2010-25683. Health Information Technology: Revisions to Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology

AGENCY:

Office of the National Coordinator for Health Information Technology (ONC), Department of Health and Human Services.

ACTION:

Interim final rule with request for comments.

SUMMARY:

The Department of Health and Human Services (HHS) is issuing this interim final rule with a request for comment to remove the implementation specifications related to public health surveillance.

DATES:

Effective Date: This interim final rule is effective October 13, 2010.

Comment Date: To be assured consideration, written or electronic comments must be received at one of the addresses provided below, no later than 5 p.m. on November 12, 2010.

ADDRESSES:

Because of staff and resource limitations, we cannot accept comments by facsimile (FAX) transmission. You may submit comments, identified by RIN 0991-AB76, by any of the following methods (please do not submit duplicate comments).

• Federal eRulemaking Portal: Follow the instructions for submitting comments. Attachments should be in Microsoft Word, WordPerfect, or Excel; however, we prefer Microsoft Word. http://www.regulations.gov.
• Regular, Express, or Overnight Mail: Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, Attention: Steven Posnack, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201. Please submit one original and two copies.
• Hand Delivery or Courier: Office of the National Coordinator for Health Information Technology, Attention: Steven Posnack, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201. Please submit one original and two copies. (Because access to the interior of the Hubert H. Humphrey Building is not readily available to persons without federal government identification, commenters are encouraged to leave their comments in the mail drop slots located in the main lobby of the building.)

Inspection of Public Comments: All comments received before the close of the comment period will be available for public inspection, including any personally identifiable or confidential business information that is included in a comment. Please do not include anything in your comment submission that you do not wish to share with the general public. Such information includes, but is not limited to: A person's social security number; date of birth; driver's license number; state identification number or foreign country equivalent; passport number; financial account number; credit or debit card number; any personal health information; or any business information that could be considered to be proprietary. We will post all comments received before the close of the comment period at http://www.regulations.gov.

Docket: For access to the docket to read background documents or comments received, go to http://www.regulations.gov or U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201 (call ahead to the contact listed below to arrange for inspection).

FOR FURTHER INFORMATION CONTACT:

Steven Posnack, Director, Federal Policy Division, Office of Policy and Planning, Office of the National Coordinator for Health Information Technology, 202-690-7151.

SUPPLEMENTARY INFORMATION:

Acronyms

ARRA American Recovery and Reinvestment Act of 2009

CDC Centers for Disease Control and Prevention

CFR Code of Federal Regulations

EHR Electronic Health Record

HHS Department of Health and Human Services

HIT Health Information Technology

HITECH Health Information Technology for Economic and Clinical Health

HL7 Health Level Seven

NAICS North American Industry Classification System

OMB Office of Management and Budget

ONC Office of the National Coordinator for Health Information Technology

ONC-ATCB ONC-Authorized Testing and Certification Body

PHSA Public Health Service Act

RFA Regulatory Flexibility Act

RIA Regulatory Impact Analysis

UMRA Unfunded Mandates Reform Act of 1995

Table of Contents

I. Background

A. Legislative History

B. Regulatory History

1. Initial Set of Standards, Implementation Specifications, and Certification Criteria for EHR Technology; Interim Final Rule

2. Initial Set of Standards, Implementation Specifications, and Certification Criteria for EHR Technology; Final Rule

3. Proposed Establishment of Certification Programs for Health Information Technology; Proposed Rule

4. Temporary Certification Program; Final Rule

II. Discussion of the Interim Final Rule

A. Public Health Surveillance Implementation Specifications

B. Waiver of Proposed Rulemaking and Delay in Effective Date

III. Response to Comments

IV. Collection of Information Requirements

V. Regulatory Impact Statement

Regulation Text

I. Background

A. Legislative History

The Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5), was enacted on February 17, 2009. The HITECH Act amended the Public Health Service Act (PHSA) and established “Title XXX—Health Information Technology and Quality” to improve health care quality, safety, and efficiency through the promotion of health information technology (HIT) and the electronic exchange of health information. Section 3004 of the PHSA, as added by the HITECH Act, authorizes the Secretary of Health and Human Services (the Secretary) to adopt standards, implementation specifications, and certification criteria to enhance the interoperability, functionality, utility, and security of health information technology. Section 3004(b)(1) of the PHSA more specifically directs the Secretary to adopt an initial set of standards, implementation specifications, and certification criteria, and permits their adoption through an interim final rule.

