c).

* * * * *

( 2) * * *

( i) Access must be granted to patient data in accordance with the implementation specification adopted in § 170.215(c) without requiring re-authorization and re-authentication when a valid refresh token is supplied by the application.

( ii) A Health IT Module's authorization server must issue a refresh token valid for a new period of no less than three months to applications using the “confidential app” profile according to an implementation specification adopted in § 170.215(c).

(B) Authentication and authorization for system scopes. Authentication and authorization must occur during the process of granting an application access to patient data in accordance with the “SMART Backend Services: Authorization Guide” section of the implementation specification adopted in § 170.215(d) and the application must be issued a valid access token.

* * * * *

§ 170.405

[Corrected]

5. On page 1434, first column, middle of page, in amendatory instruction 12 for § 170.405 correct instruction 12.a to read as “a. Revising paragraphs (a) and (b)(2)(ii) introductory text; and”

6. Starting on page 1434, in the second column, redesignate instructions 13 through 22 as instructions 14 through 23.

7. On page 1434, in the second column, add a new instruction 13 and accompanying regulatory text to read as follows:

13. Amend § 170.406 by revising paragraph (a)(5) to read:

§ 170.406

Attestations

(a) * * *

(5) Section 170.405 if a health IT developer has a Health IT Module(s) certified to any one or more ONC Certification Criteria for Health IT in § 170.315(b), (c)(1) through (3), (e)(1), (f), (g)(7) through (10), and (h).

8. On page 1435, starting in the second column, correct newly redesignated instruction 17 and the accompanying regulatory text to read as follows:

17. Amend § 170.550 by revising paragraphs (g) introductory text, (h)(1), and (m) introductory text to read as follows:

§ 170.550

Health IT Module certification.

* * * * *

(g) Health IT Module dependent criteria. When certifying a Health IT Module to the ONC Certification Criteria for Health IT, an ONC–ACB must certify the Health IT Module in accordance with the certification criteria at:

* * * * *

(h) * * *

(1) General rule. When certifying a Health IT Module to the ONC Certification Criteria for Health IT, an ONC–ACB can only issue a certification to a Health IT Module if the privacy and security certification criteria in paragraphs (h)(3)(i) through (ix) of this section have also been met (and are included within the scope of the certification).

* * * * *

(m) Time-limited certification and certification status for certain ONC Certification Criteria for Health IT. An ONC–ACB may only issue a certification to a Health IT Module and permit continued certified status for:

* * * * *

Elizabeth J. Gramling,

Executive Secretary to the Department, Department of Health and Human Services.