Meaningful Use and EHR Certification
AHIMA Meaningful Use White Paper Series
Paper no. 4
This paper reviews the final rule on EHR standards and certification, which establishes the criteria for products used in the meaningful use incentive program.
Providers and hospitals that wish to participate in the meaningful use incentive program must use EHR technology that meets federal certification requirements. Commonly referred to as certification criteria or certification standards, these requirements were officially published July 28, 2010, and become effective August 27, 2010. With the publication of the criteria, healthcare providers and vendors can begin to assess and align their systems accordingly.
The Office of the National Coordinator for Health Information Technology (ONC) initially released the criteria January 13 in an interim final rule titled “Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology.” Given how closely the criteria are integrated with the meaningful use program, the final rule was published concurrently with the meaningful use final rule, which was issued by the Centers for Medicare and Medicaid Services.
The final rule describes the set of standards, implementation specifications, and certification criteria only. ONC released a separate rule establishing a temporary certification program for the purposes of testing and certifying health IT, including the requirements for organizations wishing to become certifying bodies. The federal government establishes the certification criteria, but it will not engage in certifying products.
ONC began accepting applications from organizations seeking to become ONC-Authorized Testing and Certification Bodies (or ONC-ATCBs) soon after publishing a final rule on a temporary certification program in late June. On August 30 it announced the first two ATCBs, the Certification Commission for Health Information Technology and the Drummond Group. At that time, ONC reported it was reviewing additional applications.
The meaningful use program recognizes that organizations are at widely varying levels of IT sophistication and that today’s health IT products offer varying levels of functionality. For this reason, the requirements for meaningful use will progress over time in three stages. The EHR certification criteria will increase according to the requirements defined in the meaningful use stages. It is expected that future certification criteria will be modified and expanded through federal health IT committees and regulatory activity.
Background and Section-by-Section Discussion
The final rule begins with a brief preamble describing the legislative and regulatory history of the certification criteria and the interdependencies with other regulatory requirements.
ONC then undertakes a section-by-section review of the applicable standards, implementation specifications, and certification criteria that must be used to test and certify under the final rule. It begins by providing several definitions and how the interpretation was derived (p. 44593-98):
Standard: “A technical, functional, or performance-based rule, condition, requirement, or specification that stipulates instructions, fields, codes, data, materials, characteristics, or actions.” (Unchanged from the proposed rule.)
Implementation Specification: “Specific requirements or instructions for implementing a standard.” This is the same definition used in HIPAA. (Unchanged from the proposed rule.)
Certification Criteria: “Criteria: (1) To establish that health information technology meets applicable standards and implementation specifications adopted by the Secretary; or (2) that are used to test and certify that health information technology includes required capabilities.” (Unchanged from the proposed rule.)
Qualified Electronic Health Record: “An electronic record of health-related information on an individual that: (A) Includes patient demographic and clinical health information, such as medical history and problem lists; and (B) has the capacity: (i) To provide clinical decision support; (ii) to support physician order entry; (iii) to capture and query information relevant to health care quality; and (iv) to exchange electronic health information with, and integrate such information from other sources.” This is the statutory definition from HITECH. (Unchanged from the proposed rule.)
Complete EHR: “EHR technology that has been developed to meet, at a minimum, all applicable certification criteria adopted by the Secretary.” (Slight modification from the proposed rule.)
ONC intends that this modified definition will create a clear distinction between a “Complete EHR,” an “EHR Module,” and “Certified EHR Technology.” The definition not only provides such distinction as was defined within the interim final rule, but it could be used in future rules by CMS, ONC, and the Office for Civil Rights to define when an organization has a complete EHR that then causes it to be subject to other rules.
Certified EHR Technology: “(1) A Complete EHR that meets the requirements included in the definition of a Qualified EHR and has been tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary; or (2) A combination of EHR Modules in which each constituent EHR Module of the combination has been tested and certified in accordance with the certification program established by the National Coordinator as having met all applicable certification criteria adopted by the Secretary, and the resultant combination also meets the requirements included in the definition of a Qualified EHR.” (Clarification and rewording added within the final rule.)
