Health Care ADVISORY March 12, 2010 Certification Programs for Health Information Technology Are Here On March 10, 2010, the Office of the National Coordinator (ONC) published its Proposed Rule establishing certification programs for health information technology (HIT) in the Federal Register. 1 The Proposed Rule sets forth proposals for two certification programs for purposes of testing and certifying electronic health records (EHRs), and other HIT in the future. Accordingly, the Proposed Rule is directly related to the recently published Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology Interim Final Rule (the Interim Final Rule ) 2 and the Medicare and Medicaid Programs: Electronic Health Record Incentive Program Proposed Rule (the Meaningful Use Proposed Rule ). 3 ONC is first proposing a temporary certification program to provide for the certification of EHR technology before the fall of 2010, in connection with the Medicare and Medicaid Incentive Programs beginning in 2011. Although ONC proposes the temporary and permanent certification programs in the same rule, ONC makes clear that both programs will be finalized in separate rules. Comments to the temporary certification program will be accepted until April 9, 2010. Comments to the permanent certification program will be accepted until May 10, 2010. This advisory serves as an overview of both certification programs, as well as the key distinctions between the two. Temporary Certification Program What Is an ONC-Authorized Testing and Certification Body (ONC-ATCB)? Under the temporary certification program, an ONC-ATCB can be a single organization or a consortium of organizations that is accredited and certified by ONC to both test and certify Complete EHRs and/or EHR Modules. The Proposed Rule defines testing to mean the process used to determine the degree to which a Complete EHR or EHR Module can meet specific, predefined, measurable, quantitative requirements. 4 In addition, certification is defined as the assessment (and subsequent assertion) made by an organization, once it has analyzed the quantitative results rendered from testing along with other qualitative factors, that a Complete EHR or EHR Module has met all of the applicable certification criteria adopted by the Secretary. 5 1 2 3 4 5 75 Fed. Reg. 11328 (March 10, 2010). 75 Fed. Reg. 2014 (Jan. 13, 2010). 75 Fed. Reg. 1844 (Jan. 13, 2010). 75 Fed. Reg. at 11335 (March 10, 2010). Id. This advisory is published by Alston & Bird LLP to provide a summary of significant developments to our clients and friends. It is intended to be informational and does not constitute legal advice regarding any specific situation. This material may also be considered attorney advertising under court rules of certain jurisdictions.
How Can an Entity Become an ONC-ATCB? According to the Proposed Rule, ONC would serve as the accrediting body for ONC-ATCBs. To receive accreditation and authorization to serve as an ONC-ATCB, an entity must request an application via email from the agency. Under Part One of the application, an applicant would have to provide responses to a number of questions in order to demonstrate that its certification program complies with the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) Guide 65:1996 (Guide 65), and that its testing program complies with ISO/IEC 17025 (ISO 17025). In addition, the applicant would be required to execute an agreement that it would comply with the Principles of Proper Conduct for ONC-ATCBs established by ONC. Under Part Two of the application, an applicant would have to complete a proficiency examination to ensure it possesses an adequate level of knowledge and can properly test and certify Complete EHRs and/or EHR Modules. The National Coordinator would have 30 days to consider each application. The Proposed Rule sets forth a process by which ONC may request additional information or corrections from an applicant to Parts One and Two of the application. What Are the Responsibilities of an ONC-ATCB? An ONC-ATCB would be responsible for testing and certifying Complete EHRs and/or EHR Modules. For Complete EHRs, an ONC-ATCB would be required to test and certify that the Complete EHR meets all applicable certification criteria adopted by the Secretary. With respect to EHR Modules, ONC-ATCBs would only be required to test and certify EHR Modules in accordance with the applicable certification criterion or criteria adopted by the Secretary, and for which the ONC-ATCB has been authorized to test and certify. ONC-ATCBs would have to clearly identify the certification criterion for which an EHR Module has been certified, although it would not have to determine whether individual EHR Modules can seamlessly integrate 6 with other EHR Modules. ONC is requesting comments on