B. Regulatory History

1. Initial Set of Standards, Implementation Specifications, and Certification Criteria for EHR Technology; Interim Final Rule

On January 13, 2010, HHS published in the Federal Register an interim final rule with a request for comment, which adopted an initial set of standards, implementation specifications, and certification criteria (75 FR 2014). The certification criteria adopted in that interim final rule established the required capabilities and specified the related standards and implementation specifications that certified electronic health record (EHR) technology would need to include to, at a minimum, support the achievement of meaningful use Stage 1 as proposed by CMS for eligible professionals and eligible hospitals under the Medicare and Medicaid EHR Incentive Programs. (For consistency with subsequent regulatory changes, hereafter, references to “eligible hospitals” shall mean “eligible hospitals and/or critical access hospitals”.)

2. Initial Set of Standards, Implementation Specifications, and Certification Criteria for EHR Technology; Final Rule

On July 28, 2010, HHS published in the Federal Register a final rule (75 FR 44590) to complete the Secretary's adoption of the initial set of standards, implementation specifications, and certification criteria, and to more closely align such standards, implementation specifications, and certification criteria with final meaningful use Stage 1 objectives and measures (the “Standards and Certification Criteria Final Rule”). The certification criteria adopted in that final rule establish the required capabilities and specify the related standards and implementation specifications that certified EHR technology will need to include to, at a minimum, support the achievement of meaningful use Stage 1 by eligible professionals and eligible hospitals under the Medicare and Medicaid EHR Incentive Programs. Complete EHRs and EHR Modules will be tested and certified according to adopted certification criteria to ensure that they have properly implemented adopted standards and implementation specifications and otherwise comply with the adopted certification criteria.

3. Proposed Establishment of Certification Programs for Health Information Technology; Proposed Rule

On March 10, 2010, under the authority granted to the National Coordinator for Health Information Technology (the National Coordinator) by section 3001(c)(5) of the PHSA as added by the HITECH Act, HHS published in the Federal Register (75 FR 11328) a rule proposing the establishment of two certification programs for purposes of testing and certifying health information technology. The first proposal would establish a temporary certification program whereby the National Coordinator would authorize organizations to test and certify Complete EHRs and/or EHR Modules. The second proposal would establish a permanent certification program to replace the temporary certification program. The permanent certification program included proposals that would separate the responsibilities for performing testing and certification, introduce accreditation requirements, establish requirements for certification bodies authorized by the National Coordinator related to the surveillance of Certified EHR Technology, and would include the potential for certification bodies authorized by the National Coordinator to certify other types of health information technology besides Complete EHRs and EHR Modules.

4. Temporary Certification Program; Final Rule

On June 24, 2010, HHS published in the Federal Register a final rule (75 FR 36158) establishing the temporary certification program for HIT (Temporary Certification Program). The Temporary Certification Program, established under the authority granted to the National Coordinator by section 3001(c)(5) of the PHSA, sets forth the process the National Coordinator will utilize to authorize organizations (ONC-Authorized Testing and Certification Bodies (ONC-ATCBs)) to test and certify Complete EHRs and/or EHR Modules to the certification criteria adopted by the Secretary in the Standards and Certification Criteria Final Rule. Once tested and certified, a Complete EHR or a combination of EHR Modules can be adopted by an eligible professional or eligible hospital to meet the definition of Certified EHR Technology as specified at 45 CFR 170.102 and used to help qualify for incentive payments under the Medicare and Medicaid EHR Incentive Programs.

