2010-4991. Proposed Establishment of Certification Programs for Health Information Technology

AGENCY:

Office of the National Coordinator for Health Information Technology, Department of Health and Human Services.

ACTION:

Proposed rule.

SUMMARY:

Under the authority granted to the National Coordinator for Health Information Technology (the National Coordinator) by section 3001(c)(5) of the Public Health Service Act (PHSA) as added by the Health Information Technology for Economic and Clinical Health (HITECH) Act, this rule proposes the establishment of two certification programs for purposes of testing and certifying health information technology. While two certification programs are described in this proposed rule, we anticipate issuing separate final rules for each of the programs. The first proposal would establish a temporary certification program whereby the National Coordinator would authorize organizations to test and certify Complete EHRs and/or EHR Modules, thereby assuring the availability of Certified EHR Technology prior to the date on which health care providers seeking the incentive payments available under the Medicare and Medicaid EHR Incentives Program may begin demonstrating meaningful use of Certified EHR Technology. The second proposal would establish a permanent certification program to replace the temporary certification program. The permanent certification program would separate the responsibilities for performing testing and certification, introduce accreditation requirements, establish requirements for certification bodies authorized by the National Coordinator related to the surveillance of Certified EHR Technology, and would include the potential for certification bodies authorized by the National Coordinator to certify other types of health information technology besides Complete EHRs and EHR Modules.

DATES:

To be assured consideration, written or electronic comments on the proposals for the temporary certification program must be received at one of the addresses provided below, no later than 5 p.m. on April 9, 2010. To be assured consideration, written or electronic comments on the proposals for the permanent certification program must be received at one of the addresses provided below, no later than 5 p.m. on May 10, 2010.

ADDRESSES:

Because of staff and resource limitations, we cannot accept comments by facsimile (FAX) transmission. You may submit comments, identified by RIN 0991-AB59, by any of the following methods (please do not submit duplicate comments).

• Federal eRulemaking Portal: Follow the instructions for submitting comments. Attachments should be in Microsoft Word, WordPerfect, or Excel; however, we prefer Microsoft Word. http://www.regulations.gov.
• Regular, Express, or Overnight Mail: Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, Attention: Certification Programs Proposed Rule, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201. Please submit one original and two copies.
• Hand Delivery or Courier: Office of the National Coordinator for Health Information Technology, Attention: Certification Programs Proposed Rule, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201. Please submit one original and two copies. (Because access to the interior of the Hubert H. Humphrey Building is not readily available to persons without Federal government identification, commenters are encouraged to leave their comments in the mail drop slots located in the main lobby of the building.)

Inspection of Public Comments: All comments received before the close of the applicable comment period will be available for public inspection, including any personally identifiable or confidential business information that is included in a comment. Please do not include anything in your comment submission that you do not wish to share with the general public. Such information includes, but is not limited to: a person's social security number; date of birth; driver's license number; State identification number or foreign country equivalent; passport number; financial account number; credit or debit card number; any personal health information; or any business information that could be considered to be proprietary. We will post all comments received before the close of the applicable comment period at http://www.regulations.gov.

Docket: For access to the docket to read background documents or comments received, go to http://www.regulations.gov or U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201 (call ahead to the contact listed below to arrange for inspection).

FOR FURTHER INFORMATION CONTACT:

Steven Posnack, Policy Analyst, 202-690-7151.

SUPPLEMENTARY INFORMATION:

Acronyms

CAH Critical Access Hospital

CCHIT Certification Commission for Health Information Technology

CGD Certification Guidance Document

CMS Centers for Medicare & Medicaid Services

EHR Electronic Health Record

FACA Federal Advisory Committee Act

FFS Fee for Service (Medicare Program)

HHS Department of Health and Human Services

HIT Health Information Technology

HITECH Health Information Technology for Economic and Clinical Health

LOINC Logical Observation Identifiers Names and Codes

MA Medicare Advantage

NIST National Institute of Standards and Technology

NVLAP National Voluntary Laboratory Accreditation Program

OIG Office of Inspector General

OMB Office of Management and Budget

ONC Office of the National Coordinator for Health Information Technology

ONC-AA ONC-Approved Accreditor

ONC-ACB ONC-Authorized Certification Body

ONC-ATCB ONC-Authorized Testing and Certification Body

OPM Office of Personnel Management

PHSA Public Health Service Act

RFA Regulatory Flexibility Act

RIA Regulatory Impact Analysis

SSA Social Security Act

Table of Contents

I. Background

A. Previously Defined Terminology

B. Legislative and Regulatory History

1. Legislative History

a. Standards, Implementation Specifications, and Certification Criteria

b. Medicare and Medicaid EHR Incentive Programs

i. Medicare EHR Incentive Program

ii. Medicaid EHR Incentive Program

c. HIT Certification Programs

2. Regulatory History and Related Guidance

a. Initial Set of Standards, Implementation Specifications, and Certification Criteria

b. Medicare and Medicaid EHR Incentive Programs Proposed Rule

c. HIT Certification Programs Proposed Rule

d. Physician Self-Referral Prohibition and Anti-Kickback EHR Exception and Safe Harbor Final Rules and ONC Interim Guidance Regarding the Recognition of Certification Bodies

C. Overview of Temporary Certification Program

D. Overview of Permanent Certification Program

E. Factors Influencing the Proposal of Both Temporary and Permanent Certification Programs

1. HIT Policy Committee Recommendations

2. Coordination With the HIT Standards and Certification Criteria Interim Final Rule and the Medicare and Medicaid EHR Incentive Programs Proposed Rule

3. Timeliness Related to the Beginning of the Medicare and Medicaid EHR Incentive Programs

i. Public Comment Period

ii. Urgency of Establishing the Temporary Certification Program

4. Consultations With NIST

F. Additional Context for Comparing the Temporary and Permanent Certification Programs

1. The Distinction Between Testing and Certification

2. Accreditation

3. Surveillance

II. Provisions of the Temporary Certification Program

A. Applicability

B. Definitions

1. Definition of Applicant

2. Definition of Day or Days

3. Definition of ONC-ATCB

C. Correspondence With the National Coordinator

D. Temporary Certification Program Application Process for ONC-ATCB Status

1. Application for ONC-ATCB Status

a. Types of Applicants

b. Types of ONC-ATCB Authorization

c. Application Part One

d. Application Part Two

2. Application Review

a. Satisfactory Application

b. Deficient Application Returned and Opportunity To Revise

3. ONC-ATCB Application Reconsideration Requests

4. ONC-ATCB Status

a. Acknowledgement and Representation

b. Expiration of Status Under the Temporary Certification Program

E. ONC-ATCB Performance of Testing and Certification and Maintaining Good Standing as an ONC-ATCB

1. Authorization To Test and Certify Complete EHRs

2. Authorization To Test and Certify EHR Modules

a. Certification Criterion Scope

b. When Privacy and Security Certification Criteria Apply to EHR Modules

3. Authorized Testing and Certification Methods

4. The Testing and Certification of “Minimum Standards”

5. Maintaining Good Standing as an ONC-ATCB; Violations That Could Lead to the Revocation of ONC-ATCB Status; Revocation of ONC-ATCB Status

a. Type-1 Violations

b. Type-2 Violations

c. Proposed Revocation

i. Opportunity To Respond to a Proposed Revocation Notice

ii. Revocation of an ONC-ATCB's Status

d. Extent and Duration of Revocation Under the Temporary Certification Program

e. Alternative Considered

6. Validity of Complete EHR and EHR Module Certification

F. Sunset

III. Provisions of Permanent Certification Program

A. Applicability

B. Definitions

1. Definition of Applicant

2. Definition of ONC-Approved Accreditor

3. Definition of Day or Days

4. Definition of ONC-ACB

C. Correspondence With the National Coordinator

D. Permanent Certification Program Application Process for ONC-ACB Status

1. Application for ONC-ACB Status

a. Types of Applicants

b. Types of ONC-ACB Authorization

c. Application for ONC-ACB Status

d. Proficiency Examination

2. Application Review

3. ONC-ACB Application Reconsideration Requests

4. ONC-ACB Status

a. Acknowledgement and Representation

b. Expiration of Status Under the Permanent Certification Program

E. ONC-ACB Performance of Certification and Maintaining Good Standing as ONC-ACB

1. Authorization To Certify Complete EHRs

2. Authorization To Certify EHR Modules

3. Authorization To Certify Other HIT

4. Authorized Certification Methods

5. The Certification of “Minimum Standards”

6. Maintaining Good Standing as an ONC-ACB; Violations That Could Lead to Revocation of ONC-ACB Status; Revocation of ONC-ACB Status

7. Validity of Complete EHR and EHR Module Certification

8. Differential Certification

F. ONC-Approved Accreditor

1. Requirements for Becoming an ONC-AA

2. ONC-AA Ongoing Responsibilities

3. Number of ONC-AAs and Length of Approval

G. Promoting Participation in the Permanent Certification Program

IV. Response to Comments

V. Collection of Information Requirements

A. Collection of Information #1: Application for ONC-ATCB Status Under the Proposed Temporary Certification Program

B. Collection of Information #2: Application for ONC-ACB Status Under the Proposed Permanent Certification Program

C. Collection of Information #3: ONC-ATCB and ONC-ACB Collection and Reporting of Information Related to Complete EHR and/or EHR Module Certifications

D. Collection of Information #4: Required Documentation for Requesting ONC-Approved Accreditor Status

VI. Regulatory Impact Analysis

A. Introduction

B. Why This Rule Is Needed?

C. Executive Order 12866—Regulatory Planning and Review Analyses for the Proposed Temporary and Permanent Certification Programs

1. Temporary Certification Program Estimated Costs

a. Application Process for ONC-ATCB status

i. Applicant Costs

ii. Costs to the Federal Government

b. Temporary Certification Program: Testing and Certification of Complete EHRs and EHR Modules

2. Permanent Certification Program Estimated Costs

a. Request for ONC-AA Status

i. Cost of Submission for Requesting ONC-AA Status

ii. Cost to the Federal Government

b. Application Process for ONC-ACB Status and Renewal

i. Applicant Costs and ONC-ACB Renewal Costs

ii. Costs to the Federal Government

c. Permanent Certification Program: Testing and Certification of Complete EHRs and EHR Modules

3. Costs for Collecting, Storing, and Reporting Certification Results Under the Temporary and Permanent Certification Programs

a. Costs to ONC-ATCBs and ONC-ACBs

b. Costs to the Federal Government

4. Temporary and Permanent Certification Program Benefits

D. Regulatory Flexibility Act

E. Executive Order 13132—Federalism

F. Unfunded Mandates Reform Act of 1995

I. Background

[If you choose to comment on the background section, please include at the beginning of your comment the caption “Background” and any additional information to clearly identify the information about which you are commenting.]

A. Previously Defined Terminology

This proposed rule is directly related to the recently published (January 13, 2010) health information technology (HIT) Standards and Certification Criteria interim final rule (75 FR 2014). Consequently, in addition to new terms and definitions discussed later in this proposed rule, the following terms have the same meaning as provided at 45 CFR 170.102.

• Certification criteria means criteria: (1) To establish that health information technology meets applicable standards and implementation specifications adopted by the Secretary; or (2) that are used to test and certify that health information technology includes required capabilities.
• Certified EHR Technology means a Complete EHR or a combination of EHR Modules, each of which: (1) Meets the requirements included in the definition of a Qualified EHR; and (2) has been tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary.
• Complete EHR means EHR technology that has been developed to meet all applicable certification criteria adopted by the Secretary.
• Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.
• EHR Module means any service, component, or combination thereof that can meet the requirements of at least one certification criterion adopted by the Secretary.
• Implementation specification means specific requirements or instructions for implementing a standard.
• Qualified EHR means an electronic record of health-related information on an individual that: (1) Includes patient demographic and clinical health information, such as medical history and problem lists; and (2) has the capacity: (i) To provide clinical decision support; (ii) to support physician order entry; (iii) to capture and query information relevant to health care quality; and (iv) to exchange electronic health information with, and integrate such information from other sources.
• Standard means a technical, functional, or performance-based rule, condition, requirement, or specification that stipulates instructions, fields, codes, data, materials, characteristics, or actions.

B. Legislative and Regulatory History

1. Legislative History

The Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5), was enacted on February 17, 2009. The HITECH Act amended the Public Health Service Act (PHSA) and created “Title XXX—Health Information Technology and Quality” (Title XXX) to improve health care quality, safety, and efficiency through the promotion of health information technology (HIT) and electronic health information exchange. Section 3001 of the PHSA establishes by statute the Office of the National Coordinator for Health Information Technology (ONC). Title XXX of the PHSA provides the National Coordinator and the Secretary of the Department of Health and Human Services (the Secretary) with new responsibilities and authorities related to HIT. The HITECH Act also amended several sections of the Social Security Act (SSA) and in doing so established the availability of incentive payments to eligible professionals and eligible hospitals to promote the adoption and meaningful use of interoperable HIT.

a. Standards, Implementation Specifications, and Certification Criteria

With the passage of the HITECH Act, two new Federal advisory committees were established, the HIT Policy Committee and the HIT Standards Committee (sections 3002 and 3003 of the PHSA, respectively). Each is responsible for advising the National Coordinator on different aspects of standards, implementation specifications, and certification criteria. The HIT Policy Committee is responsible for, among other duties, recommending priorities for the development, harmonization, and recognition of standards, implementation specifications, and certification criteria while the HIT Standards Committee is responsible for recommending standards, implementation specifications, and certification criteria for adoption by the Secretary under section 3004 of the PHSA consistent with the ONC-Coordinated Federal Health IT Strategic Plan (the “strategic plan”).

Section 3004 of the PHSA defines how the Secretary adopts standards, implementation specifications, and certification criteria. Section 3004(a) of the PHSA defines a process whereby an obligation is imposed on the Secretary to review standards, implementation specifications, and certification criteria and identifies the procedures for the Secretary to follow to determine whether to adopt any grouping of standards, implementation specifications, or certification criteria included among National Coordinator-endorsed recommendations.

b. Medicare and Medicaid EHR Incentive Programs

Title IV, Division B of the HITECH Act establishes incentive payments under the Medicare and Medicaid programs for eligible professionals and eligible hospitals that meaningfully use Certified EHR Technology. The Centers for Medicare & Medicaid Services (CMS) is charged with developing the Medicare and Medicaid EHR incentive programs.

i. Medicare EHR Incentive Program

Section 4101 of the HITECH Act added new subsections to section 1848 of the SSA to establish incentive payments for the meaningful use of Certified EHR Technology by eligible professionals participating in the Medicare Fee-for-Service (FFS) program beginning in calendar year (CY) 2011 and beginning in CY 2015, downward payment adjustments for covered professional services provided by eligible professionals who are not meaningful users of Certified EHR Technology. Section 4101(c) of the HITECH Act added a new subsection to section 1853 of the SSA that provides incentive payments to Medicare Advantage (MA) organizations for their affiliated eligible professionals who meaningfully use Certified EHR Technology beginning in CY2011 and beginning in 2015, downward payment adjustments to MA organizations to account for certain affiliated eligible professionals who are not meaningful users of Certified EHR Technology.

Section 4102 of the HITECH Act added new subsections to section 1886 of the SSA that establish incentive payments for the meaningful use of Certified EHR Technology by subsection (d) hospitals (defined under section 1886(d)(1)(B) of the SSA) that participate in the Medicare FFS program beginning in Federal fiscal year (FY) 2011 and beginning in FY 2015, downward payment adjustments to the market basket updates for inpatient hospital services provided by such hospitals that are not meaningful users of Certified EHR Technology. Section 4102(b) of the HITECH Act amends section 1814 of the SSA to provide an incentive payment to critical access hospitals that meaningfully use Certified EHR Technology based on the hospitals' reasonable costs beginning in FY 2011 and downward payment adjustments for inpatient hospital services provided by such hospitals that are not meaningful users of Certified EHR Technology for cost reporting periods beginning in FY 2015. Section 4102(c) of the HITECH Act adds a new subsection to section 1853 of the SSA to provide incentive payments to MA organizations for certain affiliated eligible hospitals that meaningfully use Certified EHR Technology and beginning in FY 2015, downward payment adjustments to MA organizations for those affiliated hospitals that are not meaningful users of Certified EHR Technology.

ii. Medicaid EHR Incentive Program

Section 4201 of the HITECH Act amends section 1903 of the SSA to provide 100 percent Federal financial participation (FFP) to States for incentive payments to certain eligible health care providers participating in the Medicaid program to purchase, implement, and meaningfully use (including support services and training for staff) Certified EHR Technology and 90 percent FFP for State administrative expenses related to the incentive program.

c. HIT Certification Programs

Section 3001(c)(5) of the PHSA provides the National Coordinator with the authority to establish a certification program or programs for the voluntary certification of HIT. Specifically, section 3001(c)(5)(A) specifies that the “National Coordinator, in consultation with the Director of the National Institute of Standards and Technology, shall keep or recognize a program or programs for the voluntary certification of health information technology as being in compliance with applicable certification criteria adopted under this subtitle” (i.e., certification criteria adopted by the Secretary under section 3004 of the PHSA). The certification program(s) must also “include, as appropriate, testing of the technology in accordance with section 13201(b) of the [HITECH] Act.”

Section 13201(b) of the HITECH Act requires that with respect to the development of standards and implementation specifications, the Director of the National Institute of Standards and Technology (NIST), in coordination with the HIT Standards Committee, “shall support the establishment of a conformance testing infrastructure, including the development of technical test beds.” The United States Congress also indicated that “[t]he development of this conformance testing infrastructure may include a program to accredit independent, non-Federal laboratories to perform testing.”

2. Regulatory History and Related Guidance

a. Initial Set of Standards, Implementation Specifications, and Certification Criteria

In accordance with section 3004(b)(1) of the PHSA, the Secretary published an interim final rule with request for comments entitled “Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology” (HIT Standards and Certification Criteria interim final rule) (75 FR 2014), which adopted an initial set of standards, implementation specifications, and certification criteria. The standards, implementation specifications, and certification criteria adopted by the Secretary establish the capabilities that Certified EHR Technology must include in order to, at a minimum, support the achievement of what has been proposed for meaningful use Stage 1 by eligible professionals and eligible hospitals under the Medicare and Medicaid EHR Incentive Programs proposed rule (see 75 FR 1844 for more information about meaningful use and the proposed Stage 1 requirements).

b. Medicare and Medicaid EHR Incentive Programs Proposed Rule

On January 13, 2010, CMS published in the Federal Register (75 FR 1844) the Medicare and Medicaid EHR Incentive Program proposed rule. The rule proposes a definition for meaningful use Stage 1 and regulations associated with the incentive payments made available under Division B, Title IV of the HITECH Act. CMS has proposed that meaningful use Stage 1 would begin in 2011 and has proposed that Stage 1 would focus on “electronically capturing health information in a coded format; using that information to track key clinical conditions and communicating that information for care coordination purposes (whether that information is structured or unstructured), but in structured format whenever feasible; consistent with other provisions of Medicare and Medicaid law, implementing clinical decision support tools to facilitate disease and medication management; and reporting clinical quality measures and public health information.”

c. HIT Certification Programs Proposed Rule

Section 3001(c)(5) of the PHSA, specifies that the National Coordinator “shall keep or recognize a program or programs for the voluntary certification of health information technology as being in compliance with applicable certification criteria adopted [by the Secretary] under this subtitle.” We are using this authority to propose both temporary and permanent certification programs for HIT. These certification programs are necessary in order to assure that eligible professionals and eligible hospitals are able to adopt and implement Certified EHR Technology in an effort to qualify for meaningful use incentive payments.

Although the initial and primary purpose of our proposed temporary and permanent certification programs would be to test and certify Complete EHRs and EHR Modules, we believe that Congress did not intend to limit the National Coordinator's authority solely to this purpose. The National Coordinator is expressly authorized to establish a voluntary certification program or programs for “health information technology,” not simply EHRs. As a result, we expect that our permanent certification program could also include the testing and certification of other types and aspects of HIT. Examples of other types of HIT that could be tested and certified under the permanent certification program include personal health records (PHRs) and networks designed for the electronic exchange of health information. We invite public comment on the need for additional HIT certifications, the types of HIT that would be appropriate for certification, and on any of the potential benefits or challenges associated with certifying other types of HIT.

d. Physician Self-Referral Prohibition and Anti-Kickback EHR Exception and Safe Harbor Final Rules and ONC Interim Guidance Regarding the Recognition of Certification Bodies

In August 2006, HHS published two final rules in which CMS and the Office of Inspector General (OIG) promulgated an exception to the physician self-referral prohibition and a safe harbor under the anti-kickback statute, respectively, for certain arrangements involving the donation of interoperable EHR software to physicians and other health care practitioners or entities (71 FR 45140 and 71 FR 45110, respectively). The exception and safe harbor provide that EHR software will be “deemed to be interoperable if a certifying body recognized by the Secretary has certified the software no more than 12 months prior to the date it is provided to the [physician/recipient].” ONC published separately a Certification Guidance Document (CGD) (71 FR 44296) to explain the factors ONC would use to determine whether to recommend to the Secretary a body for “recognized certification body” status. The CGD serves as a guide for ONC to evaluate applications for “recognized certification body” status and provides the information a body would need to apply for and obtain such status. To date, the Certification Commission for Health Information Technology (CCHIT) has been the only organization that has both applied for and been granted “recognized certification body” status under the CGD.

In section VI of the CGD, ONC notified the public, including potential applicants, that the recognition process explained in the CGD would be formalized through notice and comment rulemaking and that when a final rule has been promulgated to govern the process by which a “recognized certification body” is determined, certification bodies recognized under the CGD would be required to complete new applications and successfully demonstrate compliance with all requirements of the final rule.

This proposed rule marks the beginning of the formal notice and comment rulemaking described in the CGD. As a result, the processes we propose for the temporary certification program and permanent certification program, once finalized, would supersede the CGD, and the authorization process would constitute the new established method for “recognizing” certification bodies, as referenced in the physician self-referral prohibition and anti-kickback EHR exception and safe harbor final rules. Consequently, certifications issued by a certification body “authorized” by the National Coordinator would enable Complete EHRs and EHR Modules to meet the definition of Certified EHR Technology, and it would constitute certification by “a certifying body recognized by the Secretary” in the context of the physician self-referral EHR exception and anti-kickback EHR safe harbor.

We request comment on whether we should construe the proposed new “authorization” process as the Secretary's method for “recognizing” certification bodies in the context of the physician self-referral EHR exception and anti-kickback EHR safe harbor.

C. Overview of Temporary Certification Program

We are proposing a temporary certification program to describe the process by which an organization would become an ONC-Authorized Testing and Certification Body (ONC-ATCB) and authorized under the temporary certification program to perform the testing and certification of Complete EHRs and/or EHR Modules. Under the temporary certification program, the National Coordinator would assume many of the responsibilities that we have proposed that other organizations would otherwise fulfill under the permanent certification program.

In order to become an ONC-ATCB, an organization (or organizations) would need to submit an application to the National Coordinator to demonstrate its competency and ability to test and certify Complete EHRs and/or EHR Modules. We propose under the temporary certification program that in order to become an ONC-ATCB, an applicant must be able to both test and certify Complete EHRs and/or EHR Modules. We anticipate that only a few organizations would qualify and become ONC-ATCBs under the temporary certification program. We also propose conditions and requirements applicable to the testing and certification of Complete EHRs and EHR Modules. Under the temporary program, the National Coordinator would accept applications for ONC-ATCB status at any time. The temporary program would sunset once the permanent certification program is established and at least one certification body has been authorized by the National Coordinator.

D. Overview of Permanent Certification Program

For the permanent certification program, we are proposing that several of the responsibilities assumed by the National Coordinator under the temporary certification program would be fulfilled by others. The National Coordinator would, where appropriate, seek to move as many of the temporary certification program's processes as possible to organizations in the private sector. We are proposing a process in the permanent certification program by which an organization would become an ONC-Authorized Certification Body (ONC-ACB). Please note, that an “ONC-ACB” in the permanent certification program is different than an “ONC-ATCB” in the temporary certification program. Under the permanent certification program, we are proposing that the National Coordinator's authorization would be valid solely for certification. We are also proposing that an applicant for ONC-ACB status must be accredited prior to submitting an application to the National Coordinator. An applicant's accreditation would be a critical factor in the National Coordinator's decision to grant it ONC-ACB status. We discuss in section III.F the process by which the National Coordinator would approve an accreditor (an “ONC-Approved Accreditor” (ONC-AA)) for certification bodies who intend to apply for ONC-ACB status.

Accreditation would also play an important role with respect to testing. As we discuss, the National Coordinator's authorization in the permanent certification program would no longer be valid for the purposes of testing Complete EHRs and EHR Modules. Instead, we propose that NIST through the National Voluntary Laboratory Accreditation Program (NVLAP) (and in accordance with section 13201(b) of the HITECH Act) would be responsible for accrediting testing laboratories and determining their competency. In this role, NIST would be solely responsible for overseeing activities related to testing laboratories. We further propose that ONC-ACBs would only be permitted to accept test results from NVLAP-accredited testing laboratories when evaluating a Complete EHR or EHR Module for certification. We also propose for the permanent certification program, similar to the temporary certification program, conditions and requirements that would apply to the certification of Complete EHRs and EHR Modules. Finally, unlike the temporary certification program, we propose that an ONC-ACB would be required to renew its status every two years under the permanent certification program.

E. Factors Influencing the Proposal of both Temporary and Permanent Certification Programs

A number of factors played a role in our decision to propose a temporary certification program that could be implemented quickly, and a permanent certification program that would be established for the long term. These factors include the recommendations of the HIT Policy Committee; the interrelationships of this proposed rule with the HIT Standards and Certification Criteria interim final rule (75 FR 2014) and the Medicare and Medicaid EHR Incentive Programs proposed rule (75 FR 1844); the need for eligible professionals and eligible hospitals to have Certified EHR Technology available in a timely manner; and our consultations with NIST.

1. HIT Policy Committee Recommendations

As noted above, section 3002(b) requires the HIT Policy Committee to make recommendations to the National Coordinator related to the implementation of a nationwide health information technology infrastructure. As part of this responsibility, the HIT Policy Committee made five recommendations to the National Coordinator on August 14, 2009, which support the approach proposed in this rule. The recommendations addressed the scope of the certification process in general and the approach the National Coordinator should take to establish certification programs. The HIT Policy Committee recommended “that in defining the certification process…the following objectives are pursued:

(1) Focus certification on Meaningful Use.

(2) Leverage the certification process to improve progress on privacy, security, and interoperability.

(3) Improve the objectivity and transparency of the certification process.

(4) Expand certification to include a range of software sources, e.g., open source, self-developed, etc.

(5) Develop a short-term certification transition plan.”

The National Coordinator reviewed and considered the recommendations made by the HIT Policy Committee and concluded that they should be used to provide direction for the proposals included in this rule. We believe that the proposals in this rule reflect the overall intent of the HIT Policy Committee's recommendations.

We interpret the HIT Policy Committee's use of the word “self-developed” and use it throughout the preamble to mean a Complete EHR or EHR Module that has been designed, modified, or created by, or under contract for, a person or entity that will assume the total costs for its testing and certification and will be a primary user of the Complete EHR or EHR Module. Self-developed Complete EHRs and EHR Modules could include brand new Complete EHRs or EHR Modules developed by a health care provider or their contractor. It could also include a previously purchased Complete EHR or EHR Module which is subsequently modified by the health care provider or their contractor and where such modifications are made to capabilities addressed by certification criteria adopted by the Secretary. We limit the scope of “modification” to only those capabilities for which the Secretary has adopted certification criteria because other capabilities (e.g., a different graphical user interface (GUI)) would not affect the underlying capabilities a Complete EHR or EHR Module would need to include in order to be tested and certified.

Accordingly, we would only refer to the Complete EHR or EHR Module as “self-developed” if the health care provider paid the total costs to have the Complete EHR or EHR Module tested and certified. For example, if hospital A self-develops a Complete EHR, pays for the Complete EHR to be tested and certified, and then goes on to sell or make it freely available to additional hospitals, we would not refer to the Complete EHRs used by those hospitals (other than hospital A) as being self-developed.

2. Coordination With the HIT Standards and Certification Criteria Interim Final Rule and the Medicare and Medicaid EHR Incentive Programs Proposed Rule

This proposed rule is the third and final element of HHS's coordinated rulemakings to define the meaningful use of Certified EHR Technology and support the achievement of meaningful use.

