Standards, Implementation Specifications and Certification Critera For EHR Technology Final Rule 2010-17210

44590 Federal Register / Vol. 75, No.
144 / Wednesday, July 28, 2010 / Rules and Regulations
DEPARTMENT OF HEALTH AND CAH Critical Access Hospital 4. Definition of Certification Criteria
HUMAN SERVICES CCD Continuity of Care Document 5. Definition of Qualified EHR
CCHIT Certification Commission for Health 6. Definition of Complete EHR
Office of the Secretary Information Technology 7. Definition of EHR Module
CCR Continuity of Care Record 8. Definition of Certified EHR Technology
CDA Clinical Document Architecture 9. Definition of Human Readable Format
45 CFR Part 170 CDC Centers for Disease Control and 10. Definition of User
RIN 0991–AB58 Prevention D. Final Rule Amendments to Adopted
CFR Code of Federal Regulations Standards, Implementation
Health Information Technology: Initial CGD Certification Guidance Document Specifications, and Certification Criteria
Set of Standards, Implementation CMS Centers for Medicare & Medicaid §§ 170.202, 170.205, 170.207, 170.210,
Services 170.302, 170.304, 170.306
Specifications, and Certification CPOE Computerized Provider Order Entry 1. Flexibility and Innovation
Criteria for Electronic Health Record EHR Electronic Health Record 2. Transport Standards
Technology FIPS Federal Information Processing 3. Certification Criteria and Associated
Standards Standards and Implementation
AGENCY: Office of the National HHS Department of Health and Human Specifications
Coordinator for Health Information Services a. General Certification for Complete EHRs
Technology (ONC), Department of HIPAA Health Insurance Portability and or EHR Modules—§ 170.302
Health and Human Services. Accountability Act of 1996 b. Specific Certification for Complete EHRs
ACTION: Final rule. HIT Health Information Technology or EHR Modules Designed for an
HITECH Health Information Technology for Ambulatory Setting—§ 170.304
SUMMARY: The Department of Health and Economic and Clinical Health c. Specific Certification for Complete EHRs
Human Services (HHS) is issuing this HITSP Healthcare Information Technology or EHR Modules Designed for an
final rule to complete the adoption of an Standards Panel Inpatient Setting—§ 170.306
initial set of standards, implementation HL7 Health Level Seven d. Adoption and Realignment of
ICD International Classification of Diseases Certification Criteria to Support the Final
specifications, and certification criteria, ICD–9–CM International Classification of
and to more closely align such Requirements for Meaningful Use Stage
Diseases, 9th Revision, Clinical 1.
standards, implementation Modification E. Additional Comments
specifications, and certification criteria ICD–10–PCS International Classification of F. Comments Beyond the Scope of This
with final meaningful use Stage 1 Diseases, 10th Revision, Procedure Coding Final Rule
objectives and measures. Adopted System IV. Collection of Information Requirements
certification criteria establish the ICD–10–CM International Classification of V. Regulatory Impact Analysis
required capabilities and specify the Diseases, 10th Revision, Clinical A. Introduction
Modification B. Why is this rule needed?
related standards and implementation IHS Indian Health Service
specifications that certified electronic C. Executive Order 12866—Regulatory
LOINC Logical Observation Identifiers Planning and Review Analysis
health record (EHR) technology will Names and Codes 1. Comment and Response
need to include to, at a minimum, NCPDP National Council for Prescription 2. Executive Order 12866 Final Analysis
support the achievement of meaningful Drug Programs a. Costs
use Stage 1 by eligible professionals, NLM National Library of Medicine b. Benefits
eligible hospitals, and/or critical access OCR Office for Civil Rights D. Regulatory Flexibility Act Analysis
hospitals (hereafter, references to OMB Office of Management and Budget
1. Comment and Response
ONC Office of the National Coordinator for
‘‘eligible hospitals’’ in this final rule Health Information Technology
2. Final RFA Analysis
shall mean ‘‘eligible hospitals and/or E. Executive Order 13132—Federalism
PHSA Public Health Service Act
critical access hospitals’’) under the Regulation Text
PQRI Physician Quality Reporting Initiative
Medicare and Medicaid EHR Incentive REST Representational state transfer I. Background
Programs. Complete EHRs and EHR RFA Regulatory Flexibility Act
Modules will be tested and certified SNOMED–CT Systematized Nomenclature A. Legislative History
according to adopted certification of Medicine Clinical Terms
The Health Information Technology
SOAP Simple Object Access Protocol
criteria to ensure that they have UCUM Unified Code for Units of Measure for Economic and Clinical Health
properly implemented adopted UMLS Unified Medical Language System (HITECH) Act, Title XIII of Division A
standards and implementation XML eXtensible Markup Language and Title IV of Division B of the
specifications and otherwise comply American Recovery and Reinvestment
with the adopted certification criteria. Table of Contents Act of 2009 (ARRA) (Pub. L. 111–5), was
DATES: Effective Date: This final rule is I. Background enacted on February 17, 2009. The
effective August 27, 2010. The A. Legislative History HITECH Act amended the Public Health
incorporation by reference of certain B. Regulatory History Service Act (PHSA) and established
publications listed in the rule is 1. Initial Set of Standards, Implementation ‘‘Title XXX—Health Information
Specifications, and Certification Criteria
approved by the Director of the Federal for EHR Technology Interim Final Rule
Technology and Quality’’ to improve
Register as of August 27, 2010. 2. Interdependencies With Other HITECH health care quality, safety, and
FOR FURTHER INFORMATION CONTACT: Provisions and Relationship to Other efficiency through the promotion of
Steven Posnack, Director, Federal Policy Regulatory Requirements health information technology (HIT) and
Division, Office of Policy and Planning, II. Overview of the Final Rule the electronic exchange of health
Office of the National Coordinator for III. Section-by-Section Discussion of the information. Section 3004(b)(1) of the
Final Rule and Response to Comments PHSA requires the Secretary of Health
sroberts on DSKD5P82C1PROD with RULES
Health Information Technology, 202–

A. Introduction and Human Services (the Secretary) to
690–7151. B. General Comments
SUPPLEMENTARY INFORMATION: C. Definitions—§ 170.102
adopt an initial set of standards,
1. Definition of Disclosure implementation specifications, and
Acronyms certification criteria by December 31,
2. Definition of Standard
ANSI American National Standards 3. Definition of Implementation 2009 to enhance the interoperability,
Institute Specification functionality, utility, and security of
VerDate Mar<15>2010 19:21 Jul 27, 2010 Jkt 220001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\28JYR3.SGM 28JYR3
Federal Register / Vol. 75, No. 144 / Wednesday, July 28, 2010 / Rules and Regulations 44591
health information technology. Section specifications, and certification criteria some cases, due to the simultaneous
3004(b)(1) of the PHSA also permits the adopted in the Interim Final Rule publication and topical similarity of the
Secretary to adopt the initial set of correlated with the Medicare and notice of proposed rulemaking for
standards, implementation Medicaid EHR Incentive Programs meaningful use Stage 1, commenters
specifications, and certification criteria proposed rule, we also discussed our inadvertently submitted comments to
on an interim, final basis. approach to align adopted standards, our regulation docket on regulations.gov
B. Regulatory History implementation specifications, and instead of the Centers for Medicare &
certification criteria with new and Medicaid Services (CMS) regulation
1. Initial Set of Standards, pending HITECH Act regulatory actions docket, and vice versa. Recognizing this
Implementation Specifications, and and with other already established oversight, CMS and ONC shared
Certification Criteria for EHR regulatory requirements. We also misplaced comments between the
Technology Interim Final Rule explained our approach for aligning offices and we included within our
On December 30, 2009, the Federal these standards, implementation
review all comments that could be
Register made available for public specifications, and certification criteria
reasonably identified as comments on
inspection, an interim final rule (the with: the adopted standard and
certification criterion related to the the Interim Final Rule.
Interim Final Rule) with a request for
comments, which adopted an initial set Health Insurance Portability and We have organized the preamble of
of standards, implementation Accountability Act of 1996 (HIPAA) this final rule along the following lines.
specifications, and certification criteria. Privacy Rule Accounting of Disclosures First, we respond to general comments,
As noted in this rulemaking (75 FR Regulation under the HITECH Act; including those related to the scope and
2014), we described how Congress alignment with the HIPAA Privacy and applicability of the final rule that we
fundamentally tied the adopted Security Regulations; the Medicare Part believe are necessary to clarify upfront.
standards, implementation D Electronic Prescribing Regulations; Next, we respond to comments
specifications, and certification criteria and the HIPAA Transactions and Code regarding the definitions of certain
to the incentives available under the Sets Standards Regulations. defined terms. We then respond to
Medicare and Medicaid EHR Incentive II. Overview of the Final Rule public comments on each certification
Programs by requiring the meaningful criterion, and where an adopted
use of Certified EHR Technology. We are amending part 170 of title 45 certification criterion also references
Congress outlined several goals for of the Code of Federal Regulations (CFR) standards and implementation
meaningful use, one of which included to complete the adoption of the initial specifications, we include our response
the ‘‘use of certified EHR technology in set of standards, implementation to public comments on the related
a meaningful manner.’’ This means that specifications, and certification criteria standards and implementation
to qualify for incentives, an eligible as required by section 3004(b)(1) of the
specifications. These concepts were
professional or eligible hospital must PHSA and realign them with the final
both adopt Certified EHR Technology separately discussed in the Interim
objectives and measures established for
and demonstrate meaningful use of this meaningful use Stage 1. After reviewing Final Rule and we believe that
technology. and considering public comments on discussing the certification criteria
The initial set of standards, our adopted standards, implementation together with associated standards and
implementation specifications, and specifications, and certification criteria, implementation specifications will
certification criteria adopted in the we have made several revisions to improve the clarity of the final rule and
Interim Final Rule established the support the final meaningful use will allow us to more fully address
capabilities that Certified EHR objectives and measures, clarify certain public comments in a broader context.
Technology would need to include to, at certification criteria to resolve identified We include the following table at the
a minimum, support eligible technical challenges related to some of beginning of the discussion of each
professionals’ and eligible hospitals’ the standards and implementation certification criterion section to
efforts to achieve what had been specifications we adopted, and to illustrate the final meaningful use Stage
proposed for meaningful use Stage 1 provide for additional flexibility. 1 objectives for eligible professionals
under the Medicare and Medicaid EHR and eligible hospitals and to show how
Incentive Programs proposed rule. III. Section-by-Section Discussion of the
Final Rule and Response to Comments we have revised adopted certification
2. Interdependencies With Other criteria in response to the revised
HITECH Provisions and Relationship to A. Introduction meaningful use objectives and measures
Other Regulatory Requirements This section summarizes the nearly and public comments.
In addition to our discussion of how 400 timely comments received by ONC
the standards, implementation related to the Interim Final Rule. In
Meaningful use Stage 1 objective Meaningful use Stage 1 measure Certification criterion
Eligible Professional and/or Eligible Eligible Professional and/or Eligi- Interim Final Rule Text: Certification Criterion.
Hospital & Critical Access Hos- ble Hospital & Critical Access Final Rule Text: Certification Criterion.
pital Objective. Hospital Measure.
Finally, in considering public provisions, we received comments those comments and in an effort to
comments on the Interim Final Rule, we requesting additional clarification and better structure the regulation text for
analyzed whether we had structured the we felt that the original regulatory future revisions, we have revised the
regulation text in an optimal and structure contributed to the structure conceptually to group content
understandable manner. For several commenters’ confusion. Because of exchange standards and associated
44592 Federal Register / Vol. 75, No. 144 / Wednesday, July 28, 2010 / Rules and Regulations
implementation specifications and certification of such Complete EHRs and possess the capability to generate an
vocabulary standards, and separated EHR Modules.’’ In §§ 170.200 and electronic prescription according to one
them into different sections. In line with 170.300, we further specify that ‘‘[t]he of the standards we have adopted. To
this ‘‘conceptual’’ restructuring, we have standards and implementation specify the contexts in which an
determined that specifying how a specifications adopted in this part apply electronic prescription (generated
Complete EHR or EHR Module must with respect to Complete EHRs and EHR according to the adopted standard) must
comply with an adopted standard Modules’’ and that ‘‘[t]he certification be transmitted would go beyond the
should be solely reflected in the criteria adopted in this subpart apply to scope of certification. Moreover, it
certification criteria. As a result, several the testing and certification of Complete would raise a more serious and practical
certification criteria have been revised EHRs and EHR Modules.’’ consideration. Attempting to specify
to more clearly reflect how a Complete The purpose of this final rule, when entities must utilize the
EHR or EHR Module must comply with therefore, is to adopt standards, capabilities of Certified EHR
adopted standards and, where implementation specifications, and Technology would add an unnecessary
applicable, the relevant adopted certification criteria to test and certify level of complexity to this rule and
implementation specifications. that a Complete EHR or EHR Module create the potential for conflicts with
provides certain capabilities, and where other regulations promulgated by the
B. General Comments applicable, to require that those HHS. For instance, HHS has already
Some commenters appear to have capabilities be implemented in promulgated at least two sets of
misinterpreted or misunderstood the accordance with adopted standards and regulations identifying when health care
scope of the Interim Final Rule and the implementation specifications. The providers need to use specific standards
applicability of the adopted standards, adopted standards, implementation and the contexts in which those
implementation specifications, and specifications, and certification criteria standards must be used. Under the
certification criteria. We would were not intended to impose HIPAA Transactions and Code Sets
therefore like to clarify these concepts at independent requirements on the Standards regulations, HHS specifies at
the beginning of this final rule and are entities using Certified EHR 45 CFR 162.923(a) that ‘‘[e]xcept as
providing the following responses to the Technology. Unlike certain other otherwise provided in this part, if a
relevant comments. regulatory requirements to which covered entity conducts with another
Comments. Some commenters seem to eligible professionals or eligible covered entity (or within the same
have construed the adoption of hospitals may be subject, it is not within covered entity), using electronic media,
standards, implementation the intended scope of this final rule to a transaction for which the Secretary
specifications, and certification criteria specify the requirements for entities has adopted a standard under this part,
as including requirements that apply to using Certified EHR Technology.
the health care providers that will use the covered entity must conduct the
We understand the commenters’ point
the Certified EHR Technology, rather transaction as a standard transaction.’’
though that an adopted standard and
than as required capabilities of the (Emphasis added.) Consequently, in the
implementation specification could
Certified EHR Technology itself. These HIPAA context, covered entities must
apply equally to electronic transactions
commenters, for instance, questioned use adopted transaction standards for
between legal entities as well as to
whether entities using Certified EHR covered transactions both within the
transmissions within an entity. This
Technology must comply with adopted covered entities and with outside
final rule, however, is not intended to
standards and implementation entities. The Medicare Part D electronic-
specify the conditions under which
specifications when electronically using prescribing (e-prescribing) regulations
adopted standards and implementation
or transmitting health information implement a different approach for
specifications must be used, only that a
within or among components of the Complete EHR or EHR Module, in order certain e-prescribing transactions.
legal entity or alternatively whether the to be certified, must include specified Health care providers that electronically
standards apply solely to transmissions capabilities that are implemented in prescribe Part D drugs for Part D eligible
between legal entities. Other accordance with those standards, individuals under 42 CFR
commenters specifically requested implementation specifications, and 423.160(a)(3)(iii), ‘‘may use either HL7
clarification regarding the adopted certification criteria. We anticipate that messages or the NCPDP SCRIPT
standards that are required to be used other regulations, as well as the clinical Standard to transmit prescriptions or
internally within each provider’s office, and business needs of HIT users, prescription-related information
institution, or closed system and which anticipated efficiencies and desired internally when the sender and the
standards are required for purposes of quality improvements, and technical, recipient are part of the same legal
electronically exchanging health architectural, and enterprise limitations entity. If an entity sends prescriptions
information among such entities. Some will determine when entities will utilize outside the entity (for example, from an
comments implied that the Interim the capabilities required of Certified HMO to a non-HMO pharmacy), it must
Final Rule should have specified when EHR Technology. Additionally, we use the adopted NCPDP SCRIPT
an eligible professional or eligible would note that Complete EHRs and Standard or other applicable adopted
hospital would be required to use EHR Modules will, in many cases, be standards.’’ Therefore, we believe that it
adopted standards. One commenter tested and certified independent of the is unnecessary and outside of the
specifically requested that the adopted environment within which they will be intended scope of this rule to specify
standards apply only to the electronic implemented. Consequently, specifying the contexts or circumstances under
exchange of health information between when an entity that implements which adopted standards and
implementation specifications must be
legal entities. Certified EHR Technology must utilize a

Response. As stated in § 170.101, we particular capability in its operating utilized.
specify that ‘‘[t]he standards, environment exceeds the scope of this Moreover, we anticipate that future
implementation specifications, and rule. meaningful use objectives and measures
certification criteria adopted in this part To further demonstrate this point, will specify, as necessary and
apply to Complete EHRs and EHR Certified EHR Technology implemented appropriate, the conditions under which
Modules and the testing and by an eligible professional will need to certain health care providers will need
to use adopted standards and changing medical practice and definition will read: disclosure is
implementation specifications. The regulatory requirements. We will defined as it is in 45 CFR 160.103.
context, for instance, governing when a therefore need to continue to harmonize
2. Definition of Standard
standard must be used will, in some those adopted standards with other
cases, be directly related to whether and standards to support interoperability. Comment. A commenter stated that
how an eligible professional or eligible We anticipate that the standards our definition of standard was
hospital must meaningfully use required to support future stages of comprehensive from a technical
Certified EHR Technology. For example, meaningful use will need a framework perspective, but believed the definition
a final meaningful use Stage 1 objective that supports harmonization across was incomplete from a policy
requires that eligible professionals and different meaningful use scenarios and perspective. The commenter argued that
eligible hospitals use Certified EHR that supports early real world testing. for interoperability to be successful, it
Technology to record demographics We plan to work closely with the HIT was essential that standards be created
including, among other fields, race and Standards Committee to develop a through collaborative, consensus-based
ethnicity. While we have adopted the forward looking agenda and to make processes that take into consideration
race and ethnicity codes published by known in advance the types of the needs and concerns of all interested
the Office of Management and Budget standards, implementation stakeholders. For that reason, the
(OMB), in the context Medicare and specifications, and certification criteria commenter suggested, in order for the
Medicaid EHR incentive programs, the on which we will seek definition to be whole from both a
meaningful use of Certified EHR recommendations from the HIT technical and policy perspective, we
Technology will dictate whether such Standards Committee. We believe this should add to the definition the phrase
codes must be used ‘‘inside’’ an will benefit the HIT industry by ‘‘developed through the use of open,
organization. Another example of when providing greater transparency of the collaborative, consensus-based
a meaningful use objective establishes standards adoption activities and will processes.’’
the context in which a standard must be Response. While we appreciate the
serve as an early indication for the
used is the objective that requires commenter’s point, we believe that the
public of candidate standards that are
eligible professionals and eligible proposed language is unnecessary and
being identified for possible adoption.
hospitals to use Certified EHR potentially problematic. Federal
Technology to maintain an up-to-date C. Definitions—§ 170.102 agencies are already required under the
problem list of current and active National Technology Transfer and
In this section, we respond to public
diagnoses. The measure associated with Advancement Act of 1995 (NTTAA) (15
comment on the definitions adopted in
this objective requires that entries be U.S.C. 3701 et seq.) and OMB Circular
the Interim Final Rule. We address the A–119 1 to use, wherever practical,
recorded in ‘‘structured data’’ and in this definition of Certified EHR Technology
context we adopted ICD–9 or SNOMED– technical standards that are developed
last after we provide clarifications
CT® to provide that structure. As a or adopted by voluntary consensus
related to the definitions of Complete
result, Certified EHR Technology must standards bodies to carry out policy
EHR and EHR Module.
be capable of using ICD–9 or SNOMED– objectives or activities, with certain
CT® when an eligible professional or 1. Definition of Disclosure exceptions. In drafting the Interim Final
eligible hospital seeks to maintain an Rule, we briefly discussed relevant
Comments. A few commenters noted
up-to-date problem list. provisions of the NTTAA and OMB
that the definition of disclosure was too
In other instances, the Department Circular A–119, our compliance with
broad or asked that we refine the
does not specify explicitly in regulation the statute and the Circular, and we
adopted definition to be more limited
the context for certain meaningful use requested comments on our approach to
and to only apply in certain
objectives and whether meaningful use the selection of standards. We also
circumstances. One commenter noted
of Certified EHR Technology would explained that both the NTTAA and
that this was a new definition.
require the use of a standard for OMB Circular A–119 provide for certain
electronic transactions solely between Response. As we explained in the exceptions to selecting only standards
two different legal entities, or for all preamble of the Interim Final Rule, this developed or adopted by voluntary
transactions, or for most transactions definition repeated the text specified at consensus standards bodies, namely
with certain exemptions. 45 CFR 160.103 (the General Provisions when doing so would be ‘‘inconsistent
Comments. Several commenters section for the HIPAA regulations). with applicable law or otherwise
requested that we provide more Because the Interim Final Rule created impractical.’’ In the Interim Final Rule,
information about the standards we a new part in Title 45 of the CFR, the we identified those instances in which
expect the Secretary to adopt in order to definition of disclosure as it is used in we had and had not adopted voluntary
support future stages of meaningful use. the HIPAA regulations would not consensus standards. In the instances in
These commenters noted, along with necessarily have applied to our use of which we had not adopted voluntary
referencing the timelines for making the term in this rule. Therefore, to consensus standards, we provided two
changes to HIT, that it would benefit the prevent unnecessary ambiguity for the principal reasons: first, that in most
HIT industry if we could provide a regulated community, we adopted the cases a voluntary consensus standard
roadmap, framework, or more definition of the term as it is defined at that could meet the requisite technical
descriptive ‘‘glide path’’ for future 45 CFR 160.103. goals was simply unavailable; and
standards adoption activities. In light of public comment and to second, that to the extent a potentially
Response. We anticipate that future prevent any future regulatory equivalent voluntary consensus
stages of meaningful use will require us inconsistency that would require
standard was available, the standard

to adopt additional standards, rulemaking to correct, we have revisited was too limiting and did not meet our
implementation specifications, and our approach of repeating the text of the policy goals, including allowing for
certification criteria. We also expect that definition of disclosure from 45 CFR greater innovation by the industry. In
standards we have adopted will 160.103 and have decided to cross
continue to be revised and updated over reference 45 CFR 160.103 in the 1 http://www.whitehouse.gov/omb/
time, to reflect current technology, definition of disclosure. The final circulars_a119.
this final rule, we have adopted only support; (ii) to support physician order additional standards, implementation
voluntary consensus standards, except entry; (iii) to capture and query specifications, and certification criteria.
for two government-unique standards information relevant to health care Comments. Some commenters
(CMS Physician Quality Reporting quality; and (iv) to exchange electronic requested that we clarify some of the
Initiative (PQRI) 2009 Registry XML health information with, and integrate terms in the definition of Qualified EHR
Specification and the Office of such information from other sources.’’ such as ‘‘capture,’’ ‘‘query,’’ ‘‘other
Management and Budget Standards for Both commenters recommended that the sources,’’ and ‘‘relevant to health care
Maintaining, Collecting, and Presenting definition of Qualified EHR be clarified quality’’ with respect to how they
Federal Data on Race and Ethnicity), a with one commenter suggesting that the related to Certified EHR Technology.
functional standard relating to definition should follow the definition Another commenter expressly stated
vocabularies included in RxNorm, and of EHR as it relates to health care that if we only intended to repeat the
the specified standards to protect providers. statutory definition of Qualified EHR
electronic health information. We are Response. We appreciate these without modification, we should at least
aware of no voluntary consensus comments and recognize that the clarify the meaning of demographic
standards that would serve as existence of multiple terms that include information.
alternatives to these standards for the the word ‘‘EHR’’ can be confusing. Response. We do not believe that
purposes that we have identified. We However, we believe that Congress additional clarity is needed or desirable
encourage the HIT Standards Committee intended for HHS to apply the for such terms because the meanings are
to obtain public input, hold hearings on, definition of a Qualified EHR found in context specific. The intended meanings
and recommend to the National section 3000 of the PHSA to this of these terms will depend significantly
Coordinator standards that have been regulation for specific reasons that on the contexts in which the terms are
developed or adopted by voluntary cannot be overlooked. As a result, we used and the associated capabilities of
consensus standards bodies. have decided not to adopt the the Certified EHR Technology. The
recommendation to follow the terms’ meanings may also be affected by
3. Definition of Implementation any standards and implementation
Specification definition of the term EHR that is found
specifications that are associated with
in Subtitle D of the HITECH Act. We
We did not receive any comments those capabilities and adopted. In
discuss additional responses to
applicable to the definition of certain circumstances, for instance, the
comments on the definition of Qualified
implementation specification and meaning of the phrase ‘‘other sources’’ as
EHR below.
consequently did not make any changes used in the definition of Qualified EHR
Comments. A few commenters will depend on the specific context in
to the definition.
requested that we expand the definition which electronic health information is
4. Definition of Certification Criteria of Qualified EHR to include a variety of being integrated or exchanged, and
Comments. One commenter expressly additional functionality and that a perhaps on whether the source is
stated its support for our definition of Qualified EHR be able to comply with external to or internal within the
certification criteria. business or legal requirements. These Complete EHR or the EHR Module.
Response. We appreciate the comments requested that we add Similarly, the meanings of the terms or
commenter’s support for our definition required elements for an EHR to phrases ‘‘capture,’’ ‘‘query,’’ ‘‘relevant to
of certification criteria and have not constitute a Qualified EHR, including health care quality’’ and ‘‘demographic’’
made any changes to the definition in that the EHR: Have a record-keeping information may vary according the
this final rule. capability for legal purposes; include context of the required capabilities of
certain requirements for usability; the EHR technology. In each of these
5. Definition of Qualified EHR enable health care providers to perform instances, we believe that the adopted
Comments. A couple of commenters several other actions not specified in the certification criteria and meaningful use
asserted that there is uncertainty in the definition; and that certain elements of objectives and measures will provide
industry with respect to what patient demographic information be these contexts, identify the associated
constitutes an EHR due both to the specified. required capabilities, and consequently
seemingly inconsistent definitions of Response. We understand the clarify the intended meanings of these
terms in the HITECH Act and to the rationale behind these commenters’ terms.
alternative definitions published by suggestions, but we do not believe that
different organizations and associations. it is necessary to add more prerequisite 6. Definition of Complete EHR
The commenters made specific capabilities to the definition of Comments. Some commenters
reference to the definition of ‘‘Qualified Qualified EHR. We believe Congress supported our definition of Complete
Electronic Health Record’’ (‘‘Qualified defined Qualified EHR to include a EHR and believed that it was
EHR’’) at section 3000 of the PHSA and minimum level of capabilities. understandable, sufficient, and
to the term ‘‘EHR’’ found in the HITECH Furthermore, to meet the definition of reasonable. Other commenters,
Act at section 13400 of Subtitle D. The Certified EHR Technology, a Qualified however, suggested that the definition
latter defines EHR as ‘‘an electronic EHR must be certified in accordance of Complete EHR was too narrow,
record of health-related information on with a certification program established because the term is tied to only those
an individual that is created, gathered, by the National Coordinator. As a result, certification criteria adopted by the
managed, and consulted by authorized we believe that any additional Secretary. These commenters argued
clinicians and staff.’’ The former defines capabilities a Qualified EHR would that the Complete EHR and the adopted
Qualified EHR as ‘‘an electronic record need to possess to allow an eligible certification criteria should be more
of health-related information on an professional or eligible hospital to be in comprehensive and should include

individual that: (1) Includes patient a position to qualify for incentive functionality that is not presently
demographic and clinical health payments under the Medicare and required for a Complete EHR to achieve
information, such as medical history Medicaid EHR incentive programs will certification. Many of these commenters
and problem lists; and (2) has the be more appropriately addressed referenced the Health Level Seven (HL7)
capacity: (i) to provide clinical decision through the Secretary’s adoption of EHR System Functional Model (EHR–S
FM) and contended that what we had Complete EHR or implemented in a hospitals) must be certified to all of the
defined as a Complete EHR did not align complementary fashion. The definition certification criteria adopted at 45 CFR
with or include all of the functionality sets forth a floor, not a ceiling, and 170.302 and 45 CFR 170.306.
specified in the EHR–S FM. One serves to signify that once tested and
7. Definition of EHR Module
commenter requested that we clarify certified to all applicable certification
what we meant by ‘‘we fully expect criteria, a Complete EHR meets the Comments. Numerous commenters
some EHRs to have capabilities beyond definition of Certified EHR Technology. strongly supported our inclusion of a
those addressed by certification criteria’’ For this reason, we did not seek to craft modular approach to meet the definition
when we made this point during our this definition in a way that signified of Certified EHR Technology. Many of
discussion of the definition of Complete that a Complete EHR would be able to these commenters saw this approach as
EHR in the preamble of the Interim provide all of the capabilities a health a way to spur greater innovation in the
Final Rule. Other commenters care provider desired or deemed HIT marketplace, provide more choices
recommended specific wording changes necessary, or that the entity’s EHR could for health care providers, and generally
to the definition. only include the capabilities for which broaden the appeal of HIT and expedite
Response. In the Interim Final Rule the Secretary has adopted certification its adoption. Some commenters noted,
we defined Complete EHR to mean criteria. Nor did we define Complete however, that they believed the
‘‘EHR technology that has been EHR according to a particular functional definition needed further clarification
developed to meet all applicable model, because doing so would have with respect to what would constitute
certification criteria adopted by the been inconsistent with the regulatory an EHR Module. In most cases, these
Secretary.’’ We clarified that the term purpose of the definition. commenters provided examples of
Complete EHR is ‘‘meant to encompass In light of public comment and to technologies that they believed should
EHR technology that can perform all of further clarify the regulatory purpose of meet the definition of EHR Module and
the applicable capabilities required by the definition of Complete EHR as well they sought confirmation that these
certification criteria adopted by the as make clear that a Complete EHR technologies would meet the definition.
Secretary and distinguish it from EHR should not be misinterpreted to mean Included among these technologies were
technology that cannot perform those EHR technology that is any more radiology information systems (RIS),
capabilities.’’ We believe that comprehensive than the certification picture archiving and communication
commenters misunderstood the scope criteria to which it was tested and systems (PACS), PHRs, speech
and purpose of the regulatory definition certified, we have added the phrase ‘‘at recognition software, electrocardiogram
and believe that the definition a minimum’’ to the definition. The final systems, remote patient monitoring
effectively fulfills its regulatory definition of Complete EHR will (RPM) devices, and other electronic
purpose. We intend for the definition of therefore read ‘‘EHR technology that has devices including non-health care
Complete EHR to be used to clearly been developed to meet, at a minimum, devices.
identify EHR technology as being able to all applicable certification criteria Response. In the Interim Final Rule,
perform, at a minimum, all of the adopted by the Secretary.’’ we defined an EHR Module to mean
applicable capabilities required by As a related point, we would also note ‘‘any service, component, or
certification criteria adopted by the that an eligible professional or eligible combination thereof that can meet the
Secretary, and thereby, as providing hospital would need to use a capability requirements of at least one certification
eligible professionals or eligible that is included among the adopted criterion adopted by the Secretary.’’
hospitals with the technical capabilities certification criteria to meet the Consequently, EHR Modules, by
they need to support their achievement associated meaningful use objective or definition, must provide a capability
of meaningful use of Certified EHR measure. The eligible professional or that can be tested and certified in
Technology. It is in this context that we eligible hospital therefore could not accordance with at least one
view such EHR technology as attempt to use a capability that is certification criterion adopted by the
‘‘complete.’’ superfluous to certification to Secretary. Therefore, if an EHR Module
We recognize that many commenters demonstrate the meaningful use of does not provide a capability that can be
recommended a definition of ‘‘Complete ‘‘Certified EHR Technology.’’ We tested and certified at the present time,
EHR’’ that would be more understand that the Medicare and it is not HIT that would meet the
comprehensive than the definition we Medicaid EHR Incentive Programs final definition of EHR Module. We stress ‘‘at
provided. Many commenters contended rule discusses this issue more fully in the present time,’’ because as new
that HIT exists and is available for several places, and we defer to those certification criteria are adopted by the
eligible professionals and eligible discussions concerning the Secretary, other HIT could be developed
hospitals to implement, and much of it requirements for achieving meaningful and then tested and certified in
includes a myriad of capabilities far use of Certified EHR Technology. accordance with the new certification
surpassing the capabilities required to Comment. In the context of the criteria as EHR Modules.
meet the definition of Complete EHR. definition of Complete EHR, one We encourage eligible professionals
We do not dispute that point. We also commenter asked for clarification and eligible hospitals to use any and all
understand that the capabilities regarding how many certification HIT they believe will help make the
included in a Complete EHR, as defined criteria a Complete EHR must be health care they deliver more effective
for the purposes of this regulation, may developed to meet. and efficient. However, unless the HIT
not encompass all of the capabilities a Response. For the purposes of is tested and certified to at least one
specific eligible professional or eligible meeting the definition of Complete EHR, certification criterion for use as part of
EHR technology designed for an Certified EHR Technology, it does not
hospital or for that matter any health