II. Discussion of the Interim Final Rule

A. Public Health Surveillance Implementation Specifications

In the Standards and Certification Criteria Final Rule, we adopted two content exchange standards for electronic submission to public health agencies for surveillance and reporting, Health Level Seven (HL7) versions 2.3.1 and 2.5.1. (45 CFR 170.205(d)) Additionally, in response to public comment on the interim final rule published January, 2010, we adopted in the Standards and Certification Criteria Final Rule the following implementation specifications for HL7 2.5.1: Public Health Information Network HL7 Version 2.5 Message Structure Specification for National Condition Reporting Final Version 1.0 and the Errata and Clarifications National Notification Message Structural Specification. (45 CFR 170.205(d)(2)) We did not, however, adopt at that time implementation specifications for HL7 2.3.1.

Since the publication of the Standards and Certification Criteria Final Rule, various stakeholders and state public health agencies have made numerous inquiries and expressed concerns about the appropriateness of these implementation specifications. Some stakeholder representatives indicated that they thought these implementation specifications may have been adopted in error. They noted that these implementation specifications do not appear to be appropriate for implementing the adopted standard, HL7 2.5.1 for public health surveillance (syndromic surveillance) purposes.

After further review of the implementation specifications and consultation with the Centers for Disease Control and Prevention (CDC), we have determined that these implementation specifications were adopted in error. The adopted implementation specifications provide direction to public health agencies on the structure and methodology for using HL7 2.5.1 to report “Nationally Notifiable Conditions” to CDC and do not provide additional clarity for how EHR technology would need to be designed to implement the adopted standard (HL7 2.5.1) or enable compliance with the capability identified in the certification criterion adopted at 45 CFR 170.302(l). Therefore, their adoption neither provides the appropriate or requisite implementation capability for the adopted standard, HL7 2.5.1, nor, more importantly, would enable the user to “electronically record, modify, retrieve, and submit syndrome-based public health surveillance information * * *,” as required by the adopted certification criterion, 45 CFR 170.302(l).

We have also heard from ONC-ATCBs as well as EHR technology developers that the erroneous adoption of these implementation specifications creates significant ambiguity and concern regarding whether these implementation specifications must be used for testing and certification. They correctly point out that because these implementation specifications are inappropriate for the adopted standard and would likely frustrate achieving the capability specified in the adopted certification criterion at 45 CFR 170.302(l), testing and certifying in accordance with them would be wasteful and unproductive. We understand further that while the erroneously adopted implementation specifications could be used to specify the structure and methodology for using HL7 2.5.1, their purpose is to facilitate the electronic exchange of de-identified Nationally Notifiable Conditions for notifiable disease reporting, which would not fulfill the fundamental requirements of syndromic surveillance. In contrast to notifiable disease reporting, where only data on patients with a notifiable disease diagnosis is sent to a public health agency, syndromic surveillance requires data from all patients that were seen in a health care setting. Moreover, syndromic surveillance requires data elements that the adopted implementation specifications do not address including: A patient's chief complaint; date/time of visit; severity of illness (e.g., patient's disposition status), specific indicators (e.g., pulse oximetry, measured temperature), and age.

The adoption of these implementation specifications also presents an unnecessary obstacle for EHR technology developers, who are currently faced with the dilemma of implementing HL7 2.3.1 (even though their customers may need HL7 2.5.1 to report to their state public health agency), or alternatively, HL7 2.5.1 according to the inappropriate implementation specifications, or unnecessarily to both standards, in order to seek certification. We believe that each of these alternatives places an unnecessary and unwarranted burden on EHR technology developers.

For all of these reasons, we are revising 45 CFR 170.205(d)(2) to remove these particular adopted implementation specifications. We are also removing from 45 CFR 170.302(l) the text “(and applicable implementation specifications)” to provide additional clarity and to remove the unnecessary and unwarranted burden on ONC-ATCBs and perhaps ONC-ACBs. In addition, we are removing the reference to the implementation specifications in 45 CFR 170.299(g) where it is incorporated by reference.

B. Waiver of Proposed Rulemaking and Delay in Effective Date

We ordinarily publish a notice of proposed rulemaking in the Federal Register to provide a period for public comment before the provisions of the rule take effect in accordance with section 553(b) of the Administrative Procedure Act (APA) (5 U.S.C.553(b)). We also ordinarily provide a 30-day delay in the effective date of the provisions of a rule in accordance with section 553(d) of the APA (5 U.S.C. 553(d)). However, we can waive both the notice and comment procedure and the 30-day delay in effective date if the Secretary finds for good cause that a notice and comment procedure and a 30-day delay are impracticable, unnecessary, or contrary to the public interest, and incorporates a statement of the finding and the reasons in the final notice or rule that is issued.