As required by the HITECH Act, eligible professionals and eligible hospitals must demonstrate meaningful use of Certified EHR Technology in order to receive incentive payments under the Medicare and Medicaid EHR Incentive Programs. This proposed rule would create the certification programs under which Complete EHRs and EHR Modules could be tested and certified and subsequently used as Certified EHR Technology by eligible professionals and eligible hospitals. Once authorized by the National Coordinator, ONC-ATCBs under the temporary certification program and ONC-ACBs under the permanent certification program would be obligated to use the certification criteria adopted by the Secretary and identified at 45 CFR 170.302, 45 CFR 170.304, and 45 CFR 170.306. The Secretary intends to adopt subsequent certification criteria to support the requirements for future meaningful use stages once promulgated in regulation by CMS and may, where appropriate, adopt certification criteria for other types of HIT.

3. Timeliness Related to the Beginning of the Medicare and Medicaid EHR Incentive Programs

i. Public Comment Period

Congress established specific timeframes in the HITECH Act for the beginning of the Medicare EHR incentive program. The first payment year for eligible professionals was defined as calendar year 2011 (i.e., the year beginning January 1, 2011) and the first payment year for eligible hospitals was defined as fiscal year 2011 (i.e., the year beginning October 1, 2010). Congress specified in section 1903(t)(6)(C)(i)(I) of the SSA that “for the first year of payment to a Medicaid provider under this subsection, the Medicaid provider [must] demonstrate that it is engaged in efforts to adopt, implement, or upgrade certified EHR technology.” Although there is no specified date for States to begin implementing the Medicaid EHR incentives program, Congress did set a cutoff for when first payments would no longer be permitted to Medicaid providers (“for any year beginning after 2016”). While the Medicare and Medicaid EHR Incentive Programs proposed rule provides more detail for this statutory provision, it is important to note that Medicaid providers will not be able to receive an incentive payment for “adopting, implementing, or upgrading Certified EHR Technology” until a certification program is established to allow for the testing and certification of Complete EHRs and EHR Modules.

To meet the previously mentioned timeframes, Certified EHR Technology must be available before the fall of 2010. Accomplishing this goal will require many simultaneous actions:

• Complete EHRs and EHR Modules may need to be reprogrammed or redesigned in order to meet the certification criteria adopted by the Secretary;
• A certification program must be established to allow for testing and certification of Complete EHRs and EHR Modules; and
• A collection of Complete EHRs and EHR Modules will need to be tested and certified under the established temporary certification program.

For these reasons, among others discussed below, we have chosen to propose the establishment of a temporary certification program that could be established and become quickly operational in order to assure the availability of Certified EHR Technology prior to the beginning of meaningful use Stage 1.

With these timing constraints in mind, we have provided for a 30-day public comment period on our proposals for the temporary certification program and a 60-day comment period on our proposals for the permanent certification program. Section 6(a)(1) of Executive Order 12866 on Regulatory Planning and Review (September 30, 1993, as further amended) states that “each agency should afford the public a meaningful opportunity to comment on any proposed regulation, which in most cases should include a comment period of not less than 60 days.” We believe that it is appropriate to follow this guidance in soliciting public comment on our proposed permanent certification program because the permanent certification program's final rule will be issued some months after the final rule for the temporary certification program. However, as discussed throughout the preamble, the circumstances and time constraints under which the temporary certification program must be established are different. As a result, we believe that a 30-day comment period provides a meaningful opportunity for the public to comment on our proposals for the temporary certification program and that it will allow ONC to thoughtfully consider comments before issuing a timely final rule to implement the temporary certification program. In light of the common proposals we have made for certain parts of the temporary and permanent certification programs, we anticipate considering all comments made on this proposed rule when we finalize the permanent certification program's final rule.

We have proposed a temporary certification program based on our estimates that it would take too long to establish some of the elements included in our proposed permanent certification program. For example, these elements include approximately 6-9 months for the establishment of the accreditation processes for both testing laboratories by NVLAP and certification bodies by an ONC-AA as well as the time following for organizations to gain their accreditation and then subsequently apply to the National Coordinator for ONC-ACB status. Given our goal to assure availability of Certified EHR Technology prior to the beginning of meaningful use Stage 1, we believe that the establishment of a temporary certification program is a pragmatic and prudent approach to take. Additionally, we believe that a temporary certification program is necessary because even assuming the National Coordinator receives applications from organizations seeking to become ONC-ATCBs under the temporary certification program on the first possible day they can apply, we efficiently process the applications, and ultimately authorize one or more organizations, it is likely that ONC-ATCBs will not exist until May or June 2010. It will also take ONC-ATCBs time to process requests for testing and certification under the temporary certification program.

ii. Urgency of Establishing the Temporary Certification Program

As we have discussed, the HITECH Act provides that eligible professionals and eligible hospitals must demonstrate meaningful use of Certified EHR Technology in order to receive incentive payments under the Medicare and Medicaid EHR Incentive Programs.

This rule proposes the creation of a temporary certification program, in addition to a permanent certification program, under which Complete EHRs and EHR Modules could be tested and certified, and subsequently adopted and implemented by eligible professionals and eligible hospitals in order to attempt to qualify for incentive payments under meaningful use Stage 1. Establishing the temporary certification program in a timely fashion is critical to begin enabling eligible professionals and eligible hospitals to achieve meaningful use within the required timeframes. For this goal to be accomplished both the HIT industry and the Department will have to achieve several milestones before Complete EHRs and EHR Modules can be tested and certified. After the close of the public comment period for the proposed temporary certification program, ONC will review and consider timely submitted public comments and then draft and publish the temporary certification program's final rule. The HIT industry will then need to respond. Organizations seeking to apply for ONC-ATCB status will submit their applications, the National Coordinator will then review and assess them, and if necessary, seek additional information through the established process. Once the National Coordinator has authorized the first ONC-ATCB, the testing and certification of Complete EHRs and EHR Modules will need to take place in accordance with the temporary certification program provisions.

To facilitate an immediate launch of the ONC-ATCB application review process under the temporary certification program, we are also proposing that the National Coordinator accept and hold all applications for ONC-ATCB status received prior to the final rule effective date. Under the Administrative Procedure Act (5 U.S.C. 553(d)), publication of a substantive final rule must occur not less than 30 days before its effective date, absent certain statutory exceptions. In other words, a substantive rule cannot become effective until 30 days after its publication, unless an exception applies. We are consequently proposing that the National Coordinator simply accept and hold all applications for ONC-ATCB status that are received prior to the temporary certification program's final rule's effective date, so that immediately upon the final rule becoming effective, the National Coordinator could begin reviewing received applications without further delay. We request public comment on this proposal and the urgency of establishing the temporary certification program, including how this provision might affect the ability of eligible professionals and eligible hospitals to timely achieve meaningful use Stage 1.

4. Consultations With NIST

Section 3001(c)(5) of the PHSA directs the National Coordinator to consult with the Director of the NIST in the development of a certification program or programs. Consistent with this statutory provision, we have developed our proposed certification programs with the guidance and cooperation of NIST subject matter experts in testing and certification. Based on NIST recommendations, we believe it is appropriate to use the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) ISO/IEC Guide 65, ISO/IEC 17025, and ISO/IEC 17011 to structure how testing, certification, and accreditation are conducted under our proposed certification programs. The ISO Committee on conformity assessment (CASCO) prepared ISO/IEC Guide 65, ISO/IEC 17025, and ISO/IEC 17011 and we believe the use of the ISO/IEC guide and standards will help ensure that the proposed certification programs operate in a manner consistent with national and international practices for testing and certification.

Under the temporary certification program we propose that applicants for ONC-ATCB status will need to demonstrate to the National Coordinator their conformance to both ISO/IEC Guide 65:1996 (Guide 65) and ISO/IEC 17025:2005 (ISO 17025). Under the permanent certification program applicants for ONC-ACB status would be required to be accredited by an ONC-AA for certification which would require a demonstration of conformance to Guide 65. Guide 65 specifies the “general requirements for bodies operating product certification systems.” The certification of products (including processes and services) to this standard provides assurance that the products comply with specified technical and business requirements. ISO 17025 is an international standard that specifies the “general requirements for competence of testing and calibration laboratories.” This standard addresses how testing should be performed using standard methods, non-standard methods, and laboratory-developed methods. We believe Guide 65 and ISO 17025 are necessary and appropriate for ONC-ATCBs to follow under the temporary certification program because they provide standard procedures and requirements for testing and certification widely accepted by the information technology industry and would ensure consistency and efficiency in the testing and certification procedures ONC-ATCBs would perform.

Under the permanent certification program we believe and have proposed that an ONC-AA for certification would have to conform to ISO/IEC 17011:2004 (ISO 17011). ISO 17011 is an international standard that specifies the “general requirements for accreditation bodies accrediting conformity assessment bodies,” such as certification bodies.

The ISO/IEC documents use certain terminology that differs from the terminology used in this proposed rule. We recognize that this proposed rule has been drafted to ensure consistency with existing regulatory and/or statutory terms, whereas the ISO/IEC documents were drafted for a different purpose and have a broader application to a variety of industries. Nevertheless, we intend certain terms in Guide 65, ISO 17025, and ISO 17011 to have the same meaning as related terms in this proposed rule. To ensure a consistent application of the ISO/IEC documents in the context of this proposed rule, we are therefore proposing the following crosswalk. The indicated terms in the documents specified below would have the meanings attributed to the related terms used in this proposed rule, as provided in the following table.

Terms used in Guide 65, ISO 17025, and ISO 17011	Terms used in this Proposed Rule
• Bodies operating product certification systems	• ONC-ATCB.
	• ONC-ACB.
• Certification body	• Testing and certification body.
• Conformity assessment bodies	• Certification body.
• Testing and calibration laboratories	• Testing laboratory.
• Accreditation body	• Accreditation organization.
	• ONC-AA.
• Products	• Complete EHRs.
	• EHR Modules.
	• HIT.

F. Additional Context for Comparing the Temporary and Permanent Certification Programs

Rather than proposing the temporary and permanent certification programs in two separate proposed rules, we have proposed them together in this notice of proposed rulemaking because we believe this approach provides the public with a broader context for each of the programs and a better opportunity to make informed comments. In an effort to prevent confusion, though, we first discuss our complete set of proposals for the temporary certification program (section II) and then our complete set of proposals for the permanent certification program (section III). As a result, some of the proposals discussed below for both proposed certification programs are very similar, if not the same, and are included twice—in the discussions of the temporary certification program and the permanent certification program. In other cases, there are significant differences between our proposals underlying the temporary and permanent certification programs. Before discussing our complete set of proposals for the temporary certification program and to provide additional context for the temporary program, we summarize some of the more significant differences between the temporary and permanent certification programs.

1. The Distinction Between Testing and Certification

We believe that there is a distinct difference between the “testing” and “certification” of a Complete EHR and/or EHR Module. In this proposed rule, “testing” is meant to describe the process used to determine the degree to which a Complete EHR or EHR Module can meet specific, predefined, measurable, quantitative requirements. These results would be able to be compared to and evaluated in accordance with predefined measures. In contrast, “certification” is meant to describe the assessment (and subsequent assertion) made by an organization, once it has analyzed the quantitative results rendered from testing along with other qualitative factors, that a Complete EHR or EHR Module has met all of the applicable certification criteria adopted by the Secretary. Qualitative factors could include whether a Complete EHR or EHR Module developer has a quality management system in place, or whether the Complete EHR or EHR Module developer has agreed to the policies and conditions associated with being certified (e.g., proper logo usage). Above and beyond testing, the act of certification typically promotes confidence in the quality of a product (and the vendor that produced it), offers assurance that the product will perform as described, and helps to make it easier for consumers to differentiate which products have met specific criteria from others that have not.

A fundamental difference between testing and certification is that testing is intended to result in objective, unanalyzed data. In contrast, certification is expected to result in an overall assessment of the test results, consideration of their significance, and consideration of other factors to determine whether the prerequisites for certification have been achieved. The following is a simple example to illustrate an important difference between testing and certification.

An e-prescribing EHR Module developer that seeks to have its EHR Module certified would first submit the EHR Module to be tested. To successfully pass the established testing requirements, the e-prescribing EHR Module would, among other functions, need to transmit an electronic prescription using mock patient data according to the standards adopted by the Secretary. Provided that the e-prescribing EHR Module successfully passed this test it would next be evaluated for certification. Certification could require that the EHR Module developer agree to a number of provisions, including, for example, displaying the EHR Module's version and revision number so potential purchasers could compare when the EHR Module was last updated or certified. If the EHR Module developer agreed to all of the applicable certification requirements and the EHR Module achieved a passing test result, the e-prescribing EHR Module would be certified. In these situations, both the EHR Module passing the technical requirements tests and the EHR Module vendor meeting the other certification requirements would be required for the EHR Module to achieve certification.

2. Accreditation

We have proposed, in the interest of expediency and to facilitate timely certification of Complete EHRs and EHR Modules, that ONC-ATCBs under temporary certification program would be authorized (and required) to perform both the testing and certification of Complete EHRs and/or EHR Modules. Under the temporary certification program, the National Coordinator would serve in a role similar to an accreditor and would assess an ONC-ATCB applicant's competency to perform both testing and certification before granting the applicant ONC-ATCB status. However, we do not believe that this would be an optimal or practical approach for the long-term because specialized accreditors in the private sector are better equipped to react effectively and efficiently to changes in the HIT market and to more rigorously oversee the certification bodies they accredit. Moreover, we have observed in other industries, such as the manufacturing of water-conserving products, that testing and certification processes are typically handled independently and separately.^[1] Consequently, under the permanent certification program, we have proposed to shift the accreditation responsibilities for testing laboratories and certification bodies from the National Coordinator to other organizations. As previously mentioned, we understand that it may take several months to establish separate accreditation programs for testing laboratories and certification bodies and this factor weighed heavily in our decision to propose a temporary certification program. We consequently believe that the additional time the temporary certification program would afford the Department and HIT industry to develop a HIT-oriented accreditation program would greatly assist the HIT industry's transition to the accreditation process we have proposed under the permanent certification program.

Under the permanent certification program, we propose the use of accreditation as a mechanism to ensure that organizations that test and certify Complete EHRs and/or EHR Modules possess the requisite competencies to perform such actions with a high degree of precision. We believe that the proposed accreditation process will also introduce rigor, transparency, trust, and objectivity to the permanent certification program. Additionally, accreditation provides an oversight mechanism to ensure that testing laboratories and certification bodies are properly performing their respective duties. Consequently, in order for an applicant under the permanent certification program to become an ONC-ACB, we would require that it be accredited by an “ONC-Approved Accreditor” (ONC-AA) for certification in addition to meeting our other proposed application requirements. Along these lines, we propose a process by which accreditation organizations can request the National Coordinator's approval to become an ONC-AA. We believe this process is necessary because we propose several responsibilities for an ONC-AA to fulfill in order to ensure our programmatic objectives for the permanent certification program are met. Additionally, an approval process for an ONC-AA is necessary in order for potential applicants for ONC-ACB status to know from whom they can request accreditation.

As we mention above, under the permanent certification program, the National Coordinator would only authorize organizations to engage in certification. We emphasize that this is not meant to preclude, limit, or in any way prevent an organization from also performing the testing of Complete EHRs and/or EHR Modules. However, in order for a single organization (which may comprise subsidiaries or components) to perform both testing and certification under the permanent certification program it would need to be: (1) Accredited by an ONC-AA and subsequently become an ONC-ACB; and (2) accredited by the NVLAP. We request public comment on whether we should give organizations who are “dual accredited” and also become an ONC-ACB a special designation to indicate to the public that such an organization would be capable of performing both testing and certification under the permanent certification program.

The NVLAP, established by the NIST, develops specific laboratory accreditation programs (LAPs) for testing and calibration laboratories in response to legislative or administrative actions, requests from government agencies or, in special circumstances, from private sector entities.^[2] The National Coordinator would make a final determination about whether to issue a request to NVLAP to develop a LAP for testing laboratories after considering public comments on our proposals for the permanent certification program. To ensure that ONC-ACBs review test results from legitimate and competent testing laboratories, we propose that ONC-ACBs would only be permitted to certify Complete EHRs and/or EHR Modules that have been tested by a NVLAP-accredited testing laboratory.

3. Surveillance

Under the permanent certification program we propose requirements for ONC-ACBs related to the surveillance of certified Complete EHRs and certified EHR Modules. We also propose certain requirements relating to surveillance for ONC-ATCBs under the temporary certification program. However, we anticipate that the temporary certification program would end close to the time an appropriate sample size of implemented certified Complete EHRs and certified EHR Modules would be available for ONC-ATCBs to perform ongoing surveillance. As a result of this limitation, we have proposed affording less weight to surveillance requirement compliance as well as less stringent requirements for ONC-ATCBs related to surveillance in the temporary certification program than we have proposed for ONC-ACBs under the permanent certification program.

We previously mentioned that we would require applicants for ONC-ACB status to be accredited by an ONC-AA. We propose that an ONC-AA in performing accreditation verify a certification body's conformance, at a minimum, to Guide 65. As a result, we expect that ONC-ACBs will perform surveillance in accordance at a minimum with Guide 65, which in section 13, among other provisions, provides that the “certification body [or `ONC-ACB'] shall periodically evaluate the marked [or `certified'] products to confirm that they continue to conform to the [adopted] standards.” ONC-ACBs consequently would be required to evaluate and reevaluate previously certified Complete EHRs and/or EHR Modules to determine whether the Complete EHRs and/or EHR Modules they had certified in a controlled environment also perform in an acceptable, if not the same, manner in the field as they had performed when they were being certified. We discuss our proposals related to surveillance in the permanent certification program at section III.D.1.c.iii.

II. Provisions of the Temporary Certification Program

[If you choose to comment on the provisions of the temporary certification program, please include at the beginning of your comment the specific section title and any additional information to clearly identify the proposal about which you are commenting. For example, “Definitions” or “Sunset.”]

A. Applicability

This subpart would establish the processes that applicants for ONC-ATCB status must follow to be granted ONC-ATCB status by the National Coordinator, the processes the National Coordinator would follow when assessing applicants and granting ONC-ATCB status, and the requirements of ONC-ATCBs for testing and certifying Complete EHRs and/or EHR Modules in accordance with the applicable certification criteria adopted by the Secretary in subpart C.

B. Definitions

1. Definition of Applicant

We propose that the term applicant mean a single organization or a consortium of organizations that seeks to become an ONC-ATCB by requesting and subsequently submitting an application for ONC-ATCB status to the National Coordinator.

2. Definition of Day or Days

We propose that unless otherwise explicitly specified, the term day or day s shall mean a calendar day or calendar days.

3. Definition of ONC-ATCB

We propose ONC-ATCB to mean an organization or a consortium of organizations that has applied to and been authorized by the National Coordinator pursuant to the sections below to perform the testing and certification of Complete EHRs and/or EHR Modules under the temporary certification program.

C. Correspondence With the National Coordinator

Throughout the following sections, we have proposed numerous instances where applicants for ONC-ATCB status and ONC-ATCBs would have to correspond with the National Coordinator and vice versa. These instances are almost always associated with specific timeframes (e.g., the amount of days an applicant has to respond to a deficient application notice, etc.). Additionally, because such timeframes either trigger the beginning of a review process or the close of a response period it is important for there to be clear, unambiguous beginnings and endings for when such events must occur (e.g., receipt of an application).

Moreover, it is the National Coordinator's preference to use e-mail whenever possible to communicate with an applicant for ONC-ATCB status or an ONC-ATCB. Therefore, we generally propose that any communication by the National Coordinator would be via e-mail and, where applicable, that we would consider the official date of receipt of any e-mail between the National Coordinator and an applicant for ONC-ATCB status or an ONC-ATCB to be the day the e-mail was sent, as indicated by the e-mail time-stamp. Where it is necessary for correspondence to take place via regular or express mail, we propose to use “delivery confirmation” documentation to establish the official date of receipt.

D. Temporary Certification Program Application Process for ONC-ATCB Status

1. Application for ONC-ATCB Status

In order to be considered for ONC-ATCB status, we propose that an applicant must submit an application to the National Coordinator. The application would be comprised of two parts. In order to receive an application, an applicant would have to request one in writing from the National Coordinator (requests would be made to the following e-mail address: [e-mail]).

a. Types of Applicants

We propose that single organizations and consortia would be eligible to apply for ONC-ATCB status under the temporary certification program. We expect a consortium, for example, would be comprised of one organization that would serve as a testing laboratory and a separate organization that would serve as a certification body. When viewed as a single applicant, this applicant would be able to perform all of the required responsibilities of an ONC-ATCB under the temporary certification program. We support this approach and believe that the combined expertise of two or more organizations could also result in a qualified applicant.

b. Types of ONC-ATCB Authorization

In order to properly categorize the application provided to an applicant, we would require applicants to indicate the type of testing and certification they seek authorization to perform under the temporary certification program. We propose that applicants must request authorization to perform the testing and certification of Complete EHRs or solely EHR Modules. We would treat a request for authorization to perform the testing and certification of Complete EHRs to encompass a request for authorization to perform the testing and certification of EHR Modules because, by default, an ONC-ATCB authorized to test and certify Complete EHRs would be able to test and certify all of the certification criteria adopted by the Secretary at 45 CFR part 170, subpart C. Therefore, we believe, from a technical perspective, that if an ONC-ATCB can test and certify a Complete EHR it would also be capable of testing and certifying EHR Modules. With respect to EHR Modules, this does not mean that an ONC-ATCB would be expected to determine whether one certified EHR Module would be able to seamlessly integrate with another EHR Module. Again, as discussed in the HIT Standards and Certification Criteria interim final rule, if an eligible professional or eligible hospital chooses to use a combination of certified EHR Modules to customize their HIT to meet the definition of Certified EHR Technology, they have the responsibility to ensure that the certified EHR Modules can properly work together. Please note, though, that some EHR Modules may be subject to certain additional Federal requirements.

We request public comment on whether ONC-ATCBs should also be required to test and certify that any EHR Module presented by one EHR Module developer for testing and certification would properly work (i.e., integrate) with another EHR Module presented by a different EHR Module developer (this request for public comment would also apply to ONC-ACBs under the permanent certification program).

Additionally, we request public comment on whether the National Coordinator should permit applicants to seek authorization to test and certify only Complete EHRs designed for an ambulatory setting or, alternatively, Complete EHRs designed for an inpatient setting. Under our current proposal, an applicant seeking authorization to perform Complete EHR testing and certification would be required to test and certify Complete EHRs designed for both ambulatory and inpatient settings. However, if we were to separately authorize Complete EHR testing and certification, we see certain benefits for the temporary certification program as well as some negative effects. Among the benefits, this approach could create the potential that more organizations would apply for ONC-ATCB status because fewer resources may be needed and could be focused on one type of testing and certification. Among the negative effects, this approach could result in a situation in which no ONC-ATCB exists to certify one or another type of Complete EHR. This would prevent the testing and certification of Complete EHRs designed for either an ambulatory or inpatient setting from being able to be tested and certified.

With respect to EHR Modules, we would require applicants to identify the type(s) of EHR Module(s) they seek authorization to test and certify and would restrict any authorization granted to only those types of EHR Module(s). For example, if an applicant requests authorization to test and certify electronic prescribing EHR Modules, and is subsequently authorized to do so, it would not also be authorized to test and certify other EHR Modules, such as those related to clinical decision support.

c. Application Part One

We propose that an applicant must address the following four sections in part one of its application:

i. Under section one, the applicant would be required to provide the following general information to, among other reasons, ensure that we have proper contact information:

• The name, address, city, State, ZIP code, and Web site of the applicant;
• The name, title, phone number, and e-mail of the person who will serve as the point of contact for the applicant. This person must be legally authorized to execute and submit an application on behalf of the applicant (we refer to this person as an “authorized representative”).

ii. Under section two, the applicant would be required to provide the following information in an effort to demonstrate conformance to Guide 65 (which specifies the standards for operating a certification program):

• The results of a completed self-audit to all sections of Guide 65. We expect that applicants would complete this self-audit to the best of their ability. Because the temporary certification program will only be in existence for a relatively short period of time, we recognize that certain limitations exist with respect to specific sections of Guide 65. In particular, while we expect an applicant to address Guide 65 section 13 (surveillance), we anticipate putting relatively little weight on the specific responsibilities for ONC-ATCBs related to surveillance in the temporary certification program;
• A description of the applicant's management structure according to section 4.2 of Guide 65 (Section 4.2 requires an applicant to provide a description of its organization including, but not limited to, legal or ownership status, decision making processes, assurance of objectivity and impartiality in order to justify its ability to appropriately operate a certification program);
• A copy of the applicant's quality manual that has been developed according to section 4.5.3 of Guide 65 (Section 4.5.3 requires a quality manual documenting the organization's quality system, including, but not limited to, quality objectives and commitment to quality, and associated policies and procedures to ensure quality);
• The applicant's policies and approach to confidentiality according to section 4.10 of Guide 65 (Section 4.10 requires documentation of arrangements for safeguarding confidentiality of information, consistent with applicable laws);
• The qualifications of each of the applicant's personnel who oversee or perform certification according to section 5.2 of Guide 65 (Section 5.2 requires information on the relevant qualifications, training, and expertise of each staff member involved in the certification process to be retained and kept up-to-date);
• A copy of the applicant's evaluation reporting procedures according to section 11 of Guide 65 (Section 11 requires a description of evaluation reporting procedures for conformity or nonconformity of products with all certification requirements, including any remedial actions necessary for conformity); and
• A copy of the applicant's policies for use and display of certificates (e.g., logos) according to section 14 of Guide 65 (Section 14 requires evidence of policies and procedures for use and display of certificates, as appropriate).

iii. Under section three, the applicant would be required to provide the following information in an effort to demonstrate conformance to ISO 17025 (which specifies the standards for operating a testing program):

• The results of a completed self-audit to all sections of ISO 17025;
• A copy of the applicant's quality system document according to section 4.2.2 of ISO 17025 (Section 4.2.2 requires a quality system document to describe the management system policies related to quality, including a quality policy statement covering such items as purpose, objectives, and commitment to appropriate standards and best professional practices);
• A copy of the applicant's policies and procedures for handling testing nonconformities according to section 4.9.1 of ISO 17025 (Section 4.9.1 requires a description of policies and procedures used to identify, evaluate, and correct any nonconformity to testing procedures or other requirements); and
• The qualifications of each of the applicant's personnel who oversee or perform testing according to section 5.2 of ISO 17025 (Section 5.2 requires personnel competency records on the relevant qualifications, training, and expertise of each staff member involved in performing testing to be retained and kept up-to-date).

iv. Under section four, the applicant would be required to submit a properly executed agreement that it will adhere to the “Principles of Proper Conduct for ONC-ATCBs.” The Principles of Proper Conduct for ONC-ATCBs would require an ONC-ATCB to:

• Operate its certification program in accordance with Guide 65 and its testing program in accordance with ISO 17025.
• Maintain an effective quality management system which addresses all requirements of ISO 17025.
• Attend all mandatory ONC training and program update sessions.
• Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to test and certify Complete EHRs and/or EHR Modules.
• Use testing tools and procedures published by NIST (e.g., published on its Web site or through a notice in the Federal Register) or functionally equivalent testing tools and procedures published by another entity for the purposes of assessing Complete EHRs and/or EHR Modules compliance with the certification criteria adopted by the Secretary.
• Report to ONC within 15 days any changes that materially affect its:

○ Legal, commercial, organizational, or ownership status;

○ Organization and management, including key testing and certification personnel;

○ Policies or procedures;

○ Location;

○ Facilities, working environment or other resources;

○ ONC authorized representative (point of contact); or

○ Other such matters that may otherwise materially affect its ability to test and certify Complete EHRs and/or EHR Modules.

• Allow ONC, or its authorized agents(s), to periodically observe on site (unannounced or scheduled) during normal business hours, any testing and/or certification performed to demonstrate compliance with the requirements of the temporary certification program.
• Provide ONC, no less frequently than weekly, a current list of Complete EHRs and/or EHR Modules that have been tested and certified which includes, at a minimum, the vendor name (if applicable), the date certified, product version, the unique certification number or other specific product identification, and where applicable, the certification criterion or certification criteria to which each EHR Module has been tested and certified.
• Retain all records related to the testing and certification of Complete EHRs and/or EHR Modules for the duration of the temporary certification program and provide copies of all testing and certification records to ONC at the sunset of the temporary certification program.
• Promptly refund any and all fees received for tests and certifications that will not be completed.