whether ONC-ATCBs should be required to test the compatibility of EHR Modules and whether ONC-ATCBs should be allowed to test and certify Complete EHRs designed only for one type of setting (e.g., ambulatory or inpatient setting). In addition, the ONC-ATCB must test and certify Complete EHRs and/or EHR Modules to the privacy and security certification criteria that are adopted by the Secretary under the Interim Final Rule. However, ONC proposes three instances when an ONC-ATCB would not be required to test and certify an EHR Module to the privacy and security certification criteria: (i) when the EHR Modules are presented as an integrated bundle that would constitute a Complete EHR; (ii) when it would be technically infeasible to test and certify an EHR Module in accordance with some or all of the privacy and security certification criteria (e.g., an EHR Module that does not store or maintain any health information should not be required to encrypt health information at rest or include an audit log); and (iii) when an EHR Module is only designed to perform a particular privacy and security capability. 7 An ONC-ATCB must have the capacity to test and certify EHRs at its facility, as well as at a secondary location (e.g., at the site where the Complete EHR and/or EHR Module was developed, where it is to be installed or remotely). ONC- ATCBs must retain records related to the testing and certification of Complete EHRs and/or EHR Modules for the duration of the temporary certification program. How Long Would an Entity s Certification as an ONC-ATCB Remain Effective? The temporary certification program would not include a process for the re-certification of ONC-ATCBs, as the program is 6 7 Id. at 11337. Id. at 11342-11343. -2-
expected to end within approximately two years. However, an entity s accreditation as an ONC-ATCB could be revoked if it commits certain violations specified by ONC in the Proposed Rule. 8 When Would the Temporary Certification Program Sunset? The temporary certification program would sunset upon ONC s authorization of at least one certification body under the permanent certification program. ONC is requesting comments on whether a firm deadline for the end of the temporary certification program should be established as an alternative. Permanent Certification Program What Is an ONC-Authorized Certification Body (ONC-ACB)? Under the permanent certification program, an ONC-ACB can be a single organization or a consortium of organizations that is accredited by an ONC-Approved Accreditor (ONC-AA) and authorized by ONC to certify, at a minimum, Complete EHRs and/or EHR Modules. ONC notes that an entity may also be authorized to test Complete EHRs or EHR Modules if it is accredited to do so by the National Voluntary Laboratory Accreditation Program (NVLAP). ONC is requesting comments on whether a special dual accredited designation should be given to ONC-ACBs that are accredited by the NVLAP to test Complete EHRs and EHR Modules. How Can an Entity Become an ONC-AA? An entity that wishes to become an ONC-AA must submit an application to the National Coordinator that, among other things, includes a description of its (i) conformance to ISO/IEC 17011: 2004 (ISO 17011) 9 ; (ii) experience evaluating the conformance of certification bodies to Guide 65; (iii) accreditation requirements; and (iv) procedures for monitoring ONC- ACBs. ONC proposes to approve only one ONC-AA, and would review applicants on a first-come, first-served basis. ONC would approve the first applicant that satisfactorily demonstrates its ability to serve as an ONC-AA. This would ensure consistency among all ONC-ACBs as they would be accredited by the same entity. Finally, ONC proposes to award ONC-AA status to an entity for a period of three years. How Can an Entity Become an ONC-ACB? ONC proposes to adopt a similar application process for ONC-ACBs under the permanent certification program as that for ONC-ATCBs under the temporary certification program. The applicant would be required to submit a similar application, including information necessary to confirm the applicant has been accredited by an ONC-AA and a properly executed agreement that it would comply with the Principles of Proper Conduct for ONC-ACBs. Unlike the temporary certification program, an applicant under the permanent certification program would not have to complete a proficiency examination, as an ONC-AA would determine whether the ONC-ACB possesses an adequate level of knowledge to properly certify Complete EHRs and/or EHR Modules. 8 9 The ONC proposes to establish two classes of violations called Type-1 and Type-2 violations. Type-1 violations refer to false, fraudulent or abusive activities that affect the temporary certification program or another program administered by the Department of Health and Human Services, or any program administered by the federal government. Type-2 violations refer to an entity s failure to adhere to the Principles of Proper Conduct for ONC-ATCBs, which would be established by ONC. The Proposed Rule includes a detailed appeals process. See id. at 11344-11346. ISO 17011 specifies requirements for accreditation bodies that evaluate and accredit conformity assessment bodies. -3-
