Final Rule Establishes the Temporary Certification Program for EHR Technology

On June 24, 2010, the Office of the National Coordinator (ONC) published the temporary EHR certification program final rule (Final Rule),¹ establishing the process by which the ONC will select organizations to be ONC-Authorized Testing and Certification Bodies (ONC-ATCBs) for the Medicare and Medicaid EHR incentive programs established by the Health Information Technology for Economic and Clinical Health Act (HITECH Act).

The Final Rule also establishes parameters under which the ONC-ATCBs will test and certify that EHR technology (Certified EHR Technology) meets the technological capability, functionality and security requirements (EHR Certification Requirements)² for supporting the achievement of meaningful use³ by eligible hospitals and professionals (collectively, eligible providers). The Final Rule does not permit uncertified EHR technology currently in use to be “grandfathered”—that is, deemed to be Certified EHR Technology for purposes of the EHR incentive programs.

The temporary certification program became effective immediately on the June 24, 2010, Final Rule publication date. This reflects ONC’s recognition of the need to facilitate the ability of eligible providers to meet the HITECH Act deadline for demonstrating the meaningful use of Certified EHR Technology that will be required to earn the 2011 EHR incentive payments.⁴

The Final Rule revises the sunset date for the temporary certification program so that it will end on December 31, 2011, unless the ONC determines that the permanent certification program is not fully constituted at that time and delays the sunset date. In the proposed rule for the certification programs (Proposed Rule),⁵ the ONC proposed that the temporary program would end when at least one ONC-approved accreditor was authorized to certify EHR technology under the permanent program.

The ONC is expected to issue a separate final rule establishing the permanent EHR certification program by fall 2010.⁶ For more information regarding the Proposed Rule, see the authors’ article entitled “HHS Issues Proposed Rule Establishing Certification Programs for Health Information Technology” at www.mwe.com/info/pubs/BNA0310.pdf, published in the BNA Health IT Law & Industry Report.The ONC is also expected to issue a final rule this summer finalizing the EHR Certification Requirements previously established by interim final rule on January 13, 2010.⁷

The temporary certification programs and the EHR Certification Requirements are important both to EHR technology vendors, which must obtain certification of their technology under the temporary or permanent program to serve the eligible provider market, and to eligible providers, which must ensure that the EHR technology they are purchasing will support their qualification for the Medicare and Medicaid incentives.

Selection of ONC-ATCBs

Under the temporary certification program, the ONC will select an organization(s) to become an ONC-ATCB with authority to test and certify Complete EHRs (as defined below) and/or EHR Modules (as defined below) as meeting the Certification Requirements. To become an ONC-ATCB, an organization must request and submit an application to demonstrate its competency and ability to both test and certify Complete EHRs and/or EHR Modules. The ONC is currently accepting applications.

A Complete EHR is EHR technology that has been developed to meet all of the applicable EHR Certification Requirements. The use of the word ‘‘applicable’’ reflects the fact that some requirements apply to EHR technology used in the ambulatory setting, and other criteria apply to EHR technology used in the inpatient setting. An EHR Module is any service, component or combination thereof that can meet at least one of the certification ‘‘criteria’’ included in the EHR Certification Requirements. A vendor may present an EHR Module for testing and certification as part of a pre-coordinated bundle of EHR Modules, which could otherwise constitute a Complete EHR.

As under the Proposed Rule, Part 1 of the application requires documentation to demonstrate testing and certification processes in accordance with the guide published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) (ISO/IEC Guide 65), which specifies standards for operating a certification program. Part 2 requires the applicant to complete a proficiency examination and demonstrate that it can competently test and certify Complete EHRs and/or EHR Modules.

Testing and Certification of EHR Technology

Once certified by the ONC, an ONC-ATCB would be qualified to perform testing and certification of complete EHRs and/or EHR modules. “Testing’’ describes the process used to determine the degree to which a Complete EHR or EHR Module can meet specific, predefined, measurable, quantitative requirements. The results would be compared to and evaluated in accordance with predefined measures. ‘‘Certification’’ describes the assessment (and subsequent assertion) made by an authorized certifying organization (e.g.,an ONC-ATCB in the temporary program), once it has analyzed the quantitative results rendered from testing along with other qualitative factors, that a complete EHR or EHR module has met all the applicable EHR Certification Requirements.

Testing Tools and Procedures

The Proposed Rule included a Principle of Proper Conduct (Principle) for ONC-ATCBs, requiring ONC-ATCBs to use test tools and procedures that were “published by NIST or functionally equivalent testing tools and procedures published by another entity”⁸ to test an EHR. The Final Rule revises this Principle to require instead the use of “test tools and test procedures approved by the National Coordinator for the purposes of assessing Complete EHRs’ and/or EHR Modules’ compliance with the certification criteria adopted by the Secretary.” While the ONC will still likely require NIST test tools and procedures, it will have the flexibility to adopt other acceptable test tools and procedures in addition to those developed by NIST. ONC-ATCBs and developers of Complete EHRs and EHR Modules will likely benefit from the uniformity of standards and greater ONC control achieved by this approach.