We believe that adherence to these principles is necessary because they will help protect the integrity of the certification program and ensure that an applicant is capable of satisfactorily carrying out the required duties and responsibilities of an ONC-ATCB.

With respect to the third-to-the last principle listed, and in an effort to make it easier for eligible professionals and eligible hospitals to cross-validate that they have in fact adopted Certified EHR Technology, the National Coordinator intends to make a master “certified HIT products list” of all Complete EHRs and EHR Modules tested and certified by ONC-ATCBs available on the ONC Web site. This Web site would be a public service and would be a single, aggregate source of all the certified product information ONC-ATCBs provide to the National Coordinator. The master certified HIT products list would also represent all of the Complete EHRs and EHR Modules that could be used to meet the definition of Certified EHR Technology. Over time, we anticipate adding features to this Web site, which could include interactive functions to enable eligible professionals and eligible hospitals to use to determine whether a combination of certified EHR Modules, for instance, constitutes Certified EHR Technology.

With respect to the second to the last listed principle of proper conduct, because we anticipate that the temporary certification program will sunset in a relatively short period of time, we have proposed that all testing and certification records created by ONC-ATCBs must be retained, at a minimum, for the duration of the temporary certification program rather than proposing a specific preset length of time for record retention. Further, we propose that when the temporary certification program sunsets, all ONC-ATCBs would be required to provide to the National Coordinator copies of all of their testing and certification records. We also propose a specific minimum time period for record retention in the permanent certification program.

d. Application Part Two

In part two of the ONC-ATCB application process, applicants would be required to complete a proficiency examination. A proficiency examination would be used to assess whether an applicant can competently test and certify Complete EHRs and/or EHR Modules. Because the National Coordinator under the temporary certification program is performing a role similar to an accreditor, we believe a proficiency examination is a necessary requirement. We propose to create the proficiency examination with NIST's assistance and to design it to evaluate an applicant's knowledge and understanding of HIT functionality and standards and certification criteria, as well as their ability to properly test and certify Complete EHRs and/or EHR Modules. We believe that key personnel directly employed by applicants should be primarily responsible for completing the proficiency examination. Due to the topics it will cover, we anticipate that several key personnel may be required to complete the proposed proficiency examination. While we have not proposed to prohibit applicants from consulting with outside experts to complete their application, applicants would still need to clearly demonstrate in the material they submit to the National Coordinator that they will be able to competently operate a testing and certification program. In reviewing applications, the National Coordinator would take such assistance into account in order to determine whether an applicant's purported competency is not artificially inflated by temporarily retained outside expertise.

We propose to include questions in each proficiency exam from the following three sections. While a proficiency examination would address each of the sections below, we plan to generate a pool of questions from which a random selection would be used for an individual proficiency examination to ensure that no two proficiency examinations will be exactly the same. We have provided example questions for each section, but we do not believe that the specific proficiency exam questions should be made publicly available. The purpose of a proficiency examination is for an applicant to prove to the National Coordinator at the time of application submission that it possesses an adequate level of knowledge to competently perform the testing and certification of Complete EHRs and/or EHR Modules. Consequently, our rationale for posing different questions in each proficiency examination is the same as our reason for not making the specific proficiency examination questions available prior to an applicant submitting a satisfactory application—we seek to prevent an applicant from preparing answers in advance, which could inaccurately reflect an applicant's true competency. We are proposing that the applicant also affirmatively attest that it will not copy, retain, disclose, or in any way divulge any information from the proficiency examination.

• Section 1—Knowledge Quiz

This section would require an applicant to demonstrate a solid understanding of, and technical expertise in, Complete EHRs and/or EHR Modules. The applicant would be required to address the following concepts in a quiz format: Basic health IT knowledge; familiarity with the standards, implementation specifications, and certification criteria adopted by the Secretary; familiarity with test methods associated with the certification criteria adopted by the Secretary; and ability to determine how a test should be performed for a particular set of certification criteria.

An example question for section 1 would be: Please indicate the certification criteria adopted by the Secretary that also require compliance with specific standards. For each certification criterion, indicate its purpose and, if applicable, the potential alternative standard(s) adopted by the Secretary to which a Complete EHR or EHR Module could be tested and certified.

• Section 2—Identification of Test Tools

This section would require an applicant to demonstrate that it can correctly identify and use test tools published by ONC for Complete EHRs and EHR Modules. The test tools and functional testing techniques for the certification criteria adopted by the Secretary have been or will be developed by NIST. We expect that these test tools will available prior to, or at the same time as the temporary certification program's final rule is published.

An example question for section 2 would be: Please describe the steps you would take to test the capability of a Complete EHR or EHR Module to generate a patient summary record.

• Section 3—Proper Use of Test Tools and Understanding Test Results

This section would require an applicant to demonstrate that it can properly use test tools (e.g., a continuity of care document (CCD) validation tool), can correctly interpret test results generated by test tools, and further when using test tools that the test results the applicant produces are consistent.

An example question for section 3 would be: Using the XYZ test tool with the following sample data sets, please indicate which data sets passed the test, which data sets failed because of errors, and for those that data sets that resulted in a failure discuss why such a failure occurred.

2. Application Review

An applicant would be permitted to submit its application electronically via e-mail or on paper, or via regular or express mail (we believe that electronic applications would be the most efficient). We propose that the National Coordinator be permitted up to 30 days to review an application once it has been received (the National Coordinator would notify the applicant's authorized representative to acknowledge that the application was received). We propose to review applications for ONC-ATCB status in the order in which they are received and to review and rule on an application's parts sequentially (i.e., we will first review part one of an application and if deficiencies are found we will not review part two). We propose to notify the applicant if: (1) Its entire application was reviewed and found to be satisfactory or; (2) if its application was reviewed and deficiencies were found in either part one or part two of the application. In instances where deficiencies have been found, we propose to return the entire application with the deficiencies identified in the applicable part of the application.

a. Satisfactory Application

Applicants with satisfactory applications would be notified of their successful achievement of ONC-ATCB status and upon receipt of this notification would be permitted to represent themselves as “ONC-ATCBs” and begin testing and certifying Complete EHRs and/or EHR Modules, as applicable.

b. Deficient Application Returned and Opportunity To Revise

We propose to formally return an application if part one or part two contains deficiencies. If we discover deficiencies in part one of an application, we would not review part two until part one is satisfactory. In the event that a portion of an applicant's response to its proficiency examination is determined to be deficient, the National Coordinator may pose an equivalent replacement question for an applicant to respond to from the appropriate question pool. We propose that the National Coordinator would have the discretion to have an element of an application clarified or request that an inadvertent error or minor omission be corrected. In these cases, before issuing a formal deficiency notice, we propose that the National Coordinator may request such information from the applicant's authorized representative as an addendum to its application. If the applicant fails to provide such information to the National Coordinator in the timeframe specified by the National Coordinator, but no less than 5 days, the National Coordinator could issue a formal deficiency notice. In other circumstances, the National Coordinator could immediately send a formal deficiency notice if it is determined that significant deficiencies exist which cannot be addressed by a clarification or correction of a minor omission. A formal deficiency notice would be sent to the applicant's authorized representative and would include all deficiencies related to a part of an application requiring correction. If the National Coordinator issues a formal deficiency notice, we propose to permit an applicant one opportunity per application part to revise the relevant application part in response and that a revised application part must be received by the National Coordinator within 15 days of the applicant's receipt of a formal deficiency notice. If an applicant receives a formal deficiency notice related to part one of its application, because we have noted that part two would not have been reviewed, the applicant would be free to revise part two at the same time it is revising part one and resubmit an entirely updated application.

We propose that the National Coordinator be permitted up to 15 days to review a revised application once it has been received. If, upon a second review of the application, the National Coordinator determines that the revised application still contains deficiencies, the applicant will be issued a denial notice stating that it will no longer be considered for ONC-ATCB status under the temporary certification program. We propose to permit applicants to request that the National Coordinator reconsider this decision only when the applicant can demonstrate that clear, factual errors were made in the review of its application and that the errors' correction could lead to the applicant receiving ONC-ATCB status. Requests for reconsideration of revised applications will be conducted according to the process described in the next section. We seek public comment on whether there are other instances in which the National Coordinator should reconsider an application that has been deemed deficient multiple times.

We also request public comment on whether it would be preferable for applicants to have their entire application reviewed all at once and then issued a formal deficiency notice or whether we should, as proposed, review applications in parts. While the former may seem more efficient for an applicant, the latter would potentially be more efficient overall because the National Coordinator would be able to notify an applicant about deficiencies earlier as well as spend less time and resources reviewing an application that may need significant corrections.

3. ONC-ATCB Application Reconsideration Requests

We propose that an applicant for ONC-ATCB status who has had part 1 or part 2 of its application returned twice because of deficiencies and has subsequently received a denial notice would be able to request that the National Coordinator reconsider this determination. For applicants, this would be at most a formal third and final opportunity (per application part) to continue their pursuit of ONC-ATCB status. While we believe the following would be highly unlikely, it is possible that an applicant's request for reconsideration of part 2 of their application could constitute their sixth formal opportunity (i.e., three opportunities for part 1 and two prior opportunities for part 2 before the reconsideration request) to continue their pursuit of ONC-ATCB status. Again, per our request for public comment above, if we were to change our approach to reviewing applications for ONC-ATCB status, the amount of formal opportunities to revise an application would be reduced.

As previously discussed, we would only permit applicants to request the National Coordinator to reconsider a deficient application when the applicant could demonstrate that clear, factual errors were made in the review of its application and that the errors' correction could lead to the applicant receiving ONC-ATCB status.

In order to make a reconsideration request, an applicant would be required to submit to the National Coordinator, within 15 days of receipt of a denial notice, a written statement (preferably via e-mail) contesting the decision and explaining what factual errors it believes can account for the denial. An applicant would be required to include sufficient documentation to support its explanation. If the applicant does not file the reconsideration request within the specified timeframe, the National Coordinator could reject the reconsideration request.

Upon receipt of the reconsideration request, the National Coordinator would be permitted up to 15 days to review the information submitted by the applicant. If, based on the documentation submitted, the National Coordinator determines that when the application was reviewed a clear factual error(s) was made and that correction of the error(s) would lead to the applicant receiving ONC-ATCB status, the National Coordinator would notify the applicant's authorized representative that such an error occurred and that its application would continue to be processed. If the National Coordinator determined that a clear factual error(s) was made in part 1 of an application and that correction of the error(s) would lead to a satisfactory submission for part 1 of an application, the National Coordinator would subsequently review part 2 of the application. If the National Coordinator determined that a clear factual error(s) was made in part 2 of an application and that correction of the error(s) would lead to a completely satisfactory application, the applicant's authorized representative would be notified that the applicant successfully achieved ONC-ATCB status. If, however, after reviewing an applicant's reconsideration request the National Coordinator determines that the applicant did not provide sufficient evidence in its explanation to identify the factual error or errors that were made during the review of its application, the National Coordinator could reject the applicant's reconsideration request.

4. ONC-ATCB Status

a. Acknowledgement and Representation

We propose to make publicly available at http://healthit.hhs.gov the name of each ONC-ATCB, the date each ONC-ATCB was authorized by the National Coordinator, and the type(s) of testing and certification each ONC-ATCB is authorized to perform. Further, to prevent an ONC-ATCB from misrepresenting the scope of its authorization, we propose that an ONC-ATCB must prominently and unambiguously identify on its Web site and in all marketing and communications statements (written and oral) the scope of its authorization (e.g., the HIT Certification Group is an ONC-ATCB for e-prescribing EHR Modules).

b. Expiration of Status Under the Temporary Certification Program

As previously mentioned, we expect to publish a final rule for the permanent certification program within a few months of publishing the temporary certification program's final rule. When this occurs, we would immediately begin to implement the permanent certification program's final provisions with the goal of having ONC-ACBs authorized under the permanent certification program by or before the beginning of calendar year 2012 in order to coincide with the certification activities that would need to take place in the coming months for meaningful use Stage 2. We believe it will take between 8 to 16 months to implement the permanent certification program, and therefore, we expect ONC-ATCBs under the temporary certification program would only be responsible for testing and certifying Complete EHRs and/or EHR Modules to the certification criteria adopted by the Secretary that are applicable to meaningful use Stage 1. Moreover, we will be working to assure that ONC-ACBs authorized under the permanent certification program will be in place with sufficient time to certify Complete EHRs and EHR Modules to the certification criteria adopted by the Secretary that are applicable to meaningful use Stage 2. However, if the transition to the permanent certification program occurs prior to the end of 2011, it is possible that a small percentage of late or new-to-market Complete EHRs and/or EHR Modules developed to meet the certification criteria associated with meaningful use Stage 1 may wind up being tested and certified according to the policies established in the permanent certification program.

Because the temporary certification program would be operational only for a short period of time (less than 2 years), we do not believe that it is necessary to require an ONC-ATCB to renew their “authorized status” under the temporary certification program. As a result, we have not proposed a renewal requirement for ONC-ATCB status. All ONC-ATCBs would maintain their status (unless revoked) until the temporary certification program sunsets (see section II.F). The chart below illustrates the anticipated operational periods (denoted by quarters within each calendar year) for the temporary and permanent certification programs, along with the respective proposed meaningful use Stage 1 and 2 beginning points for eligible hospitals (Q4) and eligible professionals (Q1).

E. ONC-ATCB Performance of Testing and Certification and Maintaining Good Standing as an ONC-ATCB

1. Authorization To Test and Certify Complete EHRs

We propose that authorization to test and certify Complete EHRs under the temporary certification program would require an ONC-ATCB to be capable of performing “complete” testing and certification. Complete testing and certification would result in the ONC-ATCB testing and certifying Complete EHRs to all applicable certification criteria adopted by the Secretary. For example, the certification criteria applicable to Complete EHRs that eligible professionals would adopt would need to be tested and certified to all of the certification criteria at 45 CFR 170.302 and 45 CFR 170.304.

2. Authorization To Test and Certify EHR Modules

We propose that authorization to test and certify EHR Modules under the temporary certification program would require an ONC-ATCB to do so in accordance with the applicable certification criterion or certification criteria adopted by the Secretary. Furthermore, because an EHR Module, once certified, can be used in combination with other certified EHR Modules to meet the definition of Certified EHR Technology, we propose that an ONC-ATCB authorized to test and certify EHR Modules would be required to clearly indicate the certification criterion or certification criteria to which an EHR Module has been tested and certified. We believe this requirement would benefit potential adopters of certified EHR Modules and make it easier for them to determine the full capabilities that a combination of certified EHR Modules includes. To benefit potential adopters of certified EHR Modules, we would also expect EHR Module developers to clearly indicate the certification criterion or certification criteria to which an EHR Module they have developed has been tested and certified.

a. Certification Criterion Scope

As specified at 45 CFR 170.102, the definition of EHR Module means “any service, component, or combination thereof that can meet the requirements of at least one certification criterion adopted by the Secretary.” In some cases, the certification criteria specified at 45 CFR 170.302, 45 CFR 170.304, and 45 CFR 170.306 simply reference a criterion at the first paragraph level, for example, 45 CFR 170.302, paragraph “(f)” states, “Smoking Status. Enable a user to electronically record, modify, and retrieve the smoking status of a patient. Smoking status types must include: current smoker, former smoker, or never smoked.” In other cases, for example, a certification criterion like “Drug-Drug, Drug-Allergy, Drug-Formulary Checks” at 45 CFR 170.302 paragraph “(a)” includes a second level “(1)” through “(4)” which articulate partial aspects of a single, complete capability. For the purposes of testing and certifying an EHR Module, we therefore interpret “one certification criterion” in the definition of EHR Module to mean the entirety of the capabilities encompassed by what is specified at the first paragraph level.

b. When Privacy and Security Certification Criteria Apply to EHR Modules

We believe that EHR Modules hold great promise with respect to innovation. However, we also recognize that the potential innovative benefits EHR Modules can provide will be significantly compromised if these same EHR Modules do not include appropriate privacy and security safeguards to instill trust.

EHR Modules can come in many forms and can provide a large set of capabilities or a single capability. This variability, which promotes innovation, also poses several challenges to determining when it is appropriate to require EHR Modules be tested and certified to the privacy and security certification criteria adopted by the Secretary (45 CFR 170.302(o) through (v)). Our goal for determining when this should occur is two-fold: (1) Assure eligible professionals and eligible hospitals that EHR Modules will not negatively affect how Certified EHR Technology in its entirety protects electronic health information; and (2) appropriately require (or not require) the testing and certification of EHR Modules to privacy and security certification criteria.

In the context of EHR Modules and testing and certification, it is important to keep in mind that we are discussing a point before “implementation” in the HIT lifecycle. Accordingly, ONC-ATCBs will test and certify EHR Modules independent of, and disassociated from, their potential operating environments. Below, we identify several challenges to determining when an ONC-ATCB should be required to test and certify EHR Modules to the privacy and security certification criteria adopted by the Secretary. After discussing these challenges, we propose, and request public comment on a potential approach that establishes when ONC-ATCBs should be required to test and certify EHR Modules to the privacy and security certification criteria adopted by the Secretary in addition to the capability or capabilities the EHR Module may be specifically designed to provide.

One challenge with respect to determining when EHR Modules should be tested and certified to the privacy and security certification criteria adopted by the Secretary occurs when EHR Modules operate in an environment separate from other EHR Modules—when they are so-to-speak “autonomous.” For example, an e-prescribing EHR Module or a patient portal EHR Module provided by an application service provider (ASP) could be hosted and maintained by the ASP (not by the end-user). In these cases, an end-user (e.g., eligible professional) may be unable to control or specify the level or amount of privacy and security safeguards associated with the health information stored, modified, or transmitted by the EHR Module. We believe that it would be irresponsible and potentially dangerous to permit such EHR Modules to be tested and certified solely to their specific capability, and not to the privacy and security certification criteria adopted by the Secretary.

On the flipside, a second challenge relates to EHR Modules that, by design, may provide specific capabilities which make it technically infeasible to require that they separately meet the privacy and security certification criteria adopted by the Secretary. One example could be a medication reconciliation EHR Module which, from a technical perspective, would be designed to function “behind the scenes” as part of the internal workings of Certified EHR Technology. In all likelihood, it would therefore depend on another EHR Module's or EHR Modules' privacy and security capabilities. In this example, we believe that it would be technically infeasible for the medication reconciliation EHR Module to have its own authentication capability because, in all likelihood, an end-user would have had to have been authenticated prior to gaining access to the medication reconciliation EHR Module. Conversely, while it is unlikely that the medication reconciliation EHR Module would retain or store health information, other EHR Modules might, and it may be appropriate to require such EHR Modules to be tested and certified to some or all of the privacy and security certification criteria adopted by the Secretary.

Because of the context specific nature of EHR Modules, and the fact that we expect them to provide many different capabilities, it is difficult to establish with absolute certainty an approach that will work for all EHR Modules. However, we believe that an appropriate starting point for such an approach should focus first on protecting individuals' health information and then on whether there exist appropriate exceptions to the approach that would exempt EHR Modules from the requirement to be tested and certified to adopted privacy and security certification criteria. As a result, we propose that ONC-ATCBs would be required to test and certify all EHR Modules to the privacy and security certification criteria adopted by the Secretary unless the EHR Modules is/are presented for testing and certification in one of the following manners:

• The EHR Module(s) are presented for testing and certification as a pre-coordinated, integrated “bundle” of EHR Modules, which could otherwise constitute a Complete EHR. In such instances, the EHR Module(s) would be tested and certified in the same manner as a Complete EHR. Because the bundle of EHR Modules would constitute a single, integrated product, we believe that it would be unnecessary in such cases to require each EHR Module to be tested and certified independently to privacy and security certification criteria. We propose one variation to this exception for pre-coordinated bundles of EHR Modules which include EHR Module(s) that would not be part of an eligible professional or eligible hospital's local system and under its direct control (e.g., a patient portal EHR Module that is not hosted and maintained). In these situations, the constituent EHR Modules of such an integrated bundle would need to be separately tested and certified to all privacy and security certification criteria;
• An EHR Module is presented for testing and certification, and the presenter can demonstrate to the ONC-ATCB that it would be technically infeasible for the EHR Module to be tested and certified in accordance with some or all of the privacy and security certification criteria. For example, we believe that it would be technically infeasible for an EHR Module that does not store even temporarily, or maintain any health information to be required to include a capability to encrypt health information at rest or include an audit log. Alternatively, it would presumably be technically infeasible for an EHR Module that does not provide a capability for exchange to be required to include the capabilities to encrypt health information for exchange or account for treatment, payment, or health care operations disclosures; or
• An EHR Module is presented for testing and certification, and the presenter can demonstrate to the ONC-ATCB that the EHR Module is designed to perform a specific privacy and security capability. In such instances, we do not believe that it should be tested and certified to the other privacy and security certification criteria adopted by the Secretary. For example, an encryption EHR Module would not be required to be tested and certified as also including the capability to terminate an electronic session after a predetermined time of inactivity.

We believe that the approach we have articulated above provides an appropriate framework for determining when ONC-ATCBs would be required to test and certify EHR Modules to the privacy and security certification criteria adopted by the Secretary. We request public comment on whether there are additional alternatives to the ones proposed above and other circumstances where an EHR Module should be tested and certified to none, some, or all of the privacy and security certification criterion adopted by the Secretary.

3. Authorized Testing and Certification Methods

We propose that in being authorized to test and certify Complete EHRs and/or EHR Modules, ONC-ATCBs must have the capacity to test and certify Complete EHRs and/or EHR Modules at their facility. We propose further that an ONC-ATCB must also have the capacity to test and certify Complete EHRs and/or EHR Modules through some secondary means or at a secondary location. Such secondary methods would include testing and certification: (1) At the site (i.e., physical location) where a Complete EHR or EHR Module has been developed (e.g., at a Complete EHR developer's facility); or (2) at the site (i.e., physical location) where the Complete EHR or EHR Module resides (e.g., at a hospital where the HIT has been installed); or (3) remotely (i.e., through other means, such as through secure electronic transmissions and automated Web-based tools, or at a location other than the ONC-ATCB's facilities). We believe that these secondary testing and certification methods will better accommodate self-developed Complete EHRs and EHR Modules. For example, a Complete EHR developer may submit a Complete EHR to an ONC-ATCB to be tested and certified at the ONC-ATCB's facility. In other cases, it may not be practicable for a hospital with a self-developed Complete EHR to submit its Complete EHR to an ONC-ATCB for testing and certification at the ONC-ATCBs facility and, in these cases, we expect that ONC-ATCBs would either test and certify the hospital's Complete EHR at the hospital where the Complete EHR resides or remotely through other means that do not require the ONC-ATCB to be physically present at the hospital. We expect that the most common form of remote testing and certification will employ the use of automated programs that can be accessed by the hospital via the Internet to demonstrate to the ONC-ATCB that its Complete EHR meets all applicable certification criteria adopted by the Secretary. Other forms of remote testing and certification may include an employee of the ONC-ATCB walking through a particular scripted scenario with predefined data that the hospital would have to “plug-in” to their Complete EHR and then convey the result (e.g., the hospital would be asked to enter fabricated information on a group of “test” patients into its Complete EHR and provide responses to specific questions asked by the ONC-ATCB employee). We request public comment on whether an ONC-ATCB should be required to perform any of the secondary methods discussed above in addition to testing and certifying Complete EHRs and/or EHR Modules at its facility.

Our proposals do not preclude eligible professionals and eligible hospitals who have already adopted and implemented HIT that they believe meets the definition of Certified EHR Technology from seeking to have such HIT tested and certified themselves. Rather than relying on the vendor(s) that supplied their HIT to them to apply for testing and certification, eligible professionals and eligible hospitals could go directly to an ONC-ATCB to get their HIT tested and certified. However, eligible professionals and eligible hospitals should keep in mind that they alone would bear the full costs of testing and certification if they went directly to an ONC-ATCB.

4. The Testing and Certification of “Minimum Standards”

In the HIT Standards and Certification Criteria interim final rule (75 FR 2014), we explained how we would approach the testing and certification of Complete EHRs and EHR Modules for certain vocabulary code set standards. Our approach included the establishment of these standards as “minimum standards.” Adopting a particular version of the code set as a “minimum” permits a Complete EHR and/or EHR Module to be tested and certified to a permitted newer version of an adopted code set without the need for additional rulemaking on the part of the Secretary. For example, on the day the HIT Standards and Certification Criteria interim final rule was put on display by the Federal Register for public inspection a new version (version 2.29) of Logical Observation Identifiers Names and Codes (LOINC®) was released. In that regard, we stated the following in the HIT Standards and Certification Criteria interim final rule:

[W]e understand that certain types of standards, specifically code sets, must be maintained and frequently updated to serve their intended purpose effectively * * * To address this need and accommodate industry practice, we have in this interim final rule indicated that certain types of standards will be considered a floor for certification. We have implemented this approach by preceding references to specific adopted standards with the phrase, “at a minimum.” In those instances, the certification criterion requires compliance with the version of the code set that has been adopted through incorporation by reference, or any subsequently released version of the code set. This approach will permit Complete EHRs and EHR Modules to be tested and certified, to, “at a minimum,” the version of the standard that has been adopted or a more current or subsequently released version. This will also enable Certified EHR Technology to be updated from an older, “minimum,” adopted version of a code set to a more current version without adversely affecting Certified EHR Technology's “certified status.” We intend to elaborate in the upcoming HIT Certification Programs proposed rule on how testing and certification would be conducted using standards we have adopted and designated as “minimums” in certain certification criteria. That being said, we understand that this approach has certain limitations. In some cases, for instance, rather than simply maintaining, correcting, or slightly revising a code set, a code set maintaining organization will modify the structure or framework of a code set to meet developing industry needs. We would consider this type of significant revision to a code set to be a “modification,” rather than maintenance or a minor update of the code set. An example of a code set “modification” would be if a hypothetical XYZ code set version 1 were to use 7-digit numeric codes to represent health information while XYZ code set version 2 used 9-digit alphanumeric codes to represent health information. In such cases, interoperability would likely be reduced among Complete EHRs and EHR Modules that have adopted different versions of the structurally divergent code sets. If a code set that we have adopted through incorporation by reference is modified significantly, we will update the incorporation by reference of the adopted version with the more recent version of the code set prior to requiring or permitting certification according to the newer version.

At the end of this discussion we provided examples of when a standard would be considered a “minimum standard” and the limitation to our approach. To address the identified limitation, we propose to clarify when a newer version of an adopted “minimum standard” code set would be permitted for use in testing and certification and when it would not. We believe that there are two prevailing methods the Secretary could use to determine whether a significant revision to a code set represents a “modification, rather than maintenance or a minor update of the code set” and, consequently, when a code set version should not be permitted for testing and certification above the minimum adopted by the Secretary until additional public comment can be obtained.

The first method would allow for any member of the general public to notify the National Coordinator about a new version of an identified “minimum standard” code set. For this method, we would encourage the person or entity who submits a notification to the National Coordinator to include any relevant information the National Coordinator would need to correctly identify the “minimum standard” code set (e.g., name and version) and any additional information that the National Coordinator could use to determine whether the new version constitutes general maintenance or minor updates, or a significant revision or modification. Upon receipt of these notifications and a determination by the National Coordinator that the new version of the code set did not represent a significant revision or modification, the National Coordinator would request the Secretary to permit the use of the identified new version for testing and certification purposes.

The second method we considered, and solicit public comment on, would be for the Secretary to proactively identify newly published versions of adopted minimum standard code sets and issue determinations as to whether they reflect maintenance efforts or minor updates of the adopted code set and would be permitted for testing and certification.

For either method above, we propose that once the Secretary has granted permission for a new version of an adopted minimum standard code to be used:

(1) Any ONC-ATCB may test and certify Complete EHRs and/or EHR Modules according to the new version;

(2) Certified EHR Technology may be upgraded to comply with the new version of an adopted minimum standard accepted by the Secretary without adversely affecting the certification status of the Certified EHR Technology; and

(3) ONC-ATCBs would not be required to test and certify Complete EHRs and/or EHR Modules according to the new version until we updated the incorporation by reference of the adopted version to a newer version.

For either method, we also propose to regularly publish (on quarterly basis) either by presenting to the HIT Standards Committee or by posting a notification on our Web site, any Secretarial determinations that have been made with respect to “minimum standard” code sets. We request public comment on whether a quarterly publication is an appropriate notification interval. We also seek public comment on other methods we might take to identify acceptable newer versions of minimum standard code sets in addition to the two methods we have discussed. Please note that the two methods we have proposed are not mutually exclusive and we request public comment on whether it would be advantageous to pursue both methods.