care provider, may deem essential to ambulatory setting (to be used by constitute an EHR Module for the
meet their unique business needs and eligible professionals) must be certified purposes of this regulation. Eligible
use cases. to all of the certification criteria adopted professionals and eligible hospitals are
This definition, however, does not in at 45 CFR 170.302 and 45 CFR 170.304, not prohibited from using or
any way preclude any additional and EHR technology designed for an implementing this HIT, but again, at the
capabilities from being included in a inpatient setting (to be used by eligible present time, such HIT cannot
constitute an EHR Module and serve as but they themselves would not be EHR them, and can achieve meaningful use
a necessary component of Certified EHR Modules. either with combinations of certified
Technology for eligible professionals or In those circumstances in which an HIT or a single EHR system. However,
eligible hospitals to use when seeking to interface or other software program is an some commenters mentioned that the
achieve meaningful use as defined in integral component of an EHR Module definition is unnecessarily ambiguous,
the Medicare and Medicaid EHR without which it would not be able to and subject to possible alternative
Incentive Programs final rule. be tested and certified, then such interpretations. Some commenters also
In response to these comments, we interface or other software program, commented on certain statements in the
would also like to clarify our though not itself an EHR Module, would preamble regarding EHR Modules and
conceptualization of an EHR Module. function as a critical piece of the overall queried how a proper combination of
An EHR Module could provide a single EHR Module presented for testing and EHR Modules could be used to meet the
capability required by one certification certification. For example, a software definition of Certified EHR Technology.
criterion or it could provide all program that would permit an eligible Other commenters, while
capabilities but one, required by the professional or eligible hospital to acknowledging that adopted
certification criteria for a Complete electronically exchange health certification criteria will determine in
EHR. In other words, we would call HIT information with other eligible part what constitutes Certified EHR
tested and certified to one certification professionals or eligible hospitals could Technology, urged ONC to revise the
criterion an ‘‘EHR Module’’ and HIT be tested and certified as an EHR definition to include only patient care
tested and certified to nine certification Module, if it provides the capability to functionality. Finally, a few commenters
criteria an ‘‘EHR Module,’’ where ten electronically exchange health offered specific word changes for the
certification criteria are required for a information according to standards definition to improve its clarity.
Complete EHR. We have not made any adopted by the Secretary. In this Response. In the Interim Final Rule,
changes to the definition of EHR example, whatever comprises the we defined Certified EHR Technology to
Module as a result of these comments or software program would be considered mean ‘‘a Complete EHR or a
the comments addressed below. part of the EHR Module that is tested combination of EHR Modules, each of
and certified. which: (1) Meets the requirements
Comment. One commenter asked
Finally, in situations where an included in the definition of a Qualified
whether we meant to include in the eligible professional or eligible hospital
definition of EHR Module ‘‘interfaces’’ EHR; and (2) Has been tested and
believes that it has multiple HIT certified in accordance with the
that perform data mapping or systems that would each meet the
transformation. The commenter raised certification program established by the
definition of EHR Module, we suggest National Coordinator as having met all
this question while noting that some that the eligible professional or eligible
organizations use multiple interfaces to applicable certification criteria adopted
hospital evaluate whether these systems by the Secretary.’’ With respect to a
interconnect their HIT systems and that could be combined with other systems
it would be an arduous task for these combination of EHR Modules, we
to constitute a Complete EHR. If they are clarified in the preamble of the Interim
organizations to ensure that all capable of being combined to form a
individual interfaces are certified. Final Rule that:
Complete EHR, it may be more
Another commenter sought clarification expeditious and beneficial for an As long as each EHR Module has been
regarding what we meant when we eligible professional or eligible hospital separately tested and certified in accordance
stated as an example in the Interim with the certification program established by
to simply seek Complete EHR testing the National Coordinator * * * to all of the
Final Rule that EHR Modules could be and certification.
‘‘an interface or other software program applicable certification criteria adopted by
Comments. A few commenters the Secretary, a proper combination of
that provides the capability to exchange requested that we clarify how EHR certified EHR Modules could meet the
electronic health information.’’ Modules would be tested and certified definition of Certified EHR Technology. To
Response. As discussed above, to to adopted privacy and security clarify, we are not requiring the certification
meet the definition of EHR Module, HIT certification criteria. Other commenters of combinations of certified EHR Modules,
would need to provide a capability that asked whether we meant to allow for just that the individual EHR Modules
could be tested and certified to at least there to be EHR Modules that provided combined have each been certified to all
one certification criterion. If a applicable certification criteria in order for
only privacy and security capabilities.
certification criterion has therefore been such a ‘‘combination’’ to meet the definition
Response. These comments pertain to
adopted that requires a particular of Certified EHR Technology.
the certification programs rule, and are
capability for exchanging electronic outside of the scope of this rule. We Many commenters appeared to be
health information, an interface or other therefore respond to these comments in confused by the inclusion of ‘‘each of
software program that provides that the Temporary Certification Program which’’ in the definition of Certified
capability could be tested and certified final rule (75 FR 36158). EHR Technology. Other commenters
as an EHR Module. In many also stated that ‘‘each of which’’ was
circumstances, an interface or program 8. Definition of Certified EHR awkwardly placed, making it difficult to
may provide valuable functionality, but Technology interpret how the combination of EHR
not a capability for which a certification Comments. Multiple commenters Modules must satisfy the subsequent
criterion has been adopted. For commended ONC for recognizing the requirements of the definition. This
example, software implemented by an need to certify EHR Modules and confusion also made it difficult to
eligible professional that performs data enabling certified EHR Modules to be understand the clarifying remarks
translation or mapping between two used in combination to meet the reiterated above regarding our intention
databases or data sets may provide definition of Certified EHR Technology. to avoid implying that a combination of
critical functionality, yet that software These commenters noted that this certified EHR Modules had to be
would not constitute an EHR Module. approach makes it clear that eligible certified a second time when a proper
Similarly, interfaces between ‘‘HIT professionals and eligible hospitals will combination had been created. We
systems’’ may be critical to the have the flexibility to select certified generally agree with these comments
functionality of the separate systems, EHR modules that are the most useful to and are revising the definition slightly
to avoid this ambiguity and to clarify Modules would fall under the second be tested and certified. That being said,
that the definition of Certified EHR definition of Certified EHR Technology, eligible professionals and eligible
Technology can be met in either of two although each EHR Module of the hospitals are free to utilize any other
ways. bundle would be tested and certified at type of HIT to complement or in
The first way that the definition of the same time rather than separately. combination with Certified EHR
Certified EHR Technology can be met is Therefore, provided that a proper Technology, including HIT that
for a Complete EHR to: (1) Meet the combination of EHR Modules has been provides capabilities for other purposes
requirements included in the definition created, combinations of EHR Modules not related to meaningful use.
of a Qualified EHR, and (2) be tested could be tested and certified either at Comments. Some commenters
and certified in accordance with the the same time or at separate times, to suggested that our definition was too
certification program established by the meet the definition of Certified EHR broad. Most of these commenters argued
National Coordinator as having met all Technology. that we should permit eligible
applicable certification criteria adopted Finally, we believe that commenter professionals to adopt only Complete
by the Secretary. The second way that suggestions to revise the definition of EHRs and EHR Modules that were
the definition of Certified EHR Certified EHR Technology to reference certified as including only those
Technology can be met is if each specific certification criteria are capabilities applicable to their specialty
constituent EHR Module of a misguided. The definition, regardless of or practice. In other words, these
combination of EHR Modules has been the certification criteria that must be commenters sought for the definition of
tested and certified in accordance with included in a Complete EHR or Certified EHR Technology to be
the certification program established by combination of EHR Modules, must be interpreted in such a way as to permit
the National Coordinator as having met able to accommodate changes in different specialty-oriented variations of
all applicable certification criteria certification criteria over time. Certified EHR Technology to exist.
adopted by the Secretary and the Accordingly we believe that the final Response. At the present time, we
resultant combination also meets the definition meets this intended goal and believe that the definition of Certified
requirements included in the definition conveys a clear meaning. EHR Technology already includes some
of a Qualified EHR. Comments. Some commenters of the flexibility these commenters
As previously written, it was unclear appeared to interpret our definition as request. We permit, for example, a
to many commenters that the comma providing that EHR Modules must be Complete EHR designed for an
preceding ‘‘each of which’’ was meant to used to meet the definition of Certified ambulatory setting and a Complete EHR
separately apply a Complete EHR and EHR Technology. Of these commenters, designed for an inpatient setting both to
‘‘combination of EHR Modules’’ to the some requested that we clarify whether meet the definition of Certified EHR
subsequent requirements. Our intention health care providers would be required Technology, even though each is
was that a combination of EHR Modules to obtain certification of EHR Modules compliant with a slightly different set of
would have to provide the capabilities that no vendors support. Other applicable certification criteria. In that
necessary to meet the definition of a commenters asked whether non- regard, we believe we have integrated a
Qualified EHR and that the EHR certified ‘‘EHR modules’’ could be used balanced and appropriate amount of
Modules combined would have each in combination with a Complete EHR or flexibility into the definition of Certified
been tested and certified in accordance in combination with EHR Modules that EHR Technology, which will also allow
with the certification criteria applicable are used to meet the definition of us to make additional refinements over
to each EHR Module. Certified EHR Technology. time. We believe that it is possible based
In response to commenters, we have Response. We would like to make on industry need for us to specify in a
decided to revise the definition of clear that eligible professionals and future rulemaking sets of applicable
Certified EHR Technology to state eligible hospitals are not required to use certification criteria for Complete EHRs
explicitly the two distinct ways the EHR Modules in order to meet the and EHR Modules designed for
definition can be met. The revised definition of Certified EHR Technology. particular clinical settings.
definition will read as follows. Certified The use of EHR Modules is completely
voluntary and provides an alternate 9. Definition of Human Readable Format
EHR Technology means:
(1) A Complete EHR that meets the avenue for eligible professionals and Comments. A number of commenters
requirements included in the definition eligible hospitals who seek to across several certification criteria
of a Qualified EHR and has been tested implement more customized HIT requested that we clarify the meaning of
and certified in accordance with the solutions while still meeting the ‘‘human readable format.’’ These
certification program established by the definition of Certified EHR Technology. commenters questioned what human
National Coordinator as having met all Commenters who expressed concerns readable format meant when it was used
applicable certification criteria adopted about their responsibility for seeking in the certification criteria and offered
by the Secretary; or certification for EHR Modules for which examples of what they thought would
(2) A combination of EHR Modules in no vendor supports did not provide constitute human readable format such
which each constituent EHR Module of specific examples, and we are uncertain as, style sheets and PDFs. A couple of
the combination has been tested and as to the basis for their concerns. commenters suggested that human
certified in accordance with the Regardless, we reiterate that the use of readable format should consider
certification program established by the EHR Modules is voluntary and we patients’ linguistic needs. A commenter
National Coordinator as having met all believe that most eligible professionals requested we discuss the compliance
applicable certification criteria adopted and eligible hospitals that are adopting requirements associated with the
Americans with Disabilities Act and the
by the Secretary, and the resultant HIT for the first time will have a variety
combination also meets the of Complete EHRs available from which relevant sections of the Rehabilitation
requirements included in the definition to choose. Act of 1973 to ensure human readable
of a Qualified EHR. We also clarify that only those EHR format was meant to include an
As discussed in the Temporary Modules that provide capabilities obligation to provide people with
Certification Program final rule, a pre- necessary to meet the definition of disabilities alternative formats such as
coordinated integrated bundle of EHR Certified EHR Technology will need to large print or Braille.
Response. In the Interim Final Rule, in human readable format on their suggested alternative approaches to
we discussed the meaning of human handheld device while an individual adopting standards, such as adopting
readable format and provided examples may seek an electronic document, such standards at a higher level of abstraction
of what we believe would constitute as a PDF. Given the requests for (e.g., HL7 2.x, where ‘‘x’’ could be any
human readable format. We reiterate additional clarity regarding the meaning version within the version 2 family) and
that discussion below. of human readable format, we have accompanying the adopted standards
We believe that in order to recognize the decided to define the term in this final with detailed implementation
enormous potential of HIT, greater rule as follows: Human readable format specifications or guidance outside of the
standardization in future years is necessary. means a format that enables a human to rulemaking process.
In that regard, we recognize that more read and easily comprehend the Response. We appreciate commenters’
advanced interoperability requires health information presented to him or her support for the ‘‘minimum standard’’
information to be represented by specific regardless of the method of presentation approach that we established in the
vocabularies and code sets that can be (e.g., computer screen, handheld device, Interim Final Rule. We believe that code
interpreted by EHR technology as well as sets are an appropriate type of standard
converted and presented in a readable format
electronic document).
We noted in the Interim Final Rule to set as a ‘‘minimum.’’ In the Temporary
to the users of such technology. At the
present time we recognize that implementing that the standards, implementation Certification Program final rule, we
certain vocabularies and code sets in EHR specifications, and certification criteria discuss the approaches available to the
technology is a difficult, technical adopted by the Secretary applied to Secretary to identify and accept newer
undertaking. For that reason, we have not Complete EHRs and EHR Modules, not versions of adopted minimum code set
adopted specific vocabularies and code sets to persons or entities. We also stated standards. Below, we discuss how we
for a number of the exchange purposes * * * that nothing required by the Interim have added flexibility into this final rule
We have, however, as a transitional step, Final Rule should be construed as and how we can add flexibility in future
adopted certification criteria that require rulemakings.
Certified EHR Technology to be capable of
affecting existing legal requirements
under other Federal laws. Accordingly, In many cases, however, our
presenting health information received in flexibility may be limited due to legal
human readable format. By human readable this final rule does not affect an eligible
professional or eligible hospital’s requirements to adopt substantive
format, we mean a format that enables a
human to read and easily comprehend the requirements to comply with other requirements through following the
information presented to them regardless of Federal laws in the event health procedures of the Administrative
the method of presentation (e.g., computer information is provided in human Procedure Act (APA). Depending upon
screen, handheld device, electronic readable format and persons with the circumstances and subject matter,
document). This would likely require disabilities require reasonable we may not be able to alter the
information in coded or machine readable
accommodations. substantive standards that apply to
format to be converted to, for example, its Certified EHR Technology solely
narrative English language description. In an 10. Definition of User through guidance. In addition, a real
effort to further the transition to, and and practical need to ensure consistency
prevalence of, more specific vocabularies and Comments. A number of commenters
commenting on several certification among various standards regulations
code sets, we are interested in public
comment regarding industry readiness if we criteria requested that we clarify the constrains the amount of flexibility we
were to adopt certification criteria requiring meaning of the term ‘‘user.’’ can incorporate into the standards we
the use of additional vocabularies and code Response. We recognize that the term adopt.
sets in parallel with meaningful use Stage 2. user is referenced in the certification In addition, in accordance with Office
Such certification criteria could include not criteria and at times could be of the Federal Register regulations
only that Certified EHR Technology be
interpreted differently. We believe this related to ‘‘incorporation by reference,’’
capable of presenting information in human which we follow for this final rule, the
readable format but also that it be capable of flexibility is necessary because a user
publications we reference are ‘‘limited to
automatically incorporating certain may be different depending on the
the edition of the publication that is
vocabulary or code sets (i.e., machine certification criterion and the context
approved’’ and do not include ‘‘[f]uture
readable information). within which the capability it specifies
amendments or revisions of the
The term human readable format is is used. Accordingly, we believe a user
publication.’’ Consequently, we do not
used in two contexts, when coded could be a health care professional or
include regulatory language that refers,
health information should be displayed office staff, someone who might interact
for instance, to ‘‘Version 1.X’’ when ‘‘X’’
to an eligible professional or (to a health directly with Certified EHR Technology
remains a variable.
care professional within) an eligible or that it could also be software program
We do believe, however, that
hospital using Certified EHR or service.
additional flexibility can be added into
Technology and in the circumstances D. Final Rule Amendments to Adopted this and future rulemakings through at
where Certified EHR Technology must Standards, Implementation least one of four currently identified
be capable of generating an electronic Specifications, and Certification Criteria means:
copy of health information for §§ 170.202, 170.205, 170.207, 170.210, • Alternative Standards. In the
individuals. Each context may dictate a 170.302, 170.304, 170.306 Interim Final Rule and in this final rule,
different human readable format. For we have adopted ‘‘alternative’’ standards
example, the use of a style sheet may be 1. Flexibility and Innovation (and applicable implementation
appropriate for both health care Comments. Many commenters specifications) for several certification
professionals that are interacting with requested that we provide more criteria. As a general rule, when an
Certified EHR Technology as well as flexibility in the final rule to adopted certification criterion refers to
individuals who receive an electronic accommodate new developments in two or more standards as alternatives,
copy of their health information to HIT. These commenters agreed with our use of at least one of the alternative
access at a later time. In other approach to identify minimum standards will be considered compliant
circumstances it may be more standards for certain code sets and they with the certification criterion. For the
appropriate for a health care recommended a similar approach for certification criterion at § 170.302(k)(1),
professional to view health information other standards. Some commenters for instance, we have adopted HL7 2.3.1
and HL7 2.5.1 as alternatives, and the subsequently released version of the code set. to use the older version(s). HHS
use of either standard (and the This approach will permit Complete EHRs discussed that if a newer version of a
applicable implementation and EHR Modules to be tested and certified, standard were backward compatible
to, ‘at a minimum,’ the version of the
specifications) would be sufficient to with an adopted standard, it would be
standard that has been adopted or a more
comply with the certification criterion. current or subsequently released version. possible to pursue a more expedited
In each of these instances, we have tried approach to permit the utilization of the
to balance the need for flexibility with We would note that consistent with newer version while still remaining in
the goal of advancing interoperability, this approach the Secretary has compliance with the law. We believe
while also taking into account that the proactively identified and deemed that the approach established in the
HIT industry has not yet migrated to a acceptable newer versions of the e-prescribing rulemaking could be
single specific standard for certain following adopted ‘‘minimum standard’’ leveraged in many situations for the
purposes. In some cases, this balancing code sets: standards and implementation
has required the adoption of (1) LOINC version 2.3, released on specifications adopted for HIT
certification criteria that requires certain February 26, 2010; and certification. However, we note that this
EHR technology to be capable of (2) CVX—Vaccines Administered, approach can only be implemented
receiving electronic health information March 17, 2010. when a newer version of a standard is
We are consequently using this
formatted according to a standard that it technically capable of fully functioning
opportunity to inform Complete EHR
is not natively capable of generating. For with the adopted version of the standard
and EHR Module developers,
example, with respect to patient to conduct the specified transaction.
prospective ONC-Authorized Testing Much like minimum code set
summary records, we have adopted the
Continuity of Care Document and and Certification Bodies, and the rest of standards, we could foresee possibly
Continuity of Care Record standards as the public of the Secretary’s recognition adopting a backward compatible version
alternatives. As a condition of of these newer versions of certain of a previously adopted standard and
certification, section 170.304(i)(1) adopted ‘‘minimum standard’’ code sets. allowing entities to voluntarily use the
provides as an additional requirement We reiterate that use of these newer newer version for a period of time. In
that upon receipt of a patient summary versions is voluntary. We also note in such cases, much like a minimum code
record formatted in the alternative accordance with 45 CFR 170.455(b)(2) set standard, Complete EHR and EHR
standard, the EHR technology must be that Certified EHR Technology may be Module developers would be permitted
capable of displaying the patient upgraded to comply with these newer to have their Complete EHR or EHR
summary record in human readable versions at any time without adversely Module certified according to the
format. We believe this final rule affecting the certification status of the adopted backward compatible version,
correctly balances at this stage of EHR Certified EHR Technology. and eligible professionals and eligible
adoption our goal of promoting • Optional Standards, hospitals in possession of Certified EHR
interoperability with the HIT industry’s Implementation Specifications, and Technology would be permitted to
ability to comply with the certification Certification Criteria. We believe that upgrade voluntarily their Certified EHR
criteria and its need for flexibility. additional flexibility and specificity can Technology to include the adopted
Consistent with our long-term goals for be introduced into this and future cycles backwards compatible version. Given
interoperability, we anticipate that this of rulemaking through the adoption and that we anticipate adopting new or
balance will need to change as the HIT designation of ‘‘optional’’ standards, modified standards, implementation
industry migrates to single specific implementation specifications, and specifications, and certification criteria
standards for particular purposes. certification criteria. Optional every two years in sync with the
• Minimum Code Set Standards. As standards, implementation initiation of a new meaningful use stage,
previously discussed in the Interim specifications, and certification criteria we believe that the Secretary’s adoption
Final Rule, we adopted several would be voluntary and would not be of backward compatible versions of
minimum code set standards. It is required for testing and certifying a standards would generally be limited to
important to note that these code set Complete EHR or EHR Module. We intermediate years (i.e., 2012 and 2014).
standards set the floor, not the ceiling, believe that optional standards, To accomplish the adoption of a
for testing and certification. If, and implementation specifications, and backwards compatible version, we
when, the Secretary accepts a newer certification criteria will also help better would take an approach very similar to
version of an adopted minimum prepare the HIT industry for future the approach described in the final
standard code set, the Secretary will, in mandatory certification requirements. e-prescribing regulation.
effect, raise the ceiling for what is • Standards and Backwards We would first review whether the
permitted for testing and certification as Compatibility. In previous rulemakings, new version of an adopted standard
well as whether Certified EHR specifically the Secretary’s adoption of retains at a minimum the full
Technology can be upgraded to that electronic prescribing (e-prescribing) functionality of the adopted version of
newer version without adversely standards (70 FR 67579) related to the the standard as well as whether it
affecting the Certified EHR Technology’s Medicare Part D prescription drug enables the successful completion of the
certified status. For context purposes we program, HHS discussed a process to applicable transaction(s) with entities
repeat a portion of the Interim Final improve flexibility in regulatory that continue to use the older version(s).
Rule’s preamble that discussed our requirements which involves We would then review whether a
approach to minimum code set ‘‘backwards compatibility.’’ HHS standard should be updated with a new
standards. described backwards compatibility as version and whether use of either the
meaning that a newer version of a new version or the older version would
We have implemented this approach by standard retains at a minimum the full be considered compliant as well as
preceding references to specific adopted functionality of the version previously whether use of the new version would
standards with the phrase, ‘at a minimum.’
In those instances, the certification criterion adopted in regulation, and that the conflict with any already existing
requires compliance with the version of the newer version would permit the regulatory requirements. If we believe
code set that has been adopted through successful completion of the applicable that the Secretary’s adoption of a newer
incorporation by reference, or any transaction(s) with entities that continue version of a standard on a voluntary
basis would be appropriate, we would all adopted standards, which, if true, 3. Certification Criteria and Associated
then seek the advice of the HIT would cause conflicts with several Standards and Implementation
Standards Committee to evaluate the adopted standards (e.g., it was noted Specifications
newer version of the standard and to that the HL7 standards we adopted We have organized our discussion of
solicit relevant public input. The utilize Minimum Lower Layer Protocol the final certification criteria according
Secretary would then recognize or adopt (MLLP) as the transport standard and to the order in which they are currently
for voluntary use the new version of the not SOAP or REST). specified at 45 CFR 170 subpart C. We
standard in a Federal Register note that the final regulatory citations
publication. At that point, use of either Response. We have considered the
public comments received on this will have changed for many certification
the new or old version would be criteria and encourage the public to
considered compliant. Entities that matter and we are convinced that it is
prudent to remove the adopted review, in full, the final regulatory text
would voluntarily adopt the later specified in subpart C of part 170 in the
backward compatible version of the standards, SOAP and REST. We did not
intend for the significant potential regulation text of this final rule. We
standard would remain obligated to begin with the certification criteria at 45
accommodate the earlier adopted conflicts identified by commenters to
occur as a result of our adoption of CFR 170.302 (general certification
version without modification. Prior to criteria for Complete EHRs and EHR
the Department formally retiring the SOAP and REST. We have determined
Modules), move on to 45 CFR 170.304
older version of the standard and that it would be more appropriate and
(specific certification criteria for
mandating the use of the later version, reasonable for us not to require at the Complete EHRs and EHR Modules
the Department would engage in notice present time specific transport designed for an ambulatory setting) and
and comment rulemaking. standards as a condition of certification. end with 45 CFR 170.306 (specific
We hope that this will reduce some of certification criteria for Complete EHRs
2. Transport Standards
the burden on Complete EHR and EHR or EHR Modules designed for an
Comments. Generally, commenters Module developers and provide greater inpatient setting). We also include,
echoed one of two responses: Some opportunities for innovation. With that where appropriate, a discussion of the
urged for the complete removal of SOAP said, we plan to carefully watch the adopted standard(s) and
and REST and others requested that we impact of this decision and its affect on implementation specifications
provide detailed implementation interoperability. We encourage associated with each certification
specifications for SOAP and REST along Complete EHR and EHR Module criterion. For each final certification
with the identification of the developers to utilize transport standards criterion, we start with an overview of
transactions to which SOAP and REST that will help the industry coalesce the final version and then discuss and
were applicable. Some commenters also around common methods for electronic respond to public comments.
stated that neither standard was health information exchange, and we
sufficiently specified in order to ensure a. General Certification for Complete
plan to examine this decision in future EHRs or EHR Modules—§ 170.302
interoperability, while others pointed rulemakings.
out that it appeared that we had globally Section 170.302(a)—Drug-Drug, Drug-
applied the usage of SOAP or REST to Allergy, Drug-Formulary Checks
Meaningful use
Meaningful use Stage 1 objective Certification criterion
Stage 1 measure
Implement drug-drug and drug-al- The EP/eligible hospital/CAH has Interim Final Rule Text:
lergy interaction checks. enabled this functionality for the (1) Alerts. Automatically and electronically generate and indicate
entire EHR reporting period. in real-time, alerts at the point of care for drug-drug and drug-
allergy contraindications based on medication list, medication
allergy list, age, and computerized provider order entry
(CPOE).
(3) Customization. Provide certain users with administrator rights
to deactivate, modify, and add rules for drug-drug and drug-al-
lergy checking.
(4) Alert statistics. Automatically and electronically track, record,
and generate reports on the number of alerts responded to by
a user.
Final Rule Text: § 170.302(a).
(1) Notifications. Automatically and electronically generate and
indicate in real-time, notifications at the point of care for drug-
drug and drug-allergy contraindications based on medication
list, medication allergy list, and computerized provider order
entry (CPOE).
(2) Adjustments. Provide certain users with the ability to adjust
notifications provided for drug-drug and drug-allergy interaction
checks.
Meaningful use
Meaningful use Stage 1 objective Certification criterion
Stage 1 measure
Implement drug-formulary checks ... The EP/eligible hospital/CAH has Interim Final Rule Text:
enabled this functionality and (2) Formulary checks. Enable a user to electronically check if
has access to at least one inter- drugs are in a formulary or preferred drug list in accordance
nal or external drug formulary with the standard specified in § 170.205(b).
for the entire EHR reporting pe- Final Rule Text: § 170.302(b).
riod. Drug-formulary checks. Enable a user to electronically check if
drugs are in a formulary or preferred drug list.
Comments. Based on the example alerts they received. Two commenters ‘‘response’’ to an alert. One commenter
given in the preamble of the Interim requested that ‘‘responded to by a user’’ recommended that the rule clarify that
Final Rule, several commenters believed be clarified and asked whether it meant ‘‘responded to by a user’’ means in a way
that we required real-time alerts to that a user had taken a different action which meaningfully addresses the
utilize a pop-up message or sound. as a result of the alert. One commenter alerts. A couple of commenters stated
Commenters stated that the method of recommended removing the alert that centrally hosted services would
delivering real-time alerts should not be requirement unless it is more clearly have problems complying with the
included in the regulation as it would specified. One commenter customization requirements because the
restrain innovation. One commenter recommended deleting the requirement hosting vendor takes responsibility for
expressed concern that the requirements on alert statistics because it could lead the administration, maintenance and
of this certification criterion were overly to alert fatigue. A few commenters updating of the clinical decision
specific with respect to how the expressed concern about the ability to support rules including alerts for drug
Certified EHR Technology needed to deactivate, modify, and add rules for interactions alerts, including drug-drug,
perform the tasks rather than focusing drug-drug and drug-allergy checking. drug-allergy and drug-problem. These
on the desired result. The commenter These commenters recommended that commenters were concerned that
recommended the certification criterion this capability be removed because of allowing each of their clients to create
be modified to ensure that such alerts the risk to patient safety. A commenter local drug-interaction rules would slow
are clearly visible to the physicians at noted that treating physicians should their ability to provide important
the point-of-care. Some commenters have the ability to ignore alerts in light updates to their client base, since this
recommended that the term of other clinical facts about the patient would require navigation of a complex
‘‘notification’’ should replace the term and felt that providing the ability to hierarchy of preferred local rules. These
‘‘alert’’ for this and other certification delete or modify alerts in a way that local rules would also introduce clinical
criterion because the term alert implied would be inconsistent with current risk if old local rules could create a
a particular implementation whereas medical standards would be conflict with a clinically appropriate
notification was more neutral. irresponsible and contrary to the global, updated rule.
Response. Unfortunately, many of the meaningful use goal of preserving the Response. Based on the significant
commenters who reacted to our example health and safety of patients. Other number of comments presenting diverse
also believed that it was a requirement. commenters requested clarification as to interpretations of these provisions, we
We simply added the example of a pop- whether the ability to ‘‘deactivate’’ rules determined that this certification
up message or sound in the preamble of implied the ability to remove specific criterion needed further clarification
the Interim Final Rule to make the rules or drug pairs as they exist in and have revised it accordingly. Our
requirement clear. The use of a pop-up commercially-available clinical decision intention related to the alert statistics
message or sound was not a specified support (CDS) databases; the ability to capability had been to mirror the
requirement in the regulation text. We ‘‘modify’’ rules implied that an clinical decision support capability.
agree with the commenters who administrator would be able to change With respect to customization, we
explained that there may be better ways the rules as they exist in these sought to provide users of Certified EHR
to provide alerts. For the purposes of commercially-available CDS databases; Technology with a way to adjust the
testing and certification, we leave it and the ability to ‘‘add’’ new rules severity level for which alerts are
entirely up to Complete EHR and EHR implied that the administrator could presented. In response to public
Module developers to innovate in this create new rules in comment, and to clarify what we believe
area and provide capabilities that are commercially-available CDS databases. Certified EHR Technology must include
both easy to use and prevent medical The commenters interpreted ‘‘modify’’ to as a condition of certification, we have
errors. Additionally, we agree with the mean, for example, the ability to removed the ‘‘alert statistics’’ part of the
commenters who suggested that we override or change severity setting; and certification criterion altogether and
replace ‘‘alert’’ with ‘‘notification,’’ and ‘‘add’’ to mean activating a category of revised the ‘‘customization’’ part of the
we have made that change globally CDS, such as drug-drug interactions, but certification criterion to more clearly
across all certification criteria that used not individual rules; and ‘‘deactivate’’ as specify this capability. Our revisions
the term alert. the ability to ‘‘turn off’’ specific types of focus on Certified EHR Technology’s
Comments. A few commenters rules. Another commenter requested capability to allow certain users (e.g.,
requested clarification of the clarification as to whether the those with administrator rights) with the
requirement to track and report on the requirement for customization would be
ability to adjust notifications provided

number of alerts responded to by a user. met if a system administrator were to set for drug-drug and drug-allergy checks
A commenter requested clarification on the selected severity level to reflect the (e.g., set the level of severity for which
why the number of alerts is captured but collective decision of a practice or if notifications are presented).
not what the user did with the alert and alerts must be tailored on an EP-by-EP Comment. A commenter stated that
if this data is going to be used to rate basis. A commenter requested use of age as a required data element in
providers based upon the number of clarification on what qualifies as a this certification criterion is a problem
because drug databases handle age in drug-drug and drug-allergy checks based general certification criterion that would
non-standard ways. It was also stated on medication list and medication be applicable to both Complete EHRs
that for geriatric patients weight is also allergy list information included within and EHR Modules designed for
considered along with age. Certified EHR Technology as structured ambulatory and inpatient settings.
Response. We agree with this data. We recognize that Certified EHR Accordingly, we have removed any
commenter. After considering this Technology may also store health reference to a particular standard
comment, particularly in light of the information in scanned documents, because an eligible professional or
potentially divergent interpretations of images, and other non-interoperable eligible hospital that does not have
this certification criterion we noted non-computable formats and, external access to a drug formulary
above, we have removed ‘‘age’’ from the consequently, do not expect Certified would be able to satisfy this meaningful
certification criterion. It was never our EHR Technology to be capable of use measure by checking an internally
intention, as could have been reading or accessing the information in managed drug formulary. Although the
anticipated, to require that Certified these other formats for the purposes of Formulary and Benefits standard is no
EHR Technology be capable of performing drug-drug and drug-allergy longer required as a condition of
performing checks that relate type or checks. certification, we note that eligible
dosage of drugs to the patient’s age, or Comment. A commenter requested professionals who seek to comply with
‘‘drug-age checks.’’ that ONC clarify that EHR vendors will the electronic prescribing requirements
Comment. A commenter encouraged not be required to remove the option to associated with Medicare Part D eligible
ONC to add adverse drug events to the disable drug-drug and drug-allergy individuals will need to use this
certification criterion and to identify checks. standard as they do today. Additionally,
candidate standards for its inclusion to Response. While we do not require we do not agree that it is within the
support meaningful use Stage 2. that the option to disable drug-drug and scope of this rulemaking to address
Response. We appreciate the drug-allergy checks be removed as a State Medicaid Agencies’ participation
suggestion and believe that identifying condition of certification, we note that in nationwide e-prescribing networks.
adverse drug events is important. in order for an eligible professional or Comments. Many commenters noted
Because the final meaningful use Stage eligible hospital to become a meaningful that the drug-formulary requirement
1 requirements under the Medicare and user of Certified EHR Technology this should not apply to Complete EHRs and
Medicaid EHR incentive programs do capability must be enabled. EHR Modules designed for an inpatient
not include such a requirement, though, Comments. Several commenters noted setting because there was no proposed
we do not believe that it would be that the NCPDP Formulary and Benefits requirement for meaningful use Stage 1
appropriate at the present time to add standard is not used in an inpatient for eligible hospitals to electronically
such a requirement as a condition of setting. The commenters consequently prescribe. Many of the commenters
certification. This does not preclude requested clarification as to how the recommended removing this as a
Complete EHR or EHR Module standard can be used in an inpatient requirement for eligible hospitals while
developers from including such setting. Some of the commenters noted retaining it with the criteria for eligible
functionality. that for inpatient settings, hospitals professionals. A few commenters
Comment. A couple of commenters typically relied on their own specifically recommended adding it to
requested clarification on what CPOE formularies for performing the types of the criterion for electronic prescribing.
means in the certification criterion. A checks specified. Another commenter Several commenters recommended that
commenter requested that ONC clarify requested clarification whether the if the requirement were kept for
that this certification criterion applies correct content exchange standard was hospitals it should be written as a
only to the order-entry workflow and is National Council for Prescription Drug separate criterion to address the query
not applicable to other office processes Programs (NCPDP) Formulary and of a hospital’s drug formulary during the
or workflows which might involve the Benefits Standard version 1.0 and that if order entry process and not the NCPDP
same clinical data but which would not it was, the commenter recommended its Formulary and Benefits standard. A
necessarily generate these alerts. adoption. Another commenter noted commenter stated that current industry
Response. We clarify for commenters that some State Medicaid formularies practice among vendors of EHR
that our inclusion of CPOE in the are not yet available via nationwide e- technology is to provide a ‘‘generic’’
certification criterion is meant to prescribing networks and recommended national formulary rather than the
indicate that notifications should occur that ONC encourage the implementation formulary for a particular plan. The
based on new medication orders, in of State Medicaid formularies within the commenter recommended that the
addition to a patient’s current NCPDP Formulary and Benefits functionality require that a user actually
medications and medication allergies, as Standard via a nationwide e-prescribing perform an eligibility check before
they are being entered. In response to network. access is provided and, in response to
the other commenter’s request for Response. We agree with those that check, the functionality show the
clarification, we believe that commenters who identified the correct formulary and benefits
notifications will occur during the inconsistency of applying the Formulary information, rather than just generic
order-entry workflow. and Benefits standard to the inpatient data.
Comment. A commenter requested setting. Because the CMS proposed Response. We believe that our
that the rule be clarified to explicitly meaningful use objectives applied to discussion above regarding the removal
require that drug-drug, drug-allergy, and both eligible professionals and eligible of the standard associated with this
drug formulary checks occur based on hospitals, we did not make the certification criterion addresses many of
distinction as to when a Complete EHR the concerns raised by commenters.
information and medication lists in an

individual’s complete medical record or EHR Module would need to include However, we disagree with the
derived from all relevant providers, not the Formulary and Benefits standard. suggestion that Complete EHRs and EHR
only the drug list of the specific However, in light of these comments Modules designed for an inpatient
provider. and to support the final meaningful use setting should not be required to
Response. We clarify that we expect measure, we have determined that it include this capability. This capability
Certified EHR Technology to perform would be appropriate to adopt a more is required to be enabled for the
purposes of meeting the meaningful use Response. In this rule, the Secretary is laboratory testing to ensure that drugs
Stage 1 measure. Consistent with the completing the adoption of the initial are prescribed appropriately. The
final meaningful use Stage 1 objectives set of standards, implementation commenter stated, for example, that an
which separated drug-drug and drug- specifications, and certification criteria anticoagulant medication should not be
allergy checks from drug-formulary for the certification of Complete EHRs prescribed unless there is a test result
checks, we have separated out these and EHR modules. The certification on record that shows that giving this
capabilities into two different criteria ensure that Certified EHR drug would not cause harm.
certification criteria. Technology includes certain Response. Presently, drug-test
Comments. A commenter stated a capabilities. The extent to which health checking is not a required capability for
concern that this criterion, combined care providers must use those eligible professionals and eligible
with future meaningful use capabilities and how they integrate EHR hospitals to use in order to successfully
requirements, will shift providers’ focus technology into their practice falls meet the requirements of meaningful
from prescribing the best drug for the outside the scope of this rule. We use Stage 1. Accordingly, we do not
patient to prescribing what is covered therefore do not believe that these believe that it would be appropriate to
concerns are within the scope of this require Certified EHR Technology to be
by the patient’s insurance plan or
rulemaking. capable of performing drug-test checks
generic brands. Another commenter
as a condition of certification at the
stated that adding formulary checks to Comment. A commenter
present time.
the workload of physicians will recommended that ‘‘drug-test checks’’
decrease physicians’ efficiency and should be added. The commenter stated Section 170.302(b)—Maintain Up-To-
increase their costs. that many drugs require some form of Date Problem List
Meaningful use stage 1 objective Meaningful use stage 1 measure Certification criterion
Maintain an up-to-date problem list More than 80% of all unique pa- Interim Final Rule Text:
of current and active diagnoses. tients seen by the EP or admit- Maintain up-to-date problem list. Enable a user to electronically
ted to the eligible hospital’s or record, modify, and retrieve a patient’s problem list for longitu-
CAH’s inpatient or emergency dinal care in accordance with:
department (POS 21 or 23) (1) The standard specified in § 170.205(a)(2)(i)(A); or
have at least one entry or an in- (2) At a minimum, the version of the standard specified in
dication that no problems are § 170.205(a)(2)(i)(B).
known for the patient recorded Final Rule Text: § 170.302(c).
as structured data. Final rule text remains the same as Interim Final Rule text, ex-
cept for references to adopted standards, which have been
changed.
Comments. Several commenters Comments. Several commenters eventually be able to adopt only one
expressed concerns about the use of recommended that only SNOMED–CT® standard.
ICD–9–CM because it is primarily used be adopted, or alternatively, that we Comments. A few commenters asked
for billing and administrative purposes expressly indicate an intention to move for clarification as to whether
and may not accurately represent the away from ICD–9CM and ICD–10 in the SNOMED–CT® or ICD–9CM codes
true clinical meaning of a problem or future. Another commenter needed to be included within Certified
condition when it is documented at the recommended against the adoption of EHR Technology or if these standards
point of care. One commenter stated a SNOMED–CT® because the commenter were only necessary when electronic
concern that the problem list standards felt that our adoption of SNOMED–CT® health information is exchanged. Some
do not allow for capturing of free text would require eligible professionals and of these commenters also requested that
that health care providers use when an eligible hospitals to use both ICD–9–CM we permit any coding system to be used
appropriate code is in neither and SNOMED–CT®. One commenter as long as it can be mapped to the
SNOMED–CT® nor ICD–9–CM. recommended that a publicly vetted and appropriate format when electronic
Response. The comments are correct HHS approved standard mapping health information is to be exchanged.
in that ICD–9–CM is primarily used for between ICD–9–CM and SNOMED CT® Response. As previously discussed,
billing and administrative purposes. should be made available at the public’s meaningful use requirements will
SNOMED–CT® is offered as an expense. typically specify whether an adopted
alternative standard that will support Response. We agree conceptually that standard will have to be used among
more clinical descriptions of patient a single standard for clinical components of a business organization
problems or conditions. We believe that information would be desirable in the or solely for the electronic exchange of
with the adoption of both SNOMED– long term. However, presently both health information with other legal
CT® and ICD–9–CM, healthcare ICD–9–CM and SNOMED–CT® are used entities. The measure for this final
providers should have adequate by EHR technology to code clinical meaningful use objective provides that
coverage for patient diagnoses and information, and adopting both would entries be recorded as structured data.
conditions. We are discouraging the use provide users with additional flexibility. The certification criterion specifies that
of free text for documenting problem Moreover, we anticipate that as ICD–9CM or SNOMED–CT® are the
lists since this will limit the usefulness meaningful use objectives and measures code sets which must be included in
of problem lists for clinical reminders, evolve over time, we will receive Certified EHR Technology, and are
decision support and other patient additional public input and experience therefore the code sets that would be
safety and quality reporting. related to these standards and may used to record entries as structured data.
Comments. A few commenters be capable of including entries provided criteria and we have not repeated our
recommended the removal of over an extended period of time. response. As a result, we have retained
‘‘longitudinal care’’ in the certification Consequently, for Complete EHRs and ‘‘longitudinal care’’ in each certification
criterion. These commenters cited our EHR Modules to be certified for an criterion where the term is referenced
clarification in the preamble that by ambulatory setting, they will need to be and only make this clarification once.
longitudinal care we meant ‘‘over designed to enable the user to Comment. A commenter suggested
multiple office visits.’’ These electronically record, modify, and that we include a reasonable
commenters questioned how this retrieve a patient’s problem list over expectation of what constitutes ‘‘up-to-
language would be applicable to an multiple encounters. For an inpatient date’’ in the reference to ‘‘up-to-date’’
inpatient setting since patients are setting, they will need to enable the user problem list.
typically treated for acute episodes and to electronically record, modify, and Response. We referred this comment
not over multiple office visits. retrieve a patient’s problem list for the to CMS, and it is addressed in the final
duration of an entire hospitalization. rule on the Medicare and Medicaid EHR
Response. The reference to
This clarification was also requested in Incentive Programs.
longitudinal care is intended to convey
that the problem list must be relation to the medication list and Section 170.302(c)—Maintain Active
comprehensive in the sense that it must medication allergy list certification Medication List
Maintain active medication list ........ More than 80% of all unique pa- Interim Final Rule Text:
tients seen by the EP or admit- Maintain active medication list. Enable a user to electronically
ted to the eligible hospital’s or record, modify, and retrieve a patient’s active medication list
CAH’s inpatient or emergency as well as medication history for longitudinal care in accord-
department (POS 21 or 23) ance with the standard specified in § 170.205(a)(2)(iv).
have at least one entry (or an Final Rule Text: § 170.302(d).
indication that the patient is not Maintain active medication list. Enable a user to electronically
currently prescribed any medica- record, modify, and retrieve a patient’s active medication list
tion) recorded as structured data. as well as medication history for longitudinal care.
Comments. A few commenters agreed Comment. A commenter stated that standard we adopted if it meant
with the certification criterion. One there needs to be more clarity with modifying underlying medication
commenter requested that we provide respect to whether an EHR Module must databases. This commenter suggested
more clarity on the use of term maintain a list of all active medications that this standard as it applied to the
‘‘retrieve.’’ The commenter questioned or if a specialty system, such as a maintenance of medication lists be
whether we intended to use the word cardiology system, could maintain a list deferred. Along those lines, a couple of
‘‘retrieve’’ in the certification criterion to of medications specific to its specialty commenters stated that more
mean solely the retrieval of information use and provide the list to the enterprise clarification was needed with respect to
available to Certified EHR Technology EHR. whether RxNorm identifiers needed to
or if we intended for it to also include Response. If an EHR Module be stored internally within Certified
the interactive retrieval of medication developer seeks to have its ‘‘medication EHR Technology or only needed to be
list information from external sources. list EHR Module’’ certified, the EHR used upon the electronic exchange of
The commenter suggested we clarify Module must provide the capabilities health information. Other commenters
that ‘‘retrieve’’ meant retrieval of only specified by the certification criterion. expressly stated that the mapping of the
information internally available to We do not intend to limit how the EHR vocabulary be limited to instances
Certified EHR Technology. Other Module could appropriately provide where the electronic exchange of health
commenters, similar to their comments these capabilities (i.e., whether the EHR information would take place.
on the problem list certification Module must itself enable the user to Response. We understand these
criterion, stated that there needed to be electronically record, modify, and commenters’ concerns and agree that it
retrieve a patient’s active medication list would be premature to require the use
more clarity with respect to how the
for longitudinal care, or whether the of the adopted standard in this context.
reference to ‘‘longitudinal care’’ applied
EHR Module could be designed to In that regard, we seek to clarify for
to a Complete EHR or EHR Module used
provide those capabilities through its commenters our intention, which was
by an eligible hospital.
interaction with a device or devices at solely to associate this adopted standard
Response. We clarify that for this the enterprise level). (as some commenters suggested) with
certification criterion, and all other Comment. One comment stated that the certification criteria that require the
certification criteria, the term ‘‘retrieve’’ this criterion should include a provision capability to electronically exchange
means the retrieval of information to include the ability to transmit this health information. We recognize that
directly stored and managed by information to public health entities as continuing to associate this standard
Certified EHR Technology and that it required by law. with the adopted certification criterion
does not mean the retrieval of Response. Nothing we adopt in this could potentially impose a significant
information from external sources, final rule precludes such a capability burden on the industry, which we did
unless explicitly stated otherwise. We not intend. Accordingly, we have
from being included in a Complete EHR

also take this opportunity, in the context or EHR Module. That is not, however, removed from this certification criterion
of our response regarding ‘‘longitudinal currently a necessary requirement for the requirement to use this standard. We
care’’ above, to clarify that ‘‘medication certification. discuss our response to comments on
history’’ is intended to include a record Comments. One commenter stated the standard itself in the context of the
of prior modifications to a patient’s that it would need to perform extensive patient summary record certification
medications. reprogramming to accommodate the criterion.
Section 170.302(d)—Maintain Active