Privacy and Security Testing of EHR Modules

The Proposed Rule required ONC-ATCBs to test and certify an EHR Module in accordance with the privacy and security certification criteria adopted by the Secretary, unless the EHR Module met one of the following proposed exceptions:

1) The EHR Module(s) are presented for testing and certification as a precoordinated, integrated “bundle” of EHR Modules, which could otherwise constitute a Complete EHR, and may be tested and certified in the same manner as a Complete EHR.

2) It would be technically infeasible for the EHR Module to be tested and certified in accordance with some or all of the privacy and security criteria.

3) The EHR Module is designed to perform a specific privacy and security capability.

The Final Rule eliminates the third exception for modules that can perform a specific privacy and security capability and expanded the second exception to also include cases where testing to the privacy and security criteria would be “inapplicable.”

Effect of New or Modified EHR Certification Requirements

Under the Final Rule, when the ONC adopts new or modified EHR Certification Requirements, EHR technology certified under legacy Certification Requirements would no longer be Certified EHR Technology. Consequently, each time the ONC adopts or modifies EHR Certification Requirements, previously certified EHR technology must be retested and recertified in order for eligible providers to continue to qualify for incentive payments (or avoid downward adjustments in reimbursement) for meaningful use of the technology. Currently, the ONC and the Centers for Medicare and Medicaid Services (CMS) anticipate adopting new EHR Certification Requirements and meaningful use requirements, respectively, no more frequently than every two years.

Additional Proprietary Certification Requirements

In the Final Rule, the ONC clarifies that while it does not preclude an ONC-ATCB from certifying health information technology in accordance with its own requirements that may be unrelated to and potentially exceed the ONC’s EHR Certification Requirements, such activities are not within the scope of an ONC-ATCB’s authority under the temporary certification program and are not endorsed by the ONC. Therefore, any EHR technology that is certified under the ONC’s EHR Certification Requirements as well as an ONC-ATCB’s own certification criteria would have to have its status as Certified EHR Technology noted separately from any other proprietary certifications.

Modification of Certified EHR Technology

Commenters to the Proposed Rule noted the necessity for eligible providers to understand the extent to which they may modify Certified EHR Technology without undermining the EHR’s certification and causing it to be treated as “self-developed” technology requiring certification. For example, provider comments expressed the concern that extensive modifications may be required to configure EHR technology within the context of the provider’s entire information technology environment. In the Proposed Rule, the ONC proposed to define a “self-developed” EHR as an EHR that has been designed, modified, or created by, or under contract for, a person or entity that will assume the total costs for its testing and certification and will be a primary user of the Complete EHR or EHR Module.

The Final Rule somewhat clarifies the extent to which modifications can be made without threatening the certification status of Certified EHR. The ONC believes that it is possible for an eligible provider to modify a capability of a Complete EHR or an EHR Module, provided that due diligence is taken to prevent such modification from adversely affecting the certified capability or precluding the proper operation of the Certified EHR. However, the ONC recommends in the Final Rule that if an eligible provider would like further assurance that specific modifications will not impact the certification, the provider should have the Complete EHR or EHR Module(s) retested and recertified after modification.

The authors are attorneys in the Health Industry Advisory Practice Group of global law firm McDermott, Will & Emery. Stephen W. Bernstein is head of the Firm’s Health Industry Advisory Practice Group, specializing in e-health, deployment of electronic health record systems, health related matters impacted by the Internet and HIPAA, as well as mergers, acquisitions, affiliations and joint ventures in the hospital and physician areas. Bernadette M. Broccolo serves as chair of the Life Sciences Division of the Firm’s Health Industry Advisory practice and advises clients on leading edge health industry relationship formation and realignments; health information technology acquisitions; electronic health information networks; conflict of interest compliance and overall corporate compliance programs. Daniel F. Gottlieb represents a wide range of health industry clients, advising them on compliance with federal and state health care laws as well as representing them in mergers, acquisitions, joint ventures, and other transactions involving physicians and other health care providers. Sarah Nelson is an associate in the Firm’s Los Angeles office and focuses her practice on a variety of regulatory, transactional and litigation matters for clients such as hospital systems, ambulatory surgical centers, pharmaceutical companies, health insurers and physicians. They can be reached at sbernstein@mwe.com, bbroccolo@mwe.com, dgottlieb@mwe.com or snelson@mwe.com.

References

1. 75 Fed. Reg. 36157 (June 24, 2010).

2. 75 Fed. Reg. 2013 (January 13, 2010).

3. 75 Fed. Reg. 1843 (January 13, 2010).

4. 75 Fed. Reg. at 36194.

5. 75 Fed. Reg. 11327 (March 10, 2010).

6. See ONC’s “Temporary Certification Program Final Rule: Frequently Asked Questions” at http://healthit.hhs.gov/portal/server.pt?open=512&mode=2&objID=2886&PageID=19629.

7. For more detailed information regarding the proposed EHR certification requirements, see McDermott’s White Paperentitled “HHS Establishes the Initial Pathway for Qualifying for HITECH Act Incentives Dollars for Meaningful Use of Certified Electronic Health Record Technology” at www.mwe.com/index.cfm/fuseaction/publications.nldetail/object_id/0c356337-b1ab-47c-bf1b-a452db2ae132.cfm.

8. 75 FR 11366.