5. Maintaining Good Standing as an ONC-ATCB; Violations That Could Lead to the Revocation of ONC-ATCB Status; Revocation of ONC-ATCB Status

In order to maintain good standing as an ONC-ATCB, we propose that an ONC-ATCB would have to abide by the Principles of Proper Conduct for ONC-ATCBs. In addition, we expect that an ONC-ATCB would follow other Federal and State laws to which it is subject and refrain from engaging in other types of inappropriate behavior.

Further, we propose that the National Coordinator would be capable of revoking an ONC-ATCB's status under the temporary certification program when either of two types of violations occurs. We describe these violations and the revocation process below.

a. Type-1 Violations

Type-1 violations would include violations of law or temporary certification program policies that threaten or significantly undermine the integrity of the temporary certification program. Type-1 violations would include, but are not limited to, false, fraudulent, or abusive activities that affect: The temporary certification program; a program administered by HHS; or any program administered by the Federal government. These violations could jeopardize the integrity of the temporary certification program and would include examples such as, the ONC-ATCB or a principal employee, owner, or agent of an ONC-ATCB being convicted of fraud, embezzlement or extortion or of violating a similar Federal or State securities laws while participating in the temporary certification program, falsifying or manipulating test results and certifications, or withholding information that would indicate false or fraudulent activity had occurred within the temporary certification program.

We believe that the National Coordinator must ensure that the certification program is fair and honest and provides users of Certified EHR Technology with faith in the integrity of the temporary certification program (e.g., that Complete EHRs and EHR Modules have been properly tested and certified). Therefore, if the National Coordinator has evidence that an ONC-ATCB committed one or more of the above-mentioned violations (false, fraudulent, and abusive activities) the National Coordinator could issue the ONC-ATCB a notice proposing to revoke its ONC-ATCB status.

b. Type-2 Violations

“Type-2” violations would include inappropriate conduct by an ONC-ATCB under the temporary certification program. A Type-2 violation would include, but not be limited to, the failure of an ONC-ATCB to adhere to the Principles of Proper Conduct for ONC-ATCBs and engaging in other types of inappropriate behavior. Examples of these types of violations include, but are not limited to: failing to attend mandatory ONC training programs, failing to meet specified reporting requirements, misrepresenting the scope of its authorization, and an ONC-ATCB testing and certifying Complete EHRs and/or EHR Modules for which it does not have authorization.

If the National Coordinator obtains reliable evidence from fact-gathering, requesting information from an ONC-ATCB, contacting an ONC-ATCB's customers, witnessing an ONC-ATCB perform testing or certification, and/or substantiated complaints that an ONC-ATCB's conduct may indicate a failure to adhere to the Principles of Proper Conduct for ONC-ATCBs or exhibited other inappropriate behavior, the National Coordinator would notify the ONC-ATCB of a possible Type-2 violation. The notification would include all pertinent information regarding the National Coordinator's assessment.

Unless otherwise specified by the National Coordinator, an ONC-ATCB would be permitted up to 30 days from the date it is notified about possible Type-2 violation(s) to submit a written response and any accompanying documentation that could demonstrate no violation(s) occurred or validate that violation(s) occurred and were corrected. If the ONC-ATCB fails to submit a response to the National Coordinator within 30 days, the National Coordinator could issue the ONC-ATCB a notice proposing to revoke its ONC-ATCB status.

If an ONC-ATCB submits a response, the National Coordinator would be permitted up to 30 days to evaluate the ONC-ATCB's response (and request additional information, if necessary). If the National Coordinator determines that the ONC-ATCB did not commit a Type-2 violation, or may have committed a Type-2 violation but satisfactorily corrected any violation(s) that may have occurred, a memo will be issued to the ONC-ATCB to confirm this determination. If the National Coordinator determines that the ONC-ATCB's response is insufficient and that a Type-2 violation had occurred and had not been adequately corrected, then the National Coordinator could propose to revoke an ONC-ATCB's status.

c. Proposed Revocation

We propose that the National Coordinator could propose the revocation of an ONC-ATCB's status for alleged Type-1 violations and for failing to respond to, or satisfactorily address, a notification related to a Type-2 violation.

We request public comment on whether the National Coordinator should also consider proposing the revocation of an ONC-ATCB's status for repeatedly committing Type-2 violations even if the ONC-ATCB has adequately corrected the violations each time. We further request comment on how many corrected Type-2 violations would be sufficient for proposing revocation of an ONC-ATCB and to what extent the frequency of these violations should be a consideration. While we have not repeated this request for public comment in our discussion of the permanent certification program, we nevertheless encourage comments regarding this option for that program as well.

i. Opportunity To Respond to a Proposed Revocation Notice

We propose that an ONC-ATCB could respond to a proposed revocation notice within 10 days of receipt of the proposed revocation notice in order to contest the proposed revocation and explain why its status should not be revoked. We propose that if an ONC-ATCB responds to a revocation notice, it must include sufficient documentation to support its explanation. Upon receipt of an ONC-ATCB's response to a proposed revocation notice, the National Coordinator would be permitted up to 30 days to review the information submitted by the ONC-ATCB.

During the time period provided for an ONC-ATCB to respond to the proposed revocation notice and the National Coordinator's review period, we propose to permit the ONC-ATCB to continue its operations under the temporary certification program. We believe this proposal affords the ONC-ATCB meaningful due process and would minimally impact the temporary certification program because we have proposed procedures for reaching a timely final decision on revocation. We welcome comments on this proposal and whether it would be more appropriate for the National Coordinator to immediately suspend an ONC-ATCB's operations for the time between the issuance of a proposed revocation notice and a final decision on revocation.

If the National Coordinator determines that an ONC-ATCB's status should not be revoked, the National Coordinator would notify the ONC-ATCB's authorized representative in writing to express this determination.

ii. Revocation of an ONC-ATCB's Status

We propose that the National Coordinator could revoke an ONC-ATCB's status if it is determined that revocation is appropriate after considering the information provided by the ONC-ATCB in response to the proposed revocation notice or if the ONC-ATCB does not respond to a proposed revocation notice within the specified timeframe.

We propose that a decision to revoke an ONC-ATCB's status would be final and would not be subject to further review unless the National Coordinator chooses to reconsider the revocation.

d. Extent and Duration of Revocation Under the Temporary Certification Program

We propose that the revocation of an ONC-ATCB's status would become effective as soon as the ONC-ATCB receives the revocation notice. A testing and certification body whose ONC-ATCB status has been revoked would be prohibited from accepting new requests for testing and certification and would be required to cease its current testing and certification operations related to Complete EHRs and/or EHR Modules (i.e., the National Coordinator's revocation would not apply to other testing and certification operations that are not within the scope of this rule). We would also expect it to issue a complete refund to any entity whose Complete EHR or EHR Module was being tested and certified by the ONC-ATCB at the time its status was revoked. If a testing and certification body were to refuse or fail to issue a complete refund(s) upon having its ONC-ATCB status revoked, we propose that the refusal or failure should be a consideration in determining the qualifications of a testing and certification body if it were to apply at a later date to be an ONC-ACB under the proposed permanent certification program. We welcome comments on this proposal, including any potential alternatives.

Once an ONC-ATCB has had its status revoked, the testing and certification body would be permitted to reapply for ONC-ATCB status under the temporary certification program and apply under our proposed permanent certification program unless it had its status revoked for a Type-1 violation. Type-1 violations would significantly undermine the integrity of the temporary certification program and we do not believe it would be appropriate to allow the same testing and certification body to reapply for ONC-ATCB right away. Further, we believe that Type-1 violations could so significantly undermine the public's faith in our proposed certification programs that we propose to prohibit the testing and certification body from reapplying for ONC-ATCB status for 1 year and to count that 1 year prohibition towards the ONC-ACB application period under the permanent certification program if the temporary certification program sunsets during this time. We request public comment on any other alternatives regarding the treatment of “former ONC-ATCBs” that have had their status revoked.

We recognize that in instances where an ONC-ATCB has had its status revoked, some people may call into question the legitimacy of the certifications issued by the former ONC-ATCB. To address this matter, we propose that the “certified status” of Complete EHRs and/or EHR Modules certified by the former ONC-ATCB will remain intact unless a Type-1 violation was committed that calls into question the legitimacy of the certifications issued by the former ONC-ATCB. In these circumstances, which we believe would be extremely rare, we propose that the National Coordinator would review the facts surrounding the revocation of the ONC-ATCB's status and publish a notice on ONC's Web site if the National Coordinator believes that Complete EHRs and/or EHR Modules were fraudulently certified by a former ONC-ATCB and the certification process itself failed to comply with regulatory requirements. If the National Coordinator determines that Complete EHRs and/or EHR Modules were improperly certified, we propose that the “certified status” of impacted Complete EHRs and/or EHR Modules would remain intact for 120 days after the National Coordinator publishes the notice. We believe that 120 days is a suitable timeframe for the developers of the impacted Complete EHRs and/or EHR Modules to get their HIT re-certified by an ONC-ATCB in good standing. We request public comment on our proposed approach and the timeframe for re-certification. Although highly unlikely, it is important to note that if a Complete EHR or EHR Module developer whose product was improperly certified does not seek to remedy this improper certification in the timeframe provided that all of the end-users (e.g., eligible professionals and eligible hospitals) that have adopted the Complete EHR or EHR Module developer's product would no longer have HIT that meets the definition of Certified EHR Technology.

e. Alternative Considered

As noted briefly above, another alternative approach to the revocation process described above (where the National Coordinator would issue a notice to an ONC-ATCB proposing to revoke its status) would be a suspension process whereby an ONC-ATCB's status would be suspended if the ONC-ATCB is reasonably suspected of having committed a Type-1 violation or if the ONC-ATCB fails to respond in a timely manner to a possible Type-2 violation or has not appropriately addressed an admitted Type-2 violation. Such a process would result in the National Coordinator issuing an ONC-ATCB a suspension notification. Upon receipt of a suspension notification, an ONC-ATCB would have to temporarily cease testing and certifying Complete EHRs and/or EHR Modules. Additionally, during the suspension an ONC-ATCB would also be prohibited from accepting new requests for testing and certification.

If the National Coordinator issues a suspension notice to an ONC-ATCB, the ONC-ATCB could respond directly to the National Coordinator and explain in writing why its status should not have been suspended. Upon receiving the ONC-ATCB's response, the National Coordinator would review the information submitted by the ONC-ATCB and reply within 7 days. In the reply, the National Coordinator could extend the suspension for an additional 14 days to obtain further information, terminate the suspension, or propose revocation while extending suspension during the pendency of the revocation process.

We believe that a suspension process is an alternative worth considering because it could assist the National Coordinator in preventing further untoward actions by an ONC-ATCB, whereas the process we discuss above would permit, albeit presumably for a short amount of time, an ONC-ATCB to continue to test and certify Complete EHRs and/or EHR Modules while revocation procedures are underway. Therefore, we request public comment on whether the National Coordinator should also include a process to suspend an ONC-ATCB's status. We have not repeated this request for public comment in our discussion of the permanent certification program, but we encourage commenters to consider this as an option for that program as well and provide comments.

6. Validity of Complete EHR and EHR Module Certification

In the HIT Standards and Certification Criteria interim final rule, we defined Certified EHR Technology to mean “a Complete EHR or a combination of EHR Modules, each of which: (1) Meets the requirements included in the definition of a Qualified EHR; and (2) has been tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary.”

Part two of the definition of Certified EHR Technology specifies an important concept—that in order to meet the definition, a tested and certified Complete EHR or combination of separately tested and certified EHR Modules must meet all applicable certification criteria adopted by the Secretary. Certification represents a snapshot, a fixed point in time, where it has been confirmed that a Complete EHR or EHR Module has met all applicable certification criteria adopted by the Secretary. From that point forward, a specific Complete EHR or EHR Module version which has been certified would be forever labeled “certified.” However, as the Department adopts new or modified certification criteria, previously adopted certification criteria would no longer constitute all of the applicable certification criteria to which a Complete EHR or EHR Module would need to be tested and certified. As a result, Complete EHRs and EHR Modules that had been certified to a previously adopted set of certification criteria would no longer be considered “Certified EHR Technology” for purposes of enabling an eligible professional or eligible hospital to attempt to achieve a future stage of meaningful use.

As previously mentioned in both the HIT Standards and Certification Criteria interim final rule and the Medicare and Medicaid EHR Incentive Programs proposed rule, we and CMS stated that we anticipate that the requirements for meaningful use will be adjusted every two years. Accordingly, and because the HITECH Act requires eligible professionals and eligible hospitals to use Certified EHR Technology in order to qualify for incentive payments, we expect that there will continue to be a close correlation and connection between certification criteria adopted by the Secretary and future meaningful use objectives (and their associated measures).

In that regard, when a set of objectives and measures for a future stage of meaningful use has been proposed, we anticipate that the Secretary would also propose to adopt certification criteria to replace, amend, or add to previously adopted certification criteria. Presumably, those additional or modified certification criteria would set a new, higher bar for the capabilities that Certified EHR Technology would need to include and for which eligible professionals and eligible hospitals would need in order to attempt to achieve the next proposed meaningful use stage.

We believe the planned two-year schedule for updates to meaningful use objectives and measures and correlated certification criteria creates a natural expiration for the “certified status” of Complete EHRs and EHR Modules. Accordingly, after the Secretary has adopted new or modified certification criteria, the validity of the certification associated with previously certified Complete EHRs and EHR Modules will expire and those Complete EHRs and EHR Modules would need to be re-certified in order for eligible professionals and eligible hospitals to continue to possess HIT that meets “all applicable certification criteria adopted by the Secretary” and consequently also meets the definition of Certified EHR Technology.

Stated another way, regardless of the year and meaningful use stage at which an eligible professional or eligible hospital enters the Medicare or Medicaid EHR Incentive Program, the Certified EHR Technology that would be used would have to include the capabilities necessary to meet the most current certification criteria adopted by the Secretary at 45 CFR 170 subpart C in order to meet the definition of Certified EHR Technology. For example, if the Secretary adopts 5 new certification criteria in 2012 which would be applicable to, and in support of, meaningful use Stage 2, an eligible professional who implemented Certified EHR Technology in 2011 would need to ensure that its HIT was upgraded with newly certified software or a certified EHR Module by 2013 to include the 5 new capabilities the Secretary adopted in the certification criteria in order to continue to have HIT that meets the definition of Certified EHR Technology and could provide the capabilities they would need to continue to attempt to achieve meaningful use.

We also want to point out and clarify an apparent, yet temporary, inconsistency that would occur in 2013 and 2014 should CMS finalize its proposed staggered approach for meaningful use stages to provide flexible entry points for eligible professionals and eligible hospitals (e.g., an eligible professional whose first payment year is 2013 would start at meaningful use Stage 1 in 2013, while an eligible professional whose first payment year was 2011 would be required to meet meaningful use Stage 2 requirements in 2013). The apparent inconsistency pertains to the HIT an eligible professional or eligible hospital would need to have to meet the definition of Certified EHR Technology and the meaningful use stage the eligible professional or eligible hospital would need to meet to qualify for incentive payments. As proposed, eligible professionals and eligible hospitals who seek to have their first payment year begin in 2013 or 2014 would only need to meet meaningful use stage 1 requirements; however, the Certified EHR Technology they would need to use, would need to meet the most recent certification criteria adopted by the Secretary, which at that time would be in support of meaningful use stage 2. As a result, should CMS finalize its proposed staggered approach for meaningful use stages, these eligible professionals and eligible hospitals would need to use “meaningful use stage 2 Certified EHR Technology” even though they would only have to meet meaningful use stage 1 metrics.

Should CMS finalize its proposed staggered approach for meaningful use stages, we recognize that some confusion within the HIT industry may arise during 2013 and 2014 because of this apparent inconsistency and the divergent use of the term “meaningful use.” We would anticipate, therefore, that ONC-ACBs would clearly indicate the certification criteria used when certifying Complete EHRs and/or EHR Modules, and identify certifications according to the calendar year and month rather than the meaningful use stage to reflect the currency of the certification criteria against which the Complete EHRs and/or EHR Modules have been certified. Consequently, if an eligible professional or eligible hospital were seeking to obtain a certified Complete EHR or certified EHR Module in 2014, for instance, that eligible professional or eligible hospital would look for Complete EHRs and EHR Modules certified in accordance with certification criteria current in 2014, rather than Complete EHRs and EHR Modules certified as meeting certification criteria intended to support meaningful use Stage 1, Stage 2, or Stage 3. We request comments on ways to ensure greater clarity in the certification of Complete EHRs and EHR Modules.

We believe this proposed approach would benefit eligible professionals and eligible hospitals whose first payment year is in 2013 because they would already have the Certified EHR Technology they would need in order to meet meaningful use stage 2, which, as proposed, would begin for them in the following year (2014). Eligible professionals and eligible hospitals, whose first payment year is 2014, would also benefit. They would have adopted more advanced HIT and would need to be familiar with the additional capabilities it provides, because, as proposed, they would need to meet meaningful use Stage 3 requirements in the following year (2015). This approach would also assist other HIT users with whom eligible professionals and eligible hospitals would exchange information by ensuring improved interoperability among their respective HIT systems.

We again note that this apparent inconsistency would exist only for the years 2013 and 2014. By 2015, if as proposed by CMS an eligible professional or eligible hospital seeks to begin participating in the Medicare and Medicaid incentive programs, that eligible professional or eligible hospital would need to implement Complete EHRs or EHR Modules certified to certification criteria that support meaningful use Stage 3 and would have to meet meaningful use Stage 3 metrics.

F. Sunset

We propose to sunset the temporary certification program and the rules that govern it when the National Coordinator has authorized at least one ONC-ACB under the permanent certification program. We further propose that on the date at which this sunset occurs that ONC-ATCBs under the temporary certification program will be prohibited from accepting new requests to certify Complete EHRs and/or EHR Modules. That means that ONC-ATCBs will be able to review any pending applications that they will have received prior to the termination date of the temporary certification program, and complete the certification process for those Complete EHRs and EHR Modules. We request public comment on whether we should establish a set date for the temporary program to sunset, such as 12/31/2011, instead of date that depends on a particular action—the authorization of at least one ONC-ACB. A set date would provide certainty and create a clear termination point for the temporary certification program by indicating to any ONC-ATCBs and other certification bodies that in order to be authorized to certify Complete EHRs and/or EHR Modules after 12/31/2011, they would need to be accredited and reapply to become ONC-ACBs. One potential downside to a set date would be the possibility that it would temporarily prevent certifications from being issued during the time period it takes potential ONC-ACB applicants to get accredited and receive their authorizations from the National Coordinator.

III. Provisions of Permanent Certification Program

[If you choose to comment on the provisions of the permanent certification program, please include at the beginning of your comment the specific section title and any additional information to clearly identify the proposal about which you are commenting. For example, “Definitions” or “Permanent Certification Program Application Process.”]

As noted above, we have chosen to propose both the temporary and permanent certification programs in this notice of proposed rulemaking. We believe this format offers the public significantly more context for our proposed policies and expect to receive more informed and detailed comments on our proposed policies. Similarly, we anticipate that some comments will be applicable to both certification programs. In that regard, we believe that this approach also reduces the amount of redundancy that would have existed had we published two separate proposed rules.

Along those same lines, we have proposed that certain aspects of the temporary certification program will be the same as certain elements of the permanent certification program. In those cases, to reduce unnecessary, duplicative text in this rule, we simply identify those proposed elements of both programs that are the same. In all other cases, we discuss in greater detail those proposals that are unique to the permanent certification program. To remain consistent with the section structure developed above and to improve readability and comprehension, we have presented our proposals for the permanent certification program in the same order as those presented in the temporary certification program. Additionally, in our proposals for the permanent certification program that cross-reference proposed provisions of the temporary certification program, all references to ONC-ATCBs should be substituted with references to ONC-ACBs, as appropriate.

A. Applicability

This subpart would establish the processes an applicant for ONC-ACB status must follow to be granted ONC-ACB status by the National Coordinator, the processes the National Coordinator would follow when assessing applicants and granting ONC-ACB status, the requirements of ONC-ACBs for certifying Complete EHRs and/or EHR Modules in accordance with the applicable certification criteria adopted by the Secretary in subpart C. It also establishes the processes accreditation organizations would follow to request approval from the National Coordinator and that the National Coordinator in turn would follow to approve an accreditation organization under the permanent certification program as well as certain ongoing responsibilities for an ONC-AA.

B. Definitions

1. Definition of Applicant

We propose to use the same definition of applicant for the permanent certification program with the exception of replacing ONC-ATCB with ONC-ACB.

2. Definition of Day or Days

We propose that day or days would have the same meaning under the permanent certification program as we have proposed under the temporary certification program.

3. Definition of ONC-Approved Accreditor

We propose that the term ONC-Approved Accreditor (ONC-AA) means an accreditation organization that the National Coordinator has approved to accredit certification bodies under the permanent certification program.

4. Definition of ONC-ACB

We propose ONC-ACB to mean a single organization or a consortium of organizations that has applied to and been authorized by the National Coordinator to perform the certification of, at a minimum, Complete EHRs and/or EHR Modules using the applicable certification criteria adopted by the Secretary. We have included the phrase “at a minimum” in this definition to take into account the possibility that ONC-ACBs may be authorized in the future to certify other types of HIT, such as personal health records (PHRs). Please note, however, that for that to occur, the Secretary would have to adopt certification criteria applicable to these types of HIT.

C. Correspondence With the National Coordinator

We propose that when applicants for ONC-ACB status and ONC-ACBs correspond with the National Coordinator and vice versa, that these communications must comply with the same rules we have proposed for the temporary certification program.

D. Permanent Certification Program Application Process for ONC-ACB Status

Similar to the temporary certification program, we propose under the permanent certification program to permit applicants for ONC-ACB status to apply at any time.

1. Application for ONC-ACB Status

Similar to the temporary certification program, we propose that an applicant for ONC-ACB status must submit an application to the National Coordinator in the same manner ONC-ATCB applicants must under the temporary certification program in order to be considered for ONC-ACB status. However, unlike the temporary certification program, applicants would no longer need to request an application and would instead be permitted to submit an application (which we intend to make available on the ONC Web site) to the following e-mail address: [e-mail].

a. Types of Applicants

Because the National Coordinator's authorization in the permanent certification program is only valid with respect to certification, we do not expect that it would be necessary for organizations seeking to apply for ONC-ACB status to form a partnership or consortium. However, such an applicant would not be prevented from achieving ONC-ACB status as long as it could meet all of the requirements of the permanent certification program.

b. Types of ONC-ACB Authorization

Similar to the temporary certification program, we would require an applicant for ONC-ACB status to indicate on its application the type of certification it seeks authorization to perform under the permanent certification program. If the applicant requested authorization to certify EHR Modules we would also require it to identify the type(s) of EHR Modules which it seeks authorization to certify. The proposed requirement for an applicant to indicate the type of certification it is seeking would also apply to other types of HIT if the Secretary has adopted certification criteria for that HIT.

c. Application for ONC-ACB Status

We propose that an applicant must include the following information in its application:

i. The applicant would be required to submit the same general identifying information required under the temporary certification program and section II.D.1.c.i.

ii. The applicant would be required to submit the information necessary for ONC to confirm the applicant's accreditation by an ONC-AA.

iii. The applicant would be required to submit a properly executed agreement that it will adhere to the “Principles of Proper Conduct for ONC-ACBs.” The Principles of Proper Conduct for ONC-ACBs would require an ONC-ACB to:

• Maintain its accreditation.
• Attend all mandatory ONC training and program update sessions.
• Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to certify HIT.
• Report to ONC within 15 days any changes that materially affect its:

○ Legal, commercial, organizational, or ownership status;

○ Organization and management including key certification personnel;

○ Policies or procedures;

○ Location;

○ Personnel, facilities, working environment or other resources;

○ ONC authorized representative (point of contact); or

○ Other such matters that may otherwise materially affect its ability to certify HIT.

• Allow ONC, or its authorized agents(s), to periodically observe on site (unannounced or scheduled) any certifications performed to demonstrate compliance with the requirements of the permanent certification program.
• Provide ONC, no less frequently than weekly, a current list of Complete EHRs and/or EHR Modules that have been certified, which includes, at a minimum, the vendor name (if applicable), the date certified, the product version, the unique certification number or other specific product identification, and where applicable, the certification criterion or certification criteria to which each EHR Module has been certified.
• Retain all records related to the certification of Complete EHRs and/or EHR Modules for a minimum of 5 years.
• Only certify HIT, including Complete EHRs and/or EHR Modules that have been tested by a NVLAP-accredited testing laboratory.
• Submit an annual surveillance plan to the National Coordinator and annually report to the National Coordinator its surveillance results.
• Promptly refund any and all fees received for certifications that will not be completed.

The first difference between these Principles of Proper Conduct for ONC-ACBs and those proposed under the temporary certification program is that we have removed the principles related to Guide 65 and ISO 17025. The former would be replaced and addressed by the accreditation principle for ONC-ACBs and the latter, ISO 17025, would no longer be necessary since the National Coordinator's authorization under the permanent certification program applies solely to certification.

The second difference is that we have added the principle that ONC-ACBs would only be permitted to certify Complete EHRs and/or EHR Modules that have been tested by a NVLAP-accredited testing laboratory. We believe that NVLAP-accreditation is the best option, because the NVLAP is an internationally recognized testing laboratory accreditation program and because it will best serve the public's interests. The NVLAP will also be able to rely on the significant technical and scientific staff NIST employs who have specialized expertise in developing and performing tests for and evaluations of HIT. Moreover, Congress clearly indicated its intentions both in section 3001(c)(5) of the PHSA and in section 13201(b) of the HITECH Act by associating NIST with the testing and certification of HIT. In the latter, the HITECH Act expressly provides that the Director of NIST, in coordination with the HIT Standards Committee, “shall support the establishment of a conformance testing infrastructure * * *” and that “[t]he development of this conformance testing infrastructure may include a program to accredit independent, non-Federal laboratories to perform testing.”

The third difference pertains to record retention. For the permanent certification program, we propose to require that ONC-ACBs retain their records related to the certification of Complete EHRs and EHR Modules for a minimum of five years. We understand from our consultations with NIST that this is standard industry practice for organizations involved in certification. Given the fact that it will be possible for ONC-ACBs to be authorized under the permanent certification program for many years, we believe that this time period is necessary in the event that the National Coordinator notifies an ONC-ACB of a proposed Type-2 violation or proposes to revoke an ONC-ACBs status. These records would be directly relevant to a determination by the National Coordinator that an ONC-ACB committed a Type-2 violation and/or to revoke an ONC-ACB's status. Moreover, we believe that the records will be necessary for ONC-ACBs to conduct surveillance. Finally, similar to our proposal for the temporary certification program, if an ONC-ACB loses its status for any reason it could be required to provide the National Coordinator with copies of all relevant records related to certification for up to a five year period.

The fourth and final difference is the requirement that an ONC-ACB would need to conduct surveillance of Complete EHRs and/or EHR Modules that the ONC-ACB had previously certified. As noted in section I.F.3 when we introduced the concept of surveillance, we expect that as part of ONC-ACBs' accreditation to confirm compliance at a minimum with Guide 65, they will have addressed section 13. Section 13 specifies the general surveillance requirements that a certification body must meet in order to become accredited. We propose to require that ONC-ACBs agree to submit annual surveillance plans to the National Coordinator and annually report to the National Coordinator their surveillance results. As discussed below, we also propose a requirement for the ONC-AA to have processes in place to ensure that the certification bodies it accredits properly conduct surveillance. We believe that ONC-ACBs should be given the flexibility to conduct surveillance in accordance with their accreditation. However, we recognize that it would likely benefit the HIT industry if certain common elements of surveillance could be developed and we welcome public comment on what those elements should be. We anticipate that we would issue annual guidance for ONC-ACBs before they submit their surveillance plans in order to identify ONC priorities. In that regard, we also request public comment on whether there are specific approaches to surveillance that have worked in other industries and should be replicated for HIT.

We anticipate using the results of ONC-ACB surveillance to make publicly available information related to the implementation and performance of Complete EHRs and EHR Modules in the field and as feedback for the efficient operation of the permanent certification program. We expect that these surveillance results could also be used by prospective purchasers of Complete EHRs and/or EHR Modules to determine whether a Complete EHR or EHR Module they are considering implementing has been the subject of any unsatisfactory surveillance reports (and why those unsatisfactory results occurred). We believe this requirement is important and would provide the National Coordinator and ONC-ACBs with important feedback regarding the effectiveness of the permanent certification program and what if any changes may need to be made to improve how the program operates.