What Are the Responsibilities of an ONC-ACB? An ONC-ACB would be responsible for the certification of Complete EHRs and/or EHR Modules. In general, the responsibilities of an ONC-ACB are similar to those of an ONC-ATCB under the temporary certification program. The four major differences between the two programs are the following: 10 Removal of the Guide 65 and ISO 17025 Principles Guide 65 principles would no longer be included under the Principles of Proper Conduct for ONC-ACBs, as ONC-AAs would assume responsibility for ensuring an ONC-ACB meets these principles as part of the accreditation process. The ISO 17025 principles, which pertain to testing, would be removed, as the National Coordinator s authorization would only apply to certification under the permanent certification program. Testing by NVLAP-Accredited Testing Laboratories ONC-ACBs would only be allowed to certify Complete EHRs and/or EHR Modules that have been tested by an NVLAP-Accredited Testing Laboratory. The National Institute of Standards and Technology (NIST) through NVLAP would be responsible for accrediting testing laboratories under the permanent certification program. (This is in contrast to the temporary certification program where ONC-ATCBs would be responsible for both the testing and certification of Complete EHRs and EHR Modules.) Record Retention While ONC-ATCBs would only have to retain records for the duration of the temporary certification program, ONC-ACBs would be required to retain these records for a minimum of five years. Surveillance of Previously-Certified Complete EHRs and/or EHR Modules Both the temporary and permanent certification programs include requirements for the surveillance of certified Complete EHRs and EHR Modules to ensure they continue to meet the appropriate certification criteria. As the temporary certification program would only last for approximately two years, ONC proposes to place less weight on the surveillance requirements for ONC-ATCBs. However, under the permanent certification program, ONC-ACBs would be required to submit annual surveillance plans to the National Coordinator, and annually report on their surveillance results. How Long Would an Entity s Certification as an ONC-ACB Remain Effective? An entity would be required to renew its ONC-ACB status every two years. An ONC-ACB would be required to submit a renewal application 60 days prior to the expiration of its status as an ONC-ACB. Specifics of Certification How Long Would Certification of a Complete EHR or EHR Module Be Effective? In the Meaningful Use Proposed Rule, CMS states its intent to update the meaningful use objectives and measures every two years. As necessary, ONC would issue updated standards, implementation specifications and certification criteria that support the new meaningful use objectives and measures. In the Proposed Rule, ONC suggests that the issuance of new certification criteria would establish a natural expiration for the certified status of Complete EHRs and EHR Modules. 10 75 Fed. Reg. at 11349. -4-
How Would Complete EHRs and EHR Modules Be Re-Certified for Different Phases of Meaningful Use? ONC suggests that the most appropriate means of certification for subsequent stages of meaningful use may be through differential certification. Under this approach, a Complete EHR or EHR Module previously certified for Stage 1 would only need to be tested and certified to the new Stage 2 certification criteria, rather than to the entire set of certification criteria. ONC requests comments on whether differential certification should be used. 11 Additionally, ONC notes an inconsistency that would occur during 2013 and 2014 relating to the definition of Certified EHR Technology and the meaningful use stage the eligible professional or hospital would need to satisfy to qualify for incentive payments. That is, a provider adopting EHRs for the first time in 2013 would only have to meet the Stage 1 objectives. However, this same provider would need to use Certified EHR Technology that meets the most recent certification criteria adopted by the Secretary, which at that time would be Stage 2 of meaningful use. Because of CMS staggered approach to adopting the meaningful use criteria, ONC proposes that ONC-ACBs identify certified Complete EHRs and EHR Modules by noting the calendar year and month of the certification, rather