Medication Allergy List
Maintain active medication allergy More than 80% of all unique pa- Interim Final Rule Text:
list. tients seen by the EP or admit- Maintain active medication allergy list. Enable a user to electroni-
ted to the eligible hospital’s or cally record, modify, and retrieve a patient’s active medication
CAH’s inpatient or emergency allergy list as well as medication allergy history for longitudinal
department (POS 21 or 23) care.
have at least one entry (or an Final Rule Text: Unchanged
indication that the patient has no Now § 170.302(e).
known medication allergies) re-
corded as structured data.
Comments. Much like the prior Comments. Many commenters objective and measure. We would like to
certification criterion, many suggested that non-medication allergies reiterate, however, that a certification
commenters signaled their support for be added to this certification criterion. criterion sets the floor not the ceiling for
this certification criterion. Other A few commenters stated that it could the capabilities Certified EHR
commenters raised the same points jeopardize patient safety if not all Technology must include. We
related to this certification criterion as allergens were included in Certified encourage Complete EHR and EHR
they did for the medication list EHR Technology. Module developers to provide more
certification criterion. Response. Patient safety is one of comprehensive capabilities than those
HHS’s top priorities. At the present currently required for achieving
Response. We believe our responses time, the final meaningful use objective
to the problem list and medication list certification.
and measure focus on medication
certification criteria are applicable to allergies. Accordingly, we have adopted Section 170.302(e)—Record and Chart
these repeated comments. a certification criterion to support this Vital Signs
Record and chart changes in vital For more than 50% of all unique Interim Final Rule Text:
signs: patients age 2 and over seen by (1)Vital signs. Enable a user to electronically record, modify, and
• Height the EP or admitted to eligible retrieve a patient’s vital signs including, at a minimum, the
• Weight hospital’s or CAH’s inpatient or height, weight, blood pressure, temperature, and pulse.
• Blood pressure emergency department (POS 21 (2)Calculate body mass index. Automatically calculate and dis-
• Calculate and display BMI or 23), height, weight and blood play body mass index (BMI) based on a patient’s height and
• Plot and display growth pressure are recorded as struc- weight.
charts for children 2–20 tured data. (3) Plot and display growth charts. Plot and electronically display,
years, including BMI. upon request, growth charts for patients 2–20 years old.
Final Rule Text: § 170.302(f).
(1)Vital signs. Enable a user to electronically record, modify, and
retrieve a patient’s vital signs including, at a minimum, height,
weight, and blood pressure.
(2) Unchanged
(3) Unchanged
Comment. One commenter noted that commenters requested that we remove Response. We believe that this
the units of measurement should be BMI as part of the certification criterion recommendation is overly specific, is
specified in the EHR with regards to for Complete EHR or EHR Modules more germane to meaningful use, and
vital signs. For example that height designed for an inpatient setting. The exceeds the type of capability we
should be specified in inches or rationale provided was that acute care believe should be specified as a
centimeters. providers would not be required to track condition of certification.
Response. We do not believe that this BMI.
level of specificity is necessary. We Response. While we can understand Comments. A few commenters noted
expect that Complete EHR and EHR these commenters’ concern, we believe this certification criterion applies more
Module developers will include the that BMI is a simple mathematical directly to specialties that
units of measure that their customers calculation that Certified EHR predominantly treat children. For other
believe are necessary to meet their Technology should be capable of specialties, this criterion would add
needs, which in many cases will performing regardless of the setting for unnecessary cost and complexity to
include those that patients routinely which it is designed. many HIT products that they would use.
request. We also expect that many Comment. One commenter Many commenters suggested that a
recommended that BMI and age growth chart component should not be
Complete EHR and EHR Module

developers will offer both metric units components should be used to create an required for EHR technology designed
and U.S. units of measurement, as a alert when an unhealthy BMI is for an inpatient setting, as it is not
standard business practice. indicated for a patient and that Certified feasible to track this data in a
Comments. In what appeared to be a EHR Technology should record whether meaningful way over a long enough
reaction to the proposed meaningful use the patient was informed of the period of time in an inpatient setting
objective and measure, some unhealthy BMI status. (which is typically of a short and
infrequent duration). A couple of this certification criterion establishes a understand that this type of information
commenters suggested that non- floor, not a ceiling, and we encourage is typically provided along with the
traditional forms of growth charts Complete EHR and EHR Module growth chart itself to provide greater
should be accepted. One commenter developers to include additional relevance and meaning for the growth
suggested that the certification criterion functionality where it will enhance the charts. We encourage Complete EHR
establish a baseline, but should not limit quality of care that eligible professionals and EHR Module developers to include
the expansion of this capability to other and eligible hospitals can provide. this feature.
ages. Other commenters made specific Comments. Similar to the comments Comment. A commenter suggested
suggestions for different age ranges, above, many commenters suggested the that SNOMED–CT® be used for
such as including children under the growth chart requirement should designation of BMI.
age of two and lowering the upper age include children under age 2. The Response. Although we agree that
to ages less than 20 years old (e.g., 18). charting would then include: weight, SNOMED–CT® could be used to code
length, pulse oximetry, head BMI, we only require that Certified EHR
Response. As we stated above with circumference, and blood pressure (with
respect to the calculation of BMI, we Technology be capable of calculating
percentiles based on age and weight). BMI. We do not believe that it is
believe that Certified EHR Technology Response. For Stage 1, the related
should be capable of performing this necessary, as a condition of
meaningful use objective addresses ages certification, to specify how BMI should
capability regardless of the setting for 2–20. In order to remain consistent with be coded. That being said, we do not
which it is designed. Moreover, with and support this objective, we do not preclude the use of SNOMED–CT® to
respect to whether growth charts should believe that it is necessary at this time code BMI.
be applicable to Complete EHRs and to require a capability for charting any Comment. One commenter suggested
EHR Modules designed for an inpatient additional ages as a condition of that the certification criterion should be
setting, we remind commenters that certification. better aligned with the final meaningful
children’s hospitals qualify as eligible Comment. One commenter requested use objective and measure. The
hospitals under the Medicaid EHR that we clarify whether ‘‘plot and commenter noted that the criterion
incentive program and will also need to electronically display’’ means to plot includes temperature and pulse, which
demonstrate meaningful use of Certified height, weight, and BMI over time or is not included in the meaningful use
EHR Technology. We do not preclude against national norms. objective and measure.
Complete EHR and EHR Module Response. We clarify that we expect a
Response. We agree with the
developers from designing novel growth chart to plot the height, weight,
comment and have removed
approaches to displaying growth charts. and BMI over time, as compared to
temperature and pulse from the
Finally, we concur with the commenter national norms. While the regulation
certification criterion.
that suggested this certification criterion text does not specifically require
should be a baseline. We reiterate that comparison to national norms, we Section 170.302(f)—Smoking Status
Record smoking status for patients More than 50% of all unique pa- Interim Final Rule Text:
13 years old or older. tients 13 years old or older seen Smoking status. Enable a user to electronically record, modify,
by the EP or admitted to the eli- and retrieve the smoking status of a patient. Smoking status
gible hospital’s or CAH’s inpa- types must include: current smoker, former smoker, or never
tient or emergency department smoked.
(POS 21 or 23) have smoking Final Rule Text: § 170.302(g).
status recorded as structured Smoking status. Enable a user to electronically record, modify,
data. and retrieve the smoking status of a patient. Smoking status
types must include: current every day smoker; current some
day smoker; former smoker; never smoker; smoker, current
status unknown; and unknown if ever smoked.
Comments. Several commenters provide value for both clinical care and Concurring with CMS, we believe that
stated that the smoking status public health. Commenters the fields associated with this measure
certification criterion was overly recommended that besides what we had should mirror those expressed in the
prescriptive because it specified certain specified, the certification criterion Centers for Disease Control and
status variables. These commenters should also reference packs per day Prevention, National Center for Health
agreed that recording smoking status is history information, secondhand smoke Statistics, National Health Interview
crucial to health improvement efforts, exposure, and alcohol consumption Survey related to smoking status
but contended that mandating certain information. Other commenters recodes.2 Accordingly, the final
fields was the wrong approach. Many of recommended that the certification certification criterion further specifies
these commenters stated that they were criterion be changed to reflect tobacco and slightly broadens the smoking
use rather than smoking. statuses we expect Certified EHR
unaware of defined industry standard Response. We have adopted this
value set for smoking terminology and Technology to be capable of recording.
certification criterion to fully support Generally speaking, we understand that
other suggested that our reference to
the final meaningful use objective and a ‘‘current every day smoker’’ or ‘‘current
specific types of smokers be removed. measure, which in response to some day smoker’’ is an individual who
Others asked whether these variables comments has been revised to further has smoked at least 100 cigarettes
were examples or the only responses clarify the purpose of the objective and during his/her lifetime and still
allowed. A few commenters agreed with measure. We therefore disagree with
this certification criterion as reasonable those commenters who stated that this 2 Smoking status recodes: http://www.cdc.gov/
and appropriate because it would certification criterion is too prescriptive. nchs/nhis/tobacco/tobacco_recodes.htm.
regularly smokes everyday or his/her lifetime.3 The other two statuses past, but their whether they currently
periodically, yet consistently; a ‘‘former (smoker, current status unknown; and still smoke is unknown. The last status
smoker’’ would be an individual who unknown if ever smoked) would be of ‘‘unknown if ever smoked’’ is self-
has smoked at least 100 cigarettes available if an individual’s smoking explanatory.
during his/her lifetime but does not status is ambiguous. The status ‘‘smoker,
currently smoke; and a ‘‘never smoker’’ current status unknown’’ would apply to Section 170.302(g)—Incorporate
would be an individual who has not individuals who were known to have Laboratory Test Results
smoked 100 or more cigarettes during smoked at least 100 cigarettes in the
Incorporate clinical lab-test results More than 40% of all clinical lab Interim Final Rule Text:
into certified EHR technology as tests results ordered by the EP (1) Receive results. Electronically receive clinical laboratory test
structured data. or by an authorized provider of results in a structured format and display such results in
the eligible hospital or CAH for human readable format.
patients admitted to its inpatient (2) Display codes in readable format. Electronically display in
or emergency department (POS human readable format any clinical laboratory tests that have
21 or 23) during the EHR report- been received with LOINC® codes.
ing period whose results are ei- (3) Display test report information. Electronically display all the
ther in a positive/negative or nu- information for a test report specified at 42 CFR
merical format are incorporated 493.1291(c)(1) through (7).
in certified EHR technology as (4) Update. Enable a user to electronically update a patient’s
structured data. record based upon received laboratory test results.
Final Rule Text: § 170.302(h).
(1) Unchanged.
(2) Display test report information. Electronically display all the
information for a test report specified at 42 CFR
493.1291(c)(1) through (7).
(3) Incorporate results. Electronically attribute, associate, or link
a laboratory test result to a laboratory order or patient record.
Comments on 170.302(g)(1) differently for ambulatory and inpatient patient’s stay at the hospital or if we
Comments. A few commenters settings by requiring that Complete meant to also include the receipt of
suggested that we specify in the EHRs and EHR Modules designed for an laboratory test results from other time
regulation that the reference to receiving ambulatory setting be required to periods. They suggested requiring only
clinical laboratory test results in a receive HL7 2.5.1 formatted laboratory those laboratory test results obtained
‘‘structured format’’ means in HL7 test results and those designed for an during the patient stay.
version 2.3.1 format. These commenters inpatient setting be required to receive
Response. For the purposes of
further recommended that we refer to HL7 2.3.1 formatted laboratory test
results. One commenter suggested that demonstrating compliance with this
HL7 version 2.3.1 within the certification criterion, we do not specify
certification criterion. These our objectives could be better supported
if we stated that in this certification the contexts (e.g., a patient stay) under
commenters stated that many Complete which laboratory test results are
EHR and EHR Module developers criterion a requirement that laboratory
results must be received electronically received. Rather, consistent with the
already use HL7 2.3.1 and that adopting meaningful use objective and measure
it as a standard would spur industry- using HL7 transactions with
implementation guidance. and the capabilities required by this
wide adoption and also set the stage for certification criterion, we specify that
driving adoption of future HL7 Response. While we understand the
intent of these commenters’ suggestions, when laboratory test results are received
standards, like HL7 2.5.1, in the later
we do not believe that it is within the in structured format by Certified EHR
stages of meaningful use. A commenter
scope of this rule to dictate the standard Technology, that the results can be
in support of including HL7 2.3.1 stated
that it was concerned that if we did not by which laboratories transmit test incorporated.
specify a standard for this requirement results. The scope of this rule is the Comment. One commenter requested
that there could be confusion regarding adoption of certification criteria that that we clarify whether the structured
which version of the standard should be specify required capabilities of Certified data requirement applies to all
used, and that laboratories would have EHR Technology (in this case, receiving laboratories (including reference labs,
to continue to support multiple laboratory information in structured hospital labs, physician office labs, and
standards. Another commenter also format) and not, in this instance, physicians performing their own lab
noted that we did not specify a standard specifying the standard by which tests).
format for the laboratory results that laboratories must transmit test results.
Response. This certification criterion
Certified EHR Technology must be Comment. A commenter requested
requires Complete EHRs and EHR
capable of receiving. This commenter, that we clarify how this certification
criterion is applicable to hospital Modules to provide the capability to
however, stated that many EHRs are
receive clinical laboratory test results in
compliant with HL7 2.5.1 for the settings. The commenter asked whether
purposes of receiving laboratory results. we intended for the capability of a structured format as a condition of
The commenter also recommended that receiving laboratory test results to certification. It does not speak to how
we apply this certification criterion include results obtained during a laboratories must send the test results.
3 ftp://ftp.cdc.gov/pub/Health_Statistics/NCHS/
datasets/DATA2010/Focusarea27/O2701a.pdf.
Comments on 170.302(g)(2) Comments on 170.302(g)(3) as the record maintained in the EHR.

Comments. Some commenters agreed One commenter stated that paragraph
Comments. Some commenters (g)(4) could imply process and system
requested clarification on this specific with the capability specified in
170.302(g)(3). One noted a concern that behavior that we did not intend to
capability within the certification require. The commenter stated that it is
criterion regarding what needed to be modifications to either a certified
Complete EHR or certified EHR Module common practice in a hospital setting
displayed in the context of LOINC for lab results to be transmitted in high
codes. These commenters suggested that could potentially result in the failure of
Certified EHR Technology to display the volume from a lab system to an EHR and
we not require the display of the actual made available for review to the
LOINC code, but the description test report information as required by
clinician through the EHR, without a
associated with the LOINC code. A the regulations and, thereby, put the
need for a user to review each
laboratory in technical violation of the
commenter suggested that we identify a transaction before updating the EHR to
CLIA regulations. These commenters
subset of common LOINC codes instead make the results available. Another
reasoned that because a Complete EHR
of requiring that tens of thousands of commenter made a similar point and
or EHR Module must be tested and
LOINC codes be supported for the questioned whether an ‘‘update’’ meant
certified to be in compliance with 42
purposes of certification. Other manual intervention, which they stated
CFR 493.1291(c)(1) through (7) that
commenters suggested that we offer would be impracticable in a hospital
certification should replace any
guidance in the form of a ‘‘starter set’’ of setting. One commenter stated that most
requirement for the laboratory to
LOINC codes to encourage the use of the EHR technology already links orders to
confirm that the information has been lab results in an established way. The
standard. One commenter requested that
properly transmitted and meets the commenter also indicated that the
we confirm its understanding of this
CLIA requirements. These commenters certification criterion we adopted
specific part of the certification
also asserted that a laboratory should be requires changes to a process that most
criterion, which is that Certified EHR
relieved of any further regulatory EHR developers have already
Technology must demonstrate the
responsibility under 42 CFR implemented and introduces
capability to import LOINC coded
493.1291(c)(1) through (7) for the inefficiencies for both EHR developers
results from an external source. Finally,
display of the required report and health care providers.
one commenter noted that the heading
information to the physician or Response. We appreciate the issues
for the standard at § 170.205(a)(2)(iii)
subsequent viewers of the information if raised by commenters on this specific
should just refer to ‘‘laboratory test
the Certified EHR Technology has been capability and have revised this part of
results’’ and not ‘‘laboratory orders and
implemented by an eligible professional the certification criterion to more clearly
results.’’
or eligible hospital. One commenter express our expectation for Certified
Response. We clarify that we do not reiterated the point by stating that EHR Technology and to be responsive to
expect Certified EHR Technology to because Certified EHR Technology and consistent with commenters’
natively (or internally) support LOINC would be required to display the suggestions. We intended for an update
in its entirety, which is why we do not required CLIA report elements, to mean, as indicated by the meaningful
believe that it is necessary to specify a laboratories should not be unfairly held use objective and measures, that a
subset of common LOINC codes. Given accountable for any elements that may laboratory test result would be
the diverse comments and requests for be removed or altered by other parties incorporated in Certified EHR
clarification on this specific aspect of from the test report before received by Technology with the originating
the certification criterion, we agree with the physician. laboratory order or with a patient’s
commenters that we should not require Response. While we can understand record in any one of the methods
a LOINC code that has been received, to the concern expressed by these specified. Accordingly we have revised
then be displayed. Accordingly, we commenters, we reiterate that the scope this specific capability to more clearly
have decided to remove this of our authority under this final rule reflect our intent. We believe this
requirement from the certification only applies to capabilities that addresses commenters’ concerns and
criterion. We do, however, wish to Certified EHR Technology must include. requests for clarification and would
further clarify our current approach to As a result, we cannot provide the permit batches of laboratory test results
Certified EHR Technology’s use of regulatory relief that these commenters to be electronically linked to laboratory
LOINC codes. Presently, we expect seek. orders or patient records without
Certified EHR Technology to be able to manual intervention.
reuse a LOINC code once it has been Comments on 170.302(g)(4)
Comments. Some commenters noted
received and is accessible to Certified Comments. A couple of commenters that small and medium size practices
EHR Technology. We do not expect, as questioned whether we intended for the have had a difficult time working with
we mention above, that Certified EHR ‘‘updates’’ to be manual updates of commercial laboratory vendors to
Technology will have to crosswalk or electronic records. If that were true, provide interfaces from which they can
map internal or local codes to LOINC some commenters were concerned that receive lab test results. These
codes. This clarification is applicable to would create workflow problems and commenters noted that laboratory
the standard that we have adopted reduce the availability of results. Other vendors typically charge too much for
regarding LOINC codes now specified at commenters suggested that either the their services and do not prioritize
§ 170.207. This response is applicable to user be able to create an additional establishing connections with small and
similar comments we received on other record, rather than be permitted to medium size practices because they do
certification criteria that also referenced change the ‘‘official’’ record or that an
not have the same volume of laboratory

the use of LOINC codes. Finally, we adequate audit trail be preserved of the referrals as large practices.
agree with the commenter who existing data and any updates, since an Response. This certification criterion
suggested that we revise the heading of update may result in disparities with requires as a condition of certification
the standard at § 170.205(a)(2)(iii). We the official record of test results. These that Certified EHR Technology be
have done this as part of the overall commenters wanted to ensure that the capable of supporting electronic
restructuring of the regulation text. laboratory’s record would be the same laboratory interfaces. We understand the
concerns raised by commenters necessary to design the ways in which capability would not disqualify a
pertaining to the difficulty of certain the data associated with certain Complete EHR or EHR Module from
practices being able to obtain laboratory laboratory results (e.g., microbiology, becoming certified.
interfaces and note that the meaningful molecular pathology) are displayed in Response. Enabling a Complete EHR
use Stage 1 measure associated with this EHR systems to ensure appropriate or EHR Module to receive ‘‘raw or pre-
certification criterion is included in the presentation and interpretation. final-report lab data’’ is not required
‘‘menu set’’ specified by CMS which we Response. With the exception of under this or any other adopted
believe should help assuage some displaying the required elements certification criterion.
commenters’ concerns. We do not specified at 42 CFR 493.1291(c)(1) Comment. One commenter suggested
believe that the ability of a practice through (7), we do not require as a that we modify this certification
(regardless of size) to obtain an interface condition of certification any additional criterion to require transmission of
or other type of connection is an issue display requirements. Accordingly, we cancer related lab tests and results to
that is within the scope of this final rule do not preclude Complete EHR and EHR cancer registries as required by law.
to address. Module developers from designing more
Response. Because this certification
Comment. One commenter specific displays of laboratory results criterion is about incorporating lab test
recommended that we revise this that may need to be displayed in a more results in Complete EHRs and EHR
certification criterion to require that complex fashion.
Modules and does not require any
laboratory domain expertise be Comment. One commenter requested
electronic transmissions, we do not
exhibited when laboratory information that we clarify that Certified EHR
believe that this is an appropriate
is displayed. The commenter further Technology did not need to enable the
requirement to consider.
elaborated by stating that laboratory EHR Technology user to receive
results are not homogeneous, and that voluminous raw or pre-final-report lab Section 170.302(h)—Generate Patient
specific laboratory domain expertise is data, and further, that not providing this Lists
Generate lists of patients by spe- Generate at least one report listing Interim Final Rule Text:
cific conditions to use for quality patients of the EP, eligible hos- Generate patient lists. Enable a user to electronically select, sort,
improvement, reduction of dis- pital or CAH with a specific con- retrieve, and output a list of patients and patients’ clinical infor-
parities, research or outreach. dition. mation, based on user-defined demographic data, medication
list, and specific conditions.
Final Rule Text: § 170.302(i).
Generate patient lists. Enable a user to electronically select, sort,
retrieve, and generate lists of patients according to, at a min-
imum, the data elements included in:
(1) Problem list;
(2) Medication list;
(3) Demographics; and
(4) Laboratory test results.
Comments. Several commenters Certified EHR Technology will be able particularly to clarify whether this term
requested clarification regarding the set to generate patient lists according to refers to problems and diagnoses.
of variables that should be included in certain data elements for which Clarification was also requested
the demographic information for the structured data will be available: regarding whether this information
patient lists. Some of these commenters Medical problems; medications; includes: a patient summary; the
suggested that the gender, race, demographics; and laboratory test patient’s entire medical history; and
ethnicity and preferred language of the results. While we respect the work patient encounter notes. One
patient should be included in this data completed by the Institute of Medicine, commenter recommended that we
set. One commenter suggested that the we do not believe that the public has clarify how the lists must be structured
final rule should explicitly adopt and had an adequate opportunity to consider and suggested that we specify time
incorporate the recommendations of a its recommendations related to periods for patient histories. One
report published by the Institute of demographics in the context of commenter requested clarification of the
Medicine in mid-2009 entitled, ‘‘Race, certification, and we are therefore not term ‘‘output,’’ and suggested that it
Ethnicity and Language Data: including them as a condition of should mean to produce a list for
Standardization for Health Care Quality certification at this time. We encourage internal use and that it does not refer to
Improvement.’’ the HIT Standards Committee to exporting the patient list to a system or
Response. We appreciate the consider this report as it recommends destination external to the office of an
commenters’ suggestions, and we have standards to the National Coordinator. eligible professional.
used them to clarify this certification Comments. Several commenters Response. We appreciate the concerns
criterion. It was our intention that requested further clarification regarding raised by these commenters and after
Certified EHR Technology would be the meaning of ‘‘patient’s clinical further consideration agree that the
able to leverage the information, information.’’ Other commenters stated terms referenced by commenters could
specifically the structured data it has that this phrase was too vague and was be interpreted in multiple ways.
available to it, to assist eligible not included as part of the proposed Accordingly we have removed ‘‘patient’s
professionals and eligible hospitals to meaningful use objective or measure clinical information’’ and ‘‘specific
generate patient lists. We have clarified and should therefore be removed. Some conditions’’ from the certification
this certification criterion to express this commenters requested further definition criterion, and have reframed the
intent. Accordingly, we expect that of the term ‘‘specific conditions,’’ certification criterion to more directly
align with the meaningful use measure subsequent use. We do not require as a patients with XYZ problem recorded in
by changing ‘‘output’’ to ‘‘generate.’’ We condition of certification that time the past 3 months). We believe that
sought to clarify that we intended that periods be associated with a patient list, these revisions make this certification
Certified EHR technology would be but presumably time (i.e., the age of the criterion clearer while addressing these
capable of electronically producing or information) could be one factor an commenters’ concerns.
‘‘generating’’ patient lists for an eligible eligible professional or eligible hospital Section 170.302(i)—Report Quality
professional or eligible hospital’s could also use to sort their lists (e.g., Measures
Eligible Professionals: Report am- For 2011, provide aggregate nu- Interim Final Rule Text:
bulatory clinical quality measures merator, denominator, and ex- (1) Display. Calculate and electronically display quality measures
to CMS or the States. clusions through attestation as as specified by CMS or States.
discussed in section II(A)(3) of (2) Submission. Enable a user to electronically submit calculated
[the Medicare and Medicaid quality measures in accordance with the standard and imple-
EHR Incentive Programs final mentation specifications specified in § 170.205(e).
rule].
Eligible Hospitals and CAHs: Re- For 2012, electronically submit the Final Rule Text: § 170.304(j).
port hospital clinical quality clinical quality measures as dis- (1) Calculate.
measures to CMS or the States. cussed in section II(A)(3) of [the (i) Electronically calculate all of the core clinical measures
Medicare and Medicaid EHR In- specified by CMS for eligible professionals.
centive Programs final rule]. (ii) Electronically calculate, at a minimum, three clinical qual-
ity measures specified by CMS for eligible professionals,
in addition to those clinical quality measures specified in
paragraph (1)(i).
(2) Submission. Enable a user to electronically submit calculated
clinical quality measures in accordance with the standard and
implementation specifications specified in § 170.205(f).
§ 170.306(i).
(1) Calculate. Electronically calculate all of the clinical quality
measures specified by CMS for eligible hospitals and critical
access hospitals.
(2) Submission. Enable a user to electronically submit calculated
clinical quality measures in accordance with the standard and
implementation specifications specified in § 170.205(f).
Comments. Many commenters stated Finally, a couple of commenters Interim Final Rule we have determined
that the Physician Quality Reporting suggested that ONC consider deferring that the PQRI 2009 Registry XML
Initiative (PQRI) 2008 Registry XML the naming of a standard for submission specification, a more recent version of
specifications apply only in the context of clinical quality measures until Stage the standards we adopted in the Interim
of eligible professionals. Some of these 2 and instead only require what is Final Rule is a suitable replacement for
commenters went on to state that necessary to support clinical quality 2008 version, and accordingly, we have
hospitals are not familiar with PQRI and measure submission in Stage 1. adopted the 2009 version in its place.
have been submitting quality Response. Many commenters We believe this revision should assuage
measurement data to CMS under a misinterpreted our intent with respect some commenters’ concerns about the
separate program. A few commenters to the adoption of the PQRI 2008 obsolescence of the adopted standard
recommended that this standard Registry XML specification as the and reduce concerns that a wholly
requirement be removed while several standard for electronically submitting different standard would be adopted in
others stated we should adopt both quality reporting data to CMS. the near future. If adopting a different
Quality Reporting Document Presently, CMS requires the submission standard for Certified EHR Technology
Architecture (QRDA) and the PQRI XML of aggregate, summary level data for the becomes necessary, we would do so
Registry specification in this rulemaking purposes of meaningful use and not data only after engaging in subsequent
and move to a single standard in the at the patient-specific level. It is our rulemaking.
next rulemaking. Other commenters understanding that the PQRI 2008 Comments. A few commenters stated
recommended that QRDA not be Registry XML specification is capable of that many of the clinical quality
adopted in this rulemaking. Several serving as the ‘‘envelope’’ for aggregate, measures proposed by CMS do not have
commenters suggested that an summary level data. Accordingly, we do electronic specifications and contended
implementation specification for not believe that, as some commenters that it would be difficult for any vendor
eligible hospitals be created if we intend suggested, an eligible hospital’s to have embedded these measures in
to continue to require that quality familiarity with the PQRI program is their EHR products in a timely manner.
measure be reported in the PQRI relevant to the adoption of this standard But, these same commenters stated that
Registry XML format. One commenter for this specified purpose. Nor do we when the specifications become
expressed a concern that if the PQRI believe that a specific implementation available, that HHS should ensure
2008 Registry XML standard is of this standard is necessary for hospital through the certification process that the
maintained as the adopted standard that settings as the standard’s purpose and products are capable of generating
there is a danger that the certification the type of data it will transmit to CMS accurate data. Many commenters
Complete EHR and EHR Module will be the same—aggregate, summary expressed concerns that the certification
developers obtain may become obsolete level data. Through recent discussions criterion was too vague or too broad
before Stage 1 has run its course. with CMS since the publication of the (because it implicitly referenced all of
the quality measures CMS had criterion, and the certification criteria in (Section II(A)(3) of the Medicare and
proposed). Some of the commenters general, on Federal requirements and Medicaid EHR Incentive Programs final
recommended that this certification have removed the reference to ‘‘or rule) for eligible hospitals. Again, we
criterion be removed, while others States’’ in this certification criterion. believe this revision provides greater
recommended that it focus on a subset To better align this certification clarity and reduces the potential burden
of measures in order to constrain the criterion with the final approach to for Complete EHR and EHR Module
amount of electronic measure clinical quality measures in the developers.
specifications a Complete EHR or EHR Medicare and Medicaid EHR Incentive Comments. One commenter suggested
Module developer would need to Programs final rule, we have determined that we separate the calculation and the
address in order to be certified. At least that it is no longer sufficient to specify submission parts of this certification
one of these latter commenters indicated one general certification criterion for criterion into two separate certification
that our adopted certification criteria both Complete EHRs and EHR Modules criteria.
created uncertainty for Complete EHR designed for either an ambulatory or Response. We disagree. We see no
and EHR Module Developers. This inpatient setting. Accordingly, the final basis for separating these two parts of
commenter asked that we clarify what rule in §§ 170.304 and 170.306 will this certification criterion into two
clinical quality measures would need to include a specific certification criterion separate certification criteria. However,
be tested in order to satisfy this for each setting. Complete EHRs and we believe that it is necessary to specify
certification criterion and if there would EHR Modules designed for an two different certification criteria to
be a baseline for eligible hospital ambulatory setting will be required to be account for the different clinical quality
measures as well as some identified core tested and certified as being compliant measures that eligible professionals and
set of measures for eligible with all 6 of the core (3 core and 3 eligible hospitals will need to report.
professionals. Along these same lines, alternate core) clinical quality measures Accordingly, we have adopted separate
another commenter recommended that specified by CMS for eligible certification criteria for Complete EHRs
EHR technology should be tested and professionals (Section II(A)(3) of the and EHR Modules designed for
certified only to the clinical quality Medicare and Medicaid EHR Incentive ambulatory and inpatient settings and
measures applicable to the medical Programs final rule). Complete EHRs referenced the respective quality
specialties of the eligible professionals and EHR Modules designed for an measures for each in the appropriate
that the EHR technology is intended to ambulatory setting will also be required certification criterion.
to be tested and certified as being Comments. One commenter suggested
support and to whom it is marketed.
compliant with, at a minimum, 3 of the that all approved PQRI registries be
Other commenters expressed concerns
additional clinical quality measures automatically certified as an EHR
about timing and that a significant
CMS has identified for eligible Module.
amount of effort would be required to Response. We do not believe that it is
reprogram Complete EHRs and EHR professionals (Section II(A)(3)of the
Medicare and Medicaid EHR Incentive prudent or appropriate to automatically
Modules to capture, calculate, and deem certain HIT as certified. That
report the final meaningful use Stage 1 Programs final rule). We believe this
revision provides clarity and flexibility being said, if a PQRI registry can
measures. Many commenters also stated adequately perform the capability
that the proposed quality measures are and reduces the potential burden for
Complete EHR and EHR Module specified by the certification criterion, it
not yet ready for automated reporting, could be certified as an EHR Module.
developers (who may have been
that a significant amount of work is still Comments. Several commenters
unfamiliar with certain clinical quality
required by the measure developer stated that Certified EHR Technology
measures because of the type of eligible
community, and that the value sets for should be capable of collecting quality
professional they serve) to become
these quality measures have not been measurement data and calculating
compliant with this certification
validated. Several commenters objected results for reporting to avoid having
criterion. As a result, Complete EHR and
to the reference to ‘‘States’’ in the eligible professionals and eligible
EHR Module developers for the
certification criterion and recommended hospitals perform these processes
ambulatory setting may provide
that it be removed. These commenters manually. These commenters also stated
Certified EHR Technology with a certain
contended that the certification criterion that Certified EHR Technology should
level of variability in terms of clinical
should be limited to the ‘‘federal quality measure capabilities. To provide be capable of accurately and reliably
requirements’’ and further that it was further transparency for potential reporting quality measurement data.
unrealistic to expect Complete EHR and eligible professionals regarding the Some commenters recommended that a
EHR Module developers to also comply clinical quality measures to which a Complete EHR or EHR Module only be
with 50 separate State requirements as Complete EHR or EHR Module has been required to be certified to existing e-
a condition of certification. tested and certified, we specified that an measure specifications.
Response. We understand that CMS ONC–Authorized Testing and Response. We agree that the collection
has worked to significantly increase the Certification Body would need to report of clinical quality measurement data
availability of a number of electronic such information to the National and the calculation of results for
measure specifications that are Coordinator, and further, that the submission to CMS should be
associated with specific clinical quality Complete EHR or EHR Module performed by Certified EHR
measures. In light of the final approach developer would need to make sure this Technology. We also agree that
CMS has taken with respect to clinical information is available and Complete EHRs or EHR Modules should
quality measures for meaningful use communicated to prospective only be required to be tested and
Stage 1, we have revised this certified to developed electronic
purchasers as part of the Complete EHR

certification to better align it with the or EHR Module’s certification. measure specifications. This is why
Medicare and Medicaid EHR Incentive Complete EHRs and EHR Modules CMS has only specified clinical quality
Programs final rule requirements. We designed for an inpatient setting will be measures for eligible professionals and
also agree with those commenters that required to be tested and certified as eligible hospitals in the Medicare and
requested we explicitly focus the report being compliant with all of the clinical Medicaid EHR Incentive Programs final
of clinical quality measures certification quality measures specified by CMS rule for which electronic measure
specifications have been developed. Comments. Several commenters calculated and do not see a need to
Complete EHR and EHR Module recommended that the certification specifically include the word in the
developers should follow these criterion should be revised to include certification criterion.
electronic measure specifications in the word ‘‘accurately.’’ Section 170.302(j)—Check Insurance
order to accurately calculate clinical Response. We expect that clinical Eligibility and § 170.302(k)—Submit
quality measures. quality measures would be accurately Claims
Removed from final rule .................. Removed from final rule ................ Interim Final Rule Text:
Enable a user to electronically record and display patients’ insur-
ance eligibility, and submit insurance eligibility queries to pub-
lic or private payers and receive an eligibility response in ac-
cordance with the applicable standards and implementation
specifications specified in § 170.205(d)(1) or (2).
Final Rule Text:
Removed.
Removed from final rule .................. Removed from final rule ................ Interim Final Rule Text:
Enable a user to electronically submit claims to public or private
payers in accordance with the standard and implementation
specifications specified in § 170.205(d)(3).
Final Rule Text:
Removed.
Comments. Many commenters progress has been made in using As CMS explains in more detail in the
recommended that the certification electronic eligibility inquires and claims Medicare and Medicaid EHR Incentive
criteria for administrative transactions transactions outside of an EHR context. Programs final rule, the subsequent
be removed because they considered the Those commenters expressed concern inclusion of administrative
administrative capabilities that we that the inclusion of administrative simplification requirements as part of
required to be outside of the scope of an transaction capability in this rule would meaningful use Stage 2 is an important
electronic health record and stated create confusion, ambiguity, and long-term policy goal. Administrative
further that their inclusion did not align potentially duplicate efforts. A couple of simplification can improve the
with the HIT industry’s common view commenters noted that some payers do efficiency and reduce unnecessary costs
of what constituted EHR technology. A not accept electronic claims and in the health care system as a whole; the
large number of commenters conveyed eligibility checks. One commenter small percentage of paper claims
specific challenges including: These expressly noted that including the submitted represents a
functions are usually handled by administrative functionalities would disproportionately high administrative
practice management systems which decrease innovation by creating a large cost for health plans; the reconciliation
generally are separate from an EHR, barrier to entry for EHR innovators. of billing charges for services not
although on occasion some vendors Finally, a couple of commenters noted eligible for payment creates a significant
include these functionalities in their that health care providers would face burden for providers, health plans, and
EHRs; practice management systems significant challenges in the transition most significantly, for patients.
adoption is already very high and to ASC X12N 5010 and ICD–10 and lost Moreover, we believe that the
requiring certification for these products productivity. integration of administrative and
would be unnecessary and burdensome, Response. In concert with CMS, we clinical information systems is
given the wide variety and number of have considered commenters’ rationale necessary to support effective
vendors and significant potential for for and against the inclusion of these management and coordinated care in
increasing costs for providers; providers certification criteria. We have tried to physician practices. For example, the
interested in achieving meaningful use summarize above several technical and ability to: leverage clinical
would have to abandon a working programmatic challenges commenters documentation in support of
practice management system if their identified if administrative transaction appropriate charge capture (e.g., for
practice management vendors were capability were included within the preventive counseling, or
unwilling or unable to get certified; and certification requirements. Due to the immunizations provided); link lists of
many providers currently use removal of these objectives from the patients needing clinical reminders with
clearinghouses to convert paper claims meaningful use Stage 1 requirements, patient contact information; stratify
into electronic claims to submit to CMS we do not believe that it would be quality measures by patient
and other payers. Several commenters appropriate to continue to require, as a demographic factors (e.g., race/
recommended retaining the condition of certification, that Complete ethnicity) and insurer status (e.g.,
administrative transactions certification EHRs and EHR Modules include these
Medicare beneficiaries).
criteria because it would eventually capabilities. Accordingly, we have Additionally, we believe that
reduce administrative costs across the removed the adopted standards, important benefits can be recognized
health care system. Many commenters implementation specifications, and through the future adoption of
requested that we clarify several aspects certification criteria related to these administrative transactions standards
of these certification criteria while some administrative transactions from this and certification criteria for Complete
other commenters noted that significant final rule. EHRs and EHR Modules. Through the
use of EHR Modules, eligible to align EHR technology capabilities and both ASC X12N 4010 and 5010 standard
professionals and eligible hospitals have standards for administrative transactions, but that CORE Phase 1 is
the opportunity to use practice transactions with the administrative only applicable to ASC X12N 4010
management systems or clearinghouses simplification provisions that the standard transactions and cannot be
that provide the capability to conduct Affordable Care Act provides for health used with ASC X12N 5010 standard
administrative transactions as plans and clearinghouses. Therefore, we transactions. A few commenters
components of Certified EHR intend to include for adoption, requested that we clarify whether
Technology. In that regard, we recognize administrative transactions standards providers and vendors will be required
the concerns expressed by some and certification criteria to support to receive CORE certification. Several
commenters that the developers of some meaningful use Stage 2 rulemaking, and
commenters recommended ONC retain
practice management systems may not expect health care providers and
CORE Phase 1. A few commenters noted
be prepared to seek certification for Complete EHR and EHR Module
these legacy systems in 2010 or 2011. developers to take this into that CORE promotes uniformity and can
We also acknowledge that the required consideration leading up to 2013. provide significant reduction in
compliance date of January 1, 2012 for Comments. Many commenters transaction costs. A couple commenters
ASC X12N version 5010 transactions recommended that we remove the recommended that ONC adopt
would further complicate the implementation specification, CORE subsequent CORE standards in future
certification process associated with Phase 1 (CORE), which we previously stages.
meaningful use Stage 1. However, we adopted. Several commenters noted that Response. As previously mentioned,
believe that after the ASC X12N version CORE is only useful if it has also been we have decided to align our revisions
5010 transition has occurred, and we adopted by health plans, and they with the changes made in the Medicare
approach the October 1, 2013 explained that not all health plans had and Medicaid EHR Incentive Programs
compliance date for HIPAA covered adopted CORE. A few commenters final rule and to remove, as noted above,
entities to use ICD–10, our decision to expressed concern with CORE stating
the standards, implementation
delay the adoption of administrative that it adds requirements to the HIPAA
specifications, and certification criteria
transactions certification criteria will Standard Transactions and did not
follow the work of the standards associated with administrative
prove beneficial for the adoption of
Certified EHR Technology. development organization that transactions. Consistent with that
In order to meet upcoming maintains administrative transactions. A approach, we are removing the CORE
administrative simplification deadlines, few commenters also believed that Phase 1 implementation specification
most health care providers will have to following CORE results in non- for the reasons submitted in comments.
upgrade their practice management compliant ASC X12N 4010 transactions. Section 170.302(l)—Medication
systems or implement new ones. This Other commenters noted that it Reconciliation
will provide an important opportunity appeared that we had required CORE for
The EP, eligible hospital or CAH The EP, eligible hospital or CAH Interim Final Rule Text:
who receives a patient from an- performs medication reconcili- Medication reconciliation. Electronically complete medication rec-
other setting of care or provider ation for more than 50% of tran- onciliation of two or more medication lists by comparing and
of care or believes an encounter sitions of care in which the pa- merging into a single medication list that can be electronically
is relevant should perform medi- tient is transitioned into the care displayed in real-time.
cation reconciliation. of the EP or admitted to the eli- Final Rule Text: § 170.302(j)
gible hospital’s or CAH’s inpa- Medication reconciliation. Enable a user to electronically com-
tient or emergency department pare two or more medication lists.
(POS 21 or 23).
Comments. Many commenters technical foundation and safety checks we do not want to preclude Complete
suggested that for this certification are not currently in place for automated EHR and EHR Module developers from
criterion we clarify whether we medication reconciliation. We did not innovating, provided that the desired
intended for the process of medication intend to imply that automated outcome is reached. For example, a user
reconciliation to be automatic or to reconciliation needed to occur through could be presented with two electronic
support an eligible professional or our use of the word ‘‘electronically.’’ We lists side-by-side and move medications
eligible hospital in performing this task. used the term ‘‘electronically’’ to express from one list to the other and then select
Many saw the former as a potential risk our expectation that eligible the final current list. Alternatively, a
to patient safety. Although several professionals and eligible hospitals user could view one list and two PDFs
different reasons were given, many would be able to use Certified EHR of other medications and use this
commenters recommended that we Technology to complete this task. capability to update the current
revise the certification criterion to Accordingly, we have revised this medication list. We do, however, see
indicate that two or more medication certification criterion to require that great promise in making this capability
lists be simultaneously displayed in Certified EHR Technology be capable of more comprehensive and anticipate
order to permit an eligible professional providing a user with the ability to exploring ways to improve the utility of
or eligible hospital to then reconcile the electronically compare two or more this capability before we adopt a
medication lists. medication lists (e.g., between an subsequent round of certification
Response. We have reviewed externally provided medication list and criteria.
commenters’ concerns and intend to the current medication list in Certified Comments. Several commenters
clarify the language in this certification EHR Technology). We expect that this supported this certification criterion,
criterion. We recognize that the could be done in a number of ways and but wanted clarification regarding how
we expected testing and certification to Comments. Several commenters Medicaid EHR Incentive Programs final
be accomplished, especially if only one requested that we clarify the meanings rule to see how these terms have been
medication list was in use. of ‘‘medication reconciliation,’’ clarified in response to public
Response. We believe that the ‘‘transitions of care,’’ and ‘‘relevant comments.
clarifications and revisions to the encounter.’’
certification criterion and the discussion Response. These terms are not used in Section 170.302(m)—Submission to
above clarify how we intend for this the certification criterion. We encourage Immunization Registries
certification criterion to be tested. commenters to review the Medicare and
Capability to submit electronic data Performed at least one test of cer- Interim Final Rule Text:
to immunization registries or Im- tified EHR technology’s capacity Submission to immunization registries. Electronically record, re-
munization Information Systems to submit electronic data to im- trieve, and transmit immunization information to immunization
and actual submission in accord- munization registries and follow registries in accordance with:
ance with applicable law and up submission if the test is suc- (1) One of the standards specified in § 170.205(h)(1) and, at a
practice. cessful (unless none of the im- minimum, the version of the standard specified in
munization registries to which § 170.205(h)(2); or
the EP, eligible hospital or CAH (2) The applicable state-designated standard format.
submits such information have Final Rule Text: § 170.302(k).
the capacity to receive the infor- Submission to immunization registries. Electronically record,
mation electronically). modify, retrieve, and submit immunization information in ac-
cordance with:
(1) The standard (and applicable implementation specifications)
specified in § 170.205(e)(1) or § 170.205(e)(2); and
(2) At a minimum, the version of the standard specified in
§ 170.207(e).
Comments. A significant majority of immunization registries cannot comply Response. The CDC maintains an
commenters recommended that we with HL7 2.5.1. openly available list of updated CVX
remove paragraph (m)(2) related to the Response. We appreciate that codes as well as a mapping of CVX
applicable state-designated format. commenters support our adoption of codes to CPT codes on their Web site.4
These commenters contended that such both HL7 2.3.1 and HL7 2.5.1. We Moreover, we believe that CVX codes
a requirement was vague, could be understand that both standards are are more appropriate than CPT codes
problematic from an interoperability currently in use and for that reason we because as the commenter referenced,
perspective, and would make have permitted either to be used for CPT codes are used for billing purposes.
certification impracticable. purposes of certification. We also In that regard, we believe that because
Response. We agree with those understand that eligible professionals there is a publicly available mapping
commenters that requested we explicitly and eligible hospitals will have to use between CVX and CPT, it would not be
focus the certification criterion and the standard that the immunization difficult or burdensome to map CPT
certification in general on Federal registry or Immunization Information codes to CVX codes. NDC codes were
requirements. We have therefore System in their jurisdiction can receive not adopted as a standard to represent
removed the reference to ‘‘applicable and, as a result, we have adopted the immunizations and we do not believe
that requiring their use for the purposes
stated-designated standard format’’ in two most common standards utilized for
of demonstrating compliance with this
the certification criterion. Additionally, the transmission of immunization
certification criterion would be
we have reviewed this certification information.
appropriate.
criterion and have determined that our Comment. One commenter noted that Comment. One commenter
reference to ‘‘immunization registries’’ is it would be very helpful to provide a recommended that we revise the
unnecessary. We are primarily source for mapping from the NDC code certification criterion combined with
concerned with Certified EHR on the vaccine packaging to the CVX/ associated standards to state, ‘‘For the
Technology’s ability to transmit the MVX codes used for interoperability, in purposes of electronically submitting
immunization information in a anticipation of supporting barcode information to immunization registries
standardized format, and do not believe scanning of vaccines. Another Certified EHR Technology must be
that it is necessary to specify a commenter noted that while some capable of using a certified EHR module
particular recipient in the certification mapping has occurred between CPT and or portal provided by a state
criterion. CVX, they were not aware of a immunization registry which is capable
Comments. Many commenters translation map from NDC to CVX. They of submitting and retrieving coded
supported our adoption of both HL7 also stated that even though a list of immunization information or capable of
2.3.1 and HL7 2.5.1. Some commenters CVX codes is available, they were not using HL7 2.3.1 or HL7 2.5.1 as a
acknowledged that HL7 2.3.1 was more aware of a downloadable immunization content exchange standard and the CDC
commonly used for the purpose of database using CVX codes. They maintained HL7 standard code set
submitting information to immunization considered this lack of a database a
CVX—Vaccines Administered as the