We emphasize that surveillance results obtained by ONC-ACBs and reported to the National Coordinator would not immediately affect a Complete EHR or EHR Module's certification. That is, if after an ONC-ACB reevaluated a Complete EHR it previously certified and reported that the Complete EHR no longer met a certification criterion or criteria because, for example, an individual took actions to alter a capability provided by the Complete EHR such that it no longer performed according to its original design or improperly installed the Complete EHR, such a result would not automatically invalidate the Complete EHR's certification. However, we would expect ONC-ACBs upon the identification of a pattern of poorly performing previously certified Complete EHRs and/or EHR Modules to determine whether they properly certified the Complete EHR or EHR Module in the past. We believe that the publication of surveillance results and market forces will sufficiently motivate developers of Complete EHRs and/or EHR Modules to continue to improve their products and address any shortcoming identified by the ONC-ACB surveillance process. We request public comment on whether the National Coordinator should consider proactively stepping-in to protect purchasers of Complete EHRs and/or EHRs Modules by taking action such as “de-certifying” Complete EHRs and/or EHR Modules if a pattern of unsatisfactory surveillance results emerges and the ONC-ACB has not taken any measures to evaluate the poor performance.

d. Proficiency Examination

We no longer propose the use of a proficiency exam in the permanent certification program because it would no longer serve a useful purpose. Moreover, the accreditation process for ONC-ACB applicants encompasses this requirement and we do not believe that any additional redundancy is necessary.

2. Application Review

We propose to use the same timeframes and general processes for application review under the permanent certification program as we propose for the temporary certification program. The primary difference between the permanent certification program's application review process and the temporary certification program's is the reduced number of opportunities for an applicant to submit revisions in response to formal deficiency notices (due to the fact that the application is only one part). The timeframes for review, resubmission, and reconsideration are the same as those proposed under the temporary certification program. The only other difference between our two proposals in this section is our reference to ONC-ACB instead of ONC-ATCB and that the scope of an ONC-ACBs authorization will only be valid for certification and not both testing and certification.

3. ONC-ACB Application Reconsideration Requests

We propose to use the same timeframes and processes for ONC-ACB application reconsideration requests under the permanent certification program as we propose for the temporary certification program. Again, we now refer to ONC-ACBs instead of ONC-ATCBs.

4. ONC-ACB Status

a. Acknowledgement and Representation

We propose the same policies for ONC-ACBs related to acknowledgement and representation as we do for ONC-ATCBs under the temporary certification program.

b. Expiration of Status Under the Permanent Certification Program

We propose that an ONC-ACB would be required to renew its status every two years. To renew its status, we propose that an ONC-ACB would need to submit an updated application to the National Coordinator for review 60 days prior to the expiration of its status. We request public comment on any additional information an ONC-ACB should provide the National Coordinator in order to have its status renewed, such as documentation of the ONC-ACB's current accreditation status and any additional information or updates to the original application that would aid in the National Coordinator's review of the renewal request.

E. ONC-ACB Performance of Certification and Maintaining Good Standing as ONC-ACB

1. Authorization To Certify Complete EHRs

We propose, similar to the temporary certification program, that ONC-ACBs who seek authorization under the permanent certification program to certify Complete EHRs must be capable of certifying Complete EHRs to all applicable certification criteria adopted by the Secretary.

2. Authorization To Certify EHR Modules

We again propose that ONC-ACBs who seek authorization under the permanent certification program to certify EHR Modules must be capable of certifying EHR Modules in accordance with the applicable certification criteria adopted by the Secretary. We would mirror our proposals in the temporary certification program related to the scope of a “certification criterion” and when, in this case, an ONC-ACB would be required to certify EHR Modules to the privacy and security certification criteria adopted by the Secretary in the permanent certification program.

3. Authorization To Certify Other HIT

As we mention above in the preamble, section 3001(c)(5) of the PHSA provides the National Coordinator with broad authority to establish certification programs for the “voluntary certification of health information technology as being in compliance with applicable certification criteria adopted under this subtitle.” As a result, we requested public comment on the other types of HIT that the permanent certification program could include and ONC-ACBs could certify. As the statute provides, if the Secretary were to adopt certification criteria applicable to other types of HIT that the National Coordinator could subsequently authorize an ONC-ACB to certify such HIT under the permanent certification program. Therefore, we propose that if the Secretary adopts certification criteria for HIT beyond Complete EHRs and EHR Modules, a current ONC-ACB would have to submit an addendum to its original application to request authorization to certify this other type of HIT. If a new organization wanted to be authorized to certify another type of HIT it would need to follow the rules for becoming an ONC-ACB, including first receiving accreditation from an ONC-AA.

4. Authorized Certification Methods

Similar to the temporary certification program, we propose that ONC-ACBs must have the capacity to certify Complete EHRs and/or EHR Modules at their facility and one of the secondary methods we identified in the temporary certification program.

5. The Certification of “Minimum Standards”

Based on the same rationale provided in the temporary certification program discussion above, we propose to adopt the same method or methods for identifying which minimum standards (i.e., code sets) that an ONC-ACB will use for certification.

6. Maintaining Good Standing as an ONC-ACB; Violations That Could Lead to Revocation of ONC-ACB Status; Revocation of ONC-ACB Status

We propose the same policies and procedures for an ONC-ACB to maintain good standing in the permanent certification program as in the temporary certification program. We also include the same descriptions for the types of violations discussed above in the temporary certification program as well as the same timeframes and processes the National Coordinator would take to revoke an ONC-ACBs status. Similar to the temporary certification program, we propose that if an ONC-ACB has its status revoked due to a Type-1 violation, it would be prohibited from reapplying for ONC-ACB status for at least 1 year. We believe this timeframe is justified because we assume that a former ONC-ACB would need a certain amount of time to reorganize its management and key personnel after having its status revoked. Additionally, depending on the type of violation that led to the former ONC-ACBs status being revoked, it is also possible that it would lose its accreditation. We request public comment on whether this timeframe should be shortened or lengthened, and whether alternative sanctions related to ONC-ACBs or former ONC-ACBs should be considered.

Again, per our discussion above, we maintain our policy proposal for the re-certification of Complete EHRs and/or EHR Modules if the National Coordinator determines that fraudulent certifications were issued.

7. Validity of Complete EHR and EHR Module Certification

Based on the same rationale provided in the temporary certification program we do not believe that we need to adopt an explicit expiration date for the certifications associated with Complete EHRs and EHR Modules because of the natural expiration that our other regulatory actions would create. Additionally, since a new certification program would exist, which would include different processes, we emphasize that Complete EHRs and EHR Modules tested and certified under the temporary certification program by an ONC-ATCB would need to be tested and certified according to the permanent certification program once the Secretary adopts certification criteria to replace, amend, or add to previously adopted certification criteria. We anticipate that this would occur to support meaningful use Stage 2 and, as we discussed in the temporary certification program section on this matter, the capabilities eligible professionals and eligible hospitals would need from their Certified EHR Technology would also change, thereby affecting the validity and utility of the prior certification.

That being said, with respect to EHR Modules, we can envision situations, especially in the future, where measures associated with a meaningful use objective may change, but the capability a certified EHR Module would need to provide would not change. As a result, it may be impracticable or unnecessary for the EHR Module to be re-certified. For example, a hypothetical meaningful use Stage 3 measure for electronic prescribing could be 90% of all prescriptions compared to the 80% proposed for meaningful use Stage 1. In this example, it may be impracticable for a certified EHR Module for electronic prescribing to be recertified if the only thing that has changed is the meaningful use measure. Alternatively, if the certification criteria (and standard(s) associated with those certification criteria) have changed, then it would be necessary for the EHR Module to be re-certified. Therefore, we request public comment on whether there should be circumstances where EHR Modules should not have to be re-certified.

8. Differential Certification

We expect that over time the certification criteria adopted by the Secretary will increase incrementally, much like the approach CMS has proposed for meaningful use objectives and measures. As a result, after Complete EHRs and EHR Modules have been certified to meet the certification criteria associated with meaningful use Stage 1, it may benefit both Complete EHR and EHR Module developers as well as eligible professionals and eligible hospitals if some form of differential certification were available. Differential certification would comprise an ONC-ACB certifying Complete EHRs and/or EHR Modules to the differences between the certification criteria adopted by the Secretary associated with one stage of meaningful use and a subsequent stage of meaningful use. For example, if the Secretary were to adopt 5 new certification criteria to support meaningful use Stage 2 and those were the only additional capabilities that needed to be certified in order for a Complete EHR's certification to be valid again (i.e., all other certification criteria remained the same) for the purposes of meaningful use Stage 2, then the Complete EHR would only have to be tested and certified to those 5 criteria rather than the entire set of certification criteria again. We request public comment on factors that could be considered to determine when differential certification would be appropriate and when it would not. Factors we have considered include, whether the standard(s) associated with a certification criterion or certification criteria change and whether additional certification criteria change in such a way that the new capabilities a Complete EHR or EHR Module would need to provide impact how other previously certified capabilities would perform.

We believe that differential certification could be a valuable and pragmatic approach for the future and that it may further reduce costs for certification and expedite the certification process. We request public comment on whether we should require ONC-ACBs to offer differential certification. In considering this request, we also ask when differential certification should begin. That is, should differential certification be permitted to begin with Complete EHRs and EHR Modules certified under the temporary certification program (i.e., the differences between 2011 and 2013) or after all Complete EHRs and EHR Modules have been certified once under the permanent certification program (i.e., the differences between 2013 and 2015). We ask commenters to consider this distinction because of the differences in rigor that we expect Complete EHRs and EHR Modules will go through to get certified under the permanent certification program.

F. ONC-Approved Accreditor

We propose that prior to submitting an application to the National Coordinator for ONC-ACB status, an organization would need to be accredited by an ONC-AA for certification. We propose a specific accreditation requirement for the permanent certification program in order to conform to industry best practices. We believe that the accreditation of applicants for ONC-ACB status is an important prerequisite for the permanent certification program because it not only introduces additional rigor and objectivity to the certification process, but also provides for increased confidence in, and credibility to, the certifications performed. In that regard, if Complete EHR and/or EHR Module developers believe that an ONC-ACB is not performing up to par, they would be able to notify the ONC-AA (in addition to the National Coordinator, if necessary) in order to expose any potential ONC-ACB performance problems. The ONC-AA would be able to assess whether these reports are valid, determine whether the ONC-ACB has violated any of the terms of its accreditation, and would be able to determine if any action is necessary including notifying the National Coordinator.

1. Requirements for Becoming an ONC-AA

In order to become an ONC-AA, we propose that an accreditation organization must submit a request in writing to the National Coordinator along with the following information to demonstrate its ability to serve as an ONC-AA.

• A detailed description of the accreditation organization's conformance to ISO 17011 and experience evaluating the conformance of certification bodies to Guide 65.
• A detailed description of the accreditation organization's accreditation requirements and how those requirements complement the Principles of Proper Conduct for ONC-ACBs.
• Detailed information on the accreditation organization's procedures that would be used to monitor ONC-ACBs.
• Detailed information, including education and experience, about the key personnel who review certification bodies for accreditation.
• Procedures for responding to, and investigating, complaints against ONC-ACBs.

Once the National Coordinator receives such information, we propose that the National Coordinator would be permitted up to 30 days to review and issue a determination as to whether the accreditation organization has been approved. The National Coordinator would judge ONC-AA applicants on the information they provide, the completeness of their descriptions to the elements listed above, and their overall accreditation experience. The National Coordinator would review submissions for ONC-AA status on a first come first serve basis and would “approve” the first accreditation organization that satisfactorily demonstrated its ability to serve as an ONC-AA. We propose to use the same process for reconsideration of an accreditation organization's approval request as we do for ONC-ACB applicants under the permanent certification program.

2. ONC-AA Ongoing Responsibilities

In order to ensure that our programmatic objectives for the permanent certification program are met, we propose that an ONC-AA would fulfill, at a minimum, the following ongoing responsibilities:

• Maintain conformance with ISO 17011;
• In accrediting certification bodies, verify conformance to, at a minimum, Guide 65;
• Verify that ONC-ACBs are performing surveillance in accordance with their respective annual plans; and
• Review ONC-ACB surveillance results to determine if the results indicate any substantive non-conformance with the terms set by the ONC-AA when it granted the ONC-ACB accreditation.

We request public comment on these and potentially other ongoing responsibilities that we should expressly require an ONC-AA to fulfill.

3. Number of ONC-AAs and Length of Approval

We believe that it is important for all applicants for ONC-ACB status to be accredited by the same ONC-AA. Doing so would provide stability and consistency for all ONC-ACB applicants and a common point of trust for Complete EHR and EHR Module developers. Moreover, Complete EHR and EHR Module developers would obtain a level of assurance that any ONC-ACBs' certification would be equal to another's because all of them had been accredited by the same ONC-AA. As a result, we believe that it is important from a programmatic perspective for there to be only one ONC-AA at a time and therefore we have proposed to only approve one ONC-AA at a time. We request public comment on whether it would be in the best interest of the ONC-ACB applicants and Complete EHR and EHR Module developers to allow for more than one ONC-AA at a time.

Finally, we propose that ONC-AA status would expire after 3 years. Consistent with this proposed expiration of status, we propose to again accept requests for ONC-AA status 120 days before the then current ONC-AA's status is set to expire. We believe that 3 years provides an appropriate balance between precluding other qualified accreditation organizations from requesting ONC-AA status and providing some level of consistency between the ONC-AA and ONC-ACB levels. We request public comment on whether we should extend the length of an ONC-AA's status to a maximum of 5 years before accepting requests for ONC-AA status or shortening the length to 2 years or identify a different period of time.

G. Promoting Participation in the Permanent Certification Program

In the context of the permanent certification program, it is our hope and expectation that multiple organizations will step forward to apply for and receive ONC-ACB status and that these organizations will be able to certify Complete EHRs and EHR Modules in a timely and satisfactory manner. Moreover, given the proposed Medicare and Medicaid EHR Incentive Programs, we believe that organizations will be motivated to become ONC-ACBs to meet the demand for Certified EHR Technology by eligible professionals and eligible hospitals. We do not believe that the requirements set forth in this proposed rule create prohibitively high barriers to market entry for organizations interested in becoming ONC-ACBs. However, we welcome comments on whether this proposed rule does in fact create high barriers to market entry and, if so, how we could revise the proposed requirements to lower those barriers and encourage participation. We provide cost and burden estimates in Section V (Collection of Information Requirements) and Section VI (Regulatory Impact Analysis).

HHS is responsible for the overall implementation and success of the proposed Medicare and Medicaid EHR Incentive Programs and we are acutely aware that without a properly operating certification program the overall success of the EHR incentive programs could be affected. We are concerned about two low probability, but problematic risks—there being no ONC-ACBs authorized under the permanent certification program or only one ONC-ACB that engages in monopolistic behavior. We are therefore interested in public comment regarding potential approaches that could be pursued to stimulate market involvement or remediate this situation if it were to develop, including the possibility for the National Coordinator to establish a temporary ONC-managed certification process (“ONC process”) that would include some type of certification review board. This would not be a preferred option, and would come with significant limitations. Congress, in section 3001(c)(5) of the PHSA, did not expressly authorize the National Coordinator or the Secretary to assess and collect fees related to the certification of HIT and subsequently retain and use those fees to administer an ONC process if it were established. We seek public comment on other potential approaches that could be employed to address the two risks identified above.

IV. Response to Comments

Because of the large number of public comments normally received in response to Federal Register documents, we are not able to acknowledge or respond to them individually. We will consider all comments we receive by the date and time specified in the DATES section of this preamble, and, when we proceed with a subsequent document, we will respond to the comments in the preamble of that document.

V. Collection of Information Requirements

In compliance with the requirement of section 3506(c)(2)(A) of the Paperwork Reduction Act of 1995 (PRA), the Office of the Secretary (OS), Department of Health and Human Services, is publishing the following summary of proposed information collection requests for public comment. In order to fairly evaluate an information collection, section 3506(c)(2)(A) of the PRA requires that we solicit comment on the following issues:

1. Whether the information collection is necessary and useful to carry out the proper functions of the agency;

2. The accuracy of the agency's estimate of the information collection burden;

3. The quality, utility, and clarity of the information to be collected; and

4. Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

Under the PRA, the time, effort, and financial resources necessary to meet the information collection requirements referenced in this section are to be considered. We explicitly seek, and will consider, public comment on our assumptions as they relate to the PRA requirements summarized in this section. To comment on the collections of information or to obtain copies of the supporting statements and any related forms for the proposed paperwork collections referenced in this section, e-mail your comment or request, including your address and phone number to [e-mail], or call the Reports Clearance Office on [phone]. Written comments and recommendations for the proposed information collections must be directed to the OS Paperwork Clearance Officer at the above e-mail address within 30 days.

Abstract

The Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5), was enacted on February 17, 2009. The HITECH Act amended the Public Health Service Act (PHSA) and created “Title XXX—Health Information Technology and Quality” (Title XXX) to improve health care quality, safety, and efficiency through the promotion of health information technology (HIT) and electronic health information exchange.

Section 3001(c)(5) of the PHSA requires the National Coordinator, in consultation with the Director of the National Institute of Standards and Technology, to “keep or recognize a program or programs for the voluntary certification of health information technology as being in compliance with applicable certification criteria” adopted by the Secretary under section 3004. In this notice of proposed rulemaking implementing section 3001(c)(5), we propose to establish two certification programs, a temporary certification program and a permanent certification program. The establishment of these programs and the proposals therein would require four separate collections of information.

A. Collection of Information #1: Application for ONC-ATCB Status Under the Proposed Temporary Certification Program

Under the proposed temporary certification program, an applicant who voluntarily applies to become an ONC-ATCB would be required to submit an application to the National Coordinator. Based on prior experience, we believe that the testing and certification of Complete EHRs and/or EHR Modules will require expertise that few in the HIT marketplace possess. As a result, we assume that there will be no more than 3 applicants for ONC-ATCB status. We believe that there will be no more than 3 applicants because we have only seen evidence in the press of one organization that has committed to applying and another that has expressed its interest in entering the HIT testing and certification field. The application requirements include the completion of an application form, submission of additional documentation as specified in the application form, and completion of a proficiency examination. However, the proficiency examination is not considered “information” for PRA collection purposes because it falls under the exception to the definition of information at 5 CFR 1320.3(h)(7). We estimate that it will take approximately:

• 10 minutes for an applicant to provide the general identifying information requested in the application (section 1);
• 2 hours to complete the Guide 65 self audit and assemble associated documentation (section 2);
• 2 hours to complete the ISO 17025 self audit and assemble associated documentation (section 3); and
• 20 minutes to review and agree to the “Principles of Proper Conduct for ONC-ATCBs” (section 4).

As discussed in more detail in section VI, we base these estimates on the assumption that qualified applicants for the temporary certification program will already be familiar with the relevant requirements found in the ISO/IEC standards and will have a majority, if not all, of the documentation requested in the application already developed and available before applying for ONC-ATCB status. Therefore, with the exception of completing a proficiency examination, we believe an applicant would only spend time collecting and assembling already developed information to submit with their application rather than developing, for example, a “quality manual” from scratch.

More specifics about the temporary certification program's proposed application requirements and the information that would be collected can be found at § 170.420.

Estimated Annualized Burden Hours

Type of respondent (ONC-ATCB applicant)	Number of respondents	Number of responses per respondent	Average burden hours per response	Total burden hours
ATCB Application Section 1	3	1	10/60	.5
ATCB Application Section 2	3	1	2	6
ATCB Application Section 3	3	1	2	6
ATCB Application Section 4	3	1	20/60	1
Total	3	1	4.5	13.5

B. Collection of Information #2: Application for ONC-ACB Status Under the Proposed Permanent Certification Program

Under the proposed permanent certification program, an applicant who voluntarily applies to become an ONC-ACB would be required to submit an application to the National Coordinator. We estimate that there will be no more than 6 applicants for ONC-ACB status under the permanent certification program. While we believe that the business case for entering the HIT market to perform the certification of Complete EHRs and EHR Modules could increase as health IT adoption rates increase, we believe that it is unlikely (given the expertise needed to perform the certification of Complete EHRs and EHR Modules) that the number of applicants would extend into the tens of applicants.

The application requirements include the completion of an application form and submission of additional documentation as specified in the application form. We estimate that it will take approximately:

• 10 minutes for an applicant to provide the general identifying information requested in the application (section 1);
• 30 minutes to assemble the information necessary to provide documentation of accreditation by an ONC-AA (section 2); and
• 20 minutes to review and agree to the “Principles of Proper Conduct for ONC-ACBs” (section 3).

While we anticipate that very few organizations will have the expertise to test and certify HIT in the temporary certification program, we have proposed to separate these responsibilities in the permanent certification program and in doing so, we believe that several private sector organizations that currently conduct only testing or only certification will be able to enter the HIT testing and certification field. Our burden estimates above are based on the assumption that these existing entities will already be familiar with many of the requirements proposed in this rule and will, for example, already have a majority—if not all—of the documentation requested in the application already developed and available before applying for ONC-ACB status.

Also, while this rule does impose record keeping requirements, we believed that the proposed 5-year requirement is in line with common industry practice and, consequently, would not represent an additional cost to ONC-ACBs as a result of this rule.

More specifics about the permanent certification program's proposed application requirements and the information that would be collected can be found at § 170.502.

Estimated Annualized Burden Hours

Type of respondent (ONC-ACB applicant)	Number of respondents	Number of responses per respondent	Average burden hours per response	Total burden hours
ACB Application Section 1	6	1	10/60	1
ACB Application Section 2	6	1	30/60	3
ACB Application Section 3	6	1	20/60	2
Total	6	1	1	6

C. Collection of Information #3: ONC-ATCB and ONC-ACB Collection and Reporting of Information Related To Complete EHR and/or EHR Module Certifications

Under both of the proposed certification programs we propose to require ONC-ATCBs and ONC-ACBs to provide ONC, no less frequently than weekly, a current list of Complete EHRs and/or EHR Modules that have been tested and certified which includes, at a minimum, the vendor name (if applicable), the date certified, the product version, the unique certification number or other specific product identification, and where applicable, the certification criterion or certification criteria to which each EHR Module has been tested and certified.

These specific proposed requirements for the temporary certification program and the permanent certification program can be found at § 170.420 and § 170.520, respectively.

For the purposes of estimating the potential burden, we assume that all of the estimated applicants in the tables above will apply and become ONC-ATCBs and ONC-ACBs under the temporary certification program and permanent certification program, respectively. We also assume, per our requirement specified in the respective Principles of Proper Conduct for ONC-ATCBs and ONC-ACBs, that ONC-ATCBs and ONC-ACBs will report weekly (i.e., respondents will respond 52 times per year). Finally, we assume that the information collections would be accomplished through electronic data collection and storage and that such collection and storage would be part of ONC-ATCBs and ONC-ACBs normal course of business. Therefore, with respect to this proposed collection of information, the estimated burden is limited to the actual electronic reporting of the information to ONC.

Estimated Annualized Burden Hours

Type of respondent	Number of respondents	Number of responses per respondent	Average burden hours per response	Total burden hours
ONC-ATCB Testing and Certification Results	3	52	1	156
ONC-ACB Certification Results	6	52	1	312
Total	9	104	2	468

D. Collection of Information #4: Required Documentation for Requesting ONC-Approved Accreditor Status

Under the permanent certification program we propose to require accreditation organizations who seek to become an ONC-AA to submit information to the National Coordinator to demonstrate their ability to accredit certification bodies that would eventually apply for ONC-ACB status. We assume that there will only be two accreditation organizations that will prepare and submit the information sought by the National Coordinator. We believe this will be the case based on our knowledge of the HIT market and consultations with NIST related to the existence of potential accreditation organizations that could seek the National Coordinator's approval.

We have included our estimates of the approximate time commitments associated with documenting each requirement that must be included in an accreditation organization's submission:

• 20 minutes for an accreditation organization to provide a detailed description of the accreditation organization's conformance to ISO 17011 and experience evaluating the conformance of certification bodies to Guide 65;
• 20 minutes for an accreditation organization to provide a detailed description of the accreditation organization's accreditation requirements and how the requirements complement the Principles of Proper Conduct for ONC-ACBs;
• 5 minutes for an accreditation organization to provide a copy of the procedures that would be used to monitor ONC-ACBs;
• 10 minutes for an accreditation organization to provide detailed information, including education and experience, about the key personnel who review certification bodies for accreditation; and
• 5 minutes for an accreditation organization to provide a copy of the procedures for responding to, and investigating, complaints against ONC-ACBs.

These specific proposed requirements for the permanent certification program can be found at § 170.503.

Estimated Annualized Burden Hours

Type of respondent (ONC-AA requestor)	Number of respondents	Number of responses per respondent	Average burden hours per response	Total burden hours
Documentation of Conformance to ISO 17011 and Guide 65 Experience	2	1	20/60	.67
Description of Accreditation Requirements and how they Complement the Principles of Proper Conduct for ONC-ACBs	2	1	20/60	.67
Documentation of Monitoring Procedures	2	1	5/60	.165
Documentation of Key Personnel	2	1	10/60	.33
Documentation of Procedures for Responding to and Investigating Complaints	2	1	5/60	.165
Total	2	1	1	2

As required by § 3504(h) of the Paperwork Reduction Act, we have submitted a copy of this document to the Office of Management and Budget (OMB) for its review of these information collection requirements.

VI. Regulatory Impact Analysis

A. Introduction

We have examined the impacts of this proposed rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993, as further amended), the Regulatory Flexibility Act (RFA) (5 U.S.C. 601 et seq.), section 202 of the Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1532), Executive Order 13132 on Federalism (August 4, 1999), and the Congressional Review Act (5 U.S.C. 804(2)).

Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any one year). Based on the analysis of costs and benefits that follows, we have determined that this proposed rule, including both the temporary certification program and permanent certification program, is not an economically significant rule because we estimate that the overall costs and benefits associated with the combination of the temporary and permanent certification programs as well as the costs associated with the testing and certification of Complete EHRs and EHR Modules under both certification programs will be less than $100 million per year. Nevertheless, because of the public interest in this proposed rule, we have prepared an RIA that to the best of our ability presents the costs and benefits of the proposed rule broken down by each proposed certification program. We request comments on the economic analyses provided in this proposed rule.

B. Why This Rule is Needed?

As stated in earlier sections of this proposed rule, section 3001(c)(5) of the PHSA provides the National Coordinator with the authority to establish a certification program or programs for the voluntary certification of HIT. This proposed rule is needed to outline the processes by which the National Coordinator would exercise this authority to authorize certain organizations to test and certify Complete EHRs and/or EHR Modules. Once certified, Complete EHRs and EHR Modules would be able to be used by eligible professionals and eligible hospitals as, or be combined to create, Certified EHR Technology. Eligible professionals and eligible hospitals who seek to qualify for incentive payments under the Medicare and Medicaid EHR Incentive Programs are required by statute to use Certified EHR Technology.

C. Executive Order 12866—Regulatory Planning and Review Analyses for the Proposed Temporary and Permanent Certification Programs

As required by Executive Order 12866, we have examined the economic implications of this proposed rule as it relates to our proposed temporary and permanent certification programs. Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety, and other advantages; distributive impacts; and equity). Executive Order 12866 classifies a regulation as significant if it meets any one of a number of specified conditions, including having an annual effect on the economy of $100 million, or in a material way adversely affecting the economy, a sector of the economy, competition, or jobs. While this rule is therefore not “economically significant,” as defined by Executive Order 12866, OMB has determined that this rule constitutes a “significant regulatory action” as defined by Executive Order 12866 because it raises novel legal and policy issues.

Throughout the following analyses we identify specific actions or issues for which we expressly ask for comments. The public, however, is invited to comment on any and all elements of the analyses and on all underlying assumptions.

1. Temporary Certification Program Estimated Costs

a. Application Process for ONC-ATCB Status

i. Applicant Costs

As mentioned above, we believe that the testing and certification of Complete EHRs and/or EHR Modules will require expertise that not many in the HIT marketplace currently possess. Therefore, we assume that there will be no more than 3 applicants for ONC-ATCB status. We believe that there will be no more than three applicants because we have only seen evidence in the press of one organization that has committed to applying and another that has expressed its interest in entering the HIT testing and certification field.