In its proposed rule ONC described how different types of health IT might apply to different settings. It addresses the changes that will be forthcoming in alternative EHR products and the flexibility it hopes to permit under these definitions. Further, ONC acknowledged that some providers will seek products that provide capabilities beyond those necessary for the meaningful use program. ONC also described the potential for a system of modules to qualify as certified EHR technology (as opposed to one complete system).
Disclosure: “The release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.” This definition, taken from HIPAA, was needed so that the criteria could also be adopted by the HHS secretary to facilitate a rule on accounting of disclosures.
Initial Set of Standards, Implementation Specifications, and Certification Criteria
The standards, specifications, and criteria represent the initial set adopted by the HHS secretary to support stage 1 of meaningful use. They serve as the basis for EHR testing and certification.
ONC emphasizes that the criteria do not establish requirements for healthcare providers; that is, these are technical specifications, not user specifications. Presumably the meaningful use criteria serve as the latter. ONC clarifies some methods described in the interim final rule intended to add flexibility into the program: alternative standards; minimum code set standards; optional standards, implementation specifications, and certification criteria; and standards and backwards compatibility.
The certification criteria matched to the meaningful use stage 1 criteria appear in slices throughout the discussion, highlighting changes between the interim and final rules.
The standards are organized into four categories: vocabulary, content exchange, transport, and privacy and security. ONC indicates that alternative standards have been chosen for certain purposes with regard to interoperability, and vocabulary standards have been limited initially.
AHIMA offers a comprehensive matrix that maps the certification criteria and meaningful use objectives against the content exchange standards, implementation specifications, and vocabulary standards. This is a member resource, and log in is required.
ONC reviews the standards individually as they relate to each meaningful use stage 1 object and corresponding measure with discussion of their rationale for final determination, thus presenting a “conceptual restructuring” of the information presented (p. 44600-43). ONC also provides a comparison of the interim final rule text and the final rule text so the reader can understand immediately what modifications were made in the final rule.
Eight criteria were presented in the final rule that addressed areas such as authentication, encryption, access control, and automated log-off. The criterion that became optional was the recording of disclosures made for treatment, payment, and operations. ONC believed that this capability should not be a condition of certification, thus making this criterion an optional condition; however, the wording remains unchanged from the interim final rule publication.
Accounting of Disclosures
HITECH modifies the HIPAA accounting of disclosures regulation to require covered entities that use EHRs to begin accounting for disclosures made for purposes of treatment, payment, and operations. The statute directs HHS to adopt a standard and certification criteria that enable that accounting and then within six months issue regulations that specify the information that must be included in the accounting.
Within the proposed rule ONC put forth a “basic” set of criteria to cover date, time, patient identification (name or number), user identification (name or number), and a description of the disclosure. ONC believes this set will meet the HHS secretary’s needs and should be available in an electronic system.
The Office for Civil Rights is charged with writing the regulation on the accounting of disclosure modification. In May OCR published a request for information seeking industry input, but to date it has not released any rulemaking.
Within the certification final rule ONC defines the recording of disclosures as an optional certification criterion. The office anticipates updating this criterion and the related standard in a future rulemaking to reflect OCR’s final policies.
Regulatory Impact Analysis
The final rule includes a regulatory impact analysis, which includes the estimated cost for previously certified EHRs and then applies this estimate to potential costs and benefits (pp. 44644-49). ONC acknowledges a number of necessarily broad estimates in its calculations.
The regulation begins on page 44649.
|. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .|
|The White Paper Series|
|1. Overview of the Meaningful Use Final Rule||5b. Measures Reporting for Eligible Hospitals|
|2. Meaningful Use—Provider Requirements||6a. Clinical Quality Measures for Providers|
|3. Meaningful Use—Payments and Requirements||6b. Clinical Quality Measures for Hospitals|
|4. Meaningful Use and EHR Certification||7. Qualifying for Meaningful Use|
|5a. Measures Reporting for Eligible Providers||8. Preparing for Meaningful Use|