In this case, we find that notice and comment rulemaking is contrary to the public interest because it would unnecessarily delay the implementation of a complex statutory scheme and prevent the realization of certain legislative goals within the statutory timeframe. Under the HITECH Act, ONC and CMS promulgated several rules that establish a regulatory framework through which eligible professionals and eligible hospitals may seek to qualify for certain Medicare and Medicaid programs incentive payments. The Medicare and Medicaid EHR Incentive Programs final rule established the initial criteria eligible professionals and eligible hospitals must meet in order to qualify for an incentive payment, along with other program participation requirements. The HIT Standards and Certification Criteria interim final and final rules provided for the adoption of an initial set of standards, implementation, specifications, and certification criteria for electronic health record technology. In a separate final rule, ONC established a temporary certification program that allows Complete EHRs and EHR Modules to be tested and certified to the adopted certification criteria.

In this regulatory framework, private organizations are provided the opportunity to apply to the National Coordinator for authorization as an ONC-Authorized Testing and Certification Body (ONC-ATCB). Once an organization is granted ONC-ATCB status and obtains authorization from the National Coordinator to test and certify Complete EHRs and/or EHR Modules, it will be subject, depending on the scope of its authorization, to the requirements specified at 45 CFR 170.445 (Complete EHR testing and certification) and/or 45 CFR 170.450 (EHR Module testing and certification). These provisions require ONC-ATCBs to test and certify Complete EHRs and/or EHR Modules to all applicable certification criteria adopted by the Secretary at subpart C of part 170. Consequently, an ONC-ATCB's failure to adhere to the testing and certification requirements of 170.445 and/or 170.450 could subject that ONC-ATCB to adverse action by the National Coordinator in accordance with 45 CFR 170.465 (Revocation of authorized testing and certification body status). Because ONC-ATCBs are required to test and certify Complete EHRs and/or EHR Modules in accordance with all applicable certification criteria, including 45 CFR 170.302(l), and 45 CFR 170.302(l) requires that a Complete EHR or EHR Module would need to perform the specified capabilities in accordance with, in certain scenarios, the erroneously adopted implementation specification, the Complete EHR or EHR Module certified in accordance with those provisions would not be capable of fulfilling the fundamental requirements of syndromic surveillance, as explained above. Consequently, a Complete EHR or EHR Module that was developed in accordance with HL7 Version 2.5.1 and would otherwise meet all other applicable certification criteria could not be successfully certified until the removal of the implementation specifications adopted in error. We therefore believe that if left unchanged the erroneous adoption of these implementation specifications would significantly and adversely impact the ability of ONC-ATCBs from issuing, and EHR technology developers from receiving, certifications in a timely manner.

For all of the reasons stated, we believe that a notice and comment period would be contrary to the public interest. We therefore find good cause for waiving the notice and comment period for the removal of the erroneously adopted implementation specifications.

We also believe that a 30-day delay in the effective date is contrary to the public interest for the reasons stated above and because this interim final rule with comment would alleviate an unnecessary burden on the health IT industry and impose no additional legal requirements upon the regulated community. We therefore find good cause for waiving the 30-day delay in the effective date for the removal of the relevant implementation specifications. We note, however, that we are providing the public with a 30-day period following publication of this interim final rule to submit comments.

III. Response to Comments

Because of the number of public comments we normally receive on Federal Register documents, we are not able to acknowledge or respond to them individually. We will consider all comments we receive by the date and time specified in the DATES section of this preamble, and, when we proceed with a subsequent document, we will respond to the comments in the preamble to that document.

IV. Collection of Information Requirements

This document does not impose information collection and recordkeeping requirements. Consequently, it need not be reviewed by the Office of Management and Budget under the authority of the Paperwork Reduction Act of 1995 (44 U.S.C. 35).