As part of the temporary certification program, an applicant would be required to submit an application and complete a proficiency exam. We do not believe that there will be an appreciable difference in the time commitment an applicant for ONC-ATCB status will have to make based on the type of authorization it seeks (i.e., we believe the application process and time commitment will be the same for applicants seeking authorization to conduct either the testing and certification of Complete EHRs or EHR Modules). Further, we assume that qualified applicants will have reviewed the relevant requirements found in the ISO/IEC standards and will have a majority, if not all, of the documentation requested in the application already developed and available before applying for ONC-ATCB status. Without having such documentation (including policies and procedures) we believe that it would be difficult for an applicant to operate a legitimate testing and certification program. Therefore, with the exception of completing a proficiency examination, we believe an applicant would only spend time collecting and assembling already developed information to submit with their application rather than developing, for example, a “quality manual” from scratch.

Based on our assumptions and consultations with NIST, we anticipate that it will take an applicant approximately 28.5 hours to complete the application and submit the requested documentation. Our estimate includes the time discussed above in our collection of information section and approximately up to 24 hours to complete the proficiency examination—8 hours (1 full work day) to complete section 1 (demonstration of technical expertise related to Complete EHRs and/or EHR Modules); 6 hours to complete section 2 (demonstration of test tool identification); and 10 hours to complete section 3 (demonstration of proper use of test tools and understanding of test results). Moreover, after consulting with NIST we assume that:

(1) An employee equivalent to the Federal Salary Classification of GS-9 Step 1 could provide the general information requested in the application and accomplish the paperwork duties associated with the application;

(2) An employee equivalent to the Federal Salary Classification of GS-15 Step 1 would be responsible for conducting the self audits and agreeing to the “Principles of Proper Conduct for ONC-ATCBs”; and

(3) An employee or employees equivalent to the Federal Salary Classification of GS-15 Step 1 would be responsible for completing the proficiency examination.

We have taken these employee assumptions and utilized the corresponding employee hourly rates for the locality pay area of Washington, DC as published by the U.S. Office of Personnel Management (OPM), to calculate our cost estimates. We have also calculated the costs of an employee's benefits while completing the application. We have calculated these costs by assuming that an applicant expends thirty-six percent (36%) of an employee's hourly wage on benefits for the employee. We have concluded that a 36% expenditure on benefits is an appropriate estimate because it is the routine percentage used by HHS for contract cost estimates. Our calculations are expressed in Tables 1 and 2 below.

Table 1—Temporary Certification Program: Cost to Applicants To Apply To Become an ONC-ATCB

Proposed requirement	Employee equivalent	Burden hours	Employee hourly wage rate	Cost of employee benefits per hour	Cost per applicant
General Identifying Information	GS-9 Step 1	10/60	$22.39	$8.06	$5.07
Self Audits and Documentation	GS-15 Step 1	4	59.30	21.35	322.60
Principles of Proper Conduct	GS-15 Step 1	20/60	59.30	21.35	26.89
Proficiency Examination	GS-15 Step 1	24	59.30	21.35	1,935.60
Total Cost Per Application					2,290.16

Table 2—Temporary Certification Program: Total Cost of Application Process

Anticipated number of applicants	Cost of application per applicant ($)	Total cost estimate ($)
3	$2,290.16	$6,870.48

We based our cost estimates on the amount of applicants that we believe will apply over the life of the temporary certification program. We assume that all applicants will apply during the first year of the program and thus all application costs should be attributed to the first year of the program. However, based on our projection that the temporary certification program will last approximately two years and that one or two applicants may choose to apply in the second year, the annualized cost of the application process would be $3,435. We invite comments on our estimated number of applicants and on the costs associated with the proposed application process under the temporary certification program.

ii. Costs to the Federal Government

We have estimated the cost to develop the ONC-ATCB application, including the development and administration of the proficiency examination to be $33,079 based on the 473 hours we believe it will take to develop the application, prepare standard operating procedures as well as create the requisite pools of questions for the proficiency examinations. More specifically, we believe it will take 360 hours of work of a Federal Salary Classification GS-14 Step 1 employee located in Washington, DC to develop the proficiency examination, 80 hours of work by the same employee to develop the standard operation procedures and the actual application, and 33 hours to score all the exams and handle related administrative tasks.

We also anticipate that there would be costs associated with reviewing applications under the proposed temporary certification program. We believe that a GS-15 Step 1 employee would review the applications and the National Coordinator (or designated representative) would issue final decisions on all applications. We anticipate that it would take approximately 40 hours to review and reach a final decision on each application. This estimate assumes a satisfactory application (i.e., no formal deficiency notifications) and includes the time necessary to verify the information in each application, assess the results of the proficiency examination, and prepare a briefing for the National Coordinator. We estimate the cost for the application review process to be $10,140.

As a result, we estimate the Federal government's overall cost of administering the entire application process, for the length of the temporary certification program, at approximately $43,219. Based on our projection that the temporary certification program will last approximately two years and that one or two applicants may choose to apply in the second year, the annualized cost to the Federal government for administering the entire application process would be $21,610.

As previously noted, we will also post the names of applicants granted ONC-ATCB status on our Web site. We believe that there would be minimal cost associated with this action and have calculated the potential cost to be approximately $156 on an annual basis for posting and maintaining the information on our Web site (a maximum of 3 hours of work for a Federal Salary Classification GS-12 Step 1 employee located in Washington, DC).

b. Temporary Certification Program: Testing and Certification of Complete EHRs and EHR Modules

Section 3001(c)(5)(A) of the PHSA indicates that certification is a voluntary act; however, due to the fact that the Medicare and Medicaid EHR Incentive Programs require eligible professionals and eligible hospitals to use Certified EHR Technology in order to qualify for incentive payments, we anticipate that a significant portion of Complete EHR and EHR Module developers will seek to have their HIT tested and certified.

In table 3 below, we estimate the costs for Complete EHRs and EHR Modules to be tested and certified under the temporary certification program. As discussed in the HIT Standards and Certification Criteria interim final rule, and to remain consistent with our previous estimates (75 FR 2039), we believe that approximately 93 commercially-developed and open source Complete EHRs and 50 EHR Modules will be tested and certified under our proposed temporary certification program. In addition to these costs, we also take into account what we believe will be the costs incurred by a small percentage of eligible professionals and eligible hospitals who themselves will incur the costs associated with the testing and certification of their self-developed Complete EHR or EHR Module.

With respect to the potential for eligible professionals to seek testing and certification for a self-developed Complete EHR or EHR Module, DesRoches approximates that only 5% of physicians are in large practices of over 50 doctors.^[3] Of these large practices, 17% use an “advanced EHR system” that could potentially be tested and certified if it were self-developed (we assume that smaller physician practices do not have the resources to self-develop a Complete EHR or EHR Module). We are unaware of any reliable data on the number of large physicians groups who may have a self-developed Complete EHR or EHR Module for which they would seek to be tested and certified. As a result, we request public comment on what this percentage may be and offer the following estimate based on currently available data. We believe that the total number of eligible professionals in larger practices who both possess and would seek to have a self-developed Complete EHR or EHR Module tested and certified will be low—no more than 10%. By taking CMS's estimate of approximately 450,000 eligible professionals (75 FR 1960) we multiply through by the numbers above (450,000 × .05 × .17 × .10) and then divide by a practice size of at least 50 which yields approximately 8 self-developed Complete EHRs or EHR Modules designed for an ambulatory setting that could be submitted for testing and certification.

With respect to eligible hospitals, similar to eligible professionals, we believe that only large eligible hospitals would be in a position to have self-developed a Complete EHR or EHR Module and seek to have it tested and certified. Again, we are unaware of any reliable data on the number of eligible hospitals who may have a self-developed Complete EHR or EHR Module for which they would seek to be tested and certified. As a result, we request public comment on what this percentage may be and offer the following estimate based on currently available data. We estimate that 10% of large eligible hospitals have a self-developed Complete EHR or EHR Module and that all of theses hospitals would seek to have it tested and certified. Extrapolating from the AHA survey data on hospital adoption described by Jha et al. in the New England Journal of Medicine, there would be only about 300 large hospitals with advanced systems and, as a result, we believe approximately 30 that would be in a position to seek to have a self-developed Complete EHR or EHR Module tested and certified.^[4]

We believe that our estimates for eligible professionals and eligible hospitals are generous and that a good portion of the eligible professionals and eligible hospitals who would likely seek to qualify for incentive payments with self-developed Complete EHRs or EHR Modules would only do so for meaningful use Stage 1. After meaningful use Stage 1 we anticipate that the number of eligible professionals and eligible hospitals who would incur the costs of testing and certification themselves will go down because the effort involved to maintain a Complete EHR or EHR Module may be time and cost prohibitive as the Secretary continues to adopt additional certification criteria to support future stages of meaningful use.

Due to the fact that an ONC-ATCB will be responsible for testing and certifying Complete EHRs and/or EHR Modules, we have combined the costs for testing and certification because we believe they would be difficult to independently estimate. Our cost range for the testing and certification of Complete EHRs and EHR Modules includes consideration of how the testing and certification will be conducted (i.e., by remote testing and certification, on-site testing and certification, or at the ONC-ATCB and for the complexity of an EHR Module). To illustrate, we assume that the on-site testing and certification of a Complete EHR and the testing and certification of a complex EHR Module would both be at the high end of their respective cost estimates (i.e., $50,000 and $35,000).

On July 14, 2009, CCHIT testified in front of the HIT Policy Committee on the topic of EHR certification, including the certification of EHR Modules. CCHIT estimated that “EHR-comprehensive” (Complete EHRs) testing and certification would range from approximately $30,000 to $50,000. CCHIT also estimated that the testing and certification of EHR Modules would range from approximately $5,000 to $35,000 depending on the scope of the testing and certification. We believe that these estimates provide a reasonable foundation and have used them for our cost estimates. However, we assume that competition in the testing and certification market will reduce the costs of testing and certification as estimated by CCHIT but we are unable to provide a reliable estimate at this time of what the potential reduction in costs might be. Please also note, that because we have limited data on the number of self-developed Complete EHRs and EHR Modules that will be presented for testing and certification, we cannot accurately separate the costs for the testing and certification of self-developed Complete EHRs from self-developed EHR Modules. As a result, we have estimated the lowest possible cost by assuming that all of the estimated self-developed HIT that will be presented for testing and certification will be EHR Modules and that they would be tested and certified at the lowest estimated cost ($5,000 each) and then we estimated the highest possible cost by assuming that all of the estimated self-developed HIT that will be presented for testing and certification will be Complete EHRs and that they would be tested and certified at the highest estimated cost ($50,000 each). Our cost estimates are expressed in Table 3 below.

Table 3—Temporary Certification Program: Estimated Costs for Testing and Certification

Type	Number tested and certified	Cost per complete EHR/EHR module ($M)			Total cost for all complete EHRs/EHR modules over 3-year period ($M)
		Low	High	Mid-point	Low	High	Mid-point
Commercial/Open Source Complete EHR	93	$0.03	$0.05	$0.04	$2.79	$4.65	$3.72
Commercial/Open Source EHR Module	50	0.005	0.035	0.02	0.25	1.75	1
Self-Developed Complete EHRs and EHR Modules	38	0.005	0.05	0.028	0.19	1.90	1.06
Total	181				3.23	8.30	5.78

Our estimates cover anticipated testing and certification costs under the temporary certification program from 2010 through some portion of 2012 as we expect the permanent certification program to be operational by 2012. However, because we cannot predict the exact date at which the temporary certification program will sunset (and the date at which ONC-ATCBs will finish any remaining tests and certifications in their queue), we believe that it is appropriate to attribute all 2012 costs for testing and certification to both the temporary certification program and the permanent certification program to err on the side of overestimating rather than underestimating the costs of our proposals. Therefore, we also attribute the 2012 testing and certification costs associated with certification criteria adopted by the Secretary to support meaningful use Stage 1 in section C.2 below.

Consistent with our estimates in the HIT Standards and Certification Criteria interim final rule (75 FR 2041) about when Complete EHRs and EHR Modules will be prepared for testing and certification to the certification criteria adopted by the Secretary for meaningful use Stage 1, we anticipate that they will be tested and certified in the same proportions. Therefore, we believe that of the total number of Complete EHRs and EHR Modules that we have estimated (commercial, open source, and self-developed), 45% will be tested and certified in 2010, 40% will be tested and certified in 2011, and 15% will be tested and certified in 2012. Table 4 below represents this proportional distribution of the estimated costs we calculated for the testing and certification of Complete EHRs and EHR Modules to the certification criteria adopted to support meaningful use Stage 1 under the temporary certification program as expressed in Table 3 above.

Table 4—Distributed Total Costs for the Testing and Certification of Complete EHRs and EHR Modules to Stage 1 MU by Year (3-Year Period)—Totals Rounded

Year	Ratio (percent)	Total low cost estimate ($M)	Total high cost estimate ($M)	Total average cost estimate ($M)
2010	45	$1.45	$3.74	$2.60
2011	40	1.29	3.32	2.31
2012	15	0.49	1.24	0.87
3-Year Totals		3.23	8.30	5.78

2. Permanent Certification Program Estimated Costs

a. Request for ONC-AA Status

i. Cost of Submission for Requesting ONC-AA Status

As noted in the collection of information section, we believe that only two accreditation organizations will prepare and submit the information sought by the National Coordinator. Additionally, as noted in the collection of information section, we estimate that it will take 1 hour to prepare and submit a request for ONC-AA status. We believe that an employee equivalent to the Federal Salary Classification of GS-15 Step 1 would be responsible for preparing and submitting the required information.

We have utilized the corresponding employee hourly rate for the locality pay area of Washington, DC, as published by the OPM, to calculate our cost estimates. We have also calculated the costs of an employee's benefits while preparing and submitting the required ONC-AA documentation. We have calculated these costs by assuming that an accreditation organization expends thirty-six percent (36%) of an employee's hourly wage on benefits for the employee. We have concluded that a 36% expenditure on benefits is an appropriate estimate because it is the routine percentage used by HHS for contract cost estimates. Our cost estimates are expressed in the Table 5 below.

Table 5—Permanent Certification Program: Cost to Accreditation Organizations To Submit the Information Required to Become an ONC-AA

Proposed requirement	Employee equivalent	Burden hours	Hourly wage rate	Cost of employee benefits per hour	Total cost per applicant
Submission of Request for ONC-AA Status	GS-15 Step 1	1	$59.30	$21.35	$80.65

Using our estimates above, we believe that the cost to submit the information required to become an ONC-AA will be $81 and the total cost for the two accreditation organizations that we estimate will submit requests for ONC-AA status will be $161. Based on our estimate of two accreditation organizations submitting the required documentation to be considered for ONC-AA status and on our proposal that we would seek to select an ONC-AA every three years, we estimate the annualized cost of this process to be $54. We welcome comments on our estimates for the number of accreditation organizations that will request ONC-AA status and our cost estimates.

ii. Cost to the Federal Government

We anticipate that there will be costs associated with reviewing the information provided by accreditation organizations requesting to become an ONC-AA under the proposed permanent certification program. We believe that a GS-15 Step 1 employee would review the submissions and the National Coordinator (or designated representative) would issue final decisions on all submissions. We anticipate that it would take 10 hours to review and reach a final decision on each submission. This estimate assumes a satisfactory submission (i.e., no formal deficiency notifications) and includes the time necessary to verify the information in each submission and prepare a briefing for the National Coordinator. We estimate the Federal government's overall cost to review the submissions and select an ONC-AA to be $1,732. Based on our estimate of two accreditation organizations submitting the required documentation to be considered for ONC-AA status and on our proposal that we would seek to select an ONC-AA every three years, the annualized cost to the Federal government for reviewing the submissions for ONC-AA status would be $577. If we notify the public of the selection of the ONC-AA by posting the information on our Web site or by issuing a press release, we believe that we would incur negligible costs from these actions.

b. Application Process for ONC-ACB Status and Renewal

i. Applicant Costs and ONC-ACB Renewal Costs

Similar to the temporary certification program, we propose that an applicant for ONC-ACB status would be required to submit an application. However, unlike the temporary certification program, we have proposed that applicants for ONC-ACB status must be accredited in order to be a qualified ONC-ACB applicant. We estimate that there will be 6 applicants for ONC-ACB status under the permanent certification program and that those 6 applicants will first seek and become accredited by an ONC-AA. Because accreditation would include a demonstration of conformance to Guide 65 for all organizations that seek to be accredited, we do not believe that there will be a difference in the cost of accreditation for organizations who seek to become ONC-ACBs for EHR Modules versus ONC-ACBs for Complete EHRs.

Based on our consultations with NIST, we estimate that it would take approximately 2 to 5 days for an ONC-AA to complete the accreditation process at a cost of $20,000. This cost includes an estimated $5,000 administrative fee and an estimated $15,000 fee for the accreditation assessment. We expect that the accreditation renewal process will occur once between 2012 and 2016 for each ONC-ACB and assume that the accreditation renewal process will be less onerous than the initial accreditation process because the ONC-ACB would presumably apply to the same ONC-AA and that the ONC-AA would rely on prior information and not conduct a completely new review of an ONC-ACB. We believe this is a reasonable assumption because the ONC-AA will likely already be familiar with the ONC-ACB and have its documentation on file and we do not expect that the ONC-ACB would make such drastic changes to its policies or procedures which would necessitate a lengthy assessment of their competency by an ONC-AA. Accordingly, we estimate that accreditation renewal would take no more than 3 days and would cost no more than $10,000. These estimated costs are expressed in Table 7 below.

After becoming accredited by an ONC-AA, an applicant for ONC-ACB status would incur minimal costs to prepare and submit an application to the National Coordinator. As noted in the collection of information section, we believe that it will take 10 minutes to provide the general information requested in the application, 30 minutes to assemble the information necessary to provide documentation of accreditation by an ONC-AA, and 20 minutes to review and agree to the “Principles of Proper Conduct for ONC-ACBs.”

Based on our consultations with NIST, we believe that an employee equivalent to the Federal Salary Classification of GS-9 Step 1 could provide the required general identifying information and documentation of accreditation status. We believe that an employee equivalent to the Federal Salary Classification of GS-15 Step 1 would be responsible for reviewing and agreeing to the “Principles of Proper Conduct for ONC-ACBs.” We have taken these employee assumptions and utilized the corresponding employee hourly rates for the locality pay area of Washington, DC, as published by the OPM, to calculate our cost estimates. We have also calculated the costs of an employee's benefits while completing the application. We have calculated these costs by assuming that an applicant expends thirty-six percent (36%) of an employee's hourly wage on benefits for the employee. We have concluded that a 36% expenditure on benefits is an appropriate estimate because it is the routine percentage used by HHS for contract cost estimates. Our cost estimates are expressed in Table 6 below.

Table 6—Permanent Certification Program: Cost To Applicants To Apply to Become ONC-ACBs and Cost for ONC-ACBs To Apply for Status Renewal

Proposed requirement	Emloyee equivalent	Burden hours	Employee hourly wage rate	Cost of employee benefits per hour	Cost per applicant
General Identifying Information	GS-9 Step 1	10/60	$22.39	$8.06	$5.07
Documentation of Accreditation	GS-9 Step 1	30/60	22.39	8.06	15.23
Principles of Proper Conduct	GS-15 Step 1	20/60	59.30	21.35	26.89
Total Cost Per Applicant					47.19

We have estimated the applicant costs and ONC-ACB renewal costs through 2016, but no further, because we believe that it is premature to assume how the meaningful use requirements post-Stage 3 will change after the downward payment adjustments for eligible professionals and eligible hospitals become effective (e.g., the incentive payment adjustments specified at section 1848(a)(7) of the SSA for eligible professionals) and what impact, if any, those potential changes will have on the permanent certification program. Using our estimates above, we believe that the average initial cost for an applicant to become accredited and apply to be an ONC-ACB will be approximately $20,047 and the total cost for all 6 applicants will be approximately $120,283. We estimate that between 2012 and 2016 that all applicants will renew their ONC-ACB status twice and their accreditation once. We assume that the costs for an ONC-ACB to renew its status with the National Coordinator will be similar in burden to its initial application. Furthermore, we believe that the average cost for an ONC-ACB to renew its accreditation and to apply for renewal of its ONC-ACB status twice would be approximately $10,094 and the total renewal costs for all ONC-ACBs will be approximately $60,566. We estimate that the total costs of the accreditation, application and renewal processes under the proposed permanent certification program between 2012 and 2016 would be approximately $30,142 per applicant/ONC-ACB and approximately $180,849 for all applicants/ONC-ACBs. Based on our cost estimate timeframe of 5 years (2012 through 2016), the annualized cost would be $36,170.

Table 7—Permanent Certification Program: Total Costs of Certification Accreditation, Applying for ONC Certification Authorization, and Accreditation and Authorization Renewal Between 2012 and 2016

Anticipated number of applicants	Cost of accreditation per applicant	Cost to apply for certification authorization per applicant	Cost to renew accreditation per applicant	Cost to renew ONC-ACB status twice	Total cost estimate per applicant/ONC-ACB
6	$20,000	$47.19	$10,000	$94.38	$30,141.57
Total Cost of Accreditation, Application and Renewal					180,849.42

We invite comments on the number of entities that will seek to become accredited for certification under our proposed permanent certification program and the costs associated with accreditation, applying for ONC-ACB status, the renewal costs for both, and the timeframe we used for estimating costs.

ii. Costs to the Federal Government

We estimate the cost to develop the ONC-ACB application to be $350 based on the 5 hours of work we believe it would take a Federal Salary Classification GS-14 Step 1 employee located in Washington, DC to develop the application form. We also anticipate that there would be costs associated with reviewing applications under the proposed permanent certification program. We believe that a GS-15 Step 1 employee would review the applications and the National Coordinator (or designated representative) would issue final decisions on all applications. We anticipate that it would take approximately 20 hours to review and reach a final decision on each application. This estimate assumes a satisfactory application (i.e., no formal deficiency notifications) and includes the time necessary to verify the information in each application and prepare a briefing for the National Coordinator. We estimate the cost for the application review process to be $10,392. As a result, we estimate the Federal government's overall cost of administering the entire application process at approximately $10,742. Based on our cost estimate timeframe of 5 years (2012 through 2016), the annualized cost to the Federal government would be $2,148.

As previously noted, we would also post the names of applicants granted ONC-ACB status on our Web site. We believe that there would be minimal cost associated with this action and have calculated the potential cost to be approximately $312 on an annual basis for posting and maintaining the information on our Web site (a maximum of 6 hours of work for a Federal Salary Classification GS-12 Step 1 employee located in Washington, DC).

c. Permanent Certification Program: Testing and Certification of Complete EHRs and EHR Modules

As with the temporary certification program, we estimate below the costs that Complete EHR and EHR Module developers (commercial, open source, self-developed) will incur to have their HIT tested and certified between 2012 and 2016. As previously stated in our discussion of the appropriate timeframe for estimating costs for the ONC-ACB application process, we estimate costs through 2016, but no further, because we believe that it is premature to assume how the meaningful use requirements post-Stage 3 will change after the Medicare downward payment adjustments become effective. Although CMS has proposed to promulgate updates to the meaningful use stages every 2 years, we assume that there could be more time between stages (i.e., greater than 2 years) in years post-meaningful use Stage 3 based evaluations of earlier meaningful use stages, public feedback, and other factors, which would affect when Complete EHRs and/or EHR Modules would need to be recertified. However, we do expect meaningful use requirements between 2012 and 2016, which would encompass both Stage 2 and Stage 3 requirements to become more demanding and iterate every 2 years. Therefore, we can safely assume that Complete EHRs and EHR Modules will need to be tested and certified twice during this time period.

Even though under the permanent certification program the costs for testing and certification could presumably be attributed to different entities (i.e., testing costs to a NVLAP-accredited testing laboratory and certification costs to an ONC-ACB) we have included them together in an effort to reflect the overall effect of this rulemaking. As previously mentioned, we cannot predict a specific date for when the temporary certification program will sunset, and thus when ONC-ATCBs will finish testing and certifying Complete EHRs and/or EHR Modules in their queue. Therefore, as similarly calculated for the temporary certification program costs, we have estimated and attributed to the permanent certification program's costs the 2012 cost for testing and certifying 15% of the prior number of Complete EHRs and EHR Modules to associated meaningful use Stage 1 certification criteria. We have done this to account for the possibility that the ONC-ACBs could be authorized as soon as late 2011 and thus all testing and certification for 2012 would take place solely under the auspices of the permanent certification program. This 15% 2012 cost for testing and certification is represented by 15% of the number of each type of Complete EHR and EHR Module we previously estimated would be tested and certified to Meaningful Use Stage 1 multiplied by the appropriate estimated costs for testing and certification. These cost estimates are expressed in Table 8 below.

Table 8—Permanent Certification Program: Estimated 2012 Costs for Testing & Certification Associated With Meaningful Use Stage 1

Type	Number tested and certified	Cost per complete EHR/EHR module ($M)			Total cost for all complete EHRs/EHR modules over 3-year period ($M)
		Low	High	Mid-point	Low	High	Mid-point
Commercial/Open Source Complete EHR	14	$0.03	$0.05	$0.04	$0.42	$0.70	$0.56
Commercial/Open Source EHR Module	5	0.005	0.035	0.02	0.025	0.18	0.1
Self-Developed Complete EHRs and EHR Modules	7	0.005	0.05	0.028	0.035	0.35	0.2
Total	26				0.48	1.23	0.86

In creating Tables 9A and 9B below, we make the following assumptions:

• The cost for testing and certification will remain the same in the permanent certification program as they were in the temporary certification program even with the additional requirement of surveillance on the part of ONC-ACBs (which we would expect to be included in the cost they charge Complete EHR and/or EHR Module developers). We believe this is a reasonable assumption because of the low and high ranges we have estimated.
• That testing and certification costs will be unevenly distributed across subsequent years. We assume that there will be an increase in the year preceding the next stage of meaningful use and a decline between stages. We base this assumption on the proposal CMS has made to make the reporting period for meaningful use stages as long as a full year which would consequently require that eligible professionals and eligible hospitals have HIT that meets the definition of Certified EHR Technology prior to the start of their next reporting period in order to complete a full year reporting period with Certified EHR Technology. We assumed the ratios discussed in the temporary certification program because the impetus for an increase to occur is not same for meaningful use Stage 1 as it will be for later meaningful use stages. We assumed a curve that was relatively flat for 2010 and 2011 which subsequently tapered down in 2012 because of the flexibility provided by the proposed reporting period for meaningful use Stage 1 (3 to 6 months). This shorter reporting period makes it possible for an eligible professional or eligible hospital to adopt Certified EHR Technology during the first half of their first meaningful use Stage 1 reporting year and still receive an incentive payment if they satisfy the reporting requirements. With respect to the peak years for when testing and certification costs would most likely occur, we assume that those peak years will be 2012 and 2014, the years preceding meaningful use Stages 2 and 3, respectively. We assume that an increase would encompass 85% of the Complete EHRs and EHR Modules to be certified, which would represent most, if not all, previously certified Complete EHRs and EHR Modules and that the remaining 15% of testing and certification costs for 2013 would likely represent new EHR Module entrants to the HIT marketplace and Complete EHR or EHR Module developers who were late to get certified.
• As indicated in the HIT Standards and Certification Criteria interim final rule, we assume that Complete EHR developers would continue to consolidate due to mergers and acquisitions and that this consolidation would occur at a rate of 5% between meaningful use stages. Therefore, we believe that fewer Complete EHRs will need to be tested and certified prior to each meaningful use stage.
• Conversely, we assume that the number of EHR Modules developed that would need to be tested and certified to meet associated meaningful use Stage 2 (2013) certification criteria and beyond will grow at a rate of 20% between meaningful use stages (i.e., based on our prior estimate of 50 EHR Modules between 2010 and 2012, there would be 10 new modules developed during 2012 and during meaningful use Stage 2 to meet certification criteria associated with meaningful use Stage 2). We believe our growth rate is reasonable because the cost barrier for EHR Modules to enter the market would be much less than a Complete EHR. Coupled with the ability of small or start-up HIT developers to enter the market we believe that the potential of EHR Modules would lead to a constant stream of new entrants year after year.
• The number of eligible professionals and eligible hospitals that incur the testing and certification costs for their self-developed Complete EHRs and/or EHR Modules for meaningful use Stage 2 will drop by 50% in 2012 and another 25% in 2014 and level out after 2014 due to our assumption, that by 2014, and the impending start of meaningful use Stage 3, that all of the eligible professionals and eligible hospitals who still have a self-developed Complete EHR or EHR Module are likely to maintain their HIT rather than switch to a commercial product.