registries while other commenters significant burden and impediment to vocabulary standard.’’ The basis for this
suggested that we only adopt HL7 2.5.1. compliance. The commenter concluded commenter’s suggestion was that
Some commenters recommended that by suggesting that CPT codes be used providers in its state link to the state’s
we keep our adopted standards the way instead of CVX codes, because CPT
they are. Others recommended that we codes are used for billing purposes and 4 http://www.cdc.gov/vaccines/programs/iis/stds/
only adopt HL7 2.3.1 because most would be readily available. cpt.htm.
immunization module through EHRs public comment on whether there were context. We encourage migration to this
and that all immunization data are additional implementation newer implementation specification and
stored immediately in the state’s specifications that we should adopt. We believe that it will likely advance
registry. The commenter further also noted that we would consider interoperability across the country and
clarified that since the data resides in adopting implementation specifications improve query capabilities.
the state registry natively, there is no for any or all of the standards adopted Comment. A commenter
need to transmit this information. in the Interim Final Rule. After further recommended that we clarify that the
Response. In light of this commenter’s consideration of commenters’ certification criterion should be limited
suggestion, we have revised the recommendations and consultation with to verifying the ability of the system to
certification criterion to replace the the CDC, we agree with these record, retrieve, and transmit
word ‘‘transmit’’ with ‘‘submit’’ to better commenters and believe that adopting immunization information.
align this certification criterion with the implementation specifications for the Response. The purpose of testing and
meaningful use objective and measure. transmission of immunization certifying a Complete EHR or EHR
We believe that submission of information would benefit EHR Module to this certification criterion is
immunization data would encompass technology developers and users. to verify that it can perform the
this commenter’s existing method. Moreover, given commenters’ general capabilities included in the certification
Comment. One commenter stated that
requests for greater specificity and our criterion.
they believed the use of CVX is neither
stated goal of greater interoperability, Comment. A couple of commenters
mature nor widespread.
Response. We disagree. Our we believe that it would be appropriate strongly supported the transmission of
information indicates that CVX codes to adopt the following implementation immunization data to state and local
are widely used for reporting to specifications for the submission of immunization registries but requested
immunization registries. immunization data. For HL7 2.3.1 we that the data requirements be expanded
Comment. Some commenters have adopted the ‘‘Implementation to include the transmission of
identified implementation Guide for Immunization Data information regarding diseases such as
specifications that are available for the Transactions using Version 2.3.1 of the cystic fibrosis to pediatric registries.
standards we had adopted for Health Level Seven (HL7) Standard Response. Presently, we do not
transmitting immunization information. Protocol, Implementation Guide Version believe that it is necessary or
A couple of these commenters 2.2.’’ We are aware that this appropriate to expand this certification
specifically recommended using implementation specification has been criterion in this manner. We emphasize,
implementation specifications that successfully adopted numerous times in though, that this should not preclude
would identify message types necessary various contexts since its publication eligible professionals or eligible
for transmissions to immunization four years ago and do not believe that hospitals from using Certified EHR
registries. Commenters also suggested it will be burdensome for Complete EHR Technology to submit other types of
using the CDC’s implementation guides, and EHR Module developers to information as medically appropriate
and explicitly recommended that we implement these specifications. For HL7 and if the recipient of the information
adopt the CDC public health 2.5.1, we have adopted the is capable of receiving the data.
information network (PHIN) ‘‘Implementation Guide for Comment. A commenter
implementation guide version 2.2 Immunization Messaging Release 1.0.’’ recommended including the term
associated with HL7 2.3.1 for the This implementation specification ‘‘modify’’ in the certification criterion.
transmission of immunization represents the collaborative effort of the
Response. We agree, and consistent
information and the CDC American Immunization Registry
with our other certification criteria that
implementation guide as well as the Association (AIRA) and the CDC. We
include the term ‘‘modify,’’ we have
implementation guide associated with have also consulted with CDC, and the
added this term.
HL7 2.5.1. CDC confirms the appropriateness and
Response. In the Interim Final Rule, supports the usage of these Section 170.302(n)—Public Health
we expressed our interest in receiving implementation specifications in this Surveillance
Meaningful use Stage 1 Meaningful use Stage 1 measure Certification criterion

objective
Capability to submit electronic Performed at least one test of cer- Interim Final Rule Text:
syndromic surveillance data to tified EHR technology’s capacity Public health surveillance. Electronically record, retrieve, and
public health agencies and actual to provide electronic syndromic transmit syndrome-based public health surveillance information
submission in accordance with surveillance data to public to public health agencies in accordance with one of the stand-
applicable law and practice. health agencies and follow-up ards specified in § 170.205(g).
submission if the test is suc- Final Rule Text: § 170.302(l).
cessful (unless none of the pub- Public health surveillance. Electronically record, modify, retrieve,
lic health agencies to which an and submit syndrome-based public health surveillance infor-
EP, eligible hospital or CAH mation in accordance with the standard (and applicable imple-
submits such information have mentation specifications) specified in § 170.205(d)(1) or
the capacity to receive the infor- § 170.205(d)(2).
mation electronically).
Comments. A couple of commenters this certification criterion should be Comment. One commenter
supported the adoption of certification implemented as adopted. recommended that we defer any
criteria related to public health Response. We appreciate commenters’ vocabulary standard for public health
reporting. One commenter believed that support of this certification criterion. reporting and surveillance until a later
date. Another commenter expressed
concern that we would adopt as a purpose of public health surveillance Comment. One commenter suggested
standard, ‘‘according to applicable and reporting. that if current interfaces comply with
public health agency requirements,’’ Comments. Multiple commenters public health surveillance data using
because they thought it could be stated concerns that the Federal older versions of HL7, the organizations
problematic for hospital systems with government and state governments, as should be allowed to keep these
facilities in two or more states, as their well as other public health agencies, do versions and not be required to upgrade
EHR technology would have to meet not have the capability to receive to a newer version.
whatever standards each state elected to information electronically in a Response. We permit a Complete EHR
use. standardized format. One commenter or EHR Module to be tested and
Response. We clarify for commenters stated that while they supported using certified to either HL7 2.3.1 or HL7
that we adopted two content exchange the HL7 standards, some agencies are 2.5.1. No other versions will be
standards for electronic submission to only able to accept public health considered compliant with the adopted
public health agencies for surveillance submissions if they have an HL7-based standards or certification criterion.
and reporting. We did not adopt a feed. Several commenters suggested that Comment. One commenter
specific vocabulary standard, nor did the public health reporting requirement recommended that we specify
we include the phrase one commenter be delayed until a single, national acceptable testing methods. The
stated that we included. However, we standard exists. One commenter stated commenter also recommended that the
have, consistent with our rationale in that requiring EHRs to ‘‘electronically testing methods should include an
the immunization submission record, retrieve, and transmit syndrome- evaluation of HL7 conformance,
certification criterion, removed our based public health surveillance completeness, and accuracy of test
reference to ‘‘public health agencies’’ as information to public health agencies’’ is messages sent to a state public health
the recipient of information. Also, a worthwhile future goal, but they agency with a demonstrated capability
consistent with the certification strongly questioned the likelihood that for electronic laboratory reporting.
criterion above, we have replaced the it could be accomplished within the Response. We do not specify the
term ‘‘transmit’’ with ‘‘submit.’’ 2011–2012 timeframe. The commenter testing methods applicable to the
Comments. A couple of commenters certification criterion, because that
also noted that the certification criterion
stated that compliance with HL7 2.5.1 information is outside the scope of this
did not specify which agencies (local,
not be included in this adopted set of final rule.
state, Federal) are included, and that
standards. One commenter suggested Comment. One commenter suggested
most of those agencies are not prepared
HL7 2.5.1 should be adopted in a future that adverse events be reported to public
to receive biosurveillance data
rulemaking. Another commenter health agencies.
electronically in the format specified.
suggested that HL7 2.3.1 be required for Response. Our certification criterion
The commenter concluded that it would
the purposes of certification. Another does not preclude other types of
be difficult for any EHR to prove
commenter recommended that the reportable events from occurring.
compliance with the certification
standard be HL7 2.3.1, because in its Presently, we do not believe that it is
criterion as written and recommended
opinion many public health agencies appropriate to modify the certification
the following alternative: ‘‘Electronically
cannot comply with HL7 2.5.1 while criterion to explicitly refer to adverse
record, retrieve, and be capable of
another commenter took the opposite events.
producing an electronic message
position and recommended HL7 2.5.1. Comment. One commenter
containing syndrome-based public
Response. Given the diversity in
health surveillance information in recommended that because some public
implementations and public health
accordance with one of the standards health agencies do not have the ability
agencies’ ability to receive information
specified in § 170.205(g).’’ to receive public health surveillance
in a given standard, we believe that the
Response. We recognize that some information in electronic format, we
flexibility included in this criterion is
public health agencies do not yet have should clarify that this certification
necessary for the foreseeable future.
the capability of electronically receiving criterion is limited to verifying the
However, relative to the general
information. We do not believe that this ability of the system to record, modify,
comments we received regarding the
should serve as a limiting factor, retrieve, and submit such information
adoption of implementation
however, or preclude Certified EHR based on at least one test of these
specifications for adopted standards, we
Technology from having the capability capabilities.
have adopted the following
to transmit information in a standard Response. We reiterate, that the
implementation specifications for HL7
format. purpose of certification is to verify that
2.5.1: Public Health Information
Comment. One commenter a Complete EHR or EHR Module can
Network HL7 Version 2.5 Message
commented that if a public health perform these capabilities. That should
Structure Specification for National
agency is unable to accept the data, not be construed to mean that an
Condition Reporting Final Version 1.0
separate reports could be filed with the eligible professional or eligible hospital
and the Errata and Clarifications
public health agency to ensure is exempt from using Certified EHR
National Notification Message
compliance with the standards. Technology to meet the meaningful use
Structural Specification. We believe that
objective and measure.
these implementation specifications Response. The commenter’s point is
Comment. A commenter
provide the additional clarity unclear, as is its proposal. We therefore
recommended including the word
commenters were seeking and will reiterate that Certified EHR Technology
‘‘modify’’ in the certification criterion.
enable Complete EHR and EHR Module must be capable of transmitting health
Response. Consistent with our
developers to focus their efforts on a information in accordance with the

rationale above, we have added the
more specific implementation of the standards adopted by the Secretary,
word modify to the certification
HL7 2.5.1 standard. We do not believe regardless of whether a specific public
criterion.
that a suitable implementation health agency can accept or receive the
specification for HL7 2.3.1 exists for the information. Section 170.302(o)—Access Control
Protect electronic health information Conduct or review a security risk Interim Final Rule Text:
created or maintained by the cer- analysis per 45 CFR 164.308 Access control. Assign a unique name and/or number for identi-
tified EHR technology through (a)(1) and implement security fying and tracking user identity and establish controls that per-
the implementation of appropriate updates as necessary and cor- mit only authorized users to access electronic health informa-
technical capabilities. rect identified security defi- tion.
ciencies as part of its risk man- Final Rule Text: § 170.302(o).
agement process. Unchanged.
Comment. One commenter explicitly certification criterion or provide any criterion. This certification criterion
noted its support for this certification related suggestions or remains unchanged from the
criterion. We received other comments recommendations. certification criterion adopted in the
that included some mention of ‘‘access’’ Response. We appreciate the Interim Final Rule.
but did not expressly focus on the comment supporting this certification Section 170.302(p)—Emergency Access
created or maintained by the cer- analysis per 45 CFR 164.308 Emergency access. Permit authorized users (who are authorized
tified EHR technology through (a)(1) and implement security for emergency situations) to access electronic health informa-
the implementation of appropriate updates as necessary and cor- tion during an emergency.
technical capabilities. rect identified security defi- Final Rule Text: § 170.302(p).
ciencies as part of its risk man- Unchanged.
agement process.
Comment. One commenter asked that to access electronic health information Some commenters appeared to
we clarify the circumstances that would in an emergency. In a medical interpret our reference to ‘‘emergency’’
qualify as an ‘‘emergency’’ and further emergency, those determinations would in ‘‘emergency access’’ as solely
clarify whether compliance with this be made under specific factual constituting a clinical or life threatening
certification criterion is intended to pre- circumstances and in accordance with emergency related to a patient for which
empt conflicting or stricter state laws applicable state and federal laws, access would be required. We believe
that may limit this type of access or organizational policies and procedures, that emergency could encompass that
require patient consent. Further, the and the relevant standard of care. scenario, as well as a broader range of
commenter questioned whether we were With respect to emergency access, we possibilities, including normal patient
implying that some authorized users of note that HHS stated in the HIPAA care when timely access to electronic
Certified EHR Technology would not be Security Final Rule (68 FR 8355): health information becomes critical.
authorized for emergency situations or We believe that emergency access is a Therefore, we have not sought to limit
whether we intended for any authorized necessary part of access controls and, the development of emergency access
user to be entitled to access in an therefore, is properly a required capabilities for Certified EHR
emergency situation. Finally, another implementation specification of the ‘‘Access
Technology to a particular scenario.
commenter requested clarification as to controls’’ standard. Access controls will still
whether emergency access is driven by be necessary under emergency conditions, Comment. One commenter suggested
organizational policies and whether although they may be very different from that we require automated notification
those used in normal operational of user activity to system administrators
capturing such access in an audit log is circumstances. For example, in a situation
appropriate. when emergency access is invoked.
when normal environmental systems,
Response. We have adopted including electrical power, have been Response. We appreciate this
certification criteria to ensure that severely damaged or rendered inoperative suggestion. However, at the present
Certified EHR Technology includes due to a natural or manmade disaster, time, we do not believe that this
certain capabilities, in this case that procedures should be established beforehand requirement should be a condition of
Certified EHR Technology be capable of to provide guidance on possible ways to gain
access to needed electronic protected health
certification because a person or entity’s
permitting authorized users to access organizational policies and procedures
electronic health information during an information.
may ensure timely notification of
emergency. The criterion is not We believe that this certification appropriate personnel.
intended to specify what constitutes an criterion is consistent with the HIPAA
emergency or who would be authorized Security Rule. Section 170.302(q)—Automatic Log-Off
created or maintained by the cer- analysis per 45 CFR 164.308 Automatic log-off. Terminate an electronic session after a pre-
tified EHR technology through (a)(1) and implement security determined time of inactivity.
the implementation of appropriate updates as necessary and cor- Final Rule Text: § 170.302(q).
technical capabilities. rect identified security defi- Unchanged.
ciencies as part of its risk man-
agement process.
Comments. One commenter multiple individuals are using the EHR or EHR Module developer. We are
supported this requirement. Another Certified EHR Technology at the same aware that many Web services today
commenter concurred with the purpose time. logoff customers after a period of
of the certification criterion, but noted Response. We appreciate the inactivity and do not believe this
that it may be difficult in some commenters’ support for the adoption of requirement is unduly burdensome for
circumstances for eligible professionals this certification criterion. We believe any Complete EHR or EHR Module
or eligible hospitals to implement this that automatic logoff capabilities are developer.
capability if the Certified EHR commonplace and that this certification
Technology is offered as a service and criterion can be met by any Complete Section 170.302(r)—Audit Log
created or maintained by the cer- analysis per 45 CFR 164.308 (1) Record actions. Record actions related to electronic health in-
tified EHR technology through (a)(1) and implement security formation in accordance with the standard specified in
the implementation of appropriate updates as necessary and cor- § 170.210(b).
technical capabilities. rect identified security defi- (2) Alerts. Provide alerts based on user-defined events.
ciencies as part of its risk man- (3) Display and print. Electronically display and print all or a
agement process. specified set of recorded information upon request or at a set
period of time.
Final Rule Text: § 170.302(r).
(1) Record actions. Record actions related to electronic health in-
formation in accordance with the standard specified in
§ 170.210(b).
(2) Generate audit log. Enable a user to generate an audit log
for a specific time period and to sort entries in the audit log ac-
cording to any of the elements specified in the standard at
170.210(b).
Comments. Several commenters circumvented in such ways as to make Response. We specified in the
recommended that we add to the the burden of trying to accurately audit standard that the date, time, patient
standard specified at § 170.210(b) such occurrences outweigh the benefit. identification, and user identification
‘‘access,’’ ‘‘reading,’’ or ‘‘viewing’’ as Accordingly, we have removed must be recorded when certain actions
triggers for when actions needed to be ‘‘printed’’ from the standard. We also take place. The HL7’s definition of
recorded as part of an audit log. One agree with commenters that our author is consistent with our
commenter recommended expanding omission of ‘‘access’’ should be corrected expectation. While we believe that in
the audit content to include maintaining and we have added ‘‘accessed’’ to the most cases a user will be a health care
the before-access content of the standard. We view the action of ‘‘access’’ professional performing an action using
information accessed as well as the to encompass ‘‘reading’’ or ‘‘viewing’’ Certified EHR Technology, it is also
after-access content. Some commenters and consequently have not included possible that a device or another
requested clarification of the intended those terms as well. Finally, we believe software process or program could
meaning of the reference to recording that the action of ‘‘accessed’’ is a perform any one of these actions. We do
the action of ‘‘printing.’’ Commenters superset of actions which may include not intend to preclude Complete EHR
recommended expanding or replacing ‘‘export’’ and for that reason have not and EHR Module developers from
‘‘print’’ in the standard with other types included, per some commenters’ including these and other types of
of output methods such as extraction, suggestions, the word ‘‘exported’’ in the specific features.
copy, exchange, report, and export. standard. Additionally, to provide Comment. One commenter stated that
Some commenter stated that the print greater clarity, we have added in ‘‘and the audit alert criterion exceeds
function in many operating systems and by whom’’ toward the end of the reasonable expectations for Certified
software products is a multiple step standard in order to more clearly specify EHR Technology to provide automatic
process that is difficult for any system that the actions recorded should be alerts, and recommended that the audit
to audit. Other commenters expressed associated with the user identification criteria focus on record access rather
concerns that the requirement to audit that is recorded. than electronic alerts. Several
all printing would be difficult because The final standard will read as commenters suggested that alerts are not
there were numerous ways to follows: ‘‘The date, time, patient well defined and should be removed
circumvent the specific action of identification, and user identification from the criteria. Several commenters
printing, such as using the print screen must be recorded when electronic expressed concern that the audit
function and printing out the image of health information is created, modified, alerting criterion goes beyond what is
the screen shot. One commenter stated accessed, or deleted; and an indication required by HITECH and HIPAA and
that auditing of the print function of which action(s) occurred and by exceeds the current capabilities of
would be possible, but complete whom must also be recorded.’’ products in the market, and
auditing of all possible ways of printing Comments. Some commenters recommends that the alerting criterion
requested that we clarify the term ‘‘user be eliminated from the final rule. Some
would be impracticable.
Response. We appreciate the identification’’ in the standard specified commenters recommended against the
thoughtfulness and thoroughness of the at § 170.210(b) and recommended the adoption of certification criterion that
comments provided on this standard. use of existing standards-based requires EHR systems to create an
We agree with commenters that auditing definitions, such as HL7’s definition of unlimited and open-ended series of
the action of printing, as it was author which includes person, rules to produce user-defined alerts, and
originally envisioned, could be organization, or device. suggested that we should clearly define
which actions should be recorded and HIPAA Security Rule to the degree that log requirements should address the
what alerts should be defined and Certified EHR Technology includes availability of the audit log and its
provided in an audit log. Several technical capabilities that are associated security. Several commenters
commenters stated that the use of the with assisting HIPAA covered entities recommended that additional
phrase ‘‘based on user-defined events’’ comply with applicable legal requirements be added, including that
in the criterion could be easily requirements. We disagree, however, the audit log always be on during
misinterpreted or misunderstood to with those commenters who stated that normal production for the minimum
extend beyond ‘‘entity-defined’’ events we did not have a sufficient legal basis elements specified in 170.210(b), be
to include individual patient to adopt this certification criterion the maintained in a secure manner, be
preferences. Some of the commenters way we did because it went beyond the produced in a human readable format,
that expressed concerns also contended HIPAA Security Rule. What a HIPAA and be retained in conjunction with the
that it would be difficult to test and covered entity must do to remain in retention period of the record.
certify this portion of the certification compliance with the HIPAA Security Response. We agree with these
criterion. Rule is separate and distinct from the commenters on the merits of their
Response. Again, we appreciate the capabilities that a Complete EHR or EHR suggestions. In particular, we note that
thoroughness of the commenters’ Module must include in order to be audit logs provide an important
suggestions. With respect to alerts based certified. We do not believe that we are resource for eligible professionals and
on user-defined events, we had precluded by the HITECH Act from eligible hospitals. Audit logs can assist
intended for Complete EHRs or EHR adopting certification criteria that go in the identification of security
Modules designed to provide this beyond the requirements specified by incidents, such as unauthorized access,
capability to be capable of being the HIPAA Security Rule. We believe as well as serve to deter users from
configured by a specific user of Certified that the HITECH Act, while directing conducting fraudulent or abusive
EHR Technology or based on that standards, implementation activities and detect such activities. The
organizational policy to generate alerts specifications, and certification criteria purpose of adopted certification criteria
when certain actions (defined in the be consistent with the HIPAA standards, is to specify the capabilities Complete
standard) had taken place. For example, authorizes the Secretary to adopt EHRs and EHR Modules must include in
a user-defined event could be when a certification criteria more broadly for order to be certified, not when such
patient’s health information is accessed the electronic use and exchange of capabilities must be used. Accordingly,
outside of normal business hours. In health information. Section 3004(b)(1) we do not believe that it would be
this case, it was our expectation that of the PHSA, as added by the HITECH appropriate to specify in this
Certified EHR Technology would alert a Act, requires the Secretary, for instance, certification criterion the time period for
specific user of the Certified EHR to adopt an initial set of standards, which an audit log should be ‘‘on.’’ We
Technology or the organization’s implementation specifications, and agree with commenters that audit logs
information security staff. We certification criteria to enhance the should be maintained in a secure
understand the point that commenters interoperability, functionality, utility, manner. For this reason, we have
raise, however, about the potential for and security of health information preserved the capability we adopted in
misinterpretation of this certification technology. the Interim Final Rule as part of the
criterion and the consequent potential With respect to the concern expressed integrity certification criterion that
burden. that this certification criterion requires specified that Certified EHR Technology
Our overall intent for the third capabilities that exceed the current must be capable of detecting alterations
paragraph of this certification criterion capabilities of products in the market, to audit logs. We encourage the HIT
was to ensure that Certified EHR we disagree. Based on our Standards Committee to consider
Technology provided the capability for understanding of the current EHR additional capabilities that could be
eligible professionals and eligible technology in the market, we believe specified related to audit logs.
hospitals to gain access to a specified that the capabilities we have specified Comment. One commenter
portion, or a complete representation, of in the criterion and the embedded recommended that the IHE Audit Trail
the Certified EHR Technology’s audit standard are already common industry and Node Authentication (ATNA)
log. We believe that this capability is practice, and further, that the industry Integration Profile be used, but that its
essential for eligible professionals and has expanded the functionality available use be constrained to the electronic
eligible hospitals for risk analysis and in audit logs. transactions among organizations, rather
other purposes. Therefore, in concert Comment. One commenter suggested than electronic transmissions within an
with the feedback commenters provided we defer our adoption of the standard organization.
on the second paragraph, we analyzed until the next rulemaking related to Response. We decided to defer our
whether combining the third paragraph meaningful use. adoption of the ATNA standard because
with the second paragraph into a single Response. We disagree. As stated it can be configured in multiple ways
paragraph would express a clearer above, we believe that audit log and we did not believe that it would be
requirement. Accordingly, we have capabilities are an essential component appropriate at this time to require a
merged the two paragraphs and have of Certified EHR Technology. As we specific implementation as a condition
adopted in the final rule a requirement mentioned above, we believe that the of certification. Our deferral does not
that we believe more clearly expresses actions we have specified in the preclude Complete EHR and EHR
our intent for this certification criterion. standard, in response to public Module developers from using the
We also note for clarification that the comment, are already common industry standard, however.
Comment. One commenter requested
phrase ‘‘any of the elements specified by practice. Moreover, audit logs will
170.210(b)’’ would also include, for provide valuable information to eligible clarification between ‘‘read’’ audits and
example, ‘‘date’’ or that information has professionals and eligible hospitals in ‘‘write’’ audits, and how each is to be
been ‘‘deleted.’’ the event of a security incident. used. The commenter suggested that not
Finally, we believe that it is important Comments. Several commenters requiring the capability of ‘‘read’’ audits
for our privacy and security certification acknowledged the importance of the will significantly reduce the ability of
criteria to remain consistent with the audit log, but emphasized that the audit auditors to identify and investigate
inappropriate use of health information information needed to identify a patient we only identify certain data elements
when records are accessed but not (e.g., name, record number, date of in the adopted standard that must be
manipulated. The commenter noted that birth, address) is presented to or can be recorded and believe that this
auditing all read operations for all data known by the user. specificity will help reduce any
elements within an EHR is infeasible. Response. As discussed above, we potential burden associated with
The commenter further suggested that have adopted in the standard the action recording the action of ‘‘accessed.’’
‘‘read’’ operations should be audited of ‘‘accessed’’ which would encompass
only when certain demographic health the action of ‘‘read.’’ At the present time, Section 170.302(s)—Integrity
created or maintained by the cer- analysis per 45 CFR 164.308 (1) In transit. Verify that electronic health information has not
tified EHR technology through (a)(1) and implement security been altered in transit in accordance with the standard speci-
the implementation of appropriate updates as necessary and cor- fied in § 170.210(c).
technical capabilities. rect identified security defi- (2) Detection. Detect the alteration and deletion of electronic
ciencies as part of its risk man- health information and audit logs, in accordance with the
agement process. standard specified in § 170.210(c).
Final Rule Text: § 170.302(s).
(1) Create a message digest in accordance with the standard
specified in 170.210(c).
(2) Verify in accordance with the standard specified in 170.210(c)
upon receipt of electronically exchanged health information
that such information has not been altered.
(3) Detection. Detect the alteration of audit logs.
Comments. Several commenters exchange. However, similar to our Comments. Some commenters noted
requested a definition of ‘‘in transit.’’ approach to many adopted certification that § 170.302(s)(2) refers to the use of
Other commenters suggested that criteria, we do not specify the instances the adopted standard which specifies
hashing of messages in transit be limited in which this capability needs to be the use of hashing to detect audit log
to circumstances of transmission over executed. Nevertheless, in response to alteration or deletion and that such a
public networks only. These public comments we have attempted to requirement is inappropriate. Other
commenters suggested that messages clarify this certification criterion. We commenters recommended that hashing
transmitted over private networks be clarify that we expect Certified EHR should not, at the present time, be used
exempt from complying with this Technology to be capable of creating a for detecting alterations to data at rest.
standard. One commenter suggested that message digest and when in receipt of Response. We have considered these
in addition to message hashing, digital a message digest, to use the message comments and agree with these
signatures should be required on digest to verify that the contents of the commenters that this requirement
messages in transit. Another commenter message have not been altered. We have requires further clarification. We note
stated that requiring hashing of that part of this requirement as adopted
revised the certification criterion to
messages in transit is overly in the Interim Final Rule (‘‘detect * * *
clarify our intent.
burdensome. One commenter requested deletion of electronic health
that we clarify whether we intended Additionally, based on these revisions information’’) is redundant with the
§ 170.302(s)(1) to require that the in the certification criterion, we wish to standard we specify for audit logs which
receiver of a message always verify clarify the wording of the integrity requires that deletions of electronic
messages received rather than simply standard specified at 170.210(c). The health information be recorded. For this
demonstrate the capability to use standard currently includes the words reason, we have removed the reference
hashing. ‘‘or higher’’ at the end of the standard. to the detection of deleted electronic
Response. We intend for this To provide more certainty to the health information and have opted for a
certification criterion to support, at a industry of our intended meaning, we more concise requirement that
minimum, the HIPAA Security Rule are replacing those words with more alterations to audit logs be detected. In
implementation specification provided accurate terminology. We have modified response to public comment, we have
at 45 CFR 164.312(e)(2)(i) ‘‘[i]mplement the standard to read as follows: ‘‘A chosen not to specify a standard for
security measures to ensure that hashing algorithm with a security detecting alterations to audit logs at this
electronically transmitted electronic strength equal to or greater than time.
protected health information is not SHA–1 must be used to verify that Comment. One commenter requested
improperly modified without detection electronic health information has not clarification as to how message hashing
until disposed of.’’ Because this been altered.’’ More information on should work when messages are part of
certification criterion specifies a SHA–1 and other secure hash a multi-part transmission process, e.g.,
capability that Certified EHR algorithms can be found in FIPS 180–3 5 through switches, clearinghouses, and
Technology must include, we do not while more information on the security other brokers.
believe that it is necessary or strength of certain hashing algorithms Response. We expect Certified EHR
appropriate for us to address whether Technology to be capable of generating
can be found in NIST Special