than according to the meaningful use stage. Identifying Certified EHR Technology according to the calendar year of certification would assist eligible professionals and hospitals in acquiring the proper technology. How Would ONC-ATCBs and ONC-ACBs Address the Certification of Minimum Standards? In the Interim Final Rule, ONC states its intent to define certain vocabulary code set standards as minimum standards. This would allow Complete EHRs and EHR Modules to be tested and certified to a newer, updated version of the code without additional rulemaking. If the new code has been substantially modified, however, ONC would be required to use rulemaking to adopt the new standard. In the Proposed Rule, ONC proposes two different methods for evaluating whether a new version of a code is a modification, rather than maintenance or a minor update of the code set. 12 The first method would allow a member of the general public to provide notice to the National Coordinator of a new version. The National Coordinator would then use the information provided to determine whether the new version constitutes a modification or a minor update. If the National Coordinator determines the new version is a minor update, the agency would then request that the Secretary allow use of the new version for certification and testing purposes. As an alternative method, the Secretary would proactively identify new versions of adopted minimum standard code sets and determine whether they are modifications or minor updates to the prior version. ONC is requesting comments on which of these methods should be used and whether a combination of these two methods would be appropriate. Impact on Other HIT In the future, ONC expects the permanent certification program will test and certify other types of HIT, which could include personal health records (PHRs) and networks that electronically exchange information. A current ONC-ACB would be required to submit an addendum to its original application to request authorization to certify other types of HIT. 11 12 Id. at 11351 (March 10, 2010). Id. at 1134, quoting 75 Fed. Reg. at 2025. -5-
Timeline When Would ONC Select ONC-ATCBs Under the Temporary Certification Program? ONC expects that ONC-ATCBs would be selected by May or June 2010. When Would Testing Laboratories and Accrediting Bodies Be Approved for the Permanent Certification Program? ONC expects it would take between six and nine months to establish an authorization process for testing laboratories and accrediting bodies under the permanent certification program. When Would the Permanent Certification Program Be Established? ONC estimates it would take eight to 16 months to establish the permanent certification program. Therefore, the permanent certification program should be in place by calendar year 2012, which would ensure that ONC-ACBs can certify Complete EHRs and/or EHR Modules by Stage 2 of meaningful use. -6-
If you would like to receive future Health Care Advisories electronically, please forward your contact information including e-mail address to healthcare.advisory@alston.com. Be sure to put subscribe in the subject line. For further guidance please contact one of the attorneys or advisors listed below: Alston & Bird Health Information Technology (HIT) Task Force ATLANTA One Atlantic Center 1201 West Peachtree Street Atlanta, GA 30309-3424 404.881.7000 Angela T. Burnette 404.881.7665 angie.burnette@alston.com Jennifer L. Butler 202.756.3326 jennifer.butler@alston.com Martin J. Elgison 404.881.7167 martin.elgison@alston.com Laura E. Holland 202.239.3980 laura.holland@alston.com Robert C. Jones 202.239.3903 bob.jones@alston.com Peter M. Kazon 202.756.3334 peter.kazon@alston.com David C. Keating 404.881.7355 david.keating@alston.com Robert C. Lower 404.881.7455 bob.lower@alston.com D Andrea J. Morning 404.881.7538 dandrea.morning@alston.com Colin T. Roskey 202.756.3436 colin.roskey@alston.com Tiffani V. Williams 202.756.3412 tiffani.williams@alston.com Marilyn Yager Senior Public Policy Advisor 202.756.3341 marilyn.yager@alston.com CHARLOTTE Bank of America Plaza Suite 4000 101 South Tryon Street Charlotte, NC 28280-4000 704.444.1000 DALLAS Chase Tower Suite 3601 2200 Ross Avenue Dallas, TX 75201 214.922.3400 LOS ANGELES 333 South Hope Street 16th Floor Los Angeles, CA 90071-3004 213.576.1000 NEW YORK 90 Park Avenue New York, NY 10016-1387 212.210.9400 RESEARCH TRIANGLE Suite 600 3201 Beechleaf Court Raleigh, NC 27604-1062 919.862.2200 SILICON VALLEY Two Palo Alto Square Suite 400 3000 El Camino Real Palo Alto, CA 94306-2112 650.838.2000 VENTURA COUNTY Suite 215 2801 Townsgate Road Westlake Village, CA 91361 805.497.9474 WASHINGTON, D.C. The Atlantic Building 950 F Street, NW Washington, DC 20004-1404 202.756.3300 www.alston.com Alston & Bird llp 2010