Table 9A illustrates the overall costs for testing and certification associated with meaningful use Stage 2. We have factored in the assumed 5% reduction in the number of Complete EHRs and 20% increase in EHR Modules presented for testing and certification to meet the certification criteria associated with meaningful use Stage 2. That is, we believe there will be approximately 88 unique Complete EHRs and 60 EHR Modules that will be tested and certified. We also separately factor in the 50% reduction to the number of self-developed Complete EHRs and EHR Modules that will be tested and certified to meet the certification criteria associated with meaningful use Stage 2.

Table 9A—Permanent Certification Program: Estimated Overall Costs for Testing & Certification Associated With Meaningful Use Stage 2

Type	Number tested and certified	Cost per complete EHR/EHR module ($M)			Total cost for all complete EHRs/EHR modules over 3-year period ($M)
		Low	High	Mid-point	Low	High	Mid-point
Commercial/Open Source Complete EHR	88	$0.03	$0.05	$0.04	$2.64	$4.40	$3.52
Commercial/Open Source EHR Module	60	0.005	0.035	0.02	0.30	2.10	1.2
Self-Developed Complete EHRs and EHR Modules	19	0.005	0.05	0.028	0.095	0.95	0.53
Total	167				3.04	7.45	5.25

Table 9B illustrates the overall costs for testing and certification associated with meaningful use Stage 3. We have again factored in the assumed 5% reduction in the number of Complete EHRs and 20% increase in EHR Modules presented for testing and certification to meet the certification criteria associated with meaningful use Stage 3. That is, we believe there will be approximately 84 unique Complete EHRs and 72 EHR Modules that will be tested and certified. We also separately factor in the 25% reduction to the number of self-developed Complete EHRs and EHR Modules that will be tested and certified to meet the certification criteria associated with meaningful use Stage 3.

Table 9B—Permanent Certification Program: Estimated Overall Costs for Testing & Certification Associated With Meaningful Use Stage 3

Type	Number tested and certified	Cost per complete EHR/EHR module ($M)			Total cost for all complete EHRs/EHR modules over 3-year period ($M)
		Low	High	Mid-point	Low	High	Mid-point
Commercial/Open Source Complete EHR	84	$0.03	$0.05	$0.04	$2.52	$4.20	$3.36
Commercial/Open Source EHR Module	72	0.005	0.035	0.02	0.36	2.52	1.44
Self-Developed Complete EHRs and EHR Modules	14	0.005	0.05	0.028	0.07	0.70	0.39
Total	170				2.95	7.42	5.19

Finally, Table 9C illustrates the 85% and 15% testing and certification cost distributions we estimate would be attributable to meaningful use Stages 2 and 3 (i.e., between 2012 and 2016) under the permanent certification program. Additionally, we assume that 100% of self-developed Complete EHRs and EHR Modules would be certified in year that precedes the next meaningful use stage (i.e., 2012 and 2014) because eligible professionals and eligible hospitals who remain self-developers will be motivated to ensure that their HIT can meet the definition of Certified EHR Technology prior to the beginning of a new meaningful use stage in order to avoid missing out on the incentives or being subject to downward payment adjustments. As a result, the costs for self-developers to get their Complete EHRs or EHR Modules are only attributed in Table 9C to the years 2012 and 2014. The totals multiplied by their respective percentages are derived from Tables 9A and 9B above.

Table 9C—Permanent Certification Program: Estimated Overall Costs for Testing & Certification Associated With Meaningful Use Stages 2 and 3 Accounting for Distributed Costs

Meaningful use stage	Year(s)	Percentage	Type	Low ($M)	High ($M)	Mid-point ($M)
Stage 2	2012	85	Complete EHRs/EHR Modules	$2.50	$5.53	$4.01
		100	Self-Developed	0.095	0.95	0.53
	2013/2014	15	Complete EHRs/EHR Modules	0.44	0.98	0.71
		0	Self-Developed	0	0	0
Stage 3	2014	85	Complete EHRs/EHR Modules	2.45	5.71	4.08
		100	Self-Developed	0.07	0.70	0.39
	2015/2016	15	Complete EHRs/EHR Modules	0.43	1.01	0.72
		0	Self-Developed	0	0	0

3. Costs for Collecting, Storing, and Reporting Certification Results Under the Temporary and Permanent Certification Programs

a. Costs to ONC-ATCBs and ONC-ACBs

Under both of the proposed certification programs we propose to require ONC-ATCBs and ONC-ACBs to provide ONC, no less frequently than weekly, an up-to-date list of Complete EHRs and/or EHR Modules that have been tested and certified which include, at a minimum, the vendor name (if applicable), the date certified, the product version, the unique certification number or other specific product identification, and where applicable, the certification criterion or certification criteria to which each EHR Module has been tested and certified.

As stated in the collection of information section, we anticipate requiring the reporting of this information on a weekly basis and that it will take ONC-ATCBs and ONC-ACBs about an hour to prepare and electronically transmit the information to ONC each week (i.e., respondents will respond 52 times per year).

We believe that an employee equivalent to the Federal Classification of GS-9 Step 1 could complete the transmissions of the requested information to ONC under both proposed certification programs. We have utilized the corresponding employee hourly rate for the locality pay area of Washington, DC, as published by OPM, to calculate our cost estimates. We have also calculated the costs of the employee's benefits while completing the transmissions of the requested information. We have calculated these costs by assuming that an ONC-ATCB or ONC-ACB expends thirty-six percent (36%) of an employee's hourly wage on benefits for the employee. We have concluded that a 36% expenditure on benefits is an appropriate estimate because it is the routine percentage used by HHS for contract cost estimates. Our cost estimates are expressed in Table 10 below.

Table 10—Annual Costs for ONC-ATCBs and ONC-ACBs To Report Certifications to ONC

Proposed program requirement	Employee equivalent	Annual burden hours per ONC-ATCBs/ONC-ACBs	Employee hourly wage rate	Cost of employee benefits per hour	Total cost per ONC-ATCB/ONC-ACB
ONC-ATCB Certification Results	GS-9 Step 1	52	$22.39	$8.06	$1,583.40
ONC-ACB Certification Results	GS-9 Step 1	52	22.39	8.06	1,583.40

To estimate the highest possible burden, we assume that all of the estimated applicants that we anticipate will apply under our proposed certification programs will become ONC-ATCBs and ONC-ACBs. Therefore, we estimate the total annual reporting cost under the temporary certification program to be $4,750 and the total annual reporting cost under the permanent certification program to be $9,500.

We believe that the proposed requirements for ONC-ATCBs to retain certification records for the length of the temporary certification program and for ONC-ACBs to retain certification records for 5 years under the permanent certification program are in line with common industry practices and, consequently, would not represent additional costs to ONC-ATCBs and ONC-ACBs as a result of this rule.

b. Costs to the Federal Government

As stated previously in this rule, we propose, under both certification programs, to post a comprehensive list of all Certified EHR Technology on our Web site. We believe that there would be minimal cost associated with this action and have calculated the potential cost, including weekly updates, to be $5,392 on an annualized basis. This amount is based on 104 hours of yearly work of a Federal Salary Classification GS-12 Step 1 employee located in Washington, DC.

4. Temporary and Permanent Certification Program Benefits

We believe that several benefits will accrue from the establishment of both a temporary certification program and permanent certification program. The temporary certification program would allow for the rapid influx of Complete EHRs and EHR Modules to be tested and certified at a sufficient pace for eligible professionals and eligible hospitals to adopt and implement Certified EHR Technology for meaningful use Stage 1 and thus potentially qualify for incentive payments under the CMS Medicare and Medicaid EHR Incentive Programs proposed rule. The time between the temporary certification program and the permanent certification program will permit the HIT industry the time it needs for NLVAP-accredited testing laboratories to come forward, for an ONC-AA to be approved and for additional applicants for ONC-ACB status to come forward. We believe that the permanent certification program will provide more opportunities for private sector entities to participate in the testing and certification of HIT and instill more confidence in what it means for HIT to be certified because more rigorous and objective processes will be in place. We further believe that both programs will meet our overall goals of accelerating health IT adoption and increasing levels of interoperability. At this time, we cannot predict how fast all of these savings will occur or their precise magnitude as they are partly dependent on future final rules for meaningful use and the subsequent standards and certification criteria adopted by the Secretary.

D. Regulatory Flexibility Act

The RFA requires agencies to analyze options for regulatory relief of small businesses if a rule has a significant impact on a substantial number of small entities. For more information on the Small Business Administration's (SBA's) size standards, see the SBA's Web site.^[5] For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. When conducting a RFA we are required to assess the potential effects of our proposed rule on small entities and to make every effort to minimize the regulatory burden that might be imposed on small entities. We believe that the entities that are likely to be directly affected by this proposed rule are applicants for ONC-ATCB and ONC-ACB status. Furthermore, we believe that these entities would either be classified under the North American Industry Classification System (NAICS) codes 541380 (Testing Laboratories) or 541990 (Professional, Scientific and Technical Services).^[6] As previously mentioned, we believe that there will be 3 applicants for ONC-ATCB status and 6 applicants for ONC-ACB status. According to the NAICS codes identified above, this would mean SBA size standards of $12 million and $7 million in annual receipts, respectively.^[7] Because this segment of the HIT industry is in a nascent stage and is comprised of very few entities, we have been unable to find reliable data from which to determine what realistic annual receipts would be. However, based on our total estimates for Complete EHRs and EHR Modules to be tested and certified, we assume that the annual receipts of any one ONC-ATCB or ONC-ACB could be in the low millions of dollars. Moreover, it is unclear, whether these entities may be involved in other testing and certification programs which would increase their annual receipts and potentially place them outside the SBA's size standards.

We believe that we have proposed the minimum amount of requirements necessary to accomplish our policy goals and that no appropriate regulatory alternatives could be developed to lessen the compliance burden for applicants for ONC-ATCB and ONC-ACB status as well as ONC-ATCBs and ONC-ACBs once they have been granted such status by the National Coordinator. Moreover, we believe that this proposed rule will create direct positive effects for entities because their attainment of ONC-ATCB or ONC-ACB status will permit them to test and certify Complete EHRs and/or EHR Modules. Thus, we expect that their annual receipts will increase as a result of becoming an ONC-ATCB or ONC-ACB.

Based on our analysis and discussion above, we have examined the economic implications of this proposed rule and do not believe that it will have a significant impact on a substantial number of small entities. The Secretary certifies that this proposed rule will not have a significant impact on a substantial number of small entities.

E. Executive Order 13132—Federalism

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has federalism implications.

Nothing in this proposed rule imposes substantial direct requirement costs on State and local governments, preempts State law or otherwise has federalism implications. We are not aware of any State laws or regulations that conflict with or are impeded by either of our proposed certification programs. This proposed rule affords all States an opportunity to identify any problems that our temporary or permanent certification programs would create, and to propose constructive alternatives. We welcome comments from State and local governments.

F. Unfunded Mandates Reform Act of 1995

Title II of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) requires cost-benefit and other analyses before any rulemaking if the rule includes a “Federal mandate that may result in the expenditure by State, local, and Tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any 1 year.” The current inflation-adjusted statutory threshold is approximately $133 million. We have determined that this proposed rule which encompasses our proposals for both the temporary and permanent certification programs would not constitute a significant rule under the Unfunded Mandates Reform Act, because it would impose no mandates.

OMB reviewed this proposed rule.

List of Subjects in 45 CFR Part 170

• Computer technology
• Electronic health record
• Electronic information system
• Electronic transactions
• Health
• Health care
• Health information

For the reasons set forth in the preamble, the Department proposes to amend 45 CFR subtitle A, subchapter D, part 170, as follows:

PART 170—HEALTH INFORMATION TECHNOLOGY STANDARDS, IMPLEMENTATION SPECIFICATIONS, AND CERTIFICATION CRITERIA AND CERTIFICATION PROGRAMS FOR HEALTH INFORMATION TECHNOLOGY

1. The authority citation for part 170 is revised to read as follows:

Authority: 42 U.S.C 300jj-11; 42 U.S.C 300jj-14; 5 U.S.C. 552.

2. In § 170.102, add in alphabetical order the definition of “Day or Day(s)” to read as follows:

§ 170.102

Definitions.

* * * * *

Day or Days means a calendar day or calendar days.

* * * * *

3. Add a new subpart D to part 170 to read as follows:

Subpart D—Temporary Certification Program for HIT

170.400

Basis and scope.

170.401

Applicability.

170.402

Definitions.

170.405

Correspondence.

170.410

Types of testing and certification.

170.415

Application prerequisite.

170.420

Application.

170.423

Principles of proper conduct for ONC-ATCBs.

170.425

Application submission.

170.430

Review of application.

170.435

ONC-ATCB application reconsideration.

170.440

ONC-ATCB status.

170.445

Complete EHR testing and certification.

170.450

EHR Module testing and certification.

170.455

Testing and certification to newer versions of certain standards.

170.457

Authorized testing and certification methods.

170.460

Good standing as an ONC-ATCB.

170.465

Revocation of authorized testing and certification body status.

170.470

Effect of revocation on the certifications issued to complete EHRs and EHR Modules.

170.490

Sunset of the temporary certification program.

Subpart D—Temporary Certification Program for HIT

§ 170.400

Basis and scope.

This subpart implements section 3001(c)(5) of the Public Health Service Act, and sets forth the rules and procedures related to the temporary certification program for health information technology administered by the National Coordinator for Health Information Technology.

§ 170.401

Applicability.

This subpart establishes the processes that applicants for ONC-ATCB status must follow to be granted ONC-ATCB status by the National Coordinator, the processes the National Coordinator will follow when assessing applicants and granting ONC-ATCB status, and the requirements of ONC-ATCBs for testing and certifying Complete EHRs and/or EHR Modules in accordance with the applicable certification criteria adopted by the Secretary in subpart C of this part.

§ 170.402

Definitions.

For the purposes of this subpart:

Applicant means a single organization or a consortium of organizations that seeks to become an ONC-ATCB by requesting and subsequently submitting an application for ONC-ATCB status to the National Coordinator.

ONC-ATCB or ONC-Authorized Testing and Certification Body means an organization or a consortium of organizations that has applied to and been authorized by the National Coordinator pursuant to this subpart to perform the testing and certification of Complete EHRs and/or EHR Modules under the temporary certification program.

§ 170.405

Correspondence.

(a) Correspondence and communication with the National Coordinator shall be conducted by e-mail, unless otherwise necessary. The official date of receipt of any e-mail between the National Coordinator and an applicant for ONC-ATCB status or an ONC-ATCB is the day the e-mail was sent.

(b) In circumstances where it is necessary for an applicant for ONC-ATCB status to correspond or communicate with the National Coordinator by regular or express mail, the official date of receipt will be the date of the delivery confirmation.

§ 170.410

Types of testing and certification.

Applicants may seek authorization from the National Coordinator to perform the following types of testing and certification:

(a) Complete EHR testing and certification; and/or

(b) EHR Module testing and certification.

§ 170.415

Application prerequisite.

Applicants must request in writing an application for ONC-ATCB status from the National Coordinator. Applicants must indicate:

(a) The type of authorization sought pursuant to § 170.410; and

(b) If seeking authorization to perform EHR Module testing and certification, the specific type(s) of EHR Module(s) they seek authorization to test and certify. If qualified, applicants will only be granted authorization to test and certify the types of EHR Modules for which they seek authorization.

§ 170.420

Application.

The application for ONC-ATCB status consists of two parts. Applicants must complete both parts of the application in their entirety and submit them to the National Coordinator for the application to be considered complete.

(a) Part 1. An applicant must provide all of the following:

(1) General identifying information including:

(i) Name, address, city, State, zip code, and Web site of applicant; and

(ii) Designation of an authorized representative, including name, title, phone number, and e-mail address of the person who will serve as the applicant's point of contact.

(2) Documentation of the completion and results of a self-audit against all sections of ISO/IEC Guide 65:1996, and the following:

(i) A description of the applicant's management structure according to section 4.2 of ISO/IEC Guide 65:1996;

(ii) A copy of the applicant's quality manual that has been developed according to section 4.5.3 of ISO/IEC Guide 65:1996;

(iii) A copy of the applicant's policies and approach to confidentiality according to section 4.10 of ISO/IEC Guide 65:1996;

(iv) A copy of the qualifications of each of the applicant's personnel who oversee or perform certification according to section 5.2 of ISO/IEC Guide 65:1996;

(v) A copy of the applicant's evaluation reporting procedures according to section 11 of ISO/IEC Guide 65:1996; and

(vi) A copy of the applicant's policies for use and display of certificates according to section 14 of ISO/IEC Guide 65:1996.

(3) Documentation of the completion and results of a self-audit against all sections of ISO/IEC 17025:2005, and the following:

(i) A copy of the applicant's quality system document according to section 4.2.2 of ISO/IEC 17025:2005;

(ii) A copy of the applicant's policies and procedures for handling testing nonconformities according to section 4.9.1 of ISO/IEC 17025:2005; and

(iii) The qualifications of each of the applicant's personnel who oversee or conduct testing according to section 5.2 of ISO/IEC 17025:2005.

(4) An agreement, properly executed by the applicant's authorized representative, that it will adhere to the Principles of Proper Conduct for ONC-ATCBs.

(b) Part 2. An applicant must submit a completed proficiency examination.

§ 170.423

Principles of proper conduct for ONC-ATCBs.

An ONC-ATCB shall:

(a) Operate its certification program in accordance with ISO/IEC Guide 65:1996 and testing program in accordance with ISO/IEC 17025:2005;

(b) Maintain an effective quality management system which addresses all requirements of ISO/IEC 17025:2005;

(c) Attend all mandatory ONC training and program update sessions;

(d) Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to test and certify Complete EHRs and/or EHR Modules;

(e) Use testing tools and procedures published by NIST or functionally equivalent testing tools and procedures published by another entity for the purposes of assessing Complete EHRs and/or EHR Modules compliance with the certification criteria adopted by the Secretary;

(f) Report to ONC within 15 days any changes that materially affect its:

(1) Legal, commercial, organizational, or ownership status;

(2) Organization and management, including key testing and certification personnel;

(3) Policies or procedures;

(4) Location;

(5) Facilities, working environment or other resources;

(6) ONC authorized representative (point of contact); or

(7) Other such matters that may otherwise materially affect its ability to test and certify Complete EHRs and/or EHR Modules;

(g) Allow ONC, or its authorized agents(s), to periodically observe on site (unannounced or scheduled) during normal business hours, any testing and/or certification performed to demonstrate compliance with the requirements of the temporary certification program;

(h) Provide ONC, no less frequently than weekly, a current list of Complete EHRs and/or EHR Modules that have been tested and certified which includes, at a minimum, the vendor name (if applicable), the date certified, product version, the unique certification number or other specific product identification, and where applicable, the certification criterion or certification criteria to which each EHR Module has been tested and certified;

(i) Retain all records related to the testing and certification of Complete EHRs and/or EHR Modules for the duration of the temporary certification program and provide copies of all testing and certification records to ONC at the sunset of the temporary certification program; and

(j) Promptly refund any and all fees received for tests and certifications that will not be completed.

§ 170.425

Application submission.

(a) An applicant for ONC-ATCB status must submit its application either electronically via e-mail (or Web submission if available), or by regular or express mail.

(b) An application for ONC-ATCB status may be submitted to the National Coordinator at any time during the existence of the temporary certification program.

§ 170.430

Review of application.

(a) Method of review and review timeframe.

(1) Applications will be reviewed in the order they are received.

(2) The National Coordinator will review Part 1 of the application and determine whether Part 1 of the application is complete and satisfactory before proceeding to review Part 2 of the application.

(3) The National Coordinator is permitted up to 30 days to review an application (submitted for the first time) upon receipt.

(b) Application deficiencies.

(1) If the National Coordinator identifies an area in an application that requires the applicant to clarify a statement or correct an inadvertent error or minor omission, the National Coordinator may contact the applicant to make such clarification or correction without issuing a deficiency notice. If the National Coordinator has not received the requested information after five days, the applicant may be issued a deficiency notice specifying the error, omission, or deficient statement.

(2) If the National Coordinator determines that deficiencies in either part of the application exist, the National Coordinator will issue a deficiency notice to the applicant and return the application. The deficiency notice will identify the areas of the application that require additional information or correction.

(c) Revised application.

(1) An applicant is permitted to submit a revised application in response to a deficiency notice.

(2) In order to continue to be considered for ONC-ATCB status, an applicant's revised application must address the specified deficiencies and be received by the National Coordinator within 15 days of the applicant's receipt of the deficiency notice.

(3) The National Coordinator is permitted up to 15 days to review a revised application once it has been received.

(4) If the National Coordinator determines that a revised application still contains deficiencies, the applicant will be issued a denial notice indicating that the applicant will no longer be considered for authorization under the temporary certification program. An applicant may request reconsideration of this decision in accordance with § 170.435.

(d) Satisfactory application.

(1) An application will be deemed satisfactory if it meets all application requirements, including a passing score on the proficiency examination.

(2) The National Coordinator will notify the applicant's authorized representative of its satisfactory application and its successful achievement of ONC-ATCB status.

(3) Once notified by the National Coordinator of its successful achievement of ONC-ATCB status, the applicant may represent itself as an ONC-ATCB and begin testing and certifying Complete EHRs and/or EHR Modules consistent with its authorization.

§ 170.435

ONC-ATCB application reconsideration.

(a) An applicant may request that the National Coordinator reconsider a denial notice issued for each part of an application only if the applicant can demonstrate that clear, factual errors were made in the review of the applicable part of the application and that the errors' correction could lead to the applicant obtaining ONC-ATCB status.

(b) Submission requirement. An applicant is required to submit, within 15 days of receipt of a denial notice, a written statement to the National Coordinator contesting the decision to deny its application and explaining with sufficient documentation what factual errors it believes can account for the denial. If the National Coordinator does not receive the applicant's submission within the specified timeframe, its reconsideration request may be rejected.

(c) Reconsideration request review. If the National Coordinator receives a timely reconsideration request, the National Coordinator is permitted up to 15 days from the date of receipt to review the information submitted by the applicant and issue a decision.

(d) Decision.

(1) If the National Coordinator determines that clear, factual errors were made during the review of the application and that correction of the errors would remove all identified deficiencies, the applicant's authorized representative will be notified of the National Coordinator's decision to reverse the previous decision(s) not to approve part of the applicant's application or the entire application.

(i) If the National Coordinator's decision to reverse the previous decision(s) affected part 1 of an application, the National Coordinator will subsequently review part 2 of the application.

(ii) If the National Coordinator's decision to reverse the previous decision(s) affected part 2 of an application, the applicant's authorized representative will be notified of the National Coordinator's decision as well as the applicant's successful achievement of ONC-ATCB status.

(2) If, after reviewing an applicant's reconsideration request, the National Coordinator determines that the applicant did not identify any factual errors or that correction of those factual errors would not remove all identified deficiencies in the application, the National Coordinator may reject the applicant's reconsideration request.

(3) Final decision. A reconsideration decision issued by the National Coordinator is final and not subject to further review.

§ 170.440

ONC-ATCB status.

(a) Acknowledgement and publication. The National Coordinator will acknowledge and make publicly available the names of ONC-ATCBs, including the date each was authorized and the type(s) of testing and certification each has been authorized to perform.

(b) Representation. Each ONC-ATCB must prominently and unambiguously identify on its Web site and in all marketing and communications statements (written and oral) the scope of its authorization.

(c) Renewal. ONC-ATCB status does not need to be renewed during the temporary certification program.

(d) Expiration. The status of all ONC-ATCBs will expire upon the sunset of the temporary certification program in accordance with § 170.490.

§ 170.445

Complete EHR testing and certification.

(a) To be authorized to test and certify Complete EHRs under the temporary certification program, an ONC-ATCB must be capable of testing and certifying Complete EHRs to all applicable certification criteria adopted by the Secretary at subpart C of this part.

(b) An ONC-ATCB that has been authorized to test and certify Complete EHRs is also authorized to test and certify all EHR Modules under the temporary certification program.

§ 170.450

EHR module testing and certification.

(a) When testing and certifying EHR Modules, an ONC-ATCB must test and certify in accordance with the applicable certification criterion or certification criteria adopted by the Secretary at subpart C of this part.

(b) EHR Modules are required to be tested and certified to at least one certification criterion.

(c) Privacy and security testing and certification. EHR Modules shall be tested and certified to all privacy and security certification criteria adopted by the Secretary unless the EHR Module(s) is/are presented for testing and certification in one of the following manners:

(1) The EHR Module(s) are presented for testing and certification as a pre-coordinated, integrated “bundle” of EHR Modules, which could otherwise constitute a Complete EHR. In such instances, the EHR Module(s) shall be tested and certified in the same manner as a Complete EHR. Pre-coordinated bundles of EHR Module(s) which include EHR Module(s) that would not be part of a local system and under the end user's direct control are excluded from this exception. The constituent EHR Modules of such an integrated bundle must be separately tested and certified to all privacy and security certification criteria;

(2) An EHR Module is presented for testing and certification, and the presenter can demonstrate to the ONC-ATCB that it would be technically infeasible for the EHR Module to be tested and certified in accordance with some or all of the privacy and security certification criteria; or

(3) An EHR Module is presented for testing and certification, and the presenter can demonstrate to the ONC-ATCB that the EHR Module is designed to perform a specific privacy and security capability. In such instances, the EHR Module may only be tested and certified in accordance with the applicable privacy and security certification criterion/criteria.

(d) ONC-ATCBs authorized to test and certify EHR Modules must clearly indicate the certification criterion or certification criteria to which an EHR Module has been tested and certified in its certification documentation.

§ 170.455

Testing and certification to newer versions of certain standards.

(a) ONC-ATCBs may test and certify Complete EHRs and EHR Modules to a newer version of certain identified minimum standards specified at subpart B of this part if the Secretary has accepted a newer version of an adopted minimum standard.

(b) Applicability of an accepted new version of an adopted minimum standard.

(1) ONC-ATCBs are not required to test and certify Complete EHRs and/or EHR Modules according to newer versions of an adopted minimum standard accepted by the Secretary until the incorporation by reference provision of the adopted version is updated in the Federal Register with a newer version.

(2) Certified EHR Technology may be upgraded to comply with newer versions of an adopted minimum standard accepted by the Secretary without adversely affecting the certification status of the Certified EHR Technology.

§ 170.457

Authorized testing and certification methods.

(a) Primary method. An ONC-ATCB must have the capacity to test and certify Complete EHRs and/or EHR Modules at its facility.

(b) Secondary methods. An ONC-ATCB must also have the capacity to test and certify Complete EHRs and/or EHR Modules through one of the following methods:

(1) At the site where the Complete EHR or EHR Module has been developed; or

(2) At the site where the Complete EHR or EHR Module resides; or

(3) Remotely (i.e., through other means, such as through secure electronic transmissions and automated Web-based tools, or at a location other than the ONC-ATCB's facilities).

§ 170.460

Good standing as an ONC-ATCB.

An ONC-ATCB must maintain good standing by:

(a) Adhering to the Principles of Proper Conduct for ONC-ATCBs;

(b) Refraining from engaging in other types of inappropriate behavior, including an ONC-ATCB misrepresenting the scope of its authorization as well as an ONC-ATCB testing and certifying Complete EHRs and/or EHR Modules for which it does not have authorization; and

(c) Following all other applicable Federal and State laws.

§ 170.465

Revocation of authorized testing and certification body status.

(a) Type-1 violations. The National Coordinator may revoke an ONC-ATCB's status for committing a Type-1 violation. Type-1 violations include violations of law or temporary certification program policies that threaten or significantly undermine the integrity of the temporary certification program. These violations include, but are not limited to: false, fraudulent, or abusive activities that affect the temporary certification program, a program administered by HHS or any program administered by the Federal government.

(b) Type-2 violations. The National Coordinator may revoke an ONC-ATCB's status for failing to timely or adequately correct a Type-2 violation. Type-2 violations comprise noncompliance with § 170.460.

(1) Noncompliance notification. If the National Coordinator obtains reliable evidence that an ONC-ATCB may no longer be in compliance with § 170.460, the National Coordinator will issue a noncompliance notification with reasons for the notification to the ONC-ATCB requesting that the ONC-ATCB respond to the alleged violation and correct the violation, if applicable.

(2) Opportunity to become compliant. After receipt of a noncompliance notification, an ONC-ATCB is permitted up to 30 days to submit a written response and accompanying documentation that demonstrates that no violation occurred or that the alleged violation has been corrected.