V. Regulatory Impact Statement

We have examined the impacts of this interim final rule with comment as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993, as further amended), the Regulatory Flexibility Act (RFA) (5 U.S.C. 601 et seq.), section 202 of the Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1532) (UMRA), Executive Order 13132 on Federalism (August 4, 1999), and the Congressional Review Act (5 U.S.C. 804(2)).

Executive Order 12866 (as amended by Executive Orders 13258 and 13422) directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). This interim final rule with comment does not reach the economic threshold and, thus, is not considered a major rule. Therefore, an RIA has not been prepared.

The RFA requires agencies to analyze options for regulatory relief of small businesses. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. Individuals and States are not included in the definition of a small entity. The entities impacted by this interim final rule most likely fall under the North American Industry Classification System (NAICS) code 541511 “Custom Computer Programming Services” specified at 13 CFR 121.201 where the SBA publishes “Small Business-Size Standards by NAICS Industry.” The size standard associated with this NAICS code is set at $25 million in annual receipts which “indicates the maximum allowed for a concern and its affiliates to be considered small entities.” We are not preparing an analysis for the RFA because we have determined, and the Secretary certifies, that this interim final rule with comment imposes no new requirements on small entities and, as such, will not have a significant impact on a substantial number of small entities.

Section 202 of the Unfunded Mandates Reform Act of 1995 requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2010, that threshold level is currently approximately $135 million. This interim final rule with comment will not impose an unfunded mandate on States, tribal government or the private sector of more than $135 million annually.

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has Federalism implications. Since this interim final rule with comment does not impose any costs on State or local governments, the requirements of Executive Order 13132 are not applicable.

In accordance with the provisions of Executive Order 12866, this interim final rule with comment was reviewed by the Office of Management and Budget.

List of Subjects in 45 CFR Part 170

• Computer technology
• Electronic health record
• Electronic information system
• Electronic transactions
• Health
• Health care
• Health information technology
• Health insurance
• Health records
• Hospitals
• Incorporation by reference
• Laboratories
• Medicaid
• Medicare
• Privacy
• Reporting and recordkeeping requirements
• Public health
• Security

For the reasons set forth in the preamble, 45 CFR subtitle A, subchapter D, part 170, is amended as follows:

PART 170—HEALTH INFORMATION TECHNOLOGY STANDARDS IMPLEMENTATION SPECIFICATIONS, AND CERTIFICATION CRITERIA AND CERTIFICATION PROGRAMS FOR HEALTH INFORMATION TECHNOLOGY

1. The authority citation for part 170 continues to read as follows:

Authority: 42 U.S.C. 300jj-11; 42 U.S.C. 300jj-14; 5 U.S.C. 552.

2. Section 170.205 is amended by revising paragraph (d)(2) to read as follows:

§ 170.205

Content exchange standards and implementation specifications for exchanging electronic health information.

* * * * *

(d) * * *

(2) Standard. HL7 2.5.1 (incorporated by reference in § 170.299).

* * * * *

3. Section 170.299 is amended by revising paragraph (g) to read as follows:

§ 170.299

Incorporation by reference.

* * * * *

(g) Centers for Disease Control and Prevention, National Centers for Immunization and Respiratory Diseases Immunization Information System Support Branch—Informatics 1600 Clifton Road Mailstop: E-62 Atlanta, GA 30333.

(1) HL7 Standard Code Set CVX—Vaccines Administered, July 30, 2009, IBR approved for § 170.207.

(2) Implementation Guide for Immunization Data Transactions using Version 2.3.1 of the Health Level Seven (HL7) Standard Protocol Implementation Guide Version 2.2, June 2006, IBR approved for § 170.205.

(3) HL7 2.5.1 Implementation Guide for Immunization Messaging Release 1.0, May 1, 2010, IBR approved for § 170.205.

(4) [Reserved]

4. Section 170.302 is amended by revising paragraph (l) to read as follows:

§ 170.302

General certification criteria for Complete EHRs or EHR Modules.

* * * * *

(l) Public health surveillance. Electronically record, modify, retrieve, and submit syndrome-based public health surveillance information in accordance with the standard specified in § 170.205(d)(1) or § 170.205(d)(2).

* * * * *

Dated: October 6, 2010.

Kathleen Sebelius,

Secretary.