hashing is applicable to public and Publication 800–107.6 a hash of electronic health information
private networks. Additionally, we and upon receipt of such information,
clarify that Certified EHR Technology 5 http://csrc.nist.gov/publications/fips/fips180-3/
verifying that it has not been altered
must include the capability to check the fips180-3_final.pdf. when it has been electronically
integrity of health information that has 6 http://csrc.nist.gov/publications/nistpubs/800- exchanged. We recognize that certain
been received through electronic 107/NIST-SP-800-107.pdf. situations may not be conducive to the
use of hashes, which is why, as we support any meaningful use exchanged in a meaningful manner is if
noted above, we do not specify the requirements. the integrity of the information can be
instances in which hashing must be Response. We disagree. Meaningful maintained. Information ‘‘integrity’’ is
used, just that Certified EHR use requires the electronic exchange of also one of the three pillars of securing
Technology include these capabilities. health information and the protection of or ‘‘protecting’’ electronic information.
Comment. One commenter stated that such information. We believe that the
secure transmission requirements are only practical and effective way that Section 170.302(t)—Authentication
‘‘inappropriate’’ because they do not electronic health information can be
created or maintained by the cer- analysis per 45 CFR 164.308 (1) Local. Verify that a person or entity seeking access to elec-
tified EHR technology through (a)(1) and implement security tronic health information is the one claimed and is authorized
the implementation of appropriate updates as necessary and cor- to access such information.
technical capabilities. rect identified security defi- (2) Cross network. Verify that a person or entity seeking access
ciencies as part of its risk man- to electronic health information across a network is the one
agement process. claimed and is authorized to access such information in ac-
cordance with the standard specified in § 170.210(d).
Final Rule Text: § 170.302(t).
Authentication. Verify that a person or entity seeking access to
electronic health information is the one claimed and is author-
ized to access such information.
Comments. One commenter expressly implement at the present time, was condition of certification at the present
supported this certification criterion. A overly broad, and could be subject to time. As a result, we have removed this
majority of commenters expressed multiple interpretations. Other specific part of the certification criterion
concerns related to § 170.302(t) and the commenters contended that there is an and the associated standard.
cross-enterprise authentication standard insufficient infrastructure to support Comment. A commenter requested
specified at § 170.210(d). Some cross-enterprise authentication. One clarification as to whether ‘‘user name
commenters misinterpreted our example commenter stated that cross-enterprise and password’’ would be sufficient to
and stated that Security Assertion authentication would not reside in an authorize a user or whether biometrics
Markup Language (SAML) should not be EHR application, but rather in the would be required.
required or be a named standard. One network infrastructure. Response. We do not believe that it is
commenter suggested expanding the set Response. We have considered the
appropriate to specify, as a condition of
of examples we provided. Other concerns issued by commenters and
certification, the types of factors that
commenters requested that the standard agree that the burden associated with
users could utilize to authenticate
and the related portion of the cross enterprise authentication is
themselves.
certification criterion be removed unnecessarily high and cross-network
because it was too burdensome to authentication should not be a Section 170.302(u)—Encryption
created or maintained by the cer- analysis per 45 CFR 164.308 (1) General. Encrypt and decrypt electronic health information
tified EHR technology through (a)(1) and implement security according to user-defined preferences in accordance with the
the implementation of appropriate updates as necessary and cor- standard specified in § 170.210(a)(1).
technical capabilities. rect identified security defi- (2) Exchange. Encrypt and decrypt electronic health information
ciencies as part of its risk man- when exchanged in accordance with the standard specified in
agement process. § 170.210(a)(2).
Final Rule Text: § 170.302(u).
General encryption. Encrypt and decrypt electronic health infor-
mation in accordance with the standard specified in
§ 170.210(a)(1), unless the Secretary determines that the use
of such algorithm would pose a significant security risk for Cer-
tified EHR Technology.
§ 170.302(v).
Encryption when exchanging electronic health information.
Encrypt and decrypt electronic health information when ex-
changed in accordance with the standard specified in
§ 170.210(a)(2).
Comments. A number of commenters Response. Certified EHR Technology and decryption must be performed; they
stated that transmissions of health must include the capability to encrypt simply require the capability. If an
information over leased or private and decrypt information regardless of eligible professional or eligible hospital
network lines should not be subject to the transmission method used. This determines that encryption is an
the encryption of data in transit certification criterion and related appropriate and necessary safeguard, we
requirement. standard do not specify the believe that Certified EHR Technology
circumstances under which encryption should provide the capability to
implement encryption. Overall, we want approved security function in Annex A or ONC–ACBs not to test and certify
to ensure that Certified EHR Technology of the Federal Information Processing Complete EHRs and EHR Modules
is capable of assisting eligible Standards (FIPS) Publication 140–2.’’ according to the specified compromised
professionals and eligible hospitals to The National Institute of Standards algorithm. The Department would then
implement more secure technical and Technology (NIST) published follow-up with rulemaking as necessary
solutions if they determine, based on Federal Information Processing and appropriate to update the adopted
their risk analysis, that technical Standards (FIPS) Publication 140–2 to list of acceptable encryption algorithms.
safeguards such as encryption are specify the security requirements for Comments. Many commenters
reasonable and appropriate, or required. cryptographic modules. As part of FIPS expressed concerns that the rule would
Comment. One commenter requested 140–X conformance, NIST publishes require the encryption of data at rest.
further clarification of the phrase ‘‘annexes’’ of different ‘‘approved’’ One commenter recommended that
‘‘encrypted and integrity protected link.’’ security protocols. For purposes of encryption not be a required
Several commenters recommended that encryption, NIST maintains ‘‘Annex A’’ functionality of EHR systems, but
Transport Layer Security (TLS) ought to which identifies ‘‘approved security defined as limited to devices. Some
be specifically named as a required functions.’’ Annex A identifies both commenters stated that requiring EHR
protocol. Other commenters also symmetric and asymmetric key systems to be capable of encryption
expressed concern that unless TLS is encryption algorithms that NIST has would hinder adoption.
explicitly named, all example protocols identified for use in accordance with Response. We require that Certified
would be required to be supported. FIPS 140–2. In response to commenters’ EHR Technology must be capable of
Response. The example list of concerns, we believe that leveraging encrypting electronic health
protocols that would meet the NIST’s work in this area provides for a information. We do not specify the
certification criterion is not intended to clearer requirement for compliance and policies surrounding the use of
be exhaustive or suggest that Complete provides Complete EHR and EHR encryption by an eligible professional or
EHRs or EHR Modules must be capable Module developers with the ability to eligible hospital nor do we specify that
of using all of the listed protocols to be use one or more secure encryption it should only apply to devices. Rather
certified. The example list of protocols algorithms for the purposes of we intend for Certified EHR Technology
in the Interim Final Rule was included demonstrating compliance with this to be technologically capable of
solely for illustrative purposes. We certification criterion. We believe this encryption, thereby allowing, if desired
have, however, consistent with the way flexibility will benefit eligible or required, an eligible professional or
we have restructured the regulatory text professionals and eligible hospitals eligible hospital who adopts Certified
for some standards (to better associate because they may be able to leverage a EHR Technology to use this capability.
them with the adopted certification broader suite of secure encryption We disagree that requiring Certified
criterion that reference them), modified algorithms. As noted in Special EHR Technology be capable of
this standard to simply express that the Publication 800–111, which is specified encryption would hinder adoption. To
standard is any encrypted and integrity in the guidance included in the breach the contrary, we believe that Certified
protected link. notification interim final rule for the EHR Technology capable of encrypting
Comments. Several commenters encryption of data at rest, ‘‘[w]henever electronic health information will be
suggested replacing the functional possible, AES should be used for the desired, especially in light of the new
description of the encryption standard encryption algorithm because of its breach notification requirements
with a specific reference to FIPS 140–2. strength and speed.’’ established by the HITECH Act and the
These commenters also noted that HHS We point out that the adopted Breach Notification for Unsecured
had included such a reference in an certification criterion identifies certain Protected Health Information Interim
update to its guidance specifying the discretionary authority that the Final Rule. We also take this
technologies and methodologies that Secretary is retaining with respect to opportunity to make a technical
render protected health information acceptable encryption algorithms. We correction to this certification criterion.
unusable, unreadable, or indecipherable have adopted the list of approved We inadvertently combined both
that was included in the Breach encryption algorithms that NIST has encryption capabilities under the same
Notification for Unsecured Protected identified and referenced in FIPS 140– paragraph and per our reaffirmed
Health Information Interim Final Rule, 2 Annex A, which is being incorporated interpretation expressed in the
published on August 24, 2009 (74 FR by reference. While the list is intended Temporary Certification Program, we
42740), and further, requested that we to be current, we anticipate that NIST believe that the scope of one
make our standard consistent with this will on an as-needed basis revise and certification criterion starts at the first
guidance. Some commenters explicitly update the list, based on the paragraph level and includes all
recommended that AES be specified as development of new technologies or subparagraphs. As a result, we view
the encryption algorithm standard. perhaps on identified vulnerabilities these as two distinct capabilities and
Response. We have considered these associated with a particular algorithm. have created a separate certification
commenters’ points and have decided to Regardless of any revisions to this list criterion for each.
revise our adopted standard to be more by NIST, this version of Annex A that Comments. One commenter stated
flexible regarding the encryption is incorporated by reference will remain that the security requirements,
algorithms we permit EHR Technology effective for purposes of serving as the particularly for encryption, are lower
to implement to be certified. We have adopted encryption standard. With that than the security standards it already
also sought to clarify how our adopted said, if the Secretary determines that meets. This commenter consequently
standard relates to the guidance one of the listed encryption algorithms believes that our adoption of this
included in the breach notification poses a significant security risk for standard would require it to reduce the
interim final rule. We have revised the Certified EHR Technology, the Secretary security of its products. Another
general encryption standard to read as will notify the public on the commenter stated that encryption
follows: ‘‘Any encryption algorithm Department’s Web site (and perhaps technology should not be integrated into
identified by the National Institute of with some time delay in the Federal an EHR product, but should instead be
Standards and Technology (NIST) as an Register), and will direct ONC–ATCBs implemented through other means as
part of the system on which an EHR algorithms are available for Complete in the Interim Final Rule, to mean that
may be installed. EHR and EHR Module developers to users would have the ability to elect
Response. We believe that Certified implement. when they wanted encryption to occur,
Comments. A few commenters stated for example, at log-off. We recognize
EHR Technology must be capable of
that the term ‘‘user-defined preferences’’ that organizational policies, software as
performing encryption. Because of the in the certification criteria was too
flexibility in the adopted standard, service models and other architectures
vague and allowed too much latitude for in which Certified EHR Technology may
however, how encryption is technically divergent interpretations of the
implemented is up to the Complete EHR be implemented, could lead to
requirement. Other commenters noted encryption being instituted in
or EHR Module developer to determine that users do not always get to define significantly different ways and, as a
within the parameters of Annex A of such preferences as they would conflict result, we have removed the reference to
FIPS 140–2. Given the changes we have with overarching organizational ‘‘user-defined preferences.’’
made to the general encryption policies.
standard, we believe that the full range Response. We intended the phrase, Section 170.302(v)—Accounting of
of the most secure encryption ‘‘according to user-defined preferences’’ Disclosures
created or maintained by the cer- analysis per 45 CFR 164.308 Record disclosures made for treatment, payment, and health
tified EHR technology through (a)(1) and implement security care operations in accordance with the standard specified in
the implementation of appropriate updates as necessary and cor- § 170.210(e).
technical capabilities. rect identified security defi- Final Rule Text: § 170.302(w).
ciencies as part of its risk man- Certification criterion made optional, while the text of this certifi-
agement process. cation criterion remains unchanged.
Comments. Many commenters the Secretary to promulgate a rule no decided to make this certification
asserted that the certification criterion later than six months after the Secretary criterion ‘‘optional’’ instead of removing
and accompanying standard for has adopted a standard for accounting of it. Additionally, the standard will
accounting of disclosures for treatment, disclosures, which has not yet occurred. remain unchanged as currently worded
payment, and health care operations (as Many of these commenters suggested and as applicable to the certification
these terms are defined at 45 CFR that the certification criterion and criterion to provide guidance to
164.501) would be a resource intensive standard should be removed or their Complete EHR and EHR Module
process and too administratively, adoption delayed until after the developers that choose to adopt this
technically, and financially technical specifications for accounting capability at this time. As an optional
burdensome. A large portion of of disclosures can be harmonized with certification criterion, though, Complete
commenters further conveyed specific the Secretary’s forthcoming EHR or EHR Module will not be
challenges including: The ability to promulgation of a regulation on this required to possess the capability for
differentiate between a ‘‘use’’ and a issue. Other commenters noted that the certification. As we stated previously in
‘‘disclosure’’ (as these terms are defined HIT Policy Committee included the Interim Final Rule, we plan to work
at 45 CFR 160.103); storing three years accounting of disclosures in its collaboratively with the Office for Civil
worth of disclosures, which many noted suggestions as a meaningful use Stage 3 Rights (OCR) as it develops the
could be voluminous; that health care objective. In response to the questions regulatory policy related to this
providers, especially hospitals, have we posed, several commenters noted requirement. We anticipate updating
decentralized systems, which today are that to whom the disclosure was made this certification criterion and the
manually accessed to create an (recipient) should be an important related standard in a future rulemaking
accounting of disclosures; the element included in an accounting of to reflect OCR’s final policies regarding
development time for such a capability disclosures. One commenter noted that accounting of disclosures.
would take more time than is available the standard should be the same as what Comment. Several commenters
before the meaningful use Stage 1 is currently applicable to disclosures requested that we clarify what is meant
effective date; that it would be difficult that are not for treatment, payment, and by a ‘‘description of the disclosure.’’
to account for these types of disclosures health care operations and cited the Some commenters noted that it would
in real-time without a code set for requirements at 45 CFR 164.528(b)(2). not be possible to include these
disclosures; that this requirement could Other commenters stated that the descriptions in an accounting without
affect workflow; and the scope of adopted certification criterion should be code sets for the various types of
electronic exchanges that the term an audit log. disclosures. These commenters also
‘‘disclosure’’ would encompass is Response. We appreciate the indicated that this requirement could
unclear. A majority of commenters also thoroughness, specificity, and detail have serious workflow implications
echoed that the Secretary should use provided by many of those who unless it can be fully automated.
discretion provided by the HITECH Act commented on this certification Response. We recognize the
to delay the compliance date for criterion. We recognize that significant technological challenges associated with
accounting of disclosures for treatment, technical and policy challenges remain effectively and efficiently addressing
payment, and health care operations. unresolved. Accordingly, we do not this aspect of the standard which some
Commenters supported this suggestion believe that the capability to account for commenters mentioned. We also
by pointing out that the Secretary has disclosures should be a condition of recognize that the regulated community
not yet formally established the policies certification at the present time. As is awaiting the proposed rule and
for accounting of disclosures. They discussed in the beginning of the subsequent final rule that will
explained that the HITECH Act requires preamble of this final rule, we have implement important privacy provisions
of the HITECH Act. As we discussed in descriptive information could be wait for OCR to promulgate final
the Interim Final Rule, we intended to included such as the words ‘‘treatment,’’ regulations for accounting of
leave Complete EHR and EHR Module ‘‘payment,’’ or ‘‘health care operations’’ disclosures, before revisiting whether
developers with the flexibility to separately or together as a general this certification criterion should be
innovate in this area and to develop category. We also assumed that required.
new solutions to address the needs of Complete EHR and EHR Module
their customers. We anticipated that a developers could find innovative ways b. Specific Certification for Complete
‘‘description of the disclosure’’ would, at to associate certain electronically EHRs or EHR Modules Designed for an
the present time, be a free text field that available information with the Ambulatory Setting—§ 170.304
would have included any information disclosures, such as, to whom the Section 170.304(a)—Computerized
that could be readily and electronically disclosure was made. Again, for the Provider Order Entry
associated with the disclosure. For time being, we have made this
example, we envisioned that some certification criterion optional, and will
Use CPOE for medication orders More than 30% of unique patients Interim Final Rule Text:
directly entered by any licensed with at least one medication in Enable a user to electronically record, store, retrieve, and man-
healthcare professional who can their medication list seen by the age, at a minimum, the following order types:
enter orders into the medical EP or admitted to the eligible (1) Medications;
record per state, local and pro- hospital’s or CAH’s inpatient or (2) Laboratory;
fessional guidelines. emergency department (POS 21 (3) Radiology/imaging; and
or 23) have at least one medica- (4) Provider referrals.
tion order entered using CPOE. Final Rule Text: § 170.304(a).
Computerized provider order entry. Enable a user to electroni-
cally record, store, retrieve, and modify, at a minimum, the fol-
lowing order types:
(1) Medications;
(2) Laboratory; and
(3) Radiology/imaging.
Comments. A couple of commenters referral made by an eligible professional with ‘‘modify’’ to be more consistent
noted that within the confines of many in a private practice to constitute an with the terminology used in other
hospitals, just about any ‘‘order’’ can be order that should be handled certification criteria. We have also made
entered, so the process of order entry is functionally through CPOE. this change in the CPOE certification
defined. For providers, the commenter Response. We agree with the criterion for Complete EHRs and EHR
noted that the ability to perform orders commenter that suggested that we Modules designed for an inpatient
varies. The commenter inquired narrow our focus, in order to reduce the setting.
whether a specific meaning for order burden associated with this certification Comment. A commenter stated that
entry was intended for this certification criterion. Accordingly, we have the lab industry does not have any
criterion. A few commenters supported removed ‘‘provider referrals’’ from the standards for order entry, and even
the certification criterion. One certification criterion. Complete EHR among lab providers, their operating
commenter recommended that referrals and EHR Module developers may units utilize different standards. The
to dieticians, speech therapists, child include additional orders as they see fit commenter contended that this lack of
and as recommended by some consistency in order entry would
life and social services be added to the
commenters, however in order to be require EHRs to build custom interfaces
order types, as well as durable medical
certified they must include at a to every lab. They recommended that
equipment, orthotics, and prosthetics.
minimum the three order types we require that Certified EHR
Another commenter recommended that (medications, laboratory, and radiology/ Technology provide the ability to link
CPOE include a Patient Plan of Care imaging) specified in the certification the results to the original order. Another
(PPOC) because, according to the criterion. Many commenters generally commenter recommended that the
commenter, PPOC requires the content supported these three specified order certification criterion include the
necessary for electronic data types and we note that while the final requirement for standardized bi-
interoperability. The commenter felt meaningful use Stage 1 objective focuses directional laboratory interfaces,
that PPOC within an EHR would help to on medication orders, we believe that including functionality pertinent to all
achieve the integration goals that for the purposes of certification and to the laboratory order data needed for the
promote the appropriate exchange of equip eligible professionals with a basic laboratory to conduct proper testing,
medical information for the optimal set of ordering capabilities, it is patient matching and billing (including
coordination of patient care in different appropriate to continue to maintain limited coverage rules and printing of
healthcare settings. Another commenter these three order types. (This response Advance Beneficiary Notices (ABNs)).
suggested that we narrow the CPOE also applies to the change we made in Response. In the certification criterion
requirements to focus on medications, the CPOE certification criterion for discussed above regarding incorporating
laboratory tests, and imaging tests. One Complete EHRs or EHR Modules laboratory test results, we have required
commenter stated that based on the designed for an inpatient setting). that Certified EHR Technology be
discussions of CPOE in the Interim Finally, in further reviewing this capable of electronically attributing,
Final Rule and the Medicare and certification criterion in light of associating, or linking a laboratory test
Medicaid EHR Incentive Programs comments received, we have also result to a laboratory order or patient
proposed rule, we should consider a determined that it would be appropriate record. Bidirectional exchange
request for a consultation or a provider and clearer to replace the term ‘‘manage’’ (including electronic transmission of
laboratory orders) is not a requirement regulation but rather refer to and adopt themselves in addition to the imaging
of meaningful use Stage 1 and is beyond existing controlled vocabularies or reports as part of the certification
the scope of this rule. subsets. The commenter also stated that criteria. The commenter recommended
Comments. Several commenters the regulation introduces a requirement that we further clarify the criterion and
recommended we clarify that the user of to record, store, retrieve and manage moreover, adopt the DICOM standard in
CPOE includes the eligible professional orders, though no vocabularies are the initial set of standards, as an
and any authorized user in the office of specified and further pointed out that essential step in meeting the CPOE
the eligible professional (EP). They also there are no vocabularies or standards capability.
recommended that CPOE be deemed to for orders, images, or referrals in any Response. We clarify that the adopted
include the scenario in which only the part of the Interim Final Rule. The certification criteria related to CPOE
actual orders are entered by the EP, with commenter recommended that the pertain only to the ordering, and not to
the additional billing and demographic Department focus its efforts on the delivery of results (reports or
information entered by authorized users identifying and adopting standards for images). As a result, we do not believe
in the EP’s office or even by third computable and interoperable that this commenter’s recommendation
parties (e.g. laboratory personnel in the representations of these elements and is applicable to this certification
patient service center of a laboratory processes before directing eligible criterion.
that collects specimens from the professionals to implement ‘‘CPOE.’’ Comment. A commenter
patient). Response. We appreciate the recommended that the CPOE
Response. As we stated in an earlier commenter’s concern. This is an initial certification criterion should include a
response, the standards, implementation set of standards, implementation prompt for an authorized user of the
specifications, and certification criteria specifications, and certification criteria CPOE to include diagnosis codes at
adopted in this final rule apply to and we expect to adopt more standards, order entry.
Complete EHRs and EHR Modules. We implementation specifications, and Response. We do not believe that it
have focused on whether Certified EHR certification criteria in the future as would be appropriate to specify this
Technology must include a capability necessary to improve the type of capability as a condition of
and how it must perform the capability. comprehensiveness of certain certification because it is not central to
As a result, it is not within the scope of capabilities. the meaningful use objective and
this rulemaking to specify the persons Comment. A commenter requested
measure this certification criterion is
who would need to use CPOE. that we clarify whether only imaging
intended to support.
Comment. A commenter suggested and radiology reports were intended to
that we not create controlled be included in this capability, or, if we Section 170.304(b)—Electronically
vocabularies or value sets in the intended to include the images Exchange Prescription Information
Generate and transmit permissible More than 40% of all permissible Interim Final Rule Text:
prescriptions electronically (eRx). prescriptions written by the EP Enable a user to electronically transmit medication orders (pre-
are transmitted electronically scriptions) for patients in accordance with the standards speci-
using certified EHR technology. fied in § 170.205(c).
Final Rule Text: § 170.304(b).
Electronic prescribing. Enable a user to electronically generate
and transmit prescriptions and prescription-related information
in accordance with:
(1) The standard specified in § 170.205(b)(1) or § 170.205(b)(2);
and
(2) The standard specified in 170.207(d).
Comments. Many commenters stated that ‘‘if SCRIPT 10.6 is permitted, with which they must be associated.
supported the adoption of NCPDP prior to any modification of the Therefore, we have modified this
SCRIPT 8.1 and the inclusion of NCPDP provisions of this interim final rule in certification criterion to specify that a
SCRIPT 10.6. These commenters also response to public comment, we would Complete EHR or EHR Module would be
encouraged the exclusive adoption of expect to change our requirement to compliant with this certification
NCPDP 10.6 for meaningful use Stage 2. simply permit either SCRIPT 8.1 or criterion if it has the capability of
One commenter stated that more SCRIPT 10.6.’’ Accordingly, we have generating and transmitting prescription
clarification was needed as to which modified this certification criterion to and prescription-related information
NCPDP SCRIPT standard was required specify that Complete EHR and EHR according to NCPDP SCRIPT 8.1 while
for certification. Module developers may seek to have also using the adopted vocabulary
Response. In the Interim Final Rule, their Complete EHR or EHR Module standard, or if it is capable of generating
we stated that we expected that CMS tested and certified to either solely and transmitting prescriptions and
would identify as a backwards NCPDP SCRIPT 8.1 or 10.6. prescription-related information
compatible standard NCPDP SCRIPT Additionally, we have also replaced the according to NCPDP SCRIPT 10.6 while
10.6 and permit its use as an alternative standard adopted in the Interim Final also using the adopted vocabulary
to NCPDP SCRIPT 8.1 for the electronic Rule and have adopted both NCPDP standard.
transmission of prescription and certain SCRIPT 8.1 and NCPDP SCRIPT 10.6. Comments. Several commenters
other prescription-related information As discussed in the beginning of the supported the adoption of RxNorm and
for Medicare Part D covered drugs preamble, we have revised our approach the use of RxNorm code sets as a
prescribed for Part D eligible to specifying the certification criteria to vocabulary standard. One commenter
individuals (75 FR 38026). Further, we more clearly focus on the capabilities recommended that RxNorm be adopted
in Stage 1 while one commenter stated data sets integrated within RxNorm. criterion causing two different
that Stage 2 is likely the earliest After the Interim Final Rule was workflows because of the restrictions
timeframe practicable for published, NLM subsequently released placed on the electronic prescribing of
implementation. Others suggested that several more RxNorm versions. NLM controlled substances.
more testing was needed before RxNorm has also reorganized the RxNorm Response. The Drug Enforcement
could be adopted in full. Some documentation in a way that we believe Agency has since published an interim
commenters stated that RxNorm is not more clearly specifies the intent of our final rule (75 FR 16236) on the
complete and requested guidance on standard. Accordingly, we believe that requirements related to the electronic
how gaps in RxNorm will be addressed. this standard, particularly in response to prescribing of controlled substances. At
A couple commenters stated a concern public comments, can be further the present time, we do not require as
that current drug databases do not map clarified. In addition, to permit the a condition of certification for Complete
to RxNorm and that in order to develop development or mapping and use of EHRs and EHR Modules that they be
interfaces for electronic prescribing other vocabularies independent of NLM, capable of enabling compliance with the
services, pharmacies and developers we have dropped the requirement that current DEA provisions for the
will need to expend significant effort. NLM explicitly identify the acceptable electronic prescribing of controlled
Other commenters stated that more data sources. Instead, the standard now substances.
clarification was needed with respect to permits the use of codes from any drug Comments. A couple of commenters
the description of the adopted standard vocabulary successfully included in stated that the prescribing capabilities
and one of those commenters RxNorm. To provide guidance and must allow for weight-based dosing
recommended that the description be clarification to the industry, we will calculation with intelligent rounding
changed to ‘‘a drug data source provider recognize any source vocabulary that is and that without this, e-prescribing will
that demonstrates group domain identified by NLM’s RxNorm not be helpful to pediatricians.
comprehensiveness.’’ Documentation as a source vocabulary Response. We recognize that this is an
Response. We have consolidated and included in RxNorm. We are therefore important capability for pediatricians;
addressed our adopted vocabulary revising the standard to state: ‘‘Any however, we do not believe that it
standard for medications under this source vocabulary that is included in necessary to require it as a condition of
certification criterion. However, our RxNorm, a standardized nomenclature certification at the present time. Again,
response and subsequent clarifications for clinical drugs produced by the this does not preclude Complete EHR
are applicable to all certification criteria United States National Library of and EHR Module developers from
that reference this vocabulary standard. Medicine.’’ We note that in section 3.1, including this capability.
As we explained in the Interim Final of the most recent release of the Comments. A few commenters
Rule, we determined that the HIT ‘‘RxNorm Documentation (06/07/10, expressed concerns about some
industry would benefit from a certain Version 2010–3) 7,’’ NLM has identified pharmacies not being capable of
degree of flexibility with respect to the the following source vocabularies as receiving electronic prescriptions which
coding of medications. To provide this being included in RxNorm. they stated could cause a negative
flexibility while also establishing a glide • GS—Gold Standard Alchemy. impact on the workflow. One
path to full adoption of RxNorm, we • MDDB—Medi-Span Master Drug commenter suggested that we add a
adopted a standard that permits the use Data Base. ‘‘where possible’’ to the certification
of one of many different vocabulary • MMSL—Multum MediSource criterion.
standards. We specified that a Complete Lexicon. Response. While we recognize that
EHR or EHR Module would be • MMX—Micromedex DRUGDEX. some pharmacies may be unable to
compliant with the adopted vocabulary • MSH—Medical Subject Headings receive electronic prescriptions at the
standard if it utilized ‘‘[a]ny code set by (MeSH). present time, we do not believe this
an RxNorm drug data source provider • MTHFDA—FDA National Drug limitation should affect the capability
that is identified by the United States Code Directory. that Certified EHR Technology must
National Library of Medicine as being a • MTHSPL—FDA Structured Product provide. Further, we do not believe that
complete data set integrated within Labels. inserting ‘‘where applicable’’ would be
RxNorm.’’ We specified the standard • NDDF—First DataBank NDDF Plus beneficial because it would make the
this way in order to establish what we Source Vocabulary. criterion unnecessarily ambiguous. This
• NDFRT—Veterans Health
believe is an important bridge to full phrase would relate to when electronic
Administration National Drug File—
RxNorm adoption and will help prescribing should be conducted, not
Reference Terminology.
facilitate this transition over time. Our • SNOMED CT—SNOMED Clinical how it should be done, which is the
adoption of this standard stems from Terms (drug information). focus of this certification criterion.
our belief that Complete EHRs and EHR • VANDF—Veterans Health Comment. A commenter stated that
Modules should be capable of Administration National Drug File. the electronic prescribing process
classifying and categorizing medications We clarify for commenters that the should be linked to the contraindication
for the purpose of clinical quality standard we have adopted is a and formulary conflict process and
measurement and clinical decision functional standard that enables the use should provide automatic alerts.
support. The National Library of of any source vocabulary that is Another commenter recommended that
Medicine (NLM) maintains the Unified included within RxNorm. Consequently, information relating to the language the
Medical Language System® (UMLS®), any one of these ‘‘source vocabularies’’ patient speaks should be required as
which contains the mapping between identified by NLM may be used, or any part of the electronic prescribing
RxNorm and commonly utilized drug other source vocabulary successfully process, so that pharmacy is notified of
vocabularies. included within RxNorm. a patient’s need for language assistance.
At the time we published the Interim Comments. A few commenters stated Response. We do not believe that it
Final Rule, we noted that NLM, concerns about this certification would be appropriate to expand the
according to the most recent RxNorm certification criterion as suggested at
release, listed a number of RxNorm drug 7 http://www.nlm.nih.gov/research/umls/rxnorm/ this time. This does not preclude a
data source providers with complete docs/2010/rxnorm_doco_full_2010–3.html. Complete EHR or EHR Module
developer from pursuing other ways to Section 170.304(c)—Record

optimize how a Complete EHR or EHR Demographics
Module may function.
Record demographics: More than 50% of all unique pa- Interim Final Rule Text:
• preferred language tients seen by the EP or admit- Enable a user to electronically record, modify, and retrieve pa-
• gender ted to the eligible hospital’s or tient demographic data including preferred language, insur-
• race CAH’s inpatient or emergency ance type, gender, race, ethnicity, and date of birth.
• ethnicity department (POS 21 or 23) Final Rule Text: § 170.304(c).
• date of birth have demographics recorded as Record demographics. Enable a user to electronically record,
structured data modify, and retrieve patient demographic data including pre-
ferred language, gender, race, ethnicity, and date of birth. En-
able race and ethnicity to be recorded in accordance with the
standard specified at 170.207(f).
Comments. Several commenters unaware of any alternative voluntary reporting of demographics and indicate
recommended that we adopt the OMB consensus standard that accomplishes whether information was self-reported.
race and ethnicity codes. the same purpose. Finally, one commenter stated that
Response. We agree with these Comments. Several commenters EHRs are not appropriate source of legal
commenters and have adopted the OMB recommended additional elements for documentation for births and deaths.
race and ethnicity codes. In the the certification criterion for us to
Medicare and Medicaid EHR Incentive consider adding. One commenter Response. While we understand
Programs proposed rule (75 FR 1855), recommended that we include more commenters’ intentions, we do not
CMS stated that race and ethnicity demographic data items to allow believe that it would be appropriate to
codes should follow current Federal successful matching with prior expand this certification criterion
standards. We note that the OMB race admissions and further that we consider beyond what is required to support
and ethnicity codes constitute a requiring the inclusion of social security meaningful use. Again, as we have
government-unique standard for the number, birthplace, and years of previously stated, this does not preclude
purposes of the National Technology education, if available. A couple a Complete EHR or EHR Module
Transfer and Advancement Act of 1995 commenters requested that we add developer from including the capability
(NTTAA). We have adopted this occupation and industry status as well to record additional demographic
standard because it provides an easily because they are already required for information. Finally, consistent with the
understood structure and format for cancer registries. Another commenter Medicare and Medicaid EHR Incentive
electronically transmitting the data suggested that we add family history to Programs final rule, we have removed
elements identified in the meaningful demographics that should be captured the capability to record insurance type
use Stage 1 objective, the standard is and reported. One commenter suggested from the certification criterion.
readily available, in general it provides that we also include a patient’s
the best standard to use to support our functional status. Many commenters Section 170.304(d)—Generate Patient
policies goals. Moreover, we are suggested that we encourage self- Reminder List
Send reminders to patients per pa- More than 20% of all unique pa- Interim Final Rule Text:
tient preference for preventive/ tients 65 years or older or 5 Electronically generate, upon request, a patient reminder list for
follow up care years old or younger were sent preventive or follow-up care according to patient preferences
an appropriate reminder during based on demographic data, specific conditions, and/or medi-
the EHR reporting period cation list.
Final Rule Text: § 170.304(d).
Patient reminders. Enable a user to electronically generate a pa-
tient reminder list for preventive or follow-up care according to
patient preferences based on, at a minimum, the data ele-
ments included in:
(1) Problem list;
(2) Medication list;
(3) Medication allergy list;
(4) Demographics; and
(5) Laboratory test results.
Comments. Several commenters ‘‘Electronically generate, upon request, a meaning of the term, how these
stated that they support this patient reminder list for preventive or preferences would be recorded, how the
certification criterion. Other follow-up care according to patient or preferences would be used, and whether
commenters requested further definition physician preferences based on the preferences should be automated. A
of the term ‘‘specific conditions,’’ demographic data, specific conditions, question was raised by two commenters
particularly whether this term refers to and/or medication list.’’ Several about how many choices should be
data as contained in the problem list. commenters requested further definition allowed for the preferred reminder
One commenter suggested that the of the term ‘‘patient preferences.’’ delivery method due to additional EHR
criterion text be modified to read: Clarification was requested about the system programming that may be
needed to support the set of choices. objective, we encourage commenters to elements and CMS’s express desire to
One commenter was concerned about review CMS’s responses to their consider patient preferences as
whether there would be a cost to requests for clarification. Consistent described in the Medicare and Medicaid
physician practices to implement this with the revisions we made to the EHR Incentive Programs final rule.
requirement and whether the practices ‘‘generate patient lists’’ certification Comments. Two commenters asked
will have the capacity to accommodate criterion, we believe that Certified EHR whether this requirement refers to the
this requirement. Another commenter Technology should be able to leverage creation of a list for the internal
suggested that this requirement be the information, specifically the purposes of the eligible professional and
moved to meaningful use stage 2 to structured data it had available to it, to his/her staff only and does not refer to
allow more time for EHRs to be assist eligible professionals and eligible or require electronic communication to
enhanced. Several commenters hospitals generate a patient reminder a patient.
requested clarification of the term ‘‘upon list. We have removed ‘‘upon request’’
request.’’ One commenter wanted to from the certification criterion, because, Response. Yes, we expect Certified
know which persons would be after further review, we believe that the EHR Technology to be capable of
authorized to request the patient action of requesting a list is implied by generating a patient reminder list for an
reminder list and how often. Another the certification criterion and the eligible professional and his/her staff.
commenter suggested that the phrase meaningful use measure, and therefore, The meaningful use measure establishes
‘‘upon request’’ be removed, as it unnecessary to further specify. the requirement for an eligible
believed that outpatient physicians Comments. Two commenters stated professional to take action once the
could make significant advances in the that specialists will use patient reminder list has been generated.
health of their patients by generating reminders differently than primary care Comments. Two commenters
and delivering reminders at every providers. These commenters worried suggested that the set of variables
encounter. that some patients’ preferences may contained in the demographic
Response. In response to comments, exceed a system’s current capabilities information for the patient lists note the
we have revised this certification and one commenter requested that the preferred language of the patient.
criterion to more clearly articulate the phrase ‘‘with respect to system Response. Preferred language is
capability we expect Certified EHR capability’’ be added after ‘‘patient included in demographics and we do
Technology to include. CMS discusses preferences.’’ not believe that it is necessary to
and clarifies the intended meaning of Response. We understand these
expressly call it out as part of this
‘‘patient preferences’’ in the Medicare commenters’ points of view, however,
certification criterion.
and Medicaid EHR Incentive Programs we do not believe that this addition is
final rule and because this term is necessary given the references in the Section 170.304(e)—Clinical Decision
derived from the meaningful use certification criterion to specified data Support
Implement one clinical decision Implement one clinical decision Interim Final Rule Text:
support rule relevant to specialty support rule. (1) Implement rules. Implement automated, electronic clinical de-
or high clinical priority along with cision support rules (in addition to drug-drug and drug-allergy
the ability to track compliance contraindication checking) according to specialty or clinical pri-
that rule. orities that use demographic data, specific patient diagnoses,
conditions, diagnostic test results and/or patient medication
list.
(2) Alerts. Automatically and electronically generate and indicate
in real-time, alerts and care suggestions based upon clinical
decision support rules and evidence grade.
a user.
Final Rule Text: § 170.304(e).
(1) Implement rules. Implement automated, electronic clinical de-
cision support rules (in addition to drug-drug and drug-allergy
contraindication checking) based on the data elements in-
cluded in: problem list; medication list; demographics; and lab-
oratory test results.
indicate in real-time, notifications and care suggestions based
upon clinical decision support rules.
Comments. Several commenters were include specific rules that individual Response. In consideration of
explicitly supportive of this certification eligible professionals would want or commenters’ request for clarification
criterion, while others offered specific whether those rules could be added and to more closely align this
suggestions and requests for later. Another commenter asked for certification criterion with the
clarification. Several commenters clarification regarding several terms meaningful use measure, we have
requested that we specify the decisions including ‘‘diagnostic test results,’’ revised this certification criterion. We
support rules that should be included. whether a ‘‘condition’’ was equivalent to have removed the terms that caused
One commenter asked if we could ‘‘problem,’’ as well as whether the rules some confusion with commenters and
clarify whether a Complete EHR or EHR would be associated with quality believe that these revisions will provide
Module developer would have to measures. more specificity and will make
compliance with the certification another suggested the word ‘‘advisory.’’ the requirement from the certification
criterion easier. Moreover, we clarify Some commenters requested criterion. We also removed this
that with respect to notifications, that clarification regarding ‘‘alerts responded requirement to be more consistent with
‘‘real-time’’ means at the point of clinical to by a user’’ and whether there was an CMS’s expectations for meaningful use,
decision making (i.e., notifications must expectation that alerts communicate which do not include requiring the
be provided when an eligible structured reasons. These commenters tracking of alerts at this time.
professional is using Certified EHR also asked whether users would enter a Comments. A few commenters asked
Technology and not run overnight and reason for any overrides or, in the case for clarification on what we meant by
provided in the morning, for instance). of notifications, the user would simply ‘‘evidence grade’’ and what standard for
Comments. A number of commenters acknowledge the alert by clicking ‘‘OK.’’ evidence grading will be applied in
asked questions and requested The commenters also questioned order to determine compliance with this
clarifications regarding ‘‘alerts.’’ One whether ignored alerts should be objective. Other commenters noted that
commenter requested whether it is the tracked? Many of these commenters ‘‘evidence grade’’ as a part of the rules
number of alerts that is important or the recommended removing § 170.304(e)(3). to trigger alerts is not widely available
type of alerts that is important and how Alternatively, one commenter in the marketplace and that using
we expect an eligible professional to recommended that we not only consider evidence grade in this manner could be
respond to an alert. The commenter also the number of alerts ‘‘responded to’’ but burdensome and present a significant
asked if we could clarify what would also the action prompted and whether maintenance issue.
qualify as a ‘‘response.’’ One commenter or not that action was taken.
Response. We have considered public
stated that whether we intended for the Response. We thank commenters for
comment, and agree that evidence grade
examples (pop-up or sound) to be the thorough feedback on this
is not as widely available in the
inclusive of the types of alerts we certification criterion. We have already
marketplace as we had anticipated. We
expected Certified EHR Technology addressed in our responses above the
therefore remove our reference to
would include and whether this was concerns raised by commenters and will
‘‘evidence grade’’ in the certification
deemed more valuable than a more not repeat them here. With respect to
criterion.
passive notification. The commenter the third part of this certification
suggested that the word ‘‘alert’’ be criterion, we have considered public Section 170.304(f)—Electronic Copy of
replaced with ‘‘notification’’ while comment and have decided to remove Health Information
Provide patients with an electronic More than 50% of all patients of Interim Final Rule Text:
copy of their health information the EP or the inpatient or emer- Enable a user to create an electronic copy of a patient’s clinical
(including diagnostic test results, gency departments of the eligi- information, including, at a minimum, diagnostic test results,
problem list, medication lists, ble hospital or CAH (POS 21 or problem list, medication list, medication allergy list, immuniza-
medication allergies), upon re- 23) who request an electronic tions, and procedures in:
quest. copy of their health information (1) Human readable format; and
are provided it within 3 business (2) On electronic media or through some other electronic means
days. in accordance with:
(i) One of the standards specified in § 170.205(a)(1);
(ii) The standard specified in § 170.205(a)(2)(i)(A), or, at a min-
imum, the version of the standard specified in
§ 170.205(a)(2)(i)(B);
(iii) One of the standards specified in § 170.205(a)(2)(ii);
(iv) At a minimum, the version of the standard specified in
§ 170.205(a)(2)(iii); and
(v) The standard specified in § 170.205(a)(2)(iv).
Electronic copy of health information. Enable a user to create an
electronic copy of a patient’s clinical information, including, at
a minimum, diagnostic test results, problem list, medication
list, and medication allergy list in:
(1) Human readable format; and
(2) On electronic media or through some other electronic means
in accordance with:
(i) The standard (and applicable implementation specifications)
specified in § 170.205(a)(1) or § 170.205(a)(2); and
(ii) For the following data elements the applicable standard must
be used:
(A) Problems. The standard specified in § 170.207(a)(1) or, at a
minimum, the version of the standard specified in
§ 170.207(a)(2);
(B)Laboratory test results. At a minimum, the version of the
standard specified in § 170.207(c); and
(C) Medications. The standard specified in § 170.207(d).
Comment. A commenter Response. In the context of the durable medical equipment in the
recommended that durable medical Meaningful Use Stage 1 objective and certification criterion. However, that
equipment and supplies be added to the measure, we do not believe that it is does not preclude Complete EHRs and
minimum list. appropriate, at the present time, to add
EHR Modules from having that procedures are determined for the capability should be a condition of
additional capability. certification criterion. The commenters certification. This capability would
Comments. A few commenters suggested that a subset of procedures exceed the scope of the relevant
requested clarification as to the (e.g., surgeries, catheterizations) be meaningful use Stage 1 objective and
underlying intent of the certification defined to avoid generating huge lists of measure. We also note that Complete
criterion and whether it was intended ‘‘small’’ procedures (e.g., venipunctures). EHR and EHR Module developers are
that a patient be provided with a These commenters expressed that it was not precluded from including this
complete medical record or simply a critical for the rule to provide a clear, capability in their EHR technology.
‘‘snapshot.’’ Commenters also asked how clinically-relevant definition of which
longitudinal the copy must be and types of procedures are to be included. Comment. A commenter noted that
requested that we specify a time period Response. We appreciate the with our emphasis on the representation
that the electronic copy must cover. A comment and have revised this of clinical information in the format of
commenter stated that eligible certification criterion to remove a CCD or CCR, it is unclear whether the
professionals should be able to limit the ‘‘procedures’’ as well as certification criterion is enough to meet
applicable time period by episode of ‘‘immunizations,’’ to be more consistent patients’ expectations.
care or other parameters. The with the final meaningful use objective Response. We recognize that this
commenter noted that state law also and measure and for greater clarity. minimum information may not satisfy
specifies the information that can be Comment. A commenter requested
every patient’s interests, however, we
provided to a patient without the clarification on how an electronic copy
will be disseminated, and provided believe that the information specified
provider serving as an intermediary. A
few commenters requested clarification examples such as a web-portal, e-mail, represents a core set of information that
that the medication list is limited to the and compact disc. most patients will appreciate is more
current medication list. A commenter Response. We do not specify the readily accessible to them.
recommended that the certification method by which an individual must Comment. A commenter requested
criterion be limited only to information receive an electronic copy of the clarification on the use of the word
readily available to the provider at the specified health information, only that ‘‘and’’ in the certification criterion and
conclusion of a patient encounter. Certified EHR Technology be capable of questioned whether it suggested that the
Response. We expect Certified EHR electronically generating an electronic Certified EHR Technology must generate
Technology to be capable of generating copy in human readable format and in two outputs to produce an electronic
an electronic copy of health information accordance with one of the adopted copy (i.e., a copy in human readable
that includes the minimum elements summary record standards. While
format and a copy as a CCD or CCR).
required as a condition of certification. Certified EHR Technology must be
The commenter made this inquiry
We do not believe that it is appropriate capable of creating an electronic copy of
a patient’s health information as because it believed that the certification
to dictate the timeframe such
information must encompass, but we specified in this certification criterion, criterion could be met through the
would expect that it would include, at we encourage Complete EHR and EHR production of a CCD or CCR with an
a minimum, the most current Module developers to also include the appropriate style sheet. Additionally, a
information that is available and capability to generate an electronic copy commenter stated that it is unclear
accessible within the Certified EHR in a manner that allows eligible whether the electronic copy of the
Technology. We do not believe that professionals (and eligible hospitals as health information provided to patients
limiting this certification criterion to this capability relates to Complete EHRs must be in a CCD or CCR format for
specify that just the information and EHR Modules designed for an Stage 1 or if alternative formats are
available at the end of an encounter is inpatient setting) to comply with allowed. This commenter recommended
consistent with our policy objectives. applicable provisions of the HIPAA that we clarify and distinguish between
Comments. Many commenters Privacy and Security Rules. the electronic medium carrying the
requested a definition of ‘‘diagnostic test Comment. A commenter requested information and the content enclosed.
results.’’ One commenter suggested that that we add a requirement for alerts to
prompt users to ask patients if they Response. Yes, in order to meet this
for Stage 1, the definition of diagnostic
test result be made clear and be limited want a copy of their health information certification criterion, Certified EHR
to, at a minimum, lab results. and include the ability to record Technology must be able to generate an
Response. This term is derived from whether the information was actually electronic copy that is in human
the Medicare and Medicaid EHR provided and the patient’s preference on readable format and as a CCD or CCR.
Incentive Programs final rule, and its the format of the information. The If Certified EHR Technology is capable
meaning is described there. We commenter believed that this of generating one copy that could meet
encourage commenters to review the requirement is necessary because many both of these requirements, we would
Medicare and Medicaid EHR Incentive patients are not aware that they can consider that to be a compliant
Programs final rule. make such a request. implementation of this capability.
Comments. Several commenters Response. While potentially useful as
requested that ONC define how relevant a reminder, we do not believe that this Section 170.304(g)—Timely Access
Provide patients with timely elec- More than 10% of all unique pa- Interim Final Rule Text:
tronic access to their health infor- tients seen by the EP are pro- Enable a user to provide patients with online access to their clin-
mation (including lab results, vided timely (available to the pa- ical information, including, at a minimum, lab test results, prob-
problem list, medication lists, tient within four business days lem list, medication list, medication allergy list, immunizations,
medication allergies) within four of being updated in the certified and procedures.
business days of the information EHR technology) electronic ac- Final Rule Text: § 170.304(g).
being available to the EP. cess to their health information Timely access. Enable a user to provide patients with online ac-
subject to the EP’s discretion to cess to their clinical information, including, at a minimum, lab
withhold certain information. test results, problem list, medication list, and medication al-
lergy list.
Comments. Many commenters Incentive Programs final rule) is to listed in the electronic copy, for
suggested that we should replace the ensure that patients have the ability to example, lab test results, problem list,
word ‘‘online’’ with ‘‘electronic’’ to be access their health information when medication lists, or others specified by
more clearly aligned with meaningful they see fit to do so. Accordingly, the eligible professional.
use and to not preclude other forms of referring to ‘‘electronic’’ in this Response. As discussed above, we
legitimate electronic access. certification criterion would not ensure have revised this certification criterion
Response. We disagree. The purpose that Certified EHR Technology provides to remove ‘‘procedures’’ as well as
and intent of this certification criterion the desired capability. ‘‘immunizations,’’ to be more consistent
with the final meaningful use objective
and its associated meaningful use Comments. A few commenters asked
and measure.
objective and measure (as clarified in for clarification on the meaning of
the Medicare and Medicaid EHR ‘‘procedures’’ and type of results to be Section 170.304(h)—Clinical Summaries
Provide clinical summaries for pa- Clinical summaries provided to pa- Interim Final Rule Text:
tients for each office visit. tients for more than 50% of all (1) Provision. Enable a user to provide clinical summaries to pa-
office visits within 3 business tients for each office visit that include, at a minimum, diag-
days. nostic test results, problem list, medication list, medication al-
lergy list, immunizations and procedures.
(2) Provided electronically. If the clinical summary is provided
electronically it must be:
(i) Provided in human readable format; and
(ii) On electronic media or through some other electronic means
in accordance with:
(A) One of the standards specified in § 170.205(a)(1);
(B) The standard specified in § 170.205(a)(2)(i)(A), or, at a min-
§ 170.205(a)(2)(i)(B);
(C) One of the standards specified in § 170.205(a)(2)(ii);
(D) At a minimum, the version of the standard specified in
§ 170.205(a)(2)(iii); and
(E) The standard specified in § 170.205(a)(2)(iv).
Final Rule Text: § 170.304(h).
Clinical summaries. Enable a user to provide clinical summaries
to patients for each office visit that include, at a minimum, di-
agnostic test results, problem list, medication list, and medica-
tion allergy list. If the clinical summary is provided electroni-
cally it must be:
(1) Provided in human readable format; and
(2) Provided on electronic media or through some other elec-
tronic means in accordance with:
be used:
§ 170.207(a)(2);
(B)Laboratory test results. At a minimum, the version of the
Comments. Several commenters suggesting a more comprehensive list, only procedures in a recent
requested that ‘‘diagnostic test results’’ including diagnostic imaging results. hospitalization or historically all
be further defined, with one commenter Many commenters requested procedures performed on the patient.
suggesting that lab results be the clarification on the list of procedures One commenter questioned why
minimum and other commenters and asked whether this would include immunization data appeared in the list
and believed its inclusion was Response. We understand the Comments. Several commenters
inconsistency with the other items. commenter’s point; however, we do not requested that this rule clarify that
Response. We have made revisions to believe that certification (which will providers would only be responsible for
this certification criterion consistent validate whether a Complete EHR or the completeness and accuracy of the
with the changes that we have already EHR Module can perform this capability clinical summary to the extent they
discussed above, including the removal in a manner compliant with the provided or did not provide the relevant
of certain terms. standards adopted by the Secretary) is data (e.g. if another provider has not
Comment. One commenter expressed the appropriate mechanism to address forwarded data, they are not
concern that patient summaries are most this commenter’s concerns.
useful when the patient/family literacy responsible).
Comment. One commenter urged that
and the context of the health and patient summaries be affirmatively Response. We do not believe that this
follow-up care are taken into offered to the patient, without their behavior can be addressed by the
consideration. The commenter noted requesting them, and that the offer be certification criterion, nor do we believe
further that as written there is little provided in their native language with that it is within the scope of this final
flexibility in this certification criterion the offer documented in the EHR. rule.
and that many patients will be Response. We do not believe that it is
overwhelmed with technical data that within the scope of this final rule to Section 170.304(i)—Exchange Clinical
comes with little context for require eligible professionals to offer Information and Patient Summary
understanding it. patient summaries to patients. Record
Meaningful use Stage 1 objectives Meaningful use Stage 1 measures Certification criterion
Capability to exchange key clinical Performed at least one test of cer- Interim Final Rule Text:
information (for example, problem tified EHR technology’s capacity (1) Electronically receive and display. Electronically receive a pa-
list, medication list, medication al- to electronically exchange key tient’s summary record, from other providers and organizations
lergies, diagnostic test results), clinical information. including, at a minimum, diagnostic tests results, problem list,
among providers of care and pa- medication list, medication allergy list, immunizations, and pro-
tient authorized entities electroni- cedures in accordance with § 170.205(a) and upon receipt of a
cally. patient summary record formatted in an alternate standard
specified in § 170.205(a)(1), display it in human readable for-
mat.
(2) Electronically transmit. Enable a user to electronically trans-
mit a patient summary record to other providers and organiza-
tions including, at a minimum, diagnostic test results, problem
list, medication list, medication allergy list, immunizations, and
procedures in accordance with:
The EP, eligible hospital or CAH The EP, eligible hospital or CAH (i) One of the standards specified in § 170.205(a)(1);
who transitions their patient to who transitions or refers their
another setting of care or pro- patient to another setting of care
vider of care or refers their pa- or provider of care provides a
tient to another provider of care summary of care record for
should provide summary of care more than 50% of transitions of
record for each transition of care care and referrals.
or referral.
§ 170.205(a)(2)(i)(B);
§ 170.205(a)(2)(iii); and
Final Rule Text: § 170.304(i)
(1) Electronically receive and display. Electronically receive and
display a patient’s summary record, from other providers and
organizations including, at a minimum, diagnostic tests results,
problem list, medication list, and medication allergy list in ac-
cordance with the standard (and applicable implementation
specifications) specified in § 170.205(a)(1) or § 170.205(a)(2).
Upon receipt of a patient summary record formatted according
to the alternative standard, display it in human readable for-
mat.
mit a patient summary record to other providers and organiza-
tions including, at a minimum, diagnostic test results, problem
list, medication list, and medication allergy list in accordance
with:

be used:
§ 170.207(a)(2);
(B) Laboratory test results. At a minimum, the version of the
Comments. A few commenters are not based on a common information care providers prefer the CCR over the
supported our adoption of the model. CCD. For this reason, we did not want
Continuity of Care Record (CCR) Response. We appreciate the to mandate, at such an early stage, that
standard for patient summary records; a constructive comments and all of these early adopters adopt a
couple commenters expressed no recommendations provided by different summary record standard for
preference; while many commenters commenters. We address our adoption the purposes of meaningful use Stage 1,
were opposed to our adoption of CCR as of the patient summary record standards given that electronic health information
an alternate standard and did not in this certification criterion because we exchange is not required. Second, we
believe that it was an appropriate believe that it is the most applicable understand that in some circumstances
selection. Several commenters did not place to do so. Section 3004(b)(1) of the the CCR is easier, faster, and requires
comment on the merits of adopting CCD PHSA requires the Secretary to adopt an fewer resources to implement than the
and CCR but rather expressed general initial set of standards, implementation CCD. We have therefore concluded that
concern that adopting two standards specifications, and certification criteria. it was appropriate to adopt the CCR
would be wasteful, counter-productive, Section 3004(b)(2) of the PHSA standard for patient summary records in
confusing, time-consuming, and reduce provided the Secretary with additional this initial set of standards. Finally, we
interoperability. Of the commenters that flexibility in considering what believe that at the present time, each
supported the adoption of CCR, most standards, implementation standard could equally be used to
expressed their appreciation for the specifications, and certification criteria satisfy the requirements of meaningful
flexibility we had provided. These to adopt in the initial set. Section use Stage 1.
commenters contended that CCR was 3004(b)(2) states that ‘‘[t]he standards, Comments. Numerous commenters
easier to implement and would make it implementation specifications, and questioned why we did not adopt the
certification criteria adopted before the HITSP C32 implementation
easier for smaller Complete EHR and
date of the enactment of this title specification for the CCD. These
EHR Module developers to enter the
through the process existing through the commenters requested that we adopt the
market and get certified. One
Office of the National Coordinator for C32 implementation specification. They
commenter suggested that if we
Health Information Technology may be noted that it had been accepted by the
intended to keep both CCD and CCR as
applied towards meeting the industry, tested and implemented in
adopted standards that we specify the several operating environments, and
requirement of paragraph (1).’’
transactions for which each standard Accordingly, we looked at all of the was supported by multiple EHR
should apply. This commenter standards, implementation technology developers. A few
recommended that CCD be used for specifications, and certification criteria commenters requested additional
exchanging summary records between recognized by the Secretary at any point clarification regarding our adoption of a
health care providers and that CCR be in time prior to the enactment of the ‘‘level 2’’ CCD as part of this standard
used for exchanging summary records to HITECH Act to determine whether they and stated that use of a level 2 CCD was
PHRs. Of the commenters that opposed should be included in this initial set. inconsistent with our adoption of
our selection of CCR, many of them Contrary to some commenters several adopted vocabulary standards.
recommended that we adopt the CCD statements, the CCR patient summary These commenters questioned whether
standard as the sole standard for record standard was in fact recognized we intended to adopt a level 3 CCD. At
summary records. These commenters by the Secretary in 2008 (73 FR 3976) least one commenter recommended the
principally referenced that the CCD was as part of the HITSP Consumer removal of our reference to levels.
a harmonization of CDA and CCR. Some Empowerment Interoperability Another commenter stated that problem
commenters stated that we did not Specification (HITSP V2.1 2007 IS03). list, medication list, medication allergy
provide sufficient rationale for adopting We understand that in January, 2009, list, procedures, etc. are commonly
CCR and we had reopened a debate over the Secretary recognized (74 FR 3604) referred to as ‘‘sections’’ of the CDA or
the two standards that was purportedly an updated HITSP IS03 which removed CCD document, not ‘‘fields.’’ They stated
previously settled. Some commenters the CCR standard. We do not believe that sections may contain narrative text
were concerned that CCR could not that section 3004(b)(2) precludes the using the CDA XML format for text, and
support certain information, Secretary from considering all possible need not contain level 3 entries;
particularly, in the hospital setting. standards that were part of the ‘‘prior however, they believed that in order to
These commenters contended that CCR process.’’ To the contrary, we believe the use the specified clinical vocabularies
could not support discharge information HITECH Act provided the Secretary found in the Interim Final Rule in an
and that CCR cannot provide input into with the authority and flexibility to interoperable fashion, the codes from
clinical decision support due to the lack determine which standards would be these selected vocabularies must appear
of a common definition of how data is best to include in this initial set. in level 3 entries. Some commenters
structured. Other commenters Accordingly, we adopted both the CCR also noted this and recommended that
referenced that CCR is not extensible and CCD as patient summary record we adopt CCD and specify that the
and questioned its ability to be used for standards. standard must be implemented in
quality reporting. Several commenters We adopted both standards for a few accordance with the HITSP C32
recommended that, short of adopting reasons. First, we are aware, contrary to implementation specification, using the
solely CCD, we provide clearer guidance some commenters’ statements, that a vocabulary standards we had adopted in
to the industry regarding what standard significant segment of the HIT industry the Interim Final Rule. One commenter
we expect to adopt for future stages of still uses the CCR patient summary noted that units of measure are
meaningful use because CCD and CCR record standard and that some health components of structured entries (CDA
level 3) in these sections. The principle is also applicable to Complete other revisions we have made in the
commenter supported specified clinical EHRs and EHR Modules designed for an final rule, we have removed
vocabularies and level 3 CCD because inpatient setting. ‘‘procedures’’ from the certification
the commenter felt that level 3 would be Comment. One commenter noted that criterion.
necessary to properly communicate the although CVX is identified as the Comment. At least one commenter
information. required standard for interaction with requested that we clarify what Certified
Response. We have considered public state immunization registries, no EHR Technology needs to be capable of
comments and, in response, have made standard for ‘‘immunizations’’ is meeting this certification criterion. The
two changes. Both are related to our outlined for the clinical summary. They commenter asked whether the
adoption of the CCD standard. In the presumed that CVX could be used for generation of a CCD or CCR would
Interim Final Rule we explicitly this purpose, but stated that CVX does constitute compliance with this
included a reference to ‘‘level 2’’ to not include a dose or date or reaction. criterion or would the import and
Response. Consistent with the human readable display of both
indicate that we expected a Complete
changes we have made elsewhere in the document types be required.
EHR or EHR Module would be capable
final rule, we have removed Response. We clarify that compliance
of generating a level 2 CCD. After
‘‘immunizations’’ from this certification with this certification criterion can be
further consideration, we agree that
criterion. achieved by demonstrating that the
removing ‘‘level 2’’ from the adopted Comment. A commenter suggested
standard will help clarify the Complete EHR or EHR Module is
that ONC strike the following from the
requirements regarding the capable of receiving and displaying
certification criteria ‘‘and upon receipt
implementation of CCD. As some patient summary records that comply
of a patient summary record formatted
commenters pointed out, the coded data with either patient summary record
in an alternate standard specified in
elements we expect to populate the standard (and if the alternative standard
§ 170.205(a)(1), display it in human
fields of the CCD would necessitate is used, displaying the non-natively
readable format.’’ Another commenter
‘‘level 3’’ entries. Thus, we have implemented patient summary record
stated that data transport is not
removed the reference to ‘‘level 2.’’ We standard in human readable format) and
addressed in the standards, and the
also agree, that the HITSP C32 (version generating and transmitting a patient
criterion instead refers to ‘‘transmit.’’
2.5) implementation specification for summary record according to one of the
The commenter suggested changing the
CCD would be appropriate to adopt. We patient summary record standards
first part of the criterion to ‘‘display’’
understand that a majority of Complete populated with the specified data types
instead of ‘‘receive,’’ and the second part
EHR and EHR Module developers who and their applicable standard(s). For
of the criterion to ‘‘export’’ instead of
have implemented the CCD standard do example, a Complete EHR designed to
‘‘transmit.’’
so according to the HITSP C32 Response. We disagree and have not generate patient summary records in the
implementation specification, and made these changes. We believe that CCD standard would need to be capable
consequently we do not believe that this this certification criterion expresses the of generating and transmitting patient
would be a significant burden. We capabilities we expect Certified EHR summary records in accordance with
further clarify that, for the purposes of Technology will include. Furthermore, CCD. Upon receipt of a patient summary
testing and certification, a compliant the action of ‘‘exporting’’ a patient record formatted according to the CCR
CCD implemented according to the summary record does not indicate or standard, the Complete EHR must also
HITSP C32 must include the require that Certified EHR Technology is be capable of displaying the CCR-
information for those entries ‘‘required’’ actually capable of transmitting a formatted patient summary record in
by the HITSP C32. Additionally, we patient summary record to Certified human readable format. We clarify that
note that as specified by this EHR Technology implemented by a we also expect that the Complete EHR
certification criterion, we expect that different eligible professional or eligible designed to natively generate a CCD
certain health information for which hospital. would be tested and certified as being
other certification criteria require to be Comment. A commenter requested capable of properly displaying any CCD
recorded will be used to populate clarification on how historical data from that it receives and have added the term
certain ‘‘optional’’ entries specified by paper records should be treated for the ‘‘display’’ in the beginning of the
the HITSP C32 implementation purpose of certification. If historical certification criterion. This change is
specification (e.g., problems from a data is on paper, the standards for also applicable to the certification
problem list should in most cases be display are inapplicable. criterion for Complete EHRs and EHR
available to populate the ‘‘condition Response. Data from paper records Modules designed for an inpatient
content module’’ section of the HITSP would not be a relevant factor for the setting.
C32). Accordingly, we expect that the purposes of testing and certification. We Comment. A commenter requested
test data used to evaluate whether a are concerned with whether Complete that we clarify how we intended
Complete EHR or EHR Module can EHRs and EHR Modules have adopted vocabularies to be used. The
successfully generate a CCD according implemented specific capabilities in commenter queried whether vocabulary
to the HITSP C32 will include the data compliance with the certification standards that we had adopted apply to
specified in the certification criterion to criteria adopted by the Secretary. EHRs or to transactions that EHRs
populate the ‘‘optional’’ entries for Comments. A couple of commenters conduct. The commenter further
which we have adopted vocabulary requested definition of ‘‘diagnostic test requested that we clarify whether a
standards (e.g., problems). Moreover, result’’ and ‘‘procedures’’ in the context local/proprietary medication vocabulary
from a consistency perspective, we could be mapped to RxNorm, and
of this criterion.
expect that the same test data referenced Response. Again, we do not believe whether a local/proprietary problem list
above, which would be used to test and that it is appropriate to define vocabulary could be mapped to
certify a CCD implemented according to ‘‘diagnostic test result’’ in this final rule SNOMED–CT®. Finally, the commenter
the HITSP C32 would also be used to since the term is derived from the asked if mapping is permitted, and if so,
test and certify a Complete EHR or EHR Medicare and Medicaid EHR Incentive requested that we identify the subsets of
Module’s ability to populate a CCR. This Programs final rule. Consistent with these vocabularies that should be used.
Response. For purposes of can be used to convey narrative text and capability associated with the HIPAA
electronically exchanging a patient objects such as scanned documents. Privacy Rule’s minimum necessary
summary record, we expect the patient Comments. A couple of commenters requirements because such
summary record to include health requested clarification as to the testing requirements are generally context
information that is coded, where we expected to occur related to a specific and determined when a HIPAA
applicable, in accordance with adopted Complete EHR or EHR Module’s covered entity uses or discloses
vocabulary standards. Therefore, unless compliance with this certification protected health information or when a
otherwise required in the context of a criterion. These commenters questioned HIPAA covered entity requests
meaningful use objective and measure, whether the generation of a CCD and protected health information from
an eligible professional (or eligible XDS (HITSP/TP13)/FTP/e-mail of a another HIPAA covered entity. We do
hospital) would be permitted to map or document would meet the certification not preclude, however, Complete EHR
crosswalk local/proprietary codes to the criterion requirements. and EHR Module developers from
adopted vocabulary standards prior to Response. We clarify that because we including additional features to assist
transmitting a patient summary record. have removed the adopted transport HIPAA covered entities comply with
We do not believe that it would be standards, we do not require as a these and other HIPAA Privacy Rule
appropriate to specify subsets of condition of certification that a specific requirements.
adopted vocabularies at this time and transport standard be used to transmit a
Comment. A commenter
would seek additional input from the generated CCD.
Comments. One commenter expressly recommended that the summary care
HIT Standards Committee or public
agreed with the expectations of the record should include the durable
comment prior to specifying vocabulary
certification criterion. Another medical equipment and supplies used
subsets.
Comment. A commenter stated that commenter stated that this functionality by the patient.
the adopted data exchange standards do is crucial to support the patient/family- Response. Presently, the correlated
not provide for the inclusion of centered medical home. One commenter meaningful use objective and measure
narrative text results, such as a recommended that the Certified EHR do not specify that a patient summary
radiology report, or images of scanned Technology be designed so that the record must contain information
paper documents. The commenter amount of data transmitted could be regarding durable medical equipment.
questions how meaningful use adjusted by physicians so they do not Accordingly, we do not believe that it
objectives will be achieved without violate the HIPAA Privacy Rule’s would be appropriate to require this as
these and recommends that ‘‘minimum necessary’’ requirements. a condition of certification.
implementation guidance be issued that Response. We appreciate commenters’
c. Specific Certification for Complete
includes specific references to content support for this certification criterion
EHRs or EHR Modules Designed for an
or vocabulary standards. and agree that patient summary records
Inpatient Setting—§ 170.306
Response. We have not adopted serve a valuable purpose. Presently, we
standards for radiology reports or do not believe that it is appropriate to Section 170.306(a)—Computerized
images; however, both the CCR and CCD require as a condition of certification a Provider Order Entry
Use CPOE for medication orders More than 30% of unique patients Interim Final Rule Text:
directly entered by any licensed with at least one medication in Enable a user to electronically record, store, retrieve, and man-
healthcare professional who can their medication list seen by the age, at a minimum, the following order types:
enter orders into the medical EP or admitted to the eligible (1) Medications;
record per state, local and pro- hospital’s or CAH’s inpatient or (2) Laboratory;
fessional guidelines. emergency department (POS 21 (3) Radiology/imaging;
or 23) have at least one medica- (4) Blood bank;
tion order entered using CPOE. (5) Physical therapy;
(6) Occupational therapy;
(7) Respiratory therapy;
(8) Rehabilitation therapy;
(9) Dialysis;
(10) Provider consults; and
(11) Discharge and transfer.
Final Rule Text: § 170.306(a).
Computerized provider order entry. Enable a user to electroni-
cally record, store, retrieve, and modify, at a minimum, the fol-
lowing order types:
(1) Medications;
(2) Laboratory; and
(3) Radiology/imaging.
A commenter recommended that we inconsistent patient care. Another commenters also noted that no
clarify what is meant by order entry commenter recommended that speech- information is given as to what
because the commenter believes that language pathology and audiology also constitutes adequate functionality for
within the confines of many hospitals, be added. Two commenters noted that any of the orders after the first three
just about any ‘‘order’’ can be performed. the certification criterion specifies a order types and that some, such as
A few commenters requested that ‘‘diet long list of order types. The commenters ‘‘dialysis’’ may not be appropriate order
orders’’ be added to the list of CPOE recommended that we not attempt to functionality for a general EHR system
order types in order to prevent create an exhaustive list. One of the for hospitals. Both commenters
recommended that we remove all orders While this certification criterion is now whether only imaging and radiology
from four through 10 and replace them the same as the certification criterion for reports were intended to be included in
with a single provision ‘‘other order Complete EHRs and EHR Modules this capability, or, if we intended to
types.’’ designed for an ambulatory setting, we include the images themselves in
Response. Consistent with the have not combined and moved the addition to the imaging reports as part
revisions we made to the CPOE CPOE certification criteria to the general of the certification criteria. The
certification criterion associated with certification criteria section. Rather, we commenter recommended that we
Complete EHRs and EHR Modules have kept the certification criteria for further clarify the criterion and
designed for an ambulatory setting, we CPOE separate because we anticipate requested that the DICOM standard be
agree with those commenters who that these certification criteria could in adopted in the initial set of standards,
recommended that we specify a the future include different as an essential step in meeting the CPOE
minimum core set of orders as a requirements, specific to the settings for capability.
condition of certification. Accordingly, which Complete EHRs and EHR Response. We refer this commenter to
we identify medication, laboratory, and Modules are developed. our previous response above regarding
radiology/imaging as the minimum Comment. A commenter repeated a this issue.
types of orders a Complete EHR or EHR question it raised with respect to CPOE
Module designed for inpatient settings for eligible professionals. The Section 170.306(b)—Record
must include in order to be certified. commenter requested that we clarify Demographics
Record demographics ..................... More than 50% of all unique pa- Interim Final Rule Text:
• preferred language tients seen by the EP or admit- Enable a user to electronically record, modify, and retrieve pa-
• gender ted to the eligible hospital’s or tient demographic data including preferred language, insur-
• race CAH’s inpatient or emergency ance type, gender, race, ethnicity, date of birth, and date and
• ethnicity department (POS 21 or 23) cause of death in the event of mortality.
• date of birth have demographics recorded as Final Rule Text: § 170.306(b).
• date and preliminary cause of structured data. Record demographics. Enable a user to electronically record,
death in the event of mortality in modify, and retrieve patient demographic data including pre-
the eligible hospital or CAH ferred language, gender, race, ethnicity, date of birth, and date
and preliminary cause of death in the event of mortality. En-
able race and ethnicity to be recorded in accordance with the
standard specified at § 170.207(f).
Many commenters expressed the same Comment. A commenter stated that an explained in more detail in the
comments with respect to this EHR is not an appropriate source of Medicare and Medicaid EHR Incentive
certification criterion as they did for the legal documentation for births and Programs final rule, we believe that the
record demographics certification deaths because they indicated that it is changes we have made to this specific
criterion for Complete EHRs and EHR not possible to obtain official birth and part of the certification criterion address
Modules designed for ambulatory death certificates from a provider or this commenter’s concern.
setting. These commenters hospital.
recommended the addition of other Response. In concert with and Section 170.306(c)—Clinical Decision
demographic information for additional following the changes made to this Support
clarity, as discussed above. meaningful use objective which are
Implement one clinical decision Implement one clinical decision Interim Final Rule Text:
support rule related to a high pri- support rule. (1) Implement rules. Implement automated, electronic clinical de-
ority hospital condition along with cision support rules (in addition to drug-drug and drug-allergy
the ability to track compliance contraindication checking) according to a high priority hospital
with that rule. condition that use demographic data, specific patient diag-
noses, conditions, diagnostic test results and/or patient medi-
cation list.
(2) Alerts. Automatically and electronically generate and indicate
in real-time, alerts and care suggestions based upon clinical
decision support rules and evidence grade.
a user.
Final Rule Text: § 170.306(c).
(1) Implement rules. Implement automated, electronic clinical de-
cision support rules (in addition to drug-drug and drug-allergy
contraindication checking) based on the data elements in-
cluded in: problem list; medication list; demographics; and lab-

oratory test results.
indicate in real-time, notifications and care suggestions based
upon clinical decision support rules.
This certification criterion is now designed for an ambulatory setting, we include different requirements, specific
exactly the same as the certification have not combined and moved the to the settings for which Complete EHRs
criterion applicable to Complete EHRs clinical decision support certification and EHR Modules are developed.
and EHR Modules designed for an criteria to the general certification Comments. Some commenters
ambulatory setting. As a result, our criteria section because the focus of the requested that we clarify the meaning of
responses and subsequent changes to meaningful use objective is different high priority hospital condition.
the certification criterion above are also and specific to eligible hospitals. We Response. We have removed this
applicable to this certification criterion. also believe that it is useful to keep term, consistent with the other revisions
While this certification criterion is now these certification criteria separate we made to this certification criterion.
the same as the certification criterion for because we anticipate that these Section 170.306(d)—Electronic Copy of
Complete EHRs and EHR Modules certification criteria could in the future Health Information
Provide patients with an electronic More than 50% of all patients of Interim Final Rule Text:
copy of their health information the EP or the inpatient or emer- Enable a user to create an electronic copy of a patient’s clinical
(including diagnostic test results, gency departments of the eligi- information, including, at a minimum, diagnostic test results,
problem list, medication lists, ble hospital or CAH (POS 21 or problem list, medication list, medication allergy list, immuniza-
medication allergies, discharge 23) who request an electronic tions, procedures, and discharge summary in:
summary, procedures), upon re- copy of their health information (1) Human readable format; and
quest. are provided it within 3 business (2) On electronic media or through some other electronic means
days. in accordance with:
§ 170.205(a)(2)(i)(B);
§ 170.205(a)(2)(iii); and
Final Rule Text: § 170.306(d).
(1) Enable a user to create an electronic copy of a patient’s clin-
ical information, including, at a minimum, diagnostic test re-
sults, problem list, medication list, medication allergy list, and
procedures:
(i) In human readable format; and
(ii) On electronic media or through some other electronic means
in accordance with:
(A) The standard (and applicable implementation specifications)
(B) For the following data elements the applicable standard must
be used:
(1) Problems. The standard specified in § 170.207(a)(1) or, at a
§ 170.207(a)(2);
(2) Procedures. The standard specified in § 170.207(b)(1) or
§ 170.207(b)(2);
(3) Laboratory test results. At a minimum, the version of the
(4) Medications. The standard specified in § 170.207(d).
(2) Enable a user to create an electronic copy of a patient’s dis-
charge summary in human readable format and on electronic
media or through some other electronic means.
Comment. A commenter expressed access to use certain ancillary features at records management department or
concern that requiring organizations to their workstations, we disagree that office. As the commenter suggested, a
provide anything on electronic media requiring organizations to provide patient portal would be an acceptable
was dangerous and counterproductive patients with an electronic copy mechanism to provide an electronic
to the HITECH Act’s HIPAA Privacy and presents problems related to HITECH copy.
Security Rule changes. This commenter modifications to the HIPAA privacy and Comment. A commenter stated the
also stated that thumb drives and CD/ security requirements. We do not certification criterion for eligible
DVD burners are not available to staff. specify that electronic media such as hospitals should be limited to
The commenter recommended that we thumb drives or CDs must be used. An information or tests performed during
remove this certification criterion and eligible hospital will be able to the course of a patient visit or hospital
adopt a patient portal requirement in determine, consistent with its security stay and include only summary
the next round of rulemaking. posture, if certain electronic media is information of diagnostic test results or
Response. While we understand that permissible and if so, what types. It will of information that is clinically
in certain locations (e.g., areas that are also be able to determine the means and significant and discovered during the
readily accessible to patients) health location through which an electronic encounter or admission. Other
care professionals do not normally have copy may be provided, e.g., at the commenters requested that we clarify
the reference to procedures. The in human readable format and on encouraged us to adopt the Current
commenters asked that the regulations electronic media or through some other Dental Terminology.
specify whether the EHR technology electronic means. Other electronic Response. The diagnoses included
must enable the user to create an means could include, for example, the within the patient summary record are
electronic copy of procedures associated discharge summary represented as a meant to convey clinically relevant
with the most recent hospitalization, or CCD plus the ‘‘Hospital Course’’ CDA conditions as recorded in Certified EHR
any historical procedures, or the section or provided as a PDF. We have Technology’s problem list, rather than
procedures that the patient should revised the certification criterion billing diagnoses. While we agree that
follow-up to do after discharge. accordingly. SNOMED–CT® provides additional
Response. At a minimum, Certified We note that our responses to the clinical detail, this is often not available
EHR Technology must be capable of following comments also apply to other in current practice. Furthermore, while
generating an electronic copy of health certification criteria that reference its use is not precluded, we do not
information that includes the elements procedures. believe that it is necessary to adopt the
specified by the certification criterion in Comments. A commenter requested Current Dental Terminology as a
an electronic copy. We do not specify clarification as to what we meant by condition of certification for all
the time period for which the electronic ‘‘procedures’’ for hospitals, because Complete EHRs and EHR Modules.
copy must cover as a condition of coding for medical procedures typically Comments. A commenter
certification. occurs after the patient has been recommended against the adoption of
Comment. A commenter requested the alternative standard (CPT–4), unless
discharged. Another commenter
that we consider eliminating the we subsidized the cost of licensing
requested that we further clarify the
reference to standards in this CPT–4 as has been done for certain
subset of relevant procedures that
certification criterion for Stage 1 and other code sets. Some commenters
should be included. The commenter
focusing on human readable formats. expressed concerns about the license
explained that it believed including
Response. We disagree, as doing so requirements and one commenter stated
CPT–4 or ICD–9 codes seemed
would run counter to our long term that the license cost will likely be
inappropriate for clinical summaries
goals and would not help build the passed down from the EHR developer to
since these codes are used for
foundation necessary for more the eligible professional or eligible
‘‘procedures as billed,’’ and the
comprehensive capabilities to be added hospital. Some commenters believed
commenter further asked whether we
in the future. that if we intended to keep this
Comments. A few commenters noted intended to include only major
procedures. alternative standard, we should make it
that neither the CCD nor CCR contain an freely available.
applicable section for discharge Response. We clarify that the adopted
standard pertains to the vocabulary that Response. We understand that most
summary. One commenter current EHR technology already
recommended that because the would be used to express procedures,
regardless of how they are selected, or includes the CPT–4 code sets, and we
provision of an electronic copy of believe that this indicates that the
discharge instructions was required by included.
licensing costs are not prohibitive.
another certification criterion, that Comments. A commenter stated that
Regardless, we have adopted an
discharge instructions should be with an X12 837 standard transaction,
alternative standard to CPT–4,
removed as an element in this electronic ICD–9–CM is accompanied by a flag that
SNOMED–CT®, which is freely
copy. indicates whether this code is being
available.
Response. We reviewed commenters’ used to bill for services meant to
Comment. A commenter noted that
concerns and agree that there is no eliminate a diagnosis. The commenter
the certification criterion references
applicable section for a discharge stated that neither the CCR nor the CCD
immunizations but the Medicare and
summary. Therefore, we have revised support such a flag, and concluded that
Medicaid EHR Incentive Programs
this certification criterion to reflect that there was no way to know whether ICD–
proposed rule did not include
while the other data elements can be 9–CM codes used in either CCD or CCR
immunizations in the objective. The
conveyed using the patient summary could accurately convey a patient’s
commenter suggested that we modify
record standards (CCR or CCD), we are problems. The commenter also
our certification criterion to match the
not requiring the use of any standards recommended SNOMED–CT® should be
proposed rule.
for the discharge summary section. In used with a CCD, because ICD–9 codes
Response. We have removed this
order to support the meaningful use have too little clinical detail. Another
term, consistent with the previous
objective and measure, however, we commenter favored the use of
revisions we have made to other
note that we do expect Certified EHR SNOMED–CT® as well and stated that
certification criteria above.
Technology to be capable of providing SNOMED–CT® would be more
a electronic copy of a discharge clinically accurate and better suited for Section 170.306(e)—Electronic Copy of
summary like a patient summary record, our purposes. Another commenter Discharge Information
Provide patients with an electronic More than 50% of all patients who Interim Final Rule Text:
copy of their discharge instruc- are discharged from an eligible Enable a user to create an electronic copy of the discharge in-
tions at time of discharge, upon hospital or CAH’s inpatient de- structions and procedures for a patient, in human readable for-
request. partment or emergency depart- mat, at the time of discharge on electronic media or through
ment (POS 21 or 23) and who some other electronic means.

request an electronic copy of Final Rule Text: § 170.306(e).
their discharge instructions are Electronic copy of discharge instructions. Enable a user to create
provided it. an electronic copy of the discharge instructions for a patient, in
human readable format, at the time of discharge on electronic
media or through some other electronic means.
Comment. A few commenters Comment. A commenter requested Comment. One commenter

expressed support for this certification that we clarify the meaning of the recommended that the certification
criterion. Some commenters requested phrase ‘‘at time of discharge’’ and criterion include consideration of the
that we clarify the meaning of specifically, whether it means literally patient’s preferred language.
‘‘procedures’’ in the context of this at the time when a patient is discharged Response. Like our prior responses,
certification criterion. or more broadly, soon after the we do not believe that requiring this
discharge occurs, in which case the information is appropriate or necessary
Response. We have revised this instructions could be made available to
certification criterion to be consistent to include as a condition of certification.
the patient, for example, through a web However, we do not preclude Complete
with the changes to the meaningful use portal.
objective and measure in the Medicare EHRs and EHR Modules from being
Response. This phrase is derived from
and Medicaid EHR Incentive Programs designed to reference a patient’s
the Medicare and Medicaid EHR
final rule, which removes the word preferred language.
Incentive Programs final rule, and CMS
‘‘procedures’’ from the meaningful use has provided clarifying remarks related Section 170.306(f)—Exchange Clinical
objective. to this comment. Information and Summary Record
Capability to exchange key clinical Performed at least one test of cer- Interim Final Rule Text:
information (for example, dis- tified EHR technology’s capacity (1) Electronically receive and display. Electronically receive a pa-
charge summary, procedures, to electronically exchange key tient’s summary record from other providers and organizations
problem list, medication list, clinical information. including, at a minimum, diagnostic test results, problem list,
medication allergies, diagnostic medication list, medication allergy list, immunizations, proce-
test results), among providers of dures, and discharge summary in accordance with
care and patient authorized enti- § 170.205(a) and upon receipt of a patient summary record for-
ties electronically. matted in an alternate standard specified in § 170.205(a)(1),
display it in human readable format.
mit a patient’s summary record to other providers and organi-
zations including, at a minimum, diagnostic results, problem
list, medication list, medication allergy list, immunizations, pro-
cedures, and discharge summary in accordance with:
The EP, eligible hospital or CAH The EP, eligible hospital or CAH (ii) The standard specified in § 170.205(a)(2)(i)(A), or, at a min-
who transitions their patient to who transitions or refers their imum, the version of the standard specified in
another setting of care or pro- patient to another setting of care § 170.205(a)(2)(i)(B);
vider of care or refers their pa- or provider of care provides a
tient to another provider of care summary of care record for
should provide summary of care more than 50% of transitions of
record for each transition of care care and referrals .
or referral.
§ 170.205(a)(2)(iii); and
(1) Electronically receive and display. Electronically receive and
display a patient’s summary record from other providers and
organizations including, at a minimum, diagnostic test results,
problem list, medication list, medication allergy list, and proce-
dures in accordance with the standard (and applicable imple-
mentation specifications) specified in § 170.205(a)(1) or
§ 170.205(a)(2). Upon receipt of a patient summary record for-
matted according to the alternative standard, display it in
human readable format.
mit a patient’s summary record to other providers and organi-
zations including, at a minimum, diagnostic results, problem
list, medication list, medication allergy list, and procedures in
accordance with:
be used:
§ 170.207(a)(2);
(B) Procedures. The standard specified in § 170.207(b)(1) or
§ 170.207(b)(2);
(C) Laboratory test results. At a minimum, the version of the
(D) Medications. The standard specified in § 170.207(d).
Overall this certification criterion is summary be initially permitted to be an constitutes key clinical information. In
very similar to the certification criterion unstructured CDA instead of requiring that regard, CMS notes that we specify
applicable to Complete EHRs and EHR the use of a CCD. As an alternative, it the minimum set of information that
Modules designed for an ambulatory was suggested that the CCD combined Certified EHR Technology must be
setting. As a result, our responses and with the ‘‘Hospital Course’’ CDA section capable of electronically transmitting.
subsequent changes to the certification be allowed to qualify as the discharge Given our prior statements regarding the
criterion above are also applicable to summary. ability of CCD and CCR to support the
this certification criterion. Below are the Response. As noted in one of our inclusion of the discharge summary and
comments that are unique to this responses above, we recognize that
the principle expressed by CMS that we
certification criterion. neither CCD nor CCR specifically
specify a minimum set of information in
Comment. A few commenters supports the inclusion of discharge
requested clarification on what is meant summary. In the Medicare and Medicaid the adopted certification criterion, we
by the term ‘‘discharge summary.’’ The EHR Incentive Program final rule, CMS believe that in this instance it is
commenter stated that neither the CCD references discharge summary in the appropriate to exclude discharge
nor the CCR has a document section or meaningful use objective as an example summary from the certification
module for a ‘‘discharge summary.’’ One of ‘‘key clinical information’’ but further criterion.
commenter suggested that we either clarifies within the preamble of that rule Section 170.306(g)—Reportable Lab
define the term or remove it. At least that it is up to an eligible professional Results
one commenter suggested that discharge or eligible hospital to determine what
Capability to submit electronic data Performed at least one test of cer- Interim Final Rule Text:
on reportable (as required by tified EHR technology’s capacity Electronically record, retrieve, and transmit reportable clinical lab
state or local law) lab results to to provide electronic submission results to public health agencies in accordance with the stand-
public health agencies and actual of reportable lab results to pub- ard specified in § 170.205(f)(1) and, at a minimum, the version
submission in accordance with lic health agencies and follow-up of the standard specified in § 170.205(f)(2).
applicable law and practice. submission if the test is suc- Final Rule Text: § 170.306(g).
cessful (unless none of the pub- Reportable lab results. Electronically record, modify, retrieve, and
lic health agencies to which eli- submit reportable clinical lab results in accordance with the
gible hospital or CAH submits standard (and applicable implementation specifications) speci-
such information have the ca- fied in § 170.205(c) and, at a minimum, the version of the
pacity to receive the information standard specified in § 170.207(c).
electronically).
Comment. One commenter requested batch reporting of reportable conditions commenter noted that HL7 2.3.1 was
that we clarify the meaning of ‘‘LOINC (e.g. daily or weekly). still being used by some public health
when LOINC codes have been received Response. We clarify that the agencies. Another commenter suggested
from a laboratory.’’ The commenter certification criterion does not specify, that either standard be allowed to
questioned whether the information and is not intended to specify, the accommodate for the variation in public
exchange for which this criterion would requirements for how the reports are to health departments’ ability to receive
apply is solely exchange within an be triggered nor the periodicity of the these reports. Many commenters raised
organization or only between reporting requirements. As a the concern that the criterion appears to
organizations. certification criterion, it only specifies place the burden of compliance on the
capabilities necessary for certification. sender. This problem could be
Response. For a more detailed
Comment. A commenter compounded if states and localities
response to this request for clarification,
recommended that we clarify the adopt multiple standards, which would
we refer to the relevant comments and
meaning of ‘‘reportable’’ in the make both compliance and certification
responses relating to the ‘‘incorporate
certification criterion. testing difficult and burdensome.
laboratory test results’’ certification Response. Each public health Several commenters raised the concern
criterion, where we discuss this issue at jurisdiction maintains its list of diseases that some public health agencies are not
length. or conditions that require notification of capable of receiving electronic data. One
Comment. One commenter stated that public health authorities by law. The commenter suggested removing the
it believed the standards we have CDC and the Council of State and language ‘‘or applicable state-designated
adopted are too general or at too high a Territorial Epidemiologists also standard format’’ and directly specifying
level for vendors to be able to maintain a list of nationally notifiable the format in the final rule. One
implement them uniformly. This conditions (http://www.cdc.gov/ncphi/ commenter suggested having the states
commenter suggested that we clarify disss/nndss/phs/infdis.htm). We agree upon a standard format. At least
when lab results should be transmitted, reiterate, the adoption of this one commenter requested additional
for instance upon the occurrence of certification criterion is not intended to clarity, suggesting that the HL7 message
particular trigger events, or in response affect applicable Federal or state law profile types be specified: ORU message
to specific messages, and in accordance concerning public health authority for public health reporting, ADT for
with a reporting time table. The
notification requirements. syndromic surveillance, and VXU for

commenter queries, for example, if EHR Comments. Many commenters immunizations. One commenter also
systems should use discharge as a requested further specification of the requested that we clarify whether HL7
trigger for the transmission of a data format for transmitting information V3 constructs would be allowable.
reportable condition using encounter to public health agencies. Most of these Response. We agree with the majority
level demographic segments, or whether comments recommended HL7 2.5.1 of commenters, who requested greater
EHR systems should provide a periodic version, although at least one specificity for this certification criterion.
Many of these commenters suggested specifications, and certification criteria review all comments that could be
adopting implementation specifications to ‘‘establish the capabilities and related reasonably identified as comments on
for the adopted standard (HL7 2.5.1). In standards that certified electronic health the Interim Final Rule.
response to those comments, and to record (EHR) technology will need to The following three certification
more fully support this meaningful use include in order to, at a minimum, criteria have been adopted as part of the
objective and measure which specify the support the achievement of the initial set of certification criteria,
submission of laboratory results to proposed meaningful use Stage 1.’’ We implementation specifications, and
public health, we have decided to adopt also noted that the reason we routinely standards in order to realign the
the HL7 Version 2.5.1 Implementation referred to eligible professionals and adopted certification criteria with the
Guide: Electronic Laboratory Reporting eligible hospitals in the Interim Final final meaningful use Stage 1
to Public Health, Release 1 (US Realm) Rule was ‘‘because we have closely requirements and to ensure that
to further constrain how HL7 2.5.1 is aligned the initial set of standards, Certified EHR Technology will provide
formatted for the purposes of submitting implementation specifications, and such capabilities.
laboratory test results to public health. certification criteria adopted by this rule
With respect to the comment regarding to focus on the capabilities that Certified Record Advance Directives
HL7 V3, we do not believe that the EHR Technology must be able to
industry and public health departments provide in order to support the In the Medicare and Medicaid EHR
are currently able to support the HL7 V3 achievement of the proposed criteria for Incentive Programs proposed rule, the
constructs on a widespread basis and meaningful use Stage 1 by eligible Department explained that the HIT
are therefore not adopting them. professionals and eligible hospitals Policy Committee had recommended
Comment. One commenter suggested under the Medicare and Medicaid EHR that eligible hospitals ‘‘record advance
adding the term ‘‘modify’’ to the Incentive Programs.’’ In this regard, and directives.’’ Due in part to the ambiguity
certification criterion, while one as many commenters acknowledged and of the recommendation, the Department
commenter requested clarification on expressed in their comments, this final discussed but did not include the
the term ‘‘retrieve.’’ rule and the Medicare and Medicaid objective ‘‘Record Advance Directives’’
Response. Consistent with the EHR Incentive Program final rule are for the reasons explained by CMS. In its
changes we have made to the other closely and inextricably linked. final rule, however, the Department
certification criterion, we have included Recognizing the unique connection stated that based on comments received
the word ‘‘modify.’’ between these two rules, some as well as resolution of some of the
Comments. A few commenters commenters went so far as to issue CMS ambiguity associated with the measure,
suggested the use of SNOMED–CT® and and ONC a single set of comments CMS was including this objective
UCUM for reporting. recommending changes to both rules in among its meaningful use Stage 1
Response. We do not believe that the context. Many other commenters treated objectives. The Department noted that
industry and public health departments both rules as almost being one in the some commenters reported that having
are currently able to support the use of same, acknowledging that a change in this information available would allow
SNOMED–CT® and UCUM for reporting Medicare and Medicaid EHR Incentive eligible hospitals to make decisions that
on a widespread basis. Programs final rule would need to be were better aligned with the patient’s
reflected in this final rule. Other express wishes. The ‘‘record advance
d. Adoption and Realignment of commenters submitted comments to directives’’ certification criterion would
Certification Criteria To Support the ONC on the Medicare and Medicaid ensure that Certified EHR Technology
Final Requirements for Meaningful Use EHR Incentive Programs proposed rule, enables users to electronically record
Stage 1. and to CMS on the Interim Final Rule. whether a patient has an advance
In the Interim Final Rule, we noted As we discussed previously, CMS and directive, which in turn will help
that the Secretary was adopting an ONC shared these comments between ensure that a patient’s wishes are known
initial set of standards, implementation the offices and we included within our and can be followed.
Record advance directives for pa- More than 50% of all unique pa- Final Rule Text: § 170.306(h).
tients 65 years old or older. tients 65 years old or older ad- Advance directives. Enable a user to electronically record wheth-
mitted to the eligible hospital’s er a patient has an advance directive.
or CAH’s inpatient department
(POS 21) have an indication of
an advance directive status re-
corded.
Comments. The Department received wishes. The HIT Policy Committee criterion in this final rule will enable
several comments that we should clarified that the purpose of the eligible hospitals to meet a meaningful
include the capability to record advance meaningful use Stage 1 measure would use objective they would otherwise not
directives as part of meaningful use of be to indicate whether a patient has an have been able to meet. We do not
Certified EHR Technology and, advanced directive. Furthermore, the believe that the capability we have
specifically, that it should be a committee recommended limiting this required will be a significant burden for
requirement that pertains to eligible measure to patients 65 and older. Complete EHR and EHR Module
hospitals. Other commenters reported Response. We agree that the capability developers and assume that some
that having this information available for a Complete EHR or EHR Module already have this or a similar type of
for the patient would allow eligible designed for an inpatient setting should capability already built in.
hospitals to make decisions that were be included as a condition of
better aligned with the patient’s express certification. Including this certification
Patient-Specific Education Resources to comments, the Medicare and CAH’s inpatient or emergency
The Medicare and Medicaid EHR Medicaid EHR Incentive Programs final department (POS 21 or 23) during the
Incentive Programs proposed rule rule included this objective and a EHR reporting period must be provided
discussed but did not include the related measure, finding that the patient-specific education resources in
objective of providing ‘‘access to patient availability of education resources order to meet the related meaningful use
specific education resources upon linked to EHRs is in fact more widely stage 1 objective. To support the
request,’’ primarily because of the belief available than the Department had achievement of this objective and
that there was a paucity of knowledge previously indicated in the proposed measure, we are therefore adopting as a
resources integrated within EHRs that rule. The Medicare and Medicaid EHR certification criterion the capability of
are also widely available. CMS also Incentive Programs final rule expressly enabling a user to electronically identify
noted that the ability to provide patient requires that more than 10 percent of all and provide patient-specific education
education resources in multiple unique patients seen by the EP or resources that include particular types
languages might be limited. In response admitted to the eligible hospital’s or of data elements.
Use certified EHR technology to More than 10% of all unique pa- Final Rule Text: § 170.302(m).
identify patient-specific education tients seen by the EP or admit- Patient-specific education resources. Enable a user to electroni-
resources and provide those re- ted to the eligible hospital’s or cally identify and provide patient-specific education resources
sources to the patient if appro- CAH’s inpatient or emergency according to, at a minimum, the data elements included in the
priate. department (POS 21 or 23) are patient’s: problem list; medication list; and laboratory test re-
provided patient-specific edu- sults; as well as provide such resources to the patient.
cation resources.
Comments. The Department received certification section. We clarify that we proposed rule for instance stated that
many comments, including comments do not specify how Certified EHR CMS and ONC had worked together to
from both the HIT Policy Committee Technology must be used to provide define certain terms, such as numerator
and MedPAC, that this capability such resources to a patient. That is, such and denominator, for the calculation of
should be included among the resources could be printed out, faxed, or percentages to demonstrate the
certification criteria for Certified EHR e-mailed. successful attainment of the meaningful
Technology, to enable eligible use objectives. The Medicare and
Automated Calculation of Percentage-
professionals and eligible hospitals to Medicaid EHR Incentive Programs final
Based Meaningful Use Measures
achieve meaningful use. Commenters rule confirmed that ‘‘the ability to
indicated that the availability of While the Interim Final Rule only calculate the measure is included in
education resources that could be linked expressly provided for the calculation of certified EHR technology.’’ To make
to EHR technology is widely available. BMI and the calculation and electronic explicit the Department’s operating
Response. We agree that this display of certain quality measures, the assumption, to confirm some
capability should be included as a Department’s operating assumption in commenters’ original understanding,
certification criterion for a Complete the Interim Final Rule was that Certified and to respond to other commenters’
EHR or EHR Module designed for an EHR Technology would provide for the points, we are adopting the following
ambulatory or inpatient setting. automated calculation of meaningful certification criterion regarding the
Accordingly, we have included this use Stage 1 measures. The Medicare and automated calculation of percentage-
certification criterion in the general Medicaid EHR Incentive Programs based meaningful use measures.
N/A .................................................. N/A ................................................. Final Rule Text: § 170.302(n).

Automated measure calculation. For each meaningful use objec-
tive with a percentage-based measure, electronically record
the numerator and denominator and generate a report includ-
ing the numerator, denominator, and resulting percentage as-
sociated with each applicable meaningful use measure.
Comments. The Department received pointed out that this was already a documents such as prescriptions or
several comments noting that Certified certification requirement for clinical laboratory results in order to compute
EHR Technology should be expressly quality measures and it would be the denominators of the percentage
required, as a condition of certification, inconsistent not to require automated based measures. Commenters also
to automatically calculate the calculation for the functionality indicated that if Certified EHR
meaningful use measures for which measures as part of certification. Many Technology did not include this
eligible professionals and eligible commenters expressed concerns about capability that it would dramatically
hospitals would need to report the difficulties of capturing the
increase the burden on potential

percentages to CMS or States at the end denominators for the meaningful use meaningful users to demonstrate
of an EHR reporting period. Some measures that required percentage meaningful use and could potentially
commenters explicitly noted that ONC calculations. They pointed out that the serve as a factor in their decision to
should require the automated formulas CMS identified for many participate in the Medicare and
calculation of certain measures as a objectives would require providers to Medicaid EHR incentive programs.
condition of certification. Commenters conduct labor-intensive counts of paper
Response. We agree with commenters to innovate and compete regarding, for that the adoption of such standards in
that unless we expressly adopt a example, the EHR products’ ease of use. a future rulemaking would prove
certification criterion to specify that beneficial, to enable all persons
E. Additional Comments
Certified EHR Technology must be (including health care providers with
capable of performing percentage-based Comments. In response to our request disabilities) to have equitable access to
calculations for meaningful use for public comment, several EHR technology and the electronic
measures that it would present a commenters recommended that we information it generates. In the interim,
significant burden to eligible adopt certification criteria requiring we encourage Complete EHR and EHR
professionals and eligible hospitals and technical capabilities to provide greater Module developers to design their EHR
could deter them from participating in access for people with disabilities. technology with the needs of users of
the Medicare and Medicaid EHR These commenters also pointed to a few assistive technology in mind, and
incentives programs. Accordingly, we standards currently being used to assure remind eligible professionals and
believe that it is critical to adopt the accessibility, including the Web Content eligible hospitals who seek to adopt
certification criterion specified above. Accessibility Guidelines (WCAG 2.0) Certified EHR Technology to review and
We clarify that Certified EHR and the Electronic and Information comply with applicable legal obligations
Technology must be capable of Technology Accessibility Standards. regarding accessibility. Among the ways
The commenters requested that we of designing certain capabilities with
calculating all denominators for those
coordinate more with the disability accessibility in mind, we would
meaningful use measures which are
communities on accessibility and encourage Complete EHR and EHR
percentage-based and for which CMS
usability and how HIT will impact Module developers to consider
requires an eligible professional or implementing, for example, the WCAG
members of this community. The
eligible hospital to submit the results at 2.0 8 when providing web-oriented
commenters requested that we clarify
the end of an EHR reporting period. content so that it is more accessible to
the applicability of accessibility
(CMS provides a detailed discussion in standards and that we add technological persons with disabilities. We expect the
the Medicare and Medicaid EHR non-discrimination as a goal to guide HIT Standards Committee to identify
Incentive Programs final rule on future standards work. accessibility-oriented standards 9 when
denominators.) We note that as Response. We appreciate the thorough it issues recommendations regarding the
discussed in the Medicare and Medicaid and thoughtful comments provided standards that the Secretary should
EHR Incentive Programs final rule under related to accessibility. We believe that adopt in future years.
the heading ‘‘Discussion of the Burden HIT has the potential to provide all Comments. Several commenters made
Created by the Measures associated with persons with more efficient access to recommendations related to standards
the Stage 1 Meaningful Use Objectives,’’ their health information. In that regard, that we could adopt to support future
an eligible professional or eligible we solicited public comment on the stages of meaningful use. Other
hospital is responsible for verifying that issue of accessibility and certification to commenters expressed concerns related
the denominator produced by Certified garner more information about available to the ‘‘candidate Stage 2 standards’’ that
EHR Technology is complete. The standards and to begin a path forward we referenced in the Interim Final Rule.
eligible professional or eligible hospital that included these standards as part of Finally, commenters requested that
would be expected to know whether the overall standards adoption process. Certified EHR Technology include
data had been incorrectly entered into We reiterate what we discussed in the specific capabilities that had no
Certified EHR Technology or whether interim final rule when we provided the relationship to meaningful use.
all patient records were included in context for our solicitation of public Response. We have reviewed these
Certified EHR Technology. For Stage 1 comment on accessibility. comments and appreciate the
meaningful use criteria, CMS identifies forethought provided by commenters.
Nothing required by this interim final rule Given that these suggestions were not
these measures in the table in its final should be construed as affecting existing
rule with the headings: ‘‘Measures with germane to the policies associated with
legal requirements under other Federal laws.
a Denominator of Unique Patients While the capabilities provided by Certified the Interim Final Rule we have not
Regardless of Whether the Patient’s EHR Technology may assist in the considered them for the purposes of
Records Are Maintained Using Certified compliance with certain legal requirements, promulgating this final rule.
EHR Technology’’ and ‘‘Measures with a they do not in any way remove or alter those
F. Comments Beyond the Scope of This
requirements * * *. As another example, in
Denominator of Based on Counting Final Rule
providing patients with access to their online
Actions for Patients whose Records are health information, it is important to note In response to the Interim Final Rule,
Maintained Using Certified EHR that the accessibility requirements of the some commenters chose to raise issues
Technology.’’ We do not require, as a Americans with Disabilities Act of 1990 and that are beyond the scope of our
condition of certification, that a Section 504 of the Rehabilitation Act of 1973
Complete EHR or EHR Module provide still apply to entities covered by these 8 http://www.w3.org/TR/WCAG20/.
results for the meaningful use measures Federal civil rights laws. Additionally, Title 9 As previously mentioned, there are several
that only require a ‘‘yes/no’’ attestation VI of the Civil Rights Act of 1964 and its accessibility standards for electronic and
implementing regulations protect persons information technology currently in use. For
since these results should be readily from unlawful discrimination on the basis of example, Section 508 of the Rehabilitation Act
apparent. These measures are also race, color and national origin. Under Title requires Federal agencies to ensure that electronic
identified by CMS in the table in its VI and its implementing regulations, and information technology that they develop,
final rule with the heading ‘‘Measures recipients of Federal financial assistance procure, maintain, or use is accessible to persons
Requiring Only a Yes/No Attestation.’’ must take reasonable steps to ensure with disabilities and authorizes the Architectural
and Transportation Barriers Compliance Board

We do not believe that adoption of this meaningful access to their programs, (Access Board) to promulgate standards setting
certification criterion poses a significant services, and activities by eligible limited forth the technical and functional performance
technical challenge. Rather, we believe English proficient persons. criteria necessary to implement the requirements of
Section 508. Information regarding the Electronic
that this capability will provide While we have not yet adopted and Information Technology Standards can be
Complete EHR and EHR Modules specific accessibility standards as a found on the Access Board’s Web site at http://
developers with a platform from which condition of certification, we believe www.access-board.gov/508.htm.
proposals. We do not summarize or government or the private sector of more order to prepare for certification; the
respond to those comments in this final than $135 million annually. loss of a Complete EHR or EHR Module
rule. Executive Order 13132 establishes developer’s net worth and dislocation of
certain requirements that an agency jobs if it fails and goes out of business;
IV. Collection of Information
must meet when it promulgates a and the resulting impacts that would
Requirements
proposed rule (and subsequent final occur if a Complete EHR and EHR
This final rule contains no new rule) that imposes substantial direct Module developer went out of business
information collection requirements costs of compliance on State and local and left behind customers (some or
subject to review by the OMB under the governments, preempts State law, or many of which could then be ineligible
Paperwork Reduction Act (PRA). otherwise has Federalism implications. for Medicare and Medicaid EHR
V. Regulatory Impact Analysis We do not believe that the final rule Incentive Programs) with unsupported
imposes substantial direct compliance HIT. Another commenter questioned the
A. Introduction costs on State and local governments, cost estimates in the Interim Final Rule,
We have examined the impacts of this preempts State law, or otherwise has but acknowledged that it was not
final rule as required by Executive Federalism implications. prepared to offer alternative cost
Order 12866 on Regulatory Planning estimates. The commenter did state that
B. Why is this rule needed?
and Review (September 30, 1993, as it believed our dollar values seemed low
further amended), the Regulatory Section 3004(b)(1) of the PHSA and that the gap of 25%, representing
Flexibility Act (RFA) (5 U.S.C. 601 et requires the Secretary to adopt an initial previously CCHIT-certified-EHRs that
seq.), section 202 of the Unfunded set of standards, implementation will need additional preparation to be
Mandates Reform Act of 1995 (2 U.S.C. specifications, and certification criteria. tested and certified to the certification
1532) (UMRA), Executive Order 13132 On January 13, 2010, the Secretary criteria adopted by the Secretary, also
on Federalism (August 4, 1999), and the published in the Federal Register an seemed low. The commenter suggested
Congressional Review Act (5 U.S.C. interim final rule to adopt the initial set a 40–50% gap. The commenter also
804(2)). of standards, implementation recommended that we revise our cost
Executive Order 12866 directs specifications, and certification criteria. estimates based on the certification
agencies to assess all costs and benefits This final rule has been published to criteria in the final rule to: consider
of available regulatory alternatives and, amend previously adopted standards, costs associated with workflow redesign
if regulation is necessary, to select implementation specifications, and within an eligible professional or
regulatory approaches that maximize certification criteria in order to realign eligible hospitals environment; factor in
net benefits (including potential such standards, implementation the costs for ‘‘interoperability
economic, environmental, public health specifications, and certification criteria implementation’’ (no further explanation
and safety effects, distributive impacts, with final meaningful use Stage 1 was provided); account for the costs
and equity). A regulatory impact objectives and measures, and to respond associated with implementing the
analysis (RIA) must be prepared for to public comments received. clinical quality measures certification
major rules with economically Certification criteria and associated criterion; account for the costs for
significant effects ($100 million or more standards and implementation hardware capable of supporting the
in any one year). We have determined specifications will be used to test and adopted security requirements; and
that this final rule is not an certify Complete EHRs and EHR factor in the costs for internal resources
economically significant rule because Modules in order to make it possible for and customer resources. One
we estimate that the costs to prepare eligible professionals and eligible commenter noted that the cost related to
Complete EHRs and EHR Modules to be hospitals to adopt and implement dentistry EHR technology may be higher
tested and certified will be less than Certified EHR Technology. The use of due to what it perceived as a lack of
$100 million per year. Nevertheless, Certified EHR Technology is one of the commercially available EHR technology
because of the public interest in this requirements an eligible professional or
final rule, we have prepared an RIA that and that additional costs may be
eligible hospital needs to meet in order incurred by dentistry EHR developers
to the best of our ability presents the to qualify for an incentive payment
costs and benefits of the final rule. that are not as familiar as EHR
under the Medicare and Medicaid EHR developers for other health providers
The RFA requires agencies to analyze Incentive Programs.
options for regulatory relief of small with the certification criteria adopted by
businesses if a rule has a significant C. Executive Order 12866—Regulatory the Secretary. One commenter agreed
impact on a substantial number of small Planning and Review Analysis with the $10,000 to $250,000 cost range
entities. For more information on Small we estimated for the per-certification-
1. Comment and Response criterion preparation, while another
Business Administration’s (SBA’s) size
standards, see the SBA’s Web site.10 We Comments. A few commenters offered commenter seemed to misinterpret this
examine the burden of the final opinions related to the cost estimates estimate as being the total cost to
regulation in Section V.D below. included in the Interim Final Rule. One prepare a Complete EHR or EHR
Section 202 of the UMRA also commenter disagreed with our Module. This commenter offered that it
requires that agencies assess anticipated approach. This commenter contended could take over 2,500 hours to prepare
costs and benefits before issuing any that our analysis followed a simplistic, a Complete EHR for certification. One
rule whose mandates require spending linear model that did not account for the commenter appeared to associate the
in any one year of $100 million in 1995 other potential costs that Complete EHR costs related to the preparation of a
and EHR Module developers and health Complete EHR to be tested and certified
dollars, updated annually for inflation.

In 2010, that threshold is approximately care providers would bear. The with the actual cost to be tested and
$135 million. This rule will not impose commenter suggested that we address certified, but nonetheless expressed
an unfunded mandate on States, tribal other costs in our calculations concern that we had estimated that it
including: whether a Complete EHR or would cost a Complete EHR developer
10 http://sba.gov/idc/groups/public/documents/ EHR Module developer has adequate whose EHR technology had not
sba_homepage/serv_sstd_tablepdf.pdf. resources available to modify its HIT in previously been certified no less than
$1.2 million to become compliant with Secretary. Consequently, if a Complete Consequently, we anticipate actual costs
the Interim Final Rule’s requirements. EHR or EHR Module developer does not will fall somewhere between the low
The commenter requested that HHS have the resources available to redesign and mid-point ranges of our estimates
provide assistance to EHR vendors with its Complete EHR or EHR Module to rather than between the mid-point and
revenues of less than $1 million in order incorporate the standards and high ranges of our estimates.
to help offset the costs of the implementation specifications or meet Finally, with respect to the
certification process. the certification criteria adopted in this commenter who expressed concern
Response. We appreciate commenters’ rule, this rule does not create any new regarding the total costs associated with
recommendations and suggestions expenses for its business. Given this developing a Complete EHR which had
related to our cost analysis. While we clarification, we believe that our never been certified, we note that our
understand why some commenters estimates represent a higher than likely estimates should not be construed to
recommended additional factors for us number of Complete EHR and EHR imply that a Complete EHR developer
to consider as part of our analysis, we Module developers that will prepare would have to spend over $1 million in
do not believe many of those factors are their HIT to be tested and certified to order to prepare a Complete EHR. To the
relevant for two primary reasons: (1) We the certification criteria adopted by the contrary, had we calculated our low
believe that it is improbable that this Secretary, and thus, the highest range for preparing a Complete EHR
rule will result in the outcomes potential cost. based on the absolute low we estimated
speculated and their associated costs; We considered whether an hourly for a per certification cost ($10,000), the
and (2) the factors contributing to or preparation cost should replace the total cost would have only been
causing the increased costs are outside assumptions we made in the Interim $240,000, or one-fifth the cost we
the scope of this rule (e.g., hypothetical Final Rule, but found it difficult to estimated in the Interim Final Rule. The
business failure and job loss, workflow determine what reasonable low and approach we took in the Interim Final
redesign) and could not be reasonably or high hour ranges would be even if we Rule was designed to be inclusive of a
accurately estimated. In this regard, we were to assume 2500 hours to be the middle range of possibilities, but was
reiterate what we stated in the Interim average. Further, for the purposes of never meant to preclude the possibility
Final Rule related to how costs would testing this alternative approach, we that a Complete EHR developer could
be estimated. ‘‘This interim final rule assumed that it would be reasonable for design a Complete EHR that was
estimates the costs commercial vendors, the employees of a Complete EHR or compliant with the certification criteria
open source developers, and relevant EHR Module developer responsible for adopted by the Secretary for less than
Federal agencies will incur to prepare preparing a Complete EHR or EHR we estimated. Also in response to the
Complete EHRs and EHR Modules to be Module for testing and certification to commenter’s request, we do not believe
tested and certified to adopted be paid equivalent to a Federal that it would be appropriate, nor are we
standards, implementation employee with a Federal Salary authorized, to provide subsidies to
specifications, and certification criteria. Classification of GS–15 Step 1 ($59.30/ Complete EHR or EHR Module
The Medicare and Medicaid EHR hr plus 21.35/hr for benefits) given the developers for the costs of the preparing
Incentive Programs proposed rule educational and professional experience a Complete EHR or EHR module for
estimates the impacts related to the we believe would be necessary to lead testing and certification.
actions taken by eligible professionals or this type of activity. Multiplying the
eligible hospitals to become meaningful total hourly rate by the 2500 hours 2. Executive Order 12866 Final Analysis
users, including purchasing or self- yields a total preparation cost of a. Costs
developing Complete EHRs or EHR approximately $201,000. Thus, even if
Modules. The HIT Certification we were to assume that a high average This final rule adopts standards,
Programs proposed rule estimates the for preparation of a Complete EHR or implementation specifications, and
testing and certification costs for EHR Module would be double what the certification criteria and consequently
Complete EHRs and EHR Modules.’’ commenter stated, it would only establishes the capabilities that
Accordingly, we disagree with the represent close to $400,000 in Complete EHRs or EHR Modules will
commenter who contended that our preparation costs. Accordingly, we need to demonstrate in order to be
estimates were too simplistic and linear. believe that our estimates are in fact certified. Our analysis focuses on the
We believe that in the absence of any comparatively high and the estimate direct effects of the provisions of this
additional data or an alternative model range covers a wide range of final rule—the costs incurred by
(which no commenter provided), our possibilities. Complete EHR and EHR Module
assumptions are sound and our analysis In the absence of additional data or developers to prepare Complete EHRs
is reasonable for estimating the costs any evidence to the contrary from and EHR Modules to be tested and
associated with complying with this public comment to guide revisions to certified in accordance with the
final rule. our estimates, we are finalizing them certification criteria adopted by the
We believe that it is important to note according to the data and assumptions Secretary. That is, we focus on the
to commenters that compliance with we identified in the Interim Final Rule. technological development costs
this final rule is voluntary and as such, We believe that our estimates are sound, necessary to include the capabilities in
seeking to have a Complete EHR or EHR based on reasonable assumptions and a Complete EHR or EHR Module that
Module certified is voluntary. A data, and sufficiently accommodate will be compliant with the certification
Complete EHR or EHR Module varying costs for different types of criteria adopted by the Secretary. Again,
developer is not required to comply Complete EHR and EHR Module as noted above, the actual cost a
with this final rule in order to operate developers. We believe that the Complete EHR or EHR Module
its business. Rather, a Complete EHR or additional clarity and specificity we developer will incur to be tested and
EHR Module developer will need to rely have provided for some certification certified is accounted for in our
upon this final rule only if it ultimately criteria and the removal of some certification programs final rules.
seeks to have its EHR technology tested required capabilities would further As we noted in the Interim Final Rule,
and certified as being compliant with contribute to lowering the cost estimates we analyzed previously developed
the certification criteria adopted by the for complying with this final rule. CCHIT ambulatory and inpatient
certification criteria and believe that may not be available at the present time; whether the Complete EHR or EHR
many of those criteria, but not all, and (3) that some previously CCHIT- Module: (1) Already includes the
require the exact same capabilities as certified-EHRs will be tested and capability; (2) includes some aspect of
the certification criteria adopted by the certified as EHR Modules rather than the capability which would need to be
Secretary at 45 CFR 170.302, 45 CFR Complete EHRs. Given these updated; (3) does not currently include
170.304, and 45 CFR 170.306. Generally assumptions, we have estimated the the capability at all. We believe it is
speaking, we believe this overlap number of previously CCHIT-certified- reasonable to estimate that it will cost
includes most of the clinically oriented EHRs that will be prepared to be tested somewhere between $10,000 and
capabilities required by the certification and certified will be 65 and 15, $250,000 per certification criterion to
criteria adopted by the Secretary. ambulatory and inpatient, respectively. prepare a Complete EHR for testing and
Accordingly, we believe that a We also believe it is reasonable to certification taking into account the
significant number of previously assume that of these 65 and 15, some factors identified directly above. We
CCHIT-certified-EHRs will only incur will require more preparation than have used this per certification criterion
moderate costs to prepare for others (i.e., we assume that some EHRs range as the basis for our low and high
certification. For the purpose of that were previously CCHIT-certified cost range estimates. For the ease of our
estimating costs, we presume that will include more capabilities than what calculations, we have rounded to ‘‘40’’
previously CCHIT-certified-EHRs they had when CCHIT originally tested the number of certification criteria that
include the functionality to meet the and certified them, and they may the Secretary is adopting.
definition of a Complete EHR. As a consequently be able to more easily
meet the certification criteria adopted For Table 1 we have made the
result, for our estimates in Table 1, we following assumptions based on our
by the Secretary). Based on this
anticipate that these previously CCHIT- understanding of the capabilities
assumption, we have created low and
certified-EHRs will again be prepared present in previously CCHIT-certified-
high ranges for the costs to prepare
for certification as Complete EHRs. We EHRs: (1) In general, Complete EHR
previously CCHIT-certified ambulatory
estimated in the Interim Final Rule that and inpatient EHRs. developers who previously obtained a
there were 74 CCHIT-certified-EHRs In creating our low and high ranges CCHIT certification for their EHR
certified to its 2008 ambulatory for the tables below, we assumed based technology will possess a Complete EHR
certification criteria and 17 CCHIT- on our analysis of previously developed that will meet approximately 75% of the
certified-EHRs certified to its 2007 or and required CCHIT certification criteria adopted certification criteria and, as a
2008 inpatient certification that certain capabilities (e.g., the result, these Complete EHR developers
criteria. 11, 12, 13 Of these 74 and 17 capability to maintain a medication list) may need to make more comprehensive
previously CCHIT-certified-EHRs, we will have been widely implemented and adjustments to their Complete EHRs in
expect that 90% will be prepared and deployed in HIT so that there will be order to prepare the Complete EHRs to
submitted for certification according to little or no need to modify Complete be tested and certified to the remaining
the certification criteria adopted by the EHRs or EHR Modules for certification. 25% of the certification criteria adopted
Secretary. We do not believe that it is We also assumed that the certification by the Secretary; (2) the average low and
realistic to assume that 100% of criteria adopted by the Secretary range high per certification criterion cost for
previously CCHIT-certified-EHRs will from relatively simple capabilities (e.g., ambulatory EHRs previously certified by
be prepared for certification for a recording a patient’s smoking status) to CCHIT which need to be prepared for
number of reasons. These reasons more sophisticated capabilities (e.g., testing and certification will be $50,000
include: (1) A recognition that mergers clinical decision support). As a result, and $150,000, respectively; and (3) the
and acquisitions within the marketplace we have made a general assumption that average low and high per certification
have reduced the number of previously the costs to prepare Complete EHRs and criterion cost for previously CCHIT-
CCHIT-certified-EHRs; (2) that the EHR Modules to be tested and certified certified inpatient EHRs to be prepared
subsequent resources needed to market will vary depending on a number of for testing and certification will be
and promote Certified EHR Technology factors including, but not limited to, $75,000 and $200,000, respectively.
TABLE 1—ESTIMATED ONE-TIME COSTS FOR COMPLETE EHR DEVELOPERS TO PREPARE PREVIOUSLY CCHIT–
CERTIFIED-EHRS TO BE TESTED AND CERTIFIED (3-YEAR PERIOD)—TOTALS ROUNDED
One time cost per EHR Total cost for all EHRs over 3-year period
Number ($M) ($M)
Type prepared
for certification Low High Mid-point Low High Mid-point
2008 Ambulatory CCHIT–Certified-EHR ........... 65 $0.50 $1.5 $1.0 $32.5 $97.5 $65.0
2007/2008 Inpatient CCHIT–Certified-EHR ....... 15 0.75 2.0 1.38 11.25 30.0 20.63
Total ............................................................ 80 .............. .............. ................ 43.75 127.50 85.63
The second type of cost we estimate CCHIT-certified ambulatory EHRs CCHIT–Certified-EHRs’’) and never
includes the costs that we expect for certified prior to 2008 (‘‘out-of-date previously CCHIT-certified-EHRs to be
11 Some are marked with a conditional ePrescribing EHRs that are in the process of 12 http://www.cchit.org/products/Ambulatory—
certification either ‘‘Pre-Market: These are verifying their ability to conduct medication when certification years 2006 and 2007 are
conditionally certified EHRs which are new history, formulary and eligibility checking through unchecked. While 78 EHRs are now listed, we do
products that are fully certified once their a national network for electronic-prescribing not believe that changing our estimate would have
operational use at a physician office site has been
transactions.’’ We do not believe that these caveats a measureable effect on the overall costs.
verified.’’ or ‘‘eRx Conditional: These are
conditionally certified pending advanced have any discernible effect on our estimates. 13 http://www.cchit.org/products/Inpatient.
prepared to be tested and certified as prepared to be tested and certified to all certification criteria and, as a result,
Complete EHRs rather than as EHR of the applicable certification criteria these Complete EHR developers may
Modules.14 We assume the EHR adopted by the Secretary.16 need to make more comprehensive
technology that falls into this category Again, using our general assumptions adjustments to their Complete EHRs in
may require more extensive changes discussed above (40 certification criteria order to prepare the Complete EHRs to
than previously CCHIT-certified-EHRs and a low and high range of $10,000 to be tested and certified to the remaining
identified in Table 1. Again, we have $250,000 per certification criterion) we 60% of the certification criteria adopted
estimated low and high preparation cost have made the following additional by the Secretary; (2) the average low and
ranges. We assume that there will be assumptions in our Table 2 calculations high per certification criterion costs for
very little growth in the Complete EHR based on our understanding of the Complete EHRs for eligible
market due to the market share 15 capabilities currently present in these professionals to be prepared to be tested
represented by the previously CCHIT- EHR technologies: (1) In general, and certified will be $50,000 and
certified-EHRs included in Table 1 and Complete EHR developers who have $150,000, respectively; and (3) the
the upfront costs required to bring a out-of-date CCHIT-Certified-EHRs or average low and high per certification
Complete EHR to market. As a result, we who never previously had their criterion costs for Complete EHRs for
expect there to be 8 and 5 Complete Complete EHRs certified by CCHIT will eligible hospitals to be prepared to be
EHRs (for use by eligible professionals possess Complete EHRs that will meet tested and certified will be $75,000 and
and eligible hospitals, respectively) approximately 40% of the adopted $200,000, respectively.
TABLE 2—ESTIMATED ONE-TIME COSTS FOR COMPLETE EHR DEVELOPERS TO PREPARE NEVER CCHIT-CERTIFIED-
EHRS AND OUT-OF-DATE CCHIT-CERTIFIED-EHRS TO BE TESTED AND CERTIFIED (3-YEAR PERIOD)—TOTALS ROUNDED
One time cost per EHR ($M) Total cost for all EHRs over 3-year
Number period ($M)
Type prepared for
certification Low High Mid-point Low High Mid-point
Complete EHRs for Eligible Professionals 8 $1.2 $3.6 $2.4 $9.6 $28.8 $19.2
Complete EHRs for Eligible Hospitals ....... 5 1.8 4.8 3.3 9.0 24.0 16.5
Total .................................................... 13 .................. .................. .................. 18.60 52.80 35.70
Finally, the third type of cost we that there would be 7 EHR Modules Modules for testing and certification.
estimate relates to the number of EHR prepared to be tested and certified for We estimated in the Interim Final Rule
Modules we expect to be prepared to be each of the 7 types of EHR Modules we and reiterate below a low average one-
tested and certified and the costs identified. This estimate (number of time cost of $100,000 to prepare an EHR
associated with that preparation. We modules X types of modules) resulted in Module, based on the assumption that
clarify as noted in the Temporary an approximate number of 50 EHR some of the less sophisticated EHR
Certification Program final rule that Modules that would be prepared to be Modules would only be prepared to be
these EHR Modules are not ‘‘self- tested and certified. Again, we have tested and certified to 1 or 2
developed,’’ and we assume that an EHR provided low and high preparation cost certification criteria. We estimated in
Module developer interested in estimates in Table 3 below. We assume the Interim Final Rule and reiterate
commercially marketing its EHR that some of EHR Modules prepared for below, a high average cost one-time cost
Module to eligible professionals and certification will be capable of meeting of $500,000 to prepare an EHR Module,
eligible hospitals would develop them. applicable certification criteria with based on the assumption that some of
We assumed in the Interim Final Rule little modification while other EHR the more sophisticated EHR Modules
that certain types of EHR Modules (e.g., Modules will not. Given the potential would only be prepared to be tested and
computerized provider order entry; differences in preparation costs and certified to 1 or 2 of the more
quality reporting; online patient portals) combinations of certification criteria to complicated certification criteria or
would be more likely than others to be create EHR Modules, we believe it is would be prepared to be tested and
prepared to be tested and certified, and reasonable to estimate a wide range of certified to multiple certification
we estimated based on our assumption costs for preparing these types of EHR criteria.
TABLE 3—ESTIMATED ONE-TIME COSTS TO EHR MODULE DEVELOPERS TO PREPARE EHR MODULES TO BE TESTED
AND CERTIFIED (3-YEAR PERIOD)—TOTALS ROUNDED
One-time cost per EHR module ($M) Total cost all EHR modules over 3-year
Number period ($M)
Type prepared Low High Mid-point Low High Mid-point
EHR Modules ............................................. 50 $0.1 $0.5 $0.3 $5.0 $25.0 $15.0

14 CCHIT began testing and certifying inpatient 15 http://www.cchit.org/about—‘‘* * * EHR and that it will be preparing the RPMS EHR as a
EHRs in 2007 and we assume that all of those EHRs products certified by mid-2009, representing over Complete EHR to meet the applicable certification
are included in Table 1 which is why they are not 75% of the marketplace.’’ criteria adopted by the Secretary for both
16 This estimate is premised in part on the fact
included in this discussion. ambulatory and inpatient settings.
that IHS’s RPMS EHR was not included in Table 1
TABLE 3—ESTIMATED ONE-TIME COSTS TO EHR MODULE DEVELOPERS TO PREPARE EHR MODULES TO BE TESTED
AND CERTIFIED (3-YEAR PERIOD)—TOTALS ROUNDED—Continued
One-time cost per EHR module ($M) Total cost all EHR modules over 3-year
Number period ($M)
Type prepared Low High Mid-point Low High Mid-point
Total .................................................... 50 .................. .................. .................. 5.0 25.0 15.0
In total, if we were to distribute the spread evenly over these three years due technology for testing and certification
costs to prepare Complete EHRs and to market pressures and the fact that in 2010 and 2011 rather than 2012. As
EHR Modules between 2010 and 2012 higher upfront incentive payments are a result, we believe as represented in
evenly per year, we believe they would available under the Medicare and Table 4 that the costs attributable to this
likely be in the range of $67.35 to $205.3 Medicaid EHR Incentive Programs. We final rule will be distributed as follows:
million or $22.45 to $68.43 million per assume this factor will motivate a 45% for 2010, 40% for 2011 and 15%
year with an annual cost mid-point of greater ratio of commercial vendors and for 2012.
approximately $45.44 million. However, open source developers of Complete
we do not believe that the costs will be EHRs and EHR Modules to prepare such
TABLE 6—DISTRIBUTED TOTAL PREPARATION COSTS FOR COMPLETE EHR AND EHR MODULE DEVELOPERS (3-YEAR
PERIOD)—TOTALS ROUNDED
Total low cost Total high cost Total average
Ratio
Year estimate estimate cost estimate
(percent) ($M) ($M) ($M)
2010 ............................................................................................... 45 $30.31 $92.39 $61.35

2011 ............................................................................................... 40 26.94 82.12 54.53
2012 ............................................................................................... 15 10.10 30.80 20.45
3-Year Totals ................................................................................. ............................ 67.35 205.30 136.33
Note that these cost estimates do not Complete EHR and EHR Module programmatic goals and objectives. A
include additional costs to prepare for developers as technical requirements to Complete EHR or EHR Module
testing and certification that will likely ensure that their HIT can be tested and developer will need to design a
be incurred when we adopt additional certified and subsequently adopted and Complete EHR or EHR Module that can
standards, implementation implemented as Certified EHR be tested and successfully certified to all
specifications, and certification criteria Technology. Adopting these applicable certification criteria adopted
to support meaningful use Stages 2 and certification criteria will also ultimately by the Secretary in order for the
3. We will account for costs associated help enable eligible professionals and Complete EHR or EHR Module to attain
with these additional standards, eligible hospitals to qualify for incentive certification. Accordingly, we see no
implementation specifications, and payments under Medicare and Medicaid viable alternatives to reducing the
certification criteria in future EHR Incentive Programs. requirements in the final rule or
rulemaking. providing for alternatives to adopted
D. Regulatory Flexibility Act Analysis certification criteria. Additionally, we
b. Benefits
1. Comment and Response believe that the regulation builds in a
We believe that there will be several certain amount of flexibility already in
benefits arising from this final rule. By Comment. Some commenters noted that a small business without the
adopting the revisions to this initial set, that we incorrectly referenced the resources available to develop a
the Secretary will set in motion what we proportion of businesses in the Complete EHR has the option to develop
believe will be an iterative process to marketplace that would qualify as small an EHR Module which will presumably
further enhance the interoperability, businesses under the SBA’s size require less of an investment (time and
functionality, utility, and security of standard. The commenters cited a money) to develop.
health information technology and to presentation by CCHIT which indicated
support the meaningful use of Certified that potentially up to 75% of Complete 2. Final RFA Analysis
EHR Technology. The capabilities EHR developers who design Complete The RFA requires agencies to analyze
specified in the adopted certification EHRs for ambulatory settings would options for regulatory relief of small
criteria will help ensure that health care qualify as small businesses. businesses if a rule has a significant
providers have the necessary Response. We appreciate commenters impact on a substantial number of small
information technology tools to improve pointing out this additional information. entities.
patient care, reduce medical errors and We have revised the discussion While Complete EHRs and EHR
unnecessary tests. The standards accordingly in the final RFA analysis. Module developers represent a small
adopted will aid in fostering greater However, we do not believe that this segment of the overall information
interoperability. We also believe that additional information substantially technology industry, we believe that the
this final rule will serve as a catalyst for changes our analysis. We do not believe entities impacted by this final rule most
a more competitive and innovative that any relief can be provided to small likely fall under the North American
marketplace. Finally, adopted businesses under the SBA size standard Industry Classification System (NAICS)
certification criteria can be used by that would not undercut our code 541511 ‘‘Custom Computer
Programming Services’’ specified at 13 on a substantial number of small applicable certification criteria adopted
CFR 121.201 where the SBA publishes entities. by the Secretary; or
‘‘Small Business Size Standards by (2) A combination of EHR Modules in
E. Executive Order 13132—Federalism
NAICS Industry.’’ The size standard which each constituent EHR Module of
associated with this NAICS code is set Executive Order 13132 establishes the combination has been tested and
at $25 million in annual receipts 17 certain requirements that an agency certified in accordance with the
which ‘‘indicates the maximum allowed must meet when it promulgates a certification program established by the
for a concern and its affiliates to be proposed rule (and subsequent final National Coordinator as having met all
considered small entities.’’ rule) that imposes substantial direct applicable certification criteria adopted
Based on our analysis, we believe that requirement costs on State and local by the Secretary, and the resultant
there is enough data generally available governments, preempts State law, or combination also meets the
to establish that between 75% and 90% otherwise has federalism implications. requirements included in the definition
of entities that are categorized under the Nothing in this final rule imposes of a Qualified EHR.
NAICS code 541511 are under the SBA substantial direct compliance costs on Complete EHR means EHR technology
size standard, but note that the available State and local governments, preempts that has been developed to meet, at a
data does not show how many of these State law or otherwise has federalism minimum, all applicable certification
entities will develop a Complete EHR or implications. We are not aware of any criteria adopted by the Secretary.
EHR Module. We also note that with the State laws or regulations that are Disclosure is defined as it is in 45 CFR
exception of aggregate business contradicted or impeded by any of the 160.103.
information available through the U.S. standards, implementation * * * * *
Census Bureau and the SBA related to specifications, or certification criteria Human readable format means a
NAICS code 541511, it appears that that have been adopted. format that enables a human to read and
many Complete EHR and EHR Module The Office of Management and Budget easily comprehend the information
developers are privately held or owned reviewed this final rule. presented to him or her regardless of the
and do not regularly, if at all, make their method of presentation.
specific annual receipts publicly List of Subjects in 45 CFR Part 170
* * * * *
available. As a result, it is difficult to Computer technology, Electronic
locate empirical data related to many of ■ 3. Revise subpart B to read as follows:
health record, Electronic information
the Complete EHR and EHR Module system, Electronic transactions, Health, Subpart B—Standards and
developers to correlate to the SBA size Health care, Health information Implementation Specifications for
standard. technology, Health insurance, Health
We estimate that this final rule could Health Information Technology
records, Hospitals, Incorporation by
have effects on Complete EHR and EHR reference, Laboratories, Medicaid, Sec.
Module developers, some of which may Medicare, Privacy, Reporting and 170.200 Applicability.
be small entities. However, we believe recordkeeping requirements, Public 170.202 [Reserved]
that we have established the minimum health, Security. 170.205 Content exchange standards and
amount of requirements necessary to implementation specifications for
■ For the reasons set forth in the exchanging electronic health
accomplish our policy goals and that no
appropriate regulatory alternatives preamble, 45 CFR subtitle A, subchapter information.
could be developed to lessen the D, part 170, is amended as follows: 170.207 Vocabulary standards for
representing electronic health
compliance burden associated with this information.
PART 170–HEALTH INFORMATION
final rule. In order for a Complete EHR 170.210 Standards for health information
TECHNOLOGY STANDARDS
or EHR Module to provide the technology to protect electronic health
IMPLEMENTATION SPECIFICATIONS,
capabilities an eligible professional or information created, maintained, and
AND CERTIFICATION CRITERIA AND
eligible hospital will be required to use exchanged.
CERTIFICATION PROGRAMS FOR 170.299 Incorporation by reference.
under the Medicare and Medicaid EHR
HEALTH INFORMATION
Incentive Programs final rule, it will
TECHNOLOGY § 170.200 Applicability.
need to comply with the applicable
certification criteria adopted by the ■ 1. The authority citation for part 170 The standards and implementation
Secretary. Moreover, we note that this continues to read as follows: specifications adopted in this part apply
final rule does not impose the costs with respect to Complete EHRs and EHR
Authority: 42 U.S.C. 300jj–11; 42 U.S.C. Modules.
cited in the regulatory impact analysis 300jj–14; 5 U.S.C. 552.
as compliance costs, but rather as § 170.202 [Reserved]
investments which Complete EHR and ■ 2. Amend § 170.102 by revising the
EHR Module developers voluntarily definitions of ‘‘Complete EHR,’’ § 170.205 Content exchange standards
take on and expect to recover with an ‘‘Certified EHR Technology,’’ and and implementation specifications for
appropriate rate of return. Accordingly, ‘‘Disclosure’’ and adding the definition exchanging electronic health information.
we do not believe that the final rule will of ‘‘Human readable format’’ to read as The Secretary adopts the following
create a significant impact on a follows: content exchange standards and
substantial number of small entities. associated implementation
§ 170.102 Definitions. specifications:
The Secretary certifies that this final
rule will not have a significant impact * * * * * (a) Patient summary record—(1)
Certified EHR Technology means: Standard. Health Level Seven Clinical
17 The SBA references that annual receipts means (1) A Complete EHR that meets the Document Architecture (CDA) Release
‘‘total income’’ (or in the case of a sole requirements included in the definition 2, Continuity of Care Document (CCD)
proprietorship, ‘‘gross income’’) plus ‘‘cost of goods of a Qualified EHR and has been tested (incorporated by reference in § 170.299).
sold’’ as these terms are defined and reported on
Internal Revenue Service tax return forms. http://
and certified in accordance with the Implementation specifications. The
www.sba.gov/idc/groups/public/documents/ certification program established by the Healthcare Information Technology
sba_homepage/guide_to_size_standards.pdf. National Coordinator as having met all Standards Panel (HITSP) Summary
Documents Using HL7 CCD Component § 170.207 Vocabulary standards for time, patient identification, and user
HITSP/C32 (incorporated by reference representing electronic health information. identification must be recorded when
in § 170.299). The Secretary adopts the following electronic health information is created,
(2) Standard. ASTM E2369 Standard code sets, terminology, and modified, accessed, or deleted; and an
Specification for Continuity of Care nomenclature as the vocabulary indication of which action(s) occurred
Record and Adjunct to ASTM E2369 standards for the purpose of and by whom must also be recorded.
(incorporated by reference in § 170.299). representing electronic health (c) Verification that electronic health
(b) Electronic prescribing. (1) information: information has not been altered in
Standard. The National Council for the (a) Problems—(1) Standard. The code transit. Standard. A hashing algorithm
Prescription Drug Programs (NCPDP) set specified at 45 CFR 162.1002(a)(1) with a security strength equal to or
Prescriber/Pharmacist Interface SCRIPT for the indicated conditions. greater than SHA–1 (Secure Hash
standard, Implementation Guide, (2) Standard. International Health Algorithm (SHA–1) as specified by the
Version 8, Release 1 (Version 8.1) Terminology Standards Development National Institute of Standards and
October 2005 (incorporated by reference Organization (IHTSDO) Systematized Technology (NIST) in FIPS PUB 180–3
in § 170.299) Nomenclature of Medicine Clinical (October, 2008)) must be used to verify
(2) Standard. NCPDP SCRIPT Terms (SNOMED CT®) July 2009 that electronic health information has
Standard, Implementation Guide, version (incorporated by reference in not been altered.
§ 170.299). (d) Record treatment, payment, and
Version 10.6 (incorporated by reference
(b) Procedures—(1) Standard. The health care operations disclosures. The
in § 170.299).
code set specified at 45 CFR date, time, patient identification, user
(c) Electronic submission of lab 162.1002(a)(2).
results to public health agencies. identification, and a description of the
(2) Standard. The code set specified at disclosure must be recorded for
Standard. HL7 2.5.1 (incorporated by 45 CFR 162.1002(a)(5).
reference in § 170.299). Implementation disclosures for treatment, payment, and
(c) Laboratory test results. Standard. health care operations, as these terms
specifications. HL7 Version 2.5.1 Logical Observation Identifiers Names
Implementation Guide: Electronic are defined at 45 CFR 164.501.
and Codes (LOINC®) version 2.27, when
Laboratory Reporting to Public Health, such codes were received within an § 170.299 Incorporation by reference.
Release 1 (US Realm) (incorporated by electronic transaction from a laboratory (a) Certain material is incorporated by
reference in § 170.299). (incorporated by reference in § 170.299). reference into this subpart with the
(d) Electronic submission to public (d) Medications. Standard. Any approval of the Director of the Federal
health agencies for surveillance or source vocabulary that is included in Register under 5 U.S.C. 552(a) and 1
reporting. (1) Standard. HL7 2.3.1 RxNorm, a standardized nomenclature CFR part 51. To enforce any edition
(incorporated by reference in § 170.299). for clinical drugs produced by the other than that specified in this section,
(2) Standard. HL7 2.5.1 (incorporated United States National Library of the Department of Health and Human
by reference in § 170.299). Medicine. Services must publish notice of change
Implementation specifications. Public (e) Immunizations. Standard. HL7 in the Federal Register and the material
Health Information Network HL7 Standard Code Set CVX—Vaccines must be available to the public. All
Version 2.5 Message Structure Administered, July 30, 2009 version approved material is available for
Specification for National Condition (incorporated by reference in § 170.299). inspection at the National Archives and
Reporting Final Version 1.0 and Errata (f) Race and Ethnicity. Standard. The Records Administration (NARA). For
and Clarifications National Notification Office of Management and Budget information on the availability of this
Message Structural Specification Standards for Maintaining, Collecting, material at NARA, call 202–741–6030 or
(incorporated by reference in § 170.299). and Presenting Federal Data on Race go to http://www.archives.gov/
(e) Electronic submission to and Ethnicity, Statistical Policy federal_register/
immunization registries. (1) Standard. Directive No. 15, October 30, 1997 code_of_federal_regulations/
HL7 2.3.1 (incorporated by reference in (available at http:// ibr_locations.html. Also, it is available
§ 170.299). Implementation www.whitehouse.gov/omb/rewrite/ for inspection at U.S. Department of
specifications. Implementation Guide fedreg/ombdir15.html). Health and Human Services, Office of
for Immunization Data Transactions the National Coordinator for Health
§ 170.210 Standards for health information
using Version 2.3.1 of the Health Level technology to protect electronic health Information Technology, Hubert H.
Seven (HL7) Standard Protocol information created, maintained, and Humphrey Building, Suite 729D, 200
Implementation Guide Version 2.2 exchanged. Independence Ave., SW., Washington,
(incorporated by reference in § 170.299). The Secretary adopts the following DC 20201, call ahead to arrange for
(2) Standard. HL7 2.5.1 (incorporated standards to protect electronic health inspection at 202–690–7151, and is
by reference in § 170.299). information created, maintained, and available from the sources listed below.
Implementation specifications. HL7 exchanged: (b) Health Level Seven, 3300
2.5.1 Implementation Guide for (a) Encryption and decryption of Washtenaw Avenue, Suite 227, Ann
Immunization Messaging Release 1.0 electronic health information—(1) Arbor, MI 48104; Telephone (734) 677–
(incorporated by reference in § 170.299). General. Any encryption algorithm 7777 or http://www.hl7.org/.
(f) Quality reporting. Standard. The identified by the National Institute of (1) Health Level Seven Standard
CMS Physician Quality Reporting Standards and Technology (NIST) as an Version 2.3.1 (HL7 2.3.1), An
Initiative (PQRI) 2009 Registry XML approved security function in Annex A Application Protocol for Electronic Data
Specification (incorporated by reference
of the Federal Information Processing Exchange in Healthcare Environments,

in § 170.299). Implementation Standards (FIPS) Publication 140–2 April 14, 1999, IBR approved for
specifications. Physician Quality (incorporated by reference in § 170.299). § 170.205.
Reporting Initiative Measure (2) Exchange. Any encrypted and (2) Health Level Seven Messaging
Specifications Manual for Claims and integrity protected link. Standard Version 2.5.1 (HL7 2.5.1), An
Registry (incorporated by reference in (b) Record actions related to Application Protocol for Electronic Data
§ 170.299). electronic health information. The date, Exchange in Healthcare Environments,
February 21, 2007, IBR approved for (g) Centers for Disease Control and Subpart C—Certification Criteria for
§ 170.205. Prevention, National Centers for Health Information Technology
(3) Health Level Seven Immunization and Respiratory Diseases
Implementation Guide: Clinical Immunization Information System Sec.
Document Architecture (CDA) Release 170.300 Applicability.
Support Branch—Informatics 1600 170.302 General certification criteria for
2—Continuity of Care Document (CCD), Clifton Road Mailstop: E–62 Atlanta, GA Complete EHRs or EHR Modules.
April 01, 2007, IBR approved for 30333 170.304 Specific certification criteria for
§ 170.205. (1) HL7 Standard Code Set CVX— Complete EHRs or EHR Modules
(4) HL7 Version 2.5.1 Implementation Vaccines Administered, July 30, 2009, designed for an ambulatory setting.
Guide: Electronic Laboratory Reporting IBR approved for § 170.207. 170.306 Specific certification criteria for
to Public Health, Release 1 (US Realm) Complete EHRs or EHR Modules
(2) Implementation Guide for designed for an inpatient setting.
HL7 Version 2.5.1: ORU∧R01, HL7 Immunization Data Transactions using
Informative Document, February, 2010, Version 2.3.1 of the Health Level Seven § 170.300 Applicability.
IBR approved for § 170.205. (HL7) Standard Protocol (a) The certification criteria adopted
(5) [Reserved] Implementation Guide Version 2.2, June in this subpart apply to the testing and
(c) ASTM International, 100 Barr 2006, IBR approved for § 170.205. certification of Complete EHRs and EHR
Harbor Drive, PO Box C700, West (3) HL7 2.5.1 Implementation Guide Modules.
Conshohocken, PA, 19428–2959 USA; for Immunization Messaging Release (b) When a certification criterion
Telephone (610) 832–9585 or http:// 1.0, May 1, 2010, IBR approved for refers to two or more standards as
www.astm.org/. § 170.205. alternatives, use of at least one of the
(1) ASTM E2369–05: Standard
(4) Public Health Information alternative standards will be considered
Specification for Continuity of Care
Network HL7 Version 2.5 Message compliant.
Record (CCR), year of adoption 2005, (c) Complete EHRs and EHR Modules
Structure Specification for National
ASTM approved July 17, 2006, IBR are not required to be compliant with
Condition Reporting Final Version 1.0,
approved for § 170.205. certification criteria that are designated
(2) ASTM E2369–05 (Adjunct to including Errata and Clarifications,
National Notification Message as optional.
E2369): Standard Specification
Continuity of Care Record,—Final Structural Specification, 8/18/2007, § 170.302 General certification criteria for
Version 1.0 (V1.0), November 7, 2005, August 18, 2007, IBR approved for Complete EHRs or EHR Modules.
IBR approved for § 170.205. § 170.205.
The Secretary adopts the following
(d) National Council for Prescription (5) [Reserved] general certification criteria for
Drug Programs, Incorporated, 9240 E. (h) Centers for Medicare & Medicaid Complete EHRs or EHR Modules.
Raintree Drive, Scottsdale, AZ 85260– Services, Office of Clinical Standards Complete EHRs or EHR Modules must
7518; Telephone (480) 477–1000; and and Quality, 7500 Security Boulevard, include the capability to perform the
Facsimile (480) 767–1042 or http:// Baltimore, Maryland 21244; Telephone following functions electronically,
www.ncpdp.org. (410) 786–3000 unless designated as optional, and in
(1) National Council for Prescription (1) CMS PQRI 2009 Registry XML accordance with all applicable
Drug Programs Prescriber/Pharmacist Specifications, IBR approved for standards and implementation
Interface SCRIPT Standard, § 170.205. specifications adopted in this part:
Implementation Guide, Version 8, (2) 2009 Physician Quality Reporting (a) Drug-drug, drug-allergy interaction
Release 1, October 2005, IBR approved Initiative Measure Specifications checks—(1) Notifications. Automatically
for § 170.205. Manual for Claims and Registry, Version and electronically generate and indicate
(2) SCRIPT Standard, Implementation 3.0, December 8, 2008 IBR approved for in real-time, notifications at the point of
Guide, Version 10.6, October, 2008, § 170.205. care for drug-drug and drug-allergy
(Approval date for ANSI: November 12, (i) National Institute of Standards and contraindications based on medication
2008), IBR approved for § 170.205. Technology, Information Technology list, medication allergy list, and
(3) [Reserved] Laboratory, National Institute of computerized provider order entry
(e) Regenstrief Institute, Inc., LOINC® Standards and Technology, 100 Bureau (CPOE).
c/o Medical Informatics The Regenstrief Drive, Gaithersburg, MD 20899–8930, (2) Adjustments. Provide certain users
Institute, Inc 410 West 10th Street, Suite http://csrc.nist.gov/groups/STM/cmvp/ with the ability to adjust notifications
2000 Indianapolis, IN 46202–3012; standards.html. provided for drug-drug and drug-allergy
Telephone (317) 423–5558 or http:// (1) Annex A: Approved Security interaction checks.
loinc.org/. Functions for FIPS PUB 140–2, Security (b) Drug-formulary checks. Enable a
(1) Logical Observation Identifiers Requirements for Cryptographic user to electronically check if drugs are
Names and Codes (LOINC®) version Modules, Draft, January 27, 2010, IBR in a formulary or preferred drug list.
2.27, June 15, 2009, IBR approved for approved for § 170.210. (c) Maintain up-to-date problem list.
§ 170.207. (2) [Reserved] Enable a user to electronically record,
(2) [Reserved] modify, and retrieve a patient’s problem
(f) U.S. National Library of Medicine, (j) American National Standards
Institute, Health Information list for longitudinal care in accordance
8600 Rockville Pike, Bethesda, MD with:
20894; Telephone (301) 594–5983 or Technology Standards Panel (HITSP)
(1) The standard specified in
http://www.nlm.nih.gov/. Secretariat, 25 West 43rd Street—Fourth
§ 170.207(a)(1); or
(1) International Health Terminology Floor, New York, NY 10036, http://
(2) At a minimum, the version of the

Standards Development Organization www.hitsp.org standard specified in § 170.207(a)(2).
Systematized Nomenclature of Medicine (1) HITSP Summary Documents Using (d) Maintain active medication list.
Clinical Terms (SNOMED CT®), HL7 Continuity of Care Document (CCD) Enable a user to electronically record,
International Release, July 2009, IBR Component, HITSP/C32, July 8, 2009, modify, and retrieve a patient’s active
approved for § 170.207. Version 2.5, IBR approved for § 170.205. medication list as well as medication
(2) [Reserved] ■ 4. Revise subpart C to read as follows: history for longitudinal care.
(e) Maintain active medication allergy applicable implementation (v) Encryption when exchanging
list. Enable a user to electronically specifications) specified in electronic health information. Encrypt
record, modify, and retrieve a patient’s § 170.205(d)(1) or § 170.205(d)(2). and decrypt electronic health
active medication allergy list as well as (m) Patient-specific education information when exchanged in
medication allergy history for resources. Enable a user to accordance with the standard specified
longitudinal care. electronically identify and provide in § 170.210(a)(2).
(f) Record and chart vital signs—(1) patient-specific education resources (w) Optional. Accounting of
Vital signs. Enable a user to according to, at a minimum, the data disclosures. Record disclosures made for
electronically record, modify, and elements included in the patient’s: treatment, payment, and health care
retrieve a patient’s vital signs including, problem list; medication list; and operations in accordance with the
at a minimum, height, weight, and laboratory test results; as well as standard specified in § 170.210(d).
blood pressure. provide such resources to the patient.
(2) Calculate body mass index. § 170.304 Specific certification criteria for
(n) Automated measure calculation. Complete EHRs or EHR Modules designed
Automatically calculate and display For each meaningful use objective with for an ambulatory setting.
body mass index (BMI) based on a a percentage-based measure, The Secretary adopts the following
patient’s height and weight. electronically record the numerator and
(3) Plot and display growth charts. certification criteria for Complete EHRs
denominator and generate a report or EHR Modules designed to be used in
Plot and electronically display, upon including the numerator, denominator,
request, growth charts for patients 2–20 an ambulatory setting. Complete EHRs
and resulting percentage associated with or EHR Modules must include the
years old. each applicable meaningful use
(g) Smoking status. Enable a user to capability to perform the following
measure. functions electronically and in
electronically record, modify, and (o) Access control. Assign a unique
retrieve the smoking status of a patient. accordance with all applicable
name and/or number for identifying and standards and implementation
Smoking status types must include: tracking user identity and establish
current every day smoker; current some specifications adopted in this part:
controls that permit only authorized (a) Computerized provider order
day smoker; former smoker; never users to access electronic health
smoker; smoker, current status entry. Enable a user to electronically
information. record, store, retrieve, and modify, at a
unknown; and unknown if ever smoked. (p) Emergency access. Permit
(h) Incorporate laboratory test minimum, the following order types:
authorized users (who are authorized for (1) Medications;
results—(1) Receive results. emergency situations) to access (2) Laboratory; and
Electronically receive clinical laboratory electronic health information during an (3) Radiology/imaging.
test results in a structured format and emergency. (b) Electronic prescribing. Enable a
display such results in human readable (q) Automatic log-off. Terminate an user to electronically generate and
format. electronic session after a predetermined transmit prescriptions and prescription-
(2) Display test report information. time of inactivity. related information in accordance with:
Electronically display all the (r) Audit log. (1)—Record actions. (1) The standard specified in
information for a test report specified at Record actions related to electronic § 170.205(b)(1) or § 170.205(b)(2); and
42 CFR 493.1291(c)(1) through (7). health information in accordance with (2) The standard specified in
(3) Incorporate results. Electronically § 170.207(d).
the standard specified in § 170.210(b).
attribute, associate, or link a laboratory (c) Record demographics. Enable a
(2) Generate audit log. Enable a user
test result to a laboratory order or user to electronically record, modify,
to generate an audit log for a specific
patient record. and retrieve patient demographic data
time period and to sort entries in the
(i) Generate patient lists. Enable a including preferred language, gender,
audit log according to any of the
user to electronically select, sort, race, ethnicity, and date of birth. Enable
elements specified in the standard at
retrieve, and generate lists of patients race and ethnicity to be recorded in
§ 170.210(b).
according to, at a minimum, the data accordance with the standard specified
elements included in: (s) Integrity. (1) Create a message
digest in accordance with the standard at § 170.207(f).
(1) Problem list; (d) Patient reminders. Enable a user to
(2) Medication list; specified in § 170.210(c).
(2) Verify in accordance with the electronically generate a patient
(3) Demographics; and reminder list for preventive or follow-up
(4) Laboratory test results. standard specified in § 170.210(c) upon
receipt of electronically exchanged care according to patient preferences
(j) Medication reconciliation. Enable a based on, at a minimum, the data
user to electronically compare two or health information that such
information has not been altered. elements included in:
more medication lists. (1) Problem list;
(k) Submission to immunization (3) Detection. Detect the alteration of (2) Medication list;
registries. Electronically record, modify, audit logs. (3) Medication allergy list;
retrieve, and submit immunization (t) Authentication. Verify that a (4) Demographics; and
information in accordance with: person or entity seeking access to (5) Laboratory test results.
(1) The standard (and applicable electronic health information is the one (e) Clinical decision support—(1)
implementation specifications) claimed and is authorized to access Implement rules. Implement automated,
specified in § 170.205(e)(1) or such information. electronic clinical decision support
§ 170.205(e)(2); and (u) General encryption. Encrypt and rules (in addition to drug-drug and
(2) At a minimum, the version of the decrypt electronic health information in
drug-allergy contraindication checking)

standard specified in § 170.207(e). accordance with the standard specified based on the data elements included in:
(l) Public health surveillance. in § 170.210(a)(1), unless the Secretary problem list; medication list;
Electronically record, modify, retrieve, determines that the use of such demographics; and laboratory test
and submit syndrome-based public algorithm would pose a significant results.
health surveillance information in security risk for Certified EHR (2) Notifications. Automatically and
accordance with the standard (and Technology. electronically generate and indicate in
real-time, notifications and care at a minimum, diagnostic tests results, (b) Record demographics. Enable a
suggestions based upon clinical problem list, medication list, and user to electronically record, modify,
decision support rules. medication allergy list in accordance and retrieve patient demographic data
(f) Electronic copy of health with the standard (and applicable including preferred language, gender,
information. Enable a user to create an implementation specifications) race, ethnicity, date of birth, and date
electronic copy of a patient’s clinical specified in § 170.205(a)(1) or and preliminary cause of death in the
information, including, at a minimum, § 170.205(a)(2). Upon receipt of a event of mortality. Enable race and
diagnostic test results, problem list, patient summary record formatted ethnicity to be recorded in accordance
medication list, and medication allergy according to the alternative standard, with the standard specified at
list in: display it in human readable format. § 170.207(f).
(1) Human readable format; and (2) Electronically transmit. Enable a (c) Clinical decision support—(1)
(2) On electronic media or through user to electronically transmit a patient Implement rules. Implement automated,
some other electronic means in summary record to other providers and electronic clinical decision support
accordance with: organizations including, at a minimum, rules (in addition to drug-drug and
(i) The standard (and applicable diagnostic test results, problem list, drug-allergy contraindication checking)
implementation specifications) medication list, and medication allergy based on the data elements included in:
specified in § 170.205(a)(1) or list in accordance with: problem list; medication list;
§ 170.205(a)(2); and (i) The standard (and applicable demographics; and laboratory test
(ii) For the following data elements implementation specifications) results.
the applicable standard must be used: specified in § 170.205(a)(1) or (2) Notifications. Automatically and
(A) Problems. The standard specified § 170.205(a)(2); and electronically generate and indicate in
in § 170.207(a)(1) or, at a minimum, the (ii) For the following data elements real-time, notifications and care
version of the standard specified in the applicable standard must be used: suggestions based upon clinical
§ 170.207(a)(2); (A) Problems. The standard specified decision support rules.
(B) Laboratory test results. At a in § 170.207(a)(1) or, at a minimum, the (d) Electronic copy of health
minimum, the version of the standard version of the standard specified in information. (1) Enable a user to create
specified in § 170.207(c); and § 170.207(a)(2); an electronic copy of a patient’s clinical
(C) Medications. The standard (B) Laboratory test results. At a information, including, at a minimum,
specified in § 170.207(d). minimum, the version of the standard diagnostic test results, problem list,
(g) Timely access. Enable a user to specified in § 170.207(c); and medication list, medication allergy list,
provide patients with online access to (C) Medications. The standard and procedures:
their clinical information, including, at specified in § 170.207(d). (i) In human readable format; and
a minimum, lab test results, problem (j) Calculate and submit clinical (ii) On electronic media or through
list, medication list, and medication quality measures—(1) Calculate (i) some other electronic means in
allergy list. Electronically calculate all of the core accordance with:
(h) Clinical summaries. Enable a user clinical measures specified by CMS for (A) The standard (and applicable
to provide clinical summaries to eligible professionals. implementation specifications)
patients for each office visit that (ii) Electronically calculate, at a specified in § 170.205(a)(1) or
include, at a minimum, diagnostic test minimum, three clinical quality § 170.205(a)(2); and
results, problem list, medication list, measures specified by CMS for eligible (B) For the following data elements
and medication allergy list. If the professionals, in addition to those the applicable standard must be used:
clinical summary is provided clinical quality measures specified in (1) Problems. The standard specified
electronically it must be: paragraph (1)(i). in § 170.207(a)(1) or, at a minimum, the
(1) Provided in human readable (2) Submission. Enable a user to version of the standard specified in
format; and electronically submit calculated clinical § 170.207(a)(2);
(2) Provided on electronic media or quality measures in accordance with the (2) Procedures. The standard specified
through some other electronic means in standard and implementation in § 170.207(b)(1) or § 170.207(b)(2);
accordance with: specifications specified in § 170.205(f). (3) Laboratory test results. At a
(i) The standard (and applicable minimum, the version of the standard
implementation specifications) § 170.306 Specific certification criteria for specified in § 170.207(c); and
specified in § 170.205(a)(1) or Complete EHRs or EHR Modules designed (4) Medications. The standard
§ 170.205(a)(2); and for an inpatient setting. specified in § 170.207(d).
(ii) For the following data elements The Secretary adopts the following (2) Enable a user to create an
the applicable standard must be used: certification criteria for Complete EHRs electronic copy of a patient’s discharge
(A) Problems. The standard specified or EHR Modules designed to be used in summary in human readable format and
in § 170.207(a)(1) or, at a minimum, the an inpatient setting. Complete EHRs or on electronic media or through some
version of the standard specified in EHR Modules must include the other electronic means.
§ 170.207(a)(2); capability to perform the following (e) Electronic copy of discharge
(B) Laboratory test results. At a functions electronically and in instructions. Enable a user to create an
minimum, the version of the standard accordance with all applicable electronic copy of the discharge
specified in § 170.207(c); and standards and implementation instructions for a patient, in human
(C) Medications. The standard specifications adopted in this part: readable format, at the time of discharge
specified in § 170.207(d). on electronic media or through some
(a) Computerized provider order

(i) Exchange clinical information and entry. Enable a user to electronically other electronic means.
patient summary record—(1) record, store, retrieve, and modify, at a (f) Exchange clinical information and
Electronically receive and display. minimum, the following order types: patient summary record—(1)
Electronically receive and display a (1) Medications; Electronically receive and display.
patient’s summary record, from other (2) Laboratory; and Electronically receive and display a
providers and organizations including, (3) Radiology/imaging. patient’s summary record from other
providers and organizations including, specified in § 170.205(a)(1) or and, at a minimum, the version of the
at a minimum, diagnostic test results, § 170.205(a)(2); and standard specified in § 170.207(c).
problem list, medication list, (ii) For the following data elements (h) Advance directives. Enable a user
medication allergy list, and procedures the applicable standard must be used: to electronically record whether a
in accordance with the standard (and (A) Problems. The standard specified patient has an advance directive.
applicable implementation in § 170.207(a)(1) or, at a minimum, the (i) Calculate and submit clinical
specifications) specified in version of the standard specified in quality measures—(1) Calculate.
§ 170.205(a)(1) or § 170.205(a)(2). Upon § 170.207(a)(2); Electronically calculate all of the
receipt of a patient summary record (B) Procedures. The standard clinical quality measures specified by
formatted according to the alternative specified in § 170.207(b)(1) or CMS for eligible hospitals and critical
standard, display it in human readable § 170.207(b)(2); access hospitals.
format. (2) Submission. Enable a user to
(C) Laboratory test results. At a
(2) Electronically transmit. Enable a electronically submit calculated clinical
minimum, the version of the standard
user to electronically transmit a quality measures in accordance with the
specified in § 170.207(c); and
patient’s summary record to other standard and implementation
(D) Medications. The standard specifications specified in § 170.205(f).
providers and organizations including, specified in § 170.207(d).
at a minimum, diagnostic results, (g) Reportable lab results.
problem list, medication list, Electronically record, modify, retrieve, Dated: July 9, 2010.
medication allergy list, and procedures and submit reportable clinical lab Kathleen Sebelius,
in accordance with: results in accordance with the standard Secretary.
(i) The standard (and applicable (and applicable implementation [FR Doc. 2010–17210 Filed 7–12–10; 8:45 am]
implementation specifications) specifications) specified in § 170.205(c) BILLING CODE 4150–45–P

Standards, Implementation Specifications and Certification Critera For EHR Technology Final Rule 2010-17210

Enviado por

Dados do documento

Título original

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

Standards, Implementation Specifications and Certification Critera For EHR Technology Final Rule 2010-17210

Enviado por

Direitos autorais:

Formatos disponíveis

44590 Federal Register / Vol. 75, No.

144 / Wednesday, July 28, 2010 / Rules and Regulations

Health Information Technology, 202–

legal entities. Certified EHR Technology must utilize a

standard was available, the standard

time, to reflect current technology, definition of disclosure. The final circulars_a119.

of health-related information on an professional or eligible hospital to be in comprehensive and should include

hospital or for that matter any health

ability to adjust notifications provided

information and medication lists in an

from being included in a Complete EHR

Section 170.302(d)—Maintain Active

Complete EHR and EHR Module

and appropriate because it would certification criterion is too prescriptive. nchs/nhis/tobacco/tobacco_recodes.htm.

Comments on 170.302(g)(2) Comments on 170.302(g)(3) as the record maintained in the EHR.

not have the same volume of laboratory

purchasers as part of the Complete EHR

CVX—Vaccines Administered as the

Meaningful use Stage 1 Meaningful use Stage 1 measure Certification criterion

developers to focus their efforts on a information in accordance with the

can be found in NIST Special

developer from pursuing other ways to Section 170.304(c)—Record

specified in § 170.205(a)(1) or § 170.205(a)(2); and

(C) Medications. The standard specified in § 170.207(d).

cluded in: problem list; medication list; demographics; and lab-

ment (POS 21 or 23) and who some other electronic means.

Comment. A few commenters Comment. A commenter requested Comment. One commenter

notification requirements. syndromic surveillance, and VXU for

N/A .................................................. N/A ................................................. Final Rule Text: § 170.302(n).

increase the burden on potential

and Transportation Barriers Compliance Board

dollars, updated annually for inflation.

Total ............................................................ 80 .............. .............. ................ 43.75 127.50 85.63

Total .................................................... 13 .................. .................. .................. 18.60 52.80 35.70

EHR Modules ............................................. 50 $0.1 $0.5 $0.3 $5.0 $25.0 $15.0

Total .................................................... 50 .................. .................. .................. 5.0 25.0 15.0

2010 ............................................................................................... 45 $30.31 $92.39 $61.35

of the Federal Information Processing Exchange in Healthcare Environments,

(2) At a minimum, the version of the

drug-allergy contraindication checking)

(a) Computerized provider order

Você também pode gostar