(i) If the ONC-ATCB submits a response, the National Coordinator is permitted up to 30 days from the time the response is received to evaluate the response and reach a decision. The National Coordinator may, if necessary, request additional information from the ONC-ATCB during this time period.

(ii) If the National Coordinator determines that no violation occurred or that the violation has been sufficiently corrected, the National Coordinator will issue a memo to the ONC-ATCB confirming this determination.

(iii) If the National Coordinator determines that the ONC-ATCB failed to demonstrate that no violation occurred or to correct the area(s) of non-compliance identified under paragraph (b)(1) of this section within 30 days of receipt of the noncompliance notification, then the National Coordinator may propose to revoke the ONC-ATCB's status.

(c) Proposed revocation.

(1) The National Coordinator may propose to revoke an ONC-ATCB's status if the ONC-ATCB has committed a Type-1 violation; or

(2) The National Coordinator may propose to revoke an ONC-ATCB's status if, after the ONC-ATCB has been notified of a Type-2 violation, the ONC-ATCB fails to:

(i) To rebut the finding of a violation with sufficient evidence showing that the violation did not occur or that the violation has been corrected; or

(ii) Submit to the National Coordinator a written response to the noncompliance notification within the specified timeframe under paragraph (b)(2).

(3) ONC-ATCB's operations. An ONC-ATCB may continue its operations under the temporary certification program during the time periods provided for an ONC-ATCB to respond to a proposed revocation notice and the National Coordinator to review an ONC-ATCB's response to a proposed revocation.

(d) Opportunity to respond to a proposed revocation notice.

(1) An ONC-ATCB may respond to a proposed revocation notice, but must do so within 10 days of receiving the proposed revocation notice and include appropriate documentation explaining in writing why its status should not be revoked.

(2) Upon receipt of an ONC-ATCB's response to a proposed revocation notice, the National Coordinator is permitted up to 30 days to review the information submitted by the ONC-ATCB and reach a decision.

(e) Good standing determination. If the National Coordinator determines that an ONC-ATCB's status should not be revoked, the National Coordinator will notify the ONC-ATCB's authorized representative in writing of this determination.

(f) Revocation.

(1) The National Coordinator may revoke an ONC-ATCB's status if:

(i) A determination is made that revocation is appropriate after considering the information provided by the ONC-ATCB in response to the proposed revocation notice; or

(ii) The ONC-ATCB does not respond to a proposed revocation notice within the specified timeframe in paragraph (d)(1) of this section.

(2) A decision to revoke an ONC-ATCB's status is final and not subject to further review unless the National Coordinator chooses to reconsider the revocation.

(g) Extent and duration of revocation.

(1) The revocation of an ONC-ATCB is effective as soon as the ONC-ATCB receives the revocation notice.

(2) A testing and certification body that has had its ONC-ATCB status revoked is prohibited from accepting new requests for testing and certification and must cease its current testing and certification operations under the temporary certification program.

(3) A testing and certification body that has had its ONC-ATCB status revoked for a Type-1 violation is prohibited from reapplying for ONC-ATCB status under the temporary certification program for one year. If the temporary certification program sunsets during this time, the testing and certification body is prohibited from applying for ONC-ACB status under the permanent certification program for the time that remains within the one year prohibition.

(4) The failure of a testing and certification body that has had its ONC-ATCB status revoked, to promptly refund any and all fees for tests and/or certifications of Complete EHRs and EHR Modules not completed will be considered a violation of the Principles of Proper Conduct for ONC-ATCBs and will be taken into account by the National Coordinator if the testing and certification body reapplies for ONC-ATCB status under the temporary certification program or applies for ONC-ACB status under the permanent certification program.

§ 170.470

Effect of revocation on the certifications issued to complete EHRs and EHR modules.

(a) The certified status of Complete EHRs and/or EHR Modules certified by an ONC-ATCB that had it status revoked will remain intact unless a Type-1 violation was committed that calls into question the legitimacy of the certifications issued by the former ONC-ATCB.

(b) If the National Coordinator determines that a Type-1 violation occurred that called into question the legitimacy of certifications conducted by the former ONC-ATCB, then the National Coordinator would:

(1) Review the facts surrounding the revocation of the ONC-ATCB's status; and

(2) Publish a notice on ONC's Web site if the National Coordinator believes that Complete EHRs and/or EHR Modules were improperly certified by the former ONC-ATCB.

(c) If the National Coordinator determines that Complete EHRs and/or EHR Modules were improperly certified, the certification status of affected Complete EHRs and/or EHR Modules would only remain intact for 120 days after the National Coordinator publishes the notice. The certification status of the Complete EHR and/or EHR Module can only be maintained thereafter by being re-certified by an ONC-ATCB in good standing.

§ 170.490

Sunset of the temporary certification program.

The temporary certification program will sunset on the date when the National Coordinator has authorized at least one ONC-ACB under the permanent certification program. On the date at which this sunset occurs, ONC-ATCBs under the temporary certification program are prohibited from accepting new requests to certify Complete EHRs or EHR Modules. ONC-ATCBs may, however, complete the processing of Complete EHRs and EHR Modules that are being tested and certified at the time the sunset occurs.

4. Add a new subpart E to part 170 to read as follows:

Subpart E—Permanent Certification Program for HIT

170.500

Basis and scope.

170.501

Applicability.

170.502

Definitions.

170.503

Requests for ONC-AA status and ONC-AA ongoing responsibilities.

170.504

Reconsideration process for requests for ONC-AA status.

170.505

Correspondence.

170.510

Types of certification.

170.520

Application.

170.523

Principles of proper conduct for ONC-ACBs.

170.525

Application submission.

170.530

Review of application.

170.535

ONC-ACB application reconsideration.

170.540

ONC-ACB status.

170.545

Complete EHR certification.

170.550

EHR module certification.

170.553

Certification for health information technology other than complete EHRs and EHR modules.

170.555

Certification to newer versions of certain standards.

170.557

Authorized certification methods.

170.560

Good standing as an ONC-ACB.

170.565

Revocation of authorized certification body status.

170.570

Effect of revocation on the certifications issued to complete EHRs and EHR modules.

Subpart E—Permanent Certification Program for HIT

§ 170.500

Basis and scope.

This subpart implements section 3001(c)(5) of the Public Health Service Act, and sets forth the rules and procedures related to the permanent certification program for health information technology administered by the National Coordinator for Health Information Technology.

§ 170.501

Applicability.

This subpart establishes the processes that applicants for ONC-ACB status must follow to be granted ONC-ACB status by the National Coordinator, the processes the National Coordinator will follow when assessing applicants and granting ONC-ACB status, the requirements of ONC-ACBs for certifying Complete EHRs and/or EHR Modules in accordance with the applicable certification criteria adopted by the Secretary in subpart C of this part. It also establishes the processes accreditation organizations must follow to request approval from the National Coordinator and that the National Coordinator in turn will follow to approve an accreditation organization under the permanent certification program as well as certain ongoing responsibilities for an ONC-AA.

§ 170.502

Definitions.

For the purposes of this subpart:

Applicant means a single organization or a consortium of organizations that seeks to become an ONC-ACB by requesting and subsequently submitting an application for ONC-ACB status to the National Coordinator.

ONC-ACB or ONC-Authorized Certification Body means an organization or a consortium of organizations that has applied to and been authorized by the National Coordinator pursuant to this subpart to perform the certification of, at a minimum, Complete EHRs and/or EHR Modules using the applicable certification criteria adopted by the Secretary.

ONC-Approved Accreditor or ONC-AA means an accreditation organization that the National Coordinator has approved to accredit certification bodies under the permanent certification program.

§ 170.503

Requests for ONC-AA status and ONC-AA ongoing responsibilities.

(a) Only one ONC-Approved Accreditor (ONC-AA) shall be approved by the National Coordinator at a time.

(b) Submission. In order to become an ONC-AA, an accreditation organization must submit a request in writing to the National Coordinator along with the following information to demonstrate its ability to serve as an ONC-AA:

(1) A detailed description of the accreditation organization's conformance to ISO/IEC17011:2004 and experience evaluating the conformance of certification bodies to ISO/IEC Guide 65:1996;

(2) A detailed description of the accreditation organization's accreditation requirements and how the requirements complement the Principles of Proper Conduct for ONC-ACBs;

(3) Detailed information on the accreditation organization's procedures that would be used to monitor ONC-ACBs;

(4) Detailed information, including education and experience, about the key personnel who review organizations for accreditation; and

(5) Procedures for responding to, and investigating, complaints against ONC-ACBs.

(c) Approval. The National Coordinator is permitted up to 30 days to review a request for ONC-AA status from an accreditation organization upon receipt.

(1) The National Coordinator's determination will be based on the information provided, the completeness of the accreditation organizations' descriptions to the elements listed in paragraph (b) of this section and each accreditation organization's overall accreditation experience.

(2) The National Coordinator will review requests by accreditation organizations for ONC-AA status in the order they are received and will approve the first qualified accreditation organization consistent with the requirements of paragraph (b).

(d) Reconsideration of a Decision. Any accreditation organization seeking to become an ONC-AA may appeal a decision to deny its request in accordance with § 170.504, but only if no other accreditation organization has been granted ONC-AA status.

(e) ONC-AA Ongoing Responsibilities. An ONC-AA must:

(1) Maintain conformance with ISO/IEC 17011:2004;

(2) In accrediting certification bodies, verify conformance to, at a minimum, ISO/IEC Guide 65:1996;

(3) Verify that ONC-ACBs are performing surveillance in accordance with their respective annual plans; and

(4) Review ONC-ACB surveillance results to determine if the results indicate any substantive non-conformance with the terms set by the ONC-AA when it granted the ONC-ACB accreditation.

(f) ONC-AA Status.

(1) An ONC-AA's status will expire not later than 3 years from the date its status was granted by the National Coordinator.

(2) The National Coordinator will accept requests for ONC-AA status 120 days before the current ONC-AA's status is set to expire.

§ 170.504

Reconsideration process for requests for ONC-AA status.

(a) An accreditation organization may ask that the National Coordinator to reconsider a decision to deny its request for ONC-AA status only if the accreditation organization can demonstrate that clear, factual errors were made in the review of its request for ONC-AA status and that the errors' correction could lead to the accreditation organization obtaining ONC-AA status.

(b) Submission requirement. An accreditation organization is required to submit, within 15 days of receipt of a denial notice, a written statement to the National Coordinator contesting the decision to deny its request for ONC-AA status and explaining with sufficient documentation what factual error(s) it believes can account for the denial. If the National Coordinator does not receive the accreditation organization's submission within the specified timeframe its request may be rejected.

(c) Reconsideration request review. If the National Coordinator receives a timely reconsideration request, the National Coordinator will be permitted up to 15 days from the date of receipt to review the information submitted by the accreditation organization and issue a decision.

(d) Decision.

(1) If the National Coordinator determines that clear, factual errors were made during the review of the request, that correction of the errors would remove all identified deficiencies, and that during this review no other accreditation organization has been granted ONC-AA status, the accreditation organization will be notified by National Coordinator that its request for ONC-AA status has been approved.

(2) If, after reviewing an accreditation organization's reconsideration request, the National Coordinator determines that the accreditation organization did not identify the factual errors that were made during the review of its request for ONC-AA status, the National Coordinator may reject its reconsideration request.

(3) Final Decision. A reconsideration decision issued by the National Coordinator is final and not subject to further review.

§ 170.505

Correspondence.

(a) Correspondence and communication with the National Coordinator shall be conducted by e-mail, unless otherwise necessary. The official date of receipt of any e-mail between the National Coordinator and an applicant for ONC-ACB status or an ONC-ACB is the day the e-mail was sent.

(b) In circumstances where it is necessary for an applicant for ONC-ACB status to correspond or communicate with the National Coordinator by regular or express mail, the official date of receipt will be the date of the delivery confirmation.

§ 170.510

Types of certification.

Applicants may seek authorization from the National Coordinator to perform the following types of certification:

(a) Complete EHR certification; and/or

(b) EHR Module certification; and/or

(c) Other types of health information technology certification for which the Secretary has adopted certification criteria under subpart C of this part.

§ 170.520

Application.

Applicants must include the following information in an application for ONC-ACB status and submit it to the National Coordinator for the application to be considered complete.

(a) The type of authorization sought pursuant to § 170.510. For authorization to perform EHR Module certification, applicants must indicate the specific type(s) of EHR Module(s) they seek authorization to certify. If qualified, applicants will only be granted authorization to certify the types of EHR Modules for which they seek authorization.

(b) General identifying information including:

(1) Name, address, city, State, zip code, and Web site of applicant; and

(2) Designation of an authorized representative, including name, title, phone number and e-mail address of the person who will serve as the applicant's point of contact.

(c) Documentation that confirms that the applicant has been accredited by an ONC-AA.

(d) An agreement, properly executed by the applicant's authorized representative, that it will adhere to the Principles of Proper Conduct for ONC-ACBs.

§ 170.523

Principles of proper conduct for ONC-ACBs.

An ONC-ACB shall:

(a) Maintain its accreditation;

(b) Attend all mandatory ONC training and program update sessions;

(c) Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to certify HIT;

(d) Report to ONC within 15 days any changes that materially affect its:

(1) Legal, commercial, organizational, or ownership status;

(2) Organization and management including key certification personnel;

(3) Policies or procedures;

(4) Location;

(5) Personnel, facilities, working environment or other resources;

(6) ONC authorized representative (point of contact); or

(7) Other such matters that may otherwise materially affect its ability to certify HIT.

(e) Allow ONC, or its authorized agents(s), to periodically observe on site (unannounced or scheduled) any certifications performed to demonstrate compliance with the requirements of the permanent certification program;

(f) Provide ONC, no less frequently than weekly, a current list of Complete EHRs and/or EHR Modules that have been certified, which includes, at a minimum, the vendor name (if applicable), the date certified, the product version, the unique certification number or other specific product identification, and where applicable, the certification criterion or certification criteria to which each EHR Module has been certified;

(g) Retain all records related to the certification of Complete EHRs and/or EHR Modules for a minimum of 5 years;

(h) Only certify HIT, including Complete EHRs and/or EHR Modules, that have been tested by a NVLAP-accredited testing laboratory;

(i) Submit an annual surveillance plan to the National Coordinator and annually report to the National Coordinator its surveillance results; and

(j) Promptly refund any and all fees received for certifications that will not be completed.

§ 170.525

Application submission.

(a) An applicant for ONC-ACB status must submit its application either electronically, via e-mail (or Web submission if available), or by regular or express mail.

(b) An application for ONC-ACB status may be submitted to the National Coordinator at any time during the existence of the permanent certification program.

§ 170.530

Review of application.

(a) Method of review and review timeframe.

(1) Applications will be reviewed in the order they are received.

(2) The National Coordinator is permitted up to 30 days from receipt to review an application (submitted for the first time).

(b) Application deficiencies.

(1) If the National Coordinator identifies an area in an application that requires the applicant to clarify a statement or correct an inadvertent error or minor omission, the National Coordinator may contact the applicant to make such clarification or correction without issuing a deficiency notice. If the National Coordinator has not received the requested information after five days, the applicant may be issued a deficiency notice specifying the error, omission, or deficient statement.

(2) If the National Coordinator determines that deficiencies in either part of the application exist, the National Coordinator will issue a deficiency notice to the applicant and return the application. The deficiency notice will identify the areas of the application that require additional information or correction.

(c) Revised application.

(1) An applicant is permitted to submit a revised application in response to a deficiency notice.

(2) In order to continue to be considered for ONC-ACB status, an applicant's revised application must be received by the National Coordinator within 15 days of the applicant's receipt of the deficiency notice.

(3) The National Coordinator is permitted 15 days to review a revised application once it has been received.

(4) If the National Coordinator determines that a revised application still contains deficiencies, the applicant will be issued a denial notice indicating that the applicant will no longer be considered for authorization under the permanent certification program. An applicant may request reconsideration of this decision in accordance with § 170.535.

(d) Satisfactory application.

(1) An application will be deemed satisfactory if it meets all the application requirements.

(2) The National Coordinator will notify the applicant's authorized representative of its satisfactory application and its successful achievement of ONC-ACB status.

(3) Once notified by the National Coordinator of its successful achievement of ONC-ACB status, the applicant may represent itself as an ONC-ACB and begin certifying health information technology consistent with its authorization.

§ 170.535

ONC-ACB application reconsideration.

(a) An applicant may request that the National Coordinator reconsider a denial notice only if the applicant can demonstrate that clear, factual errors were made in the review of its application and that the errors' correction could lead to the applicant obtaining ONC-ACB status.

(b) Submission requirement. An applicant is required to submit, within 15 days of receipt of a denial notice, a written statement to the National Coordinator contesting the decision to deny its application and explaining with sufficient documentation what factual errors it believes can account for the denial. If the National Coordinator does not receive the applicant's reconsideration request within the specified timeframe its reconsideration request may be rejected.

(c) Reconsideration request review. If the National Coordinator receives a timely reconsideration request, the National Coordinator is permitted up to 15 days from the date of receipt to review the information submitted by the applicant and issue a decision.

(d) Decision.

(1) If the National Coordinator determines that clear, factual errors were made during the review of the application and that correction of the errors would remove all identified deficiencies, the applicant's authorized representative will be notified of the National Coordinator's determination and the applicant's successful achievement of ONC-ACB status.

(2) If, after reviewing an applicant's reconsideration request, the National Coordinator determines that the applicant did not identify any factual errors or that correction of those factual errors would not remove all identified deficiencies in the application, the National Coordinator may reject the applicant's reconsideration request.

(3) Final decision. A reconsideration decision issued by the National Coordinator is final and not subject to further review.

§ 170.540

ONC-ACB Status.

(a) Acknowledgement and publication. The National Coordinator will acknowledge and make publicly available the names of ONC-ACBs, including the date each was authorized and the type(s) of certification each has been authorized to perform.

(b) Representation. Each ONC-ACB must prominently and unambiguously identify on its Web site and in all marketing and communications statements (written and oral) the scope of its authorization.

(c) Renewal. An ONC-ACB is required to renew its status every two years. An ONC-ACB is required to submit a renewal request to the National Coordinator 60 days prior to the expiration of its status.

(d) Expiration. An ONC-ACB's status will expire two years from the date it was granted by the National Coordinator unless it is renewed in accordance with paragraph (c) of this section.

§ 170.545

Complete EHR Certification.

(a) To be authorized to certify Complete EHRs under the permanent certification program, an ONC-ACB must be capable of certifying Complete EHRs to all applicable certification criteria adopted by the Secretary at subpart C of this part.

(b) An ONC-ACB that has been authorized to certify Complete EHRs is also authorized to certify all EHR Modules under the permanent certification program.

§ 170.550

EHR module certification.

(a) When certifying EHR Modules, an ONC-ACB must certify in accordance with the applicable certification criterion or certification criteria adopted by the Secretary at subpart C of this part.

(b) EHR Modules are required to be certified to at least one certification criterion.

(c) Privacy and security certification. EHR Modules shall be certified to all privacy and security certification criteria adopted by the Secretary unless the EHR Module(s) is/are presented for certification in one of the following manners:

(1) The EHR Module(s) are presented for certification as a pre-coordinated, integrated “bundle” of EHR Modules, which could otherwise constitute a Complete EHR. In such instances, the EHR Module(s) shall be certified in the same manner as a Complete EHR. Pre-coordinated bundles of EHR Module(s) which include EHR Module(s) that would not be part of a local system and under the end user's direct control are excluded from this exception. The constituent EHR Modules of such an integrated bundle must be separately certified to all privacy and security certification criteria.

(2) An EHR Module is presented for certification, and the presenter can demonstrate to the ONC-ACB that it would be technically infeasible for the EHR Module to be certified in accordance with some or all of the privacy and security certification criteria; or

(3) An EHR Module is presented for certification, and the presenter can demonstrate to the ONC-ACB that the EHR Module is designed to perform a specific privacy and security capability. In such instances, the EHR Module may only be certified in accordance with the applicable privacy and security certification criterion/criteria.

(d) ONC-ACBs authorized to certify EHR Modules must clearly indicate the certification criterion or certification criteria to which an EHR Module has been certified in its certification documentation.

§ 170.553

Certification for health information technology other than complete EHRs and EHR modules.

An ONC-ACB authorized to certify health information technology other than Complete EHRs and/or EHR Modules must certify such health information technology in accordance with the applicable certification criterion or certification criteria adopted by the Secretary at subpart C of this part.

§ 170.555

Certification to newer versions of certain standards.

(a) ONC-ACBs may test and certify Complete EHRs and EHR Modules to a newer version of certain identified minimum standards specified at subpart B of this part if the Secretary has accepted a newer version of an adopted minimum standard.

(b) Applicability of an accepted new version of an adopted minimum standard.

(1) ONC-ACBs are not required to test and certify Complete EHRs and/or EHR Modules according to newer versions of an adopted minimum standard accepted by the Secretary until the incorporation by reference provision of the adopted version is updated in the Federal Register with a newer version.

(2) Certified EHR Technology may be upgraded to comply with newer versions of an adopted minimum standard accepted by the Secretary without adversely affecting the certification status of the Certified EHR Technology.

§ 170.557

Authorized certification methods.

(a) Primary method. An ONC-ACB must have the capacity to certify Complete EHRs and/or EHR Modules at their facility.

(b) Secondary methods. An ONC-ACB must also have the capacity to certify Complete EHRs and/or EHR Modules through one of the following methods:

(1) At the site where the Complete EHR or EHR Module has been developed; or

(2) At the site where the Complete EHR or EHR Module resides; or

(3) Remotely (i.e., through other means, such as through secure electronic transmissions and automated Web-based tools, or at a location other than the ONC-ACB's facilities).

§ 170.560

Good standing as an ONC-ACB.

An ONC-ACB must maintain good standing by:

(a) Adhering to the Principles of Proper Conduct for ONC-ACBs;

(b) Refraining from engaging in other types of inappropriate behavior, including an ONC-ACB misrepresenting the scope of its authorization as well as an ONC-ACB testing and certifying Complete EHRs and/or EHR Modules for which it does not have authorization; and

(c) Following all other applicable Federal and State laws.

§ 170.565

Revocation of authorized certification body status.

(a) Type-1 violations. The National Coordinator may revoke an ONC-ACB's status for committing a Type-1 violation. Type-1 violations include violations of law or permanent certification program policies that threaten or significantly undermine the integrity of the permanent certification program. These violations include, but are not limited to: False, fraudulent, or abusive activities that affect the permanent certification program, a program administered by HHS or any program administered by the Federal government.

(b) Type-2 violations. The National Coordinator may revoke an ONC-ACB's status for failing to timely or adequately correct a Type-2 violation. Type-2 violations comprise noncompliance with § 170.560.

(1) Noncompliance notification. If the National Coordinator obtains reliable evidence that an ONC-ACB may no longer be in compliance with § 170.560, the National Coordinator will issue a noncompliance notification with reasons for the notification to the ONC-ACB requesting that the ONC-ACB respond to the alleged violation and correct the violation, if applicable.

(2) Opportunity to become compliant. After receipt of a noncompliance notification, an ONC-ACB is permitted to 30 days to submit a written response and accompanying documentation that demonstrates that no violation occurred or that the alleged violation has been corrected.

(i) If the ONC-ACB submits a response, the National Coordinator is permitted up to 30 days from the time the response is received to evaluate the response and reach a decision. The National Coordinator may, if necessary, request additional information from the ONC-ACB during this time period.

(ii) If the National Coordinator determines that no violation occurred or that the violation has been sufficiently corrected, the National Coordinator will issue a memo to the ONC-ACB confirming this determination.

(iii) If the National Coordinator determines that the ONC-ACB failed to demonstrate that no violation occurred or to correct the area(s) of non-compliance identified under paragraph (b)(1) of this section within 30 days of receipt of the noncompliance notification, then the National Coordinator may propose to revoke the ONC-ACB's status.

(c) Proposed revocation.

(1) The National Coordinator may propose to revoke an ONC-ACB's status if the ONC-ACB has committed a Type-1 violation; or

(2) The National Coordinator may propose to revoke an ONC-ACB's status if, after the ONC-ACB has been notified of a Type-2 violation, the ONC-ACB fails to:

(i) To rebut the finding of a violation with sufficient evidence showing that the violation did not occur or that the violation has been corrected; or

(ii) Submit to the National Coordinator a written response to the noncompliance notification within the specified timeframe under paragraph (b)(2).

(3) ONC-ACB's operations. An ONC-ACB may continue its operations under the permanent certification program during the time periods provided for an ONC-ACB to respond to a proposed revocation notice and the National Coordinator to review an ONC-ACB's response to a proposed revocation.

(d) Opportunity to respond to a proposed revocation notice.

(1) An ONC-ACB may respond to a proposed revocation notice, but must do so within 10 days of receiving the proposed revocation notice and include appropriate documentation explaining in writing why its status should not be revoked.

(2) Upon receipt of an ONC-ACB's response to a proposed revocation notice, the National Coordinator is permitted up to 30 days to review the information submitted by the ONC-ACB and reach a decision.

(e) Good standing determination. If the National Coordinator determines that an ONC-ACB's status should not be revoked, the National Coordinator will notify the ONC-ACB's authorized representative in writing of this determination.

(f) Revocation.

(1) The National Coordinator may revoke an ONC-ACB's status if:

(i) A determination is made that revocation is appropriate after considering the information provided by the ONC-ACB in response to the proposed revocation notice; or

(ii) The ONC-ACB does not respond to a proposed revocation notice within the specified timeframe in paragraph (d)(1) of this section.

(2) A decision to revoke an ONC-ACB's status is final and not subject to further review unless the National Coordinator chooses to reconsider the revocation.

(g) Extent and duration of revocation.

(1) The revocation of an ONC-ACB is effective as soon as the ONC-ACB receives the revocation notice.

(2) A certification body that has had its ONC-ACB status revoked is prohibited from accepting new requests for certification and must cease its current certification operations under the permanent certification program.

(3) A certification body that has had its ONC-ACB has its status revoked for a Type-1 violation, is not permitted to reapply for ONC-ACB status under the permanent certification program for a period of 1 year.

(4) The failure of a certification body that has had its ONC-ACB status revoked to promptly refund any and all fees for certifications of Complete EHRs and EHR Modules not completed will be considered a violation of the Principles of Proper Conduct for ONC-ACBs and will be taken into account by the National Coordinator if the certification body reapplies for ONC-ACB status under the permanent certification program.

§ 170.570

Effect of revocation on the certifications issued to complete EHRs and EHR modules.

(a) The certified status of Complete EHRs and/or EHR Modules certified by an ONC-ACB that had it status revoked will remain intact unless a Type-1 violation was committed that calls into question the legitimacy of the certifications issued by the former ONC-ACB.

(b) If the National Coordinator determines that a Type-1 violation occurred that called into question the legitimacy of certifications conducted by the former ONC-ACB, then the National Coordinator would:

(1) Review the facts surrounding the revocation of the ONC-ACB's status; and

(2) Publish a notice on ONC's Web site if the National Coordinator believes that Complete EHRs and/or EHR Modules were improperly certified by the former ONC-ACB.

(c) If the National Coordinator determines that Complete EHRs and/or EHR Modules were improperly certified, the certification status of affected Complete EHRs and/or EHR Modules would only remain intact for 120 days after the National Coordinator publishes the notice. The certification status of the Complete EHR and/or EHR Module can only be maintained thereafter by being re-certified by an ONC-ACB in good standing.

Kathleen Sebelius,

Secretary.

Footnotes

1.  See http://www.epa.gov/​watersense/​partners/​certification.html.

2.  “What is the NVLAP” http://ts.nist.gov/​Standards/​upload/​What-is-the-NVLAP.pdf.

3.  DesRoches, CM et al. Electronic Health Records in Ambulatory Care—A National Survey of Physicians New England Journal of Medicine July 2008; 359:50-60.

4.  Jha, AK et al. Use of Electronic Health Records in U.S. Hospitals. New England Journal of Medicine March 2009; 360:1628-38.

5.  http://sba.gov/​idc/​groups/​public/​documents/​sba_​homepage/​serv_​sstd_​tablepdf.pdf.

6.  See 13 CFR 121.201.

7.  The SBA references that annual receipts means “total income” (or in the case of a sole proprietorship, “gross income”) plus “cost of goods sold” as these terms are defined and reported on Internal Revenue Service tax return forms. http://www.sba.gov/​idc/​groups/​public/​documents/​sba_​homepage/​guide_​to_​size_​